Edit tour

Windows Analysis Report
vEcIHT68pU.exe

Overview

General Information

Sample name:	vEcIHT68pU.exe renamed because original name is a hash value
Original sample name:	64fe8dfa186f801847e6c710f30b2884.exe
Analysis ID:	1528265
MD5:	64fe8dfa186f801847e6c710f30b2884
SHA1:	7e6887011b600858d5b0d2d59564b3e44c023965
SHA256:	5a7b7a57eba095cf41ef86faa906c39c7f26b7b09e8b2268d1e882ad8afb92a6
Tags:	32exetrojan
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Injects a PE file into a foreign processes

LummaC encrypted strings found

Machine Learning detection for sample

Sample uses string decryption to hide its real strings

Sigma detected: Silenttrinity Stager Msbuild Activity

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Checks if the current process is being debugged

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

vEcIHT68pU.exe (PID: 7580 cmdline: "C:\Users\user\Desktop\vEcIHT68pU.exe" MD5: 64FE8DFA186F801847E6C710F30B2884)

MSBuild.exe (PID: 7604 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

WerFault.exe (PID: 7900 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7604 -s 1624 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 8168 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7604 -s 1608 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 7720 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7580 -s 260 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["laddyirekyi.sbs", "bemuzzeki.sbs", "exilepolsiy.sbs", "invinjurhey.sbs", "exemplarou.sbs", "frizzettei.sbs", "wickedneatr.sbs", "isoplethui.sbs"], "Build id": "H8NgCl--"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmp	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
00000002.00000002.1573299382.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Unpacked PEs

Source	Rule	Description	Author
2.2.MSBuild.exe.400000.0.unpack	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
2.2.MSBuild.exe.400000.0.raw.unpack	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
0.2.vEcIHT68pU.exe.a50000.0.unpack	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security

Sigma Signatures

System Summary

Sigma detected: Silenttrinity Stager Msbuild Activity

Source: Network Connection

Author: Kiran kumar s, oscd.community: Data: DestinationIp: 188.114.96.3, DestinationIsIpv6: false, DestinationPort: 443, EventID: 3, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, Initiated: true, ProcessId: 7604, Protocol: tcp, SourceIp: 192.168.2.7, SourceIsIpv6: false, SourcePort: 49741

Suricata Signatures

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T18:00:24.926091+0200	2054653	1	A Network Trojan was detected	192.168.2.7	49741	188.114.96.3	443	TCP
2024-10-07T18:00:26.056636+0200	2054653	1	A Network Trojan was detected	192.168.2.7	49747	188.114.96.3	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T18:00:24.926091+0200	2049836	1	A Network Trojan was detected	192.168.2.7	49741	188.114.96.3	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T18:00:26.056636+0200	2049812	1	A Network Trojan was detected	192.168.2.7	49747	188.114.96.3	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: vEcIHT68pU.exe

Avira: detected

Found malware configuration

Source: 0.2.vEcIHT68pU.exe.a50000.0.unpack

Malware Configuration Extractor: LummaC {"C2 url": ["laddyirekyi.sbs", "bemuzzeki.sbs", "exilepolsiy.sbs", "invinjurhey.sbs", "exemplarou.sbs", "frizzettei.sbs", "wickedneatr.sbs", "isoplethui.sbs"], "Build id": "H8NgCl--"}

Multi AV Scanner detection for submitted file

Source: vEcIHT68pU.exe

ReversingLabs: Detection: 34%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: vEcIHT68pU.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmp	String decryptor: wickedneatr.sbs
Source: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmp	String decryptor: invinjurhey.sbs
Source: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmp	String decryptor: laddyirekyi.sbs
Source: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmp	String decryptor: exilepolsiy.sbs
Source: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmp	String decryptor: bemuzzeki.sbs
Source: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmp	String decryptor: exemplarou.sbs
Source: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmp	String decryptor: isoplethui.sbs
Source: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmp	String decryptor: frizzettei.sbs
Source: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmp	String decryptor: exemplarou.sbs
Source: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmp	String decryptor: - Screen Resoluton:
Source: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmp	String decryptor: Workgroup: -
Source: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmp	String decryptor: H8NgCl--

Source: vEcIHT68pU.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.7:49985 version: TLS 1.2

Source: vEcIHT68pU.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\vEcIHT68pU.exe

Code function: 0_2_00A69ABF FindFirstFileExW,

0_2_00A69ABF

Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_vEcIHT68pU.exe_2cbb3d2a264287c88ad2d657e7ba421935d5091_0c1dfcd1_bf82597f-35a2-4bae-b294-ab3c2288ee54\	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MSBuild.exe_a7c83bcf6ac3ff550146223df713f817623037_05bdfb8c_f23c1e99-82ae-4bac-b94b-eac5ca96fd4e\	Jump to behavior

Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: 4x nop then mov eax, dword ptr [esp+0Ch]	0_2_00AAA0B9
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: 4x nop then movzx ebx, word ptr [ecx]	0_2_00AA8051
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: 4x nop then mov dword ptr [esp], 00000000h	0_2_00A982E8
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_00A9A3BF
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 7789B0CBh	0_2_00AC43F8
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: 4x nop then movzx eax, word ptr [esi+ecx]	0_2_00ABE318
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: 4x nop then movzx ecx, word ptr [edi+eax]	0_2_00AC45E8
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	0_2_00AB8528
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	0_2_00AAA687
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00AC2601
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: 4x nop then mov eax, ebx	0_2_00A9264D
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_00AA665F
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 62429966h	0_2_00AC07F8
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 53F09CFAh	0_2_00AC68A8
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F8FD61B8h	0_2_00A9C89C
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: 4x nop then mov byte ptr [edi], al	0_2_00AB0813
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: 4x nop then cmp word ptr [ecx+eax+02h], 0000h	0_2_00A9A86A
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: 4x nop then jmp dword ptr [0044FDB4h]	0_2_00A92849
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: 4x nop then jmp eax	0_2_00A8E9A5
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: 4x nop then movzx edx, byte ptr [esi+ebx]	0_2_00A82928
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	0_2_00AB093D
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: 4x nop then jmp eax	0_2_00A8E914
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: 4x nop then mov eax, dword ptr [esp+40h]	0_2_00A8EAC6
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: 4x nop then cmp word ptr [ebp+edi+02h], 0000h	0_2_00AA4AD8
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 53F09CFAh	0_2_00AC6A38
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: 4x nop then mov eax, dword ptr [esp+000006B8h]	0_2_00A9AA47
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00AC6BB8
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: 4x nop then cmp dword ptr [ebp+edx*8+00h], 9ECF05EBh	0_2_00AC6BB8
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: 4x nop then mov byte ptr [edi], al	0_2_00AB0B22
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], A70A987Fh	0_2_00ABCB36
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: 4x nop then mov eax, dword ptr [esp+04h]	0_2_00A8CB78
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: 4x nop then mov byte ptr [edi], al	0_2_00AB0B43
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	0_2_00AAAC81
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: 4x nop then movzx ecx, word ptr [ebp+00h]	0_2_00A88D88
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_00AA4D38
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: 4x nop then mov eax, dword ptr [esp+40h]	0_2_00A8ED6B
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00AA2D48
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: 4x nop then jmp ecx	0_2_00AC2EAE
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: 4x nop then mov word ptr [edx], 0000h	0_2_00A9CEB7
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], F3285E74h	0_2_00AC4E98
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00AC4E98
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: 4x nop then jmp eax	0_2_00AA6EC4
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00ABCE48
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: 4x nop then mov dword ptr [esp+1Ch], 5E46585Eh	0_2_00AACF30
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	0_2_00AB0F18
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: 4x nop then mov eax, dword ptr [esi+14h]	0_2_00AB0F18
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F3285E74h	0_2_00AC0F18
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: 4x nop then jmp ecx	0_2_00AC2F6C
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: 4x nop then mov eax, dword ptr [esi+04h]	0_2_00A90F6F
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: 4x nop then mov ebp, eax	0_2_00A871D8
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: 4x nop then mov word ptr [eax], dx	0_2_00A9F138
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: 4x nop then mov word ptr [esi], ax	0_2_00A9F138
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	0_2_00AAF2B8
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], C274D4CAh	0_2_00AC3290
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: 4x nop then mov eax, dword ptr [esp+0Ch]	0_2_00AA93AF
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], C274D4CAh	0_2_00AC3390
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: 4x nop then mov eax, dword ptr [esi+04h]	0_2_00A9340E
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: 4x nop then movzx ebx, byte ptr [ecx+esi+25h]	0_2_00A85468
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	0_2_00AAB56A
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: 4x nop then mov word ptr [eax], dx	0_2_00A9F540
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: 4x nop then mov eax, dword ptr [esp+08h]	0_2_00AC36C7
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], F3285E74h	0_2_00AA5824
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 27BAF212h	0_2_00AC3833
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: 4x nop then movzx edx, byte ptr [esi+edi]	0_2_00A81878
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F3285E74h	0_2_00AC1918
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	0_2_00AADA58
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], C85F7986h	0_2_00AA9BA8
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00AA9BA8
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], C85F7986h	0_2_00AA9BA8
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: 4x nop then cmp word ptr [eax+esi+02h], 0000h	0_2_00AABB20
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: 4x nop then mov word ptr [edx], ax	0_2_00AA7B69
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: 4x nop then jmp eax	0_2_00AA7B48
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: 4x nop then cmp byte ptr [ebx], 00000000h	0_2_00A93CBA
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: 4x nop then jmp eax	0_2_00AA5C1B
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00AC5C62
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: 4x nop then mov eax, dword ptr [ebp-10h]	0_2_00A8DDC4
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: 4x nop then mov edi, ecx	0_2_00A91D02
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: 4x nop then movzx edi, byte ptr [ecx+esi]	0_2_00A83D78
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: 4x nop then mov ecx, dword ptr [edx]	0_2_00A7DED8
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: 4x nop then mov eax, dword ptr [esi+20h]	0_2_00A93E69
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: 4x nop then jmp ecx	0_2_00A85FB0
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00A89FE8
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00A89FE8
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	0_2_00AAFFD5
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: 4x nop then dec ebx	0_2_00ABBF08
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	0_2_00AAFF74
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp]	2_2_0040D110
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp]	2_2_0040D110
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], C274D4CAh	2_2_004463B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 27BAF212h	2_2_0044695B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp+04h]	2_2_0040FCA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [ebp-10h]	2_2_00410EEC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F3285E74h	2_2_00444040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov ecx, dword ptr [edx]	2_2_00401000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esi+20h]	2_2_00416F91
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then dec ebx	2_2_0043F030
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp ecx	2_2_00446094
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp+0Ch]	2_2_0042D1E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov word ptr [eax], dx	2_2_00422260
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov word ptr [esi], ax	2_2_00422260
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esi+04h]	2_2_004142FC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov ebp, eax	2_2_0040A300
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	2_2_004323E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	2_2_004323E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	2_2_004323E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov byte ptr [edi], al	2_2_004323E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	2_2_004323E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esi+14h]	2_2_004323E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx eax, word ptr [esi+ecx]	2_2_00441440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov word ptr [eax], cx	2_2_0041D457
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp+0Ch]	2_2_0042C470
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	2_2_0042E40C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov dword ptr [esp], 00000000h	2_2_0041B410
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], C274D4CAh	2_2_004464B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov word ptr [eax], cx	2_2_00429510
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 7789B0CBh	2_2_00447520
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esi+04h]	2_2_00416536
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx ebx, byte ptr [ecx+esi+25h]	2_2_00408590
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	2_2_0043B650
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	2_2_0042E66A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp]	2_2_00445700
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx ecx, word ptr [edi+eax]	2_2_00447710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp+08h]	2_2_004467EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	2_2_0042D7AF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov word ptr [eax], dx	2_2_004228E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp word ptr [ecx+eax+02h], 0000h	2_2_0041D961
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 62429966h	2_2_00443920
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 53F09CFAh	2_2_004499D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx edx, byte ptr [esi+edi]	2_2_004049A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F3285E74h	2_2_00444A40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx edx, byte ptr [esi+ebx]	2_2_00405A50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp eax	2_2_00411A3C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp eax	2_2_00411ACD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 53F09CFAh	2_2_00449B60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp+000006B8h]	2_2_0041DB6F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F8FD61B8h	2_2_0041DB6F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esi+04h]	2_2_00413BE2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp+40h]	2_2_00411BEE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	2_2_00430B80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp word ptr [eax+esi+02h], 0000h	2_2_0042EC48
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp word ptr [ebp+edi+02h], 0000h	2_2_00427C00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], A70A987Fh	2_2_0043FC20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], C85F7986h	2_2_0042CCD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp]	2_2_0042CCD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], C85F7986h	2_2_0042CCD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp]	2_2_00449CE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [ebp+edx*8+00h], 9ECF05EBh	2_2_00449CE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp eax	2_2_0042AC91
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov word ptr [edx], ax	2_2_0042AC91
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov dword ptr [esp+1Ch], 5E46585Eh	2_2_0042FD10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	2_2_0042DD29
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp]	2_2_00448D8A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx ebx, word ptr [ecx]	2_2_0042AE57
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov word ptr [eax], cx	2_2_00427E60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp]	2_2_00425E70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov edi, ecx	2_2_00414E2A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp+40h]	2_2_00411E93
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx edi, byte ptr [ecx+esi]	2_2_00406EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx ecx, word ptr [ebp+00h]	2_2_0040BEB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp byte ptr [ebx], 00000000h	2_2_00416EBF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp eax	2_2_00429F62
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp]	2_2_0043FF70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], F3285E74h	2_2_00447FC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp]	2_2_00447FC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp ecx	2_2_00408FD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp ecx	2_2_00445FD6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov word ptr [edx], 0000h	2_2_0041FFDF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esi+20h]	2_2_00416F91

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.7:49747 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:49747 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.7:49741 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:49741 -> 188.114.96.3:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: laddyirekyi.sbs
Source: Malware configuration extractor	URLs: bemuzzeki.sbs
Source: Malware configuration extractor	URLs: exilepolsiy.sbs
Source: Malware configuration extractor	URLs: invinjurhey.sbs
Source: Malware configuration extractor	URLs: exemplarou.sbs
Source: Malware configuration extractor	URLs: frizzettei.sbs
Source: Malware configuration extractor	URLs: wickedneatr.sbs
Source: Malware configuration extractor	URLs: isoplethui.sbs

Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3
Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: exemplarou.sbs
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedCookie: __cf_mw_byp=8szsHMVtgVs_pn855IzqpE9iQsPSJHYscPV7OKUAzz0-1728316824-0.0.1.1-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 42Host: exemplarou.sbs

Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45

Source: global traffic

DNS traffic detected: DNS query: exemplarou.sbs

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: exemplarou.sbs

Source: Amcache.hve.5.dr	String found in binary or memory: http://upx.sf.net
Source: MSBuild.exe, 00000002.00000002.1573707096.0000000001522000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1573707096.00000000014FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://exemplarou.sbs/
Source: MSBuild.exe, 00000002.00000002.1573707096.0000000001513000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://exemplarou.sbs/api
Source: MSBuild.exe, 00000002.00000002.1573707096.0000000001522000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://exemplarou.sbs/w
Source: MSBuild.exe, 00000002.00000002.1573707096.0000000001522000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.cloudflare.com/5xx-error-landing

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49947 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49677 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49969 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49942
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49940
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49939
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49938
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49937
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49936
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49935
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49934
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49933
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49932
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49931
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49930
Source: unknown	Network traffic detected: HTTP traffic on port 49925 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49971 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49936 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49960 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49929
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49928
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49927
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49926
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49925
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49924
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49923
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49922
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443

Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.7:49985 version: TLS 1.2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 2_2_00438720 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

2_2_00438720

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 2_2_00438720 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

2_2_00438720

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 2_2_004390EE GetDC,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetCurrentObject,GetObjectW,DeleteObject,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,

2_2_004390EE

Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: 0_2_00A52021	0_2_00A52021
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: 0_2_00A82088	0_2_00A82088
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: 0_2_00A840C8	0_2_00A840C8
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: 0_2_00AAE1A8	0_2_00AAE1A8
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: 0_2_00A7E1CF	0_2_00A7E1CF
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: 0_2_00A82123	0_2_00A82123
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: 0_2_00AAE132	0_2_00AAE132
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: 0_2_00A88278	0_2_00A88278
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: 0_2_00A7E272	0_2_00A7E272
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: 0_2_00A7E27B	0_2_00A7E27B
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: 0_2_00A80488	0_2_00A80488
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: 0_2_00A7E455	0_2_00A7E455
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: 0_2_00A7E527	0_2_00A7E527
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: 0_2_00AB8798	0_2_00AB8798
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: 0_2_00AAE738	0_2_00AAE738
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: 0_2_00AC4988	0_2_00AC4988
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: 0_2_00A5CAF2	0_2_00A5CAF2
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: 0_2_00A84AC8	0_2_00A84AC8
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: 0_2_00A9AA47	0_2_00A9AA47
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: 0_2_00A88D88	0_2_00A88D88
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: 0_2_00AAAD84	0_2_00AAAD84
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: 0_2_00A86D40	0_2_00A86D40
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: 0_2_00AC4E98	0_2_00AC4E98
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: 0_2_00AC6FA8	0_2_00AC6FA8
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: 0_2_00A8EF08	0_2_00A8EF08
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: 0_2_00AC0F18	0_2_00AC0F18
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: 0_2_00A8B078	0_2_00A8B078
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: 0_2_00AB51A8	0_2_00AB51A8
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: 0_2_00A871D8	0_2_00A871D8
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: 0_2_00A5729C	0_2_00A5729C
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: 0_2_00A6D39B	0_2_00A6D39B
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: 0_2_00AB33C8	0_2_00AB33C8
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: 0_2_00A994C8	0_2_00A994C8
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: 0_2_00A85468	0_2_00A85468
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: 0_2_00A87728	0_2_00A87728
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: 0_2_00A6572C	0_2_00A6572C
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: 0_2_00ABB778	0_2_00ABB778
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: 0_2_00AC1918	0_2_00AC1918
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: 0_2_00AA9BA8	0_2_00AA9BA8
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: 0_2_00A6BB36	0_2_00A6BB36
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: 0_2_00A63C92	0_2_00A63C92
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: 0_2_00A87DE8	0_2_00A87DE8
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: 0_2_00A51D79	0_2_00A51D79
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: 0_2_00A5FEF0	0_2_00A5FEF0
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: 0_2_00A7DED8	0_2_00A7DED8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0043F620	2_2_0043F620
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00444040	2_2_00444040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00401000	2_2_00401000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00412030	2_2_00412030
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0044A0D0	2_2_0044A0D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00405160	2_2_00405160
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_004071F0	2_2_004071F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0040E1A0	2_2_0040E1A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00410228	2_2_00410228
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_004382D0	2_2_004382D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_004312D0	2_2_004312D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_004012F7	2_2_004012F7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0040A300	2_2_0040A300
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_004323E0	2_2_004323E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0040B3A0	2_2_0040B3A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_004013A3	2_2_004013A3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0042C470	2_2_0042C470
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_004364F0	2_2_004364F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00414487	2_2_00414487
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0041049B	2_2_0041049B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0041C5F0	2_2_0041C5F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00408590	2_2_00408590
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_004035B0	2_2_004035B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0040164F	2_2_0040164F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00448652	2_2_00448652
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_004486F0	2_2_004486F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0040A850	2_2_0040A850
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00431860	2_2_00431860
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0043B8C0	2_2_0043B8C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0043E8A0	2_2_0043E8A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0042098B	2_2_0042098B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_004489A0	2_2_004489A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00444A40	2_2_00444A40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00448A80	2_2_00448A80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00447AB0	2_2_00447AB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0041DB6F	2_2_0041DB6F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00407BF0	2_2_00407BF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00448C02	2_2_00448C02
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0042CCD0	2_2_0042CCD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00446CBF	2_2_00446CBF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00428D62	2_2_00428D62
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0042FD10	2_2_0042FD10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0042DD29	2_2_0042DD29
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0042AE57	2_2_0042AE57
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00448E70	2_2_00448E70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00414E2A	2_2_00414E2A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0040BEB0	2_2_0040BEB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00416EBF	2_2_00416EBF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0040AF10	2_2_0040AF10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00447FC0	2_2_00447FC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00408FD0	2_2_00408FD0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 0040CAA0 appears 48 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 0041D300 appears 152 times
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: String function: 00A9A1D8 appears 152 times
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: String function: 00A57B80 appears 49 times
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: String function: 00A89978 appears 93 times

Source: C:\Users\user\Desktop\vEcIHT68pU.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7580 -s 260

Source: vEcIHT68pU.exe, 00000000.00000000.1380270579.0000000000AD8000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameproquota.exej% vs vEcIHT68pU.exe
Source: vEcIHT68pU.exe	Binary or memory string: OriginalFilenameproquota.exej% vs vEcIHT68pU.exe

Source: vEcIHT68pU.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: vEcIHT68pU.exe

Static PE information: Section: .data ZLIB complexity 0.9912286931818182

Source: classification engine

Classification label: mal100.troj.evad.winEXE@6/13@1/1

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 2_2_0043F420 CoCreateInstance,

2_2_0043F420

Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7580
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7604

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\3aba802e-b8ac-470d-a190-629f136a8c07

Jump to behavior

Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Command line argument: MZx	0_2_00A52021
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Command line argument: MZx	0_2_00A52021
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Command line argument: MZx	0_2_00A52021

Source: vEcIHT68pU.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\vEcIHT68pU.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: vEcIHT68pU.exe

ReversingLabs: Detection: 34%

Source: unknown	Process created: C:\Users\user\Desktop\vEcIHT68pU.exe "C:\Users\user\Desktop\vEcIHT68pU.exe"
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7580 -s 260
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7604 -s 1624
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7604 -s 1608
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior

Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: vEcIHT68pU.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: vEcIHT68pU.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: vEcIHT68pU.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: vEcIHT68pU.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: vEcIHT68pU.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: vEcIHT68pU.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: vEcIHT68pU.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: vEcIHT68pU.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: vEcIHT68pU.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: vEcIHT68pU.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: vEcIHT68pU.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: vEcIHT68pU.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: vEcIHT68pU.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: 0_2_00A571AD push ecx; ret		0_2_00A571C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0044F23B push edx; ret		2_2_0044F24B

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\vEcIHT68pU.exe

API coverage: 4.2 %

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7648

Thread sleep time: -30000s >= -30000s

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Users\user\Desktop\vEcIHT68pU.exe

Code function: 0_2_00A69ABF FindFirstFileExW,

0_2_00A69ABF

Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_vEcIHT68pU.exe_2cbb3d2a264287c88ad2d657e7ba421935d5091_0c1dfcd1_bf82597f-35a2-4bae-b294-ab3c2288ee54\	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MSBuild.exe_a7c83bcf6ac3ff550146223df713f817623037_05bdfb8c_f23c1e99-82ae-4bac-b94b-eac5ca96fd4e\	Jump to behavior

Source: Amcache.hve.5.dr	Binary or memory string: VMware
Source: Amcache.hve.5.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.5.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.5.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.5.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.5.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.5.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.5.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: MSBuild.exe, 00000002.00000002.1573707096.0000000001522000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1573707096.00000000014FC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.5.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.5.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.5.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.5.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.5.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.5.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.5.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.5.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.5.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.5.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.5.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.5.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.5.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.5.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.5.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.5.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.5.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.5.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.5.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.5.dr	Binary or memory string: VMware-42 27 88 19 56 cc 59 1a-97 79 fb 8c bf a1 e2 9d
Source: Amcache.hve.5.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

API call chain: ExitProcess graph end node

graph_2-19771

Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 2_2_004400D0 LdrInitializeThunk,

2_2_004400D0

Source: C:\Users\user\Desktop\vEcIHT68pU.exe

Code function: 0_2_00A57922 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00A57922

Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: 0_2_00A52003 mov edi, dword ptr fs:[00000030h]	0_2_00A52003
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: 0_2_00A6A64C mov eax, dword ptr fs:[00000030h]	0_2_00A6A64C
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: 0_2_00A60F2E mov ecx, dword ptr fs:[00000030h]	0_2_00A60F2E

Source: C:\Users\user\Desktop\vEcIHT68pU.exe

Code function: 0_2_00A6CC4B GetProcessHeap,

0_2_00A6CC4B

Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: 0_2_00A57610 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00A57610
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: 0_2_00A57922 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00A57922
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: 0_2_00A57AAF SetUnhandledExceptionFilter,	0_2_00A57AAF
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: 0_2_00A5DA73 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00A5DA73

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\vEcIHT68pU.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\vEcIHT68pU.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 value starts with: 4D5A

Jump to behavior

LummaC encrypted strings found

Source: vEcIHT68pU.exe	String found in binary or memory: frizzettei.sbs
Source: vEcIHT68pU.exe	String found in binary or memory: isoplethui.sbs
Source: vEcIHT68pU.exe	String found in binary or memory: exemplarou.sbs
Source: vEcIHT68pU.exe	String found in binary or memory: invinjurhey.sbs
Source: vEcIHT68pU.exe	String found in binary or memory: wickedneatr.sbs
Source: vEcIHT68pU.exe	String found in binary or memory: exilepolsiy.sbs
Source: vEcIHT68pU.exe	String found in binary or memory: laddyirekyi.sbs
Source: vEcIHT68pU.exe	String found in binary or memory: bemuzzeki.sbs

Writes to foreign memory regions

Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 401000	Jump to behavior
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 44B000	Jump to behavior
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 44E000	Jump to behavior
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 45E000	Jump to behavior
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 1022008	Jump to behavior

Source: C:\Users\user\Desktop\vEcIHT68pU.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"

Jump to behavior

Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	0_2_00A6C085
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: GetLocaleInfoW,	0_2_00A6622B
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: EnumSystemLocalesW,	0_2_00A6C327
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: EnumSystemLocalesW,	0_2_00A6C372
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_00A6C498
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: EnumSystemLocalesW,	0_2_00A6C40D
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: GetLocaleInfoW,	0_2_00A6C6EB
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_00A6C814
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_00A6C9E9
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: GetLocaleInfoW,	0_2_00A6C91A
Source: C:\Users\user\Desktop\vEcIHT68pU.exe	Code function: EnumSystemLocalesW,	0_2_00A65D7F

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\vEcIHT68pU.exe

Code function: 0_2_00A57815 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00A57815

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Amcache.hve.5.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.5.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.5.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.5.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: Amcache.hve.5.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: 2.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.MSBuild.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.vEcIHT68pU.exe.a50000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1573299382.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: 2.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.MSBuild.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.vEcIHT68pU.exe.a50000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1573299382.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	311 Process Injection	2 Virtualization/Sandbox Evasion	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Screen Capture	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	1 DLL Side-Loading	311 Process Injection	LSASS Memory	41 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 PowerShell	Logon Script (Windows)	Logon Script (Windows)	11 Deobfuscate/Decode Files or Information	Security Account Manager	2 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	2 Clipboard Data	113 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	3 Obfuscated Files or Information	NTDS	2 File and Directory Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Software Packing	LSA Secrets	33 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label
vEcIHT68pU.exe	34%	ReversingLabs	Win32.Trojan.Generic
vEcIHT68pU.exe	100%	Avira	HEUR/AGEN.1310458
vEcIHT68pU.exe	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
http://upx.sf.net	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false		unknown
exemplarou.sbs	188.114.96.3	true	true		unknown

Contacted URLs

Name	Malicious	Reputation
frizzettei.sbs	true	unknown
bemuzzeki.sbs	true	unknown
invinjurhey.sbs	true	unknown
https://exemplarou.sbs/api	true	unknown
exilepolsiy.sbs	true	unknown
exemplarou.sbs	true	unknown
laddyirekyi.sbs	true	unknown
wickedneatr.sbs	true	unknown
isoplethui.sbs	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://exemplarou.sbs/	MSBuild.exe, 00000002.00000002.1573707096.0000000001522000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1573707096.00000000014FC000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://exemplarou.sbs/w	MSBuild.exe, 00000002.00000002.1573707096.0000000001522000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://upx.sf.net	Amcache.hve.5.dr	false	URL Reputation: safe	unknown
https://www.cloudflare.com/5xx-error-landing	MSBuild.exe, 00000002.00000002.1573707096.0000000001522000.00000004.00000020.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
188.114.96.3	exemplarou.sbs	European Union		13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1528265
Start date and time:	2024-10-07 17:59:12 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 31s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	vEcIHT68pU.exe renamed because original name is a hash value
Original Sample Name:	64fe8dfa186f801847e6c710f30b2884.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@6/13@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 75% Number of executed functions: 18 Number of non-executed functions: 158
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 40.126.32.68, 40.126.32.133, 40.126.32.76, 20.190.160.14, 40.126.32.138, 20.190.160.22, 20.190.160.20, 40.126.32.134, 199.232.214.172, 20.12.23.50, 20.3.187.198, 20.42.73.29, 52.165.164.15, 52.149.20.212
Excluded domains from analysis (whitelisted): prdv4a.aadg.msidentity.com, ctldl.windowsupdate.com.delivery.microsoft.com, slscr.update.microsoft.com, www.tm.v4.a.prd.aadg.trafficmanager.net, ctldl.windowsupdate.com, login.msa.msidentity.com, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, login.live.com, glb.cws.prod.dcat.dsp.trafficmanager.net, blobcollector.events.data.trafficmanager.net, onedsblobprdeus15.eastus.cloudapp.azure.com, sls.update.microsoft.com, umwatson.events.data.microsoft.com, wu-b-net.trafficmanager.net, www.tm.lg.prod.aadmsa.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: vEcIHT68pU.exe

Simulations

Behavior and APIs

Time	Type	Description
12:00:23	API Interceptor	1x Sleep call for process: MSBuild.exe modified
12:00:43	API Interceptor	3x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
188.114.96.3	RFQ 245801.exe	Get hash	malicious	FormBook	Browse	www.j88.travel/c24t/?9rm4ULV=iDjdFcjw5QZJ8NeJJL4ZS/2sliUdDJEhqWnTSCKxgeFtQoD7uajT9bZ2+m2NwmP2xDXw&D4hl2=fT-dvVK08nUDKdF
	74qgPmarBM.exe	Get hash	malicious	Pony	Browse	kuechenundmehr.com/x.htm
	PURCHASE ORDER-6350.exe	Get hash	malicious	FormBook	Browse	www.cc101.pro/ttiz/
	http://revexhibition.pages.dev/	Get hash	malicious	HTMLPhisher	Browse	revexhibition.pages.dev/favicon.ico
	http://meta.case-page-appeal.eu/community-standard/112225492204863/	Get hash	malicious	Unknown	Browse	meta.case-page-appeal.eu/assets/k9854w4e5136q5a-f2169603.png
	http://www.tkmall-wholesale.com/	Get hash	malicious	Unknown	Browse	www.tkmall-wholesale.com/
	c1#U09a6.exe	Get hash	malicious	Unknown	Browse	winfileshare.com/ticket_line/llb.php
	QUOTATION_OCTQTRA071244PDF.scr.exe	Get hash	malicious	Unknown	Browse	filetransfer.io/data-package/eZFzMENr/download
	QUOTATION_OCTQTRA071244PDF.scr.exe	Get hash	malicious	Unknown	Browse	filetransfer.io/data-package/eZFzMENr/download
	1tstvk3Sls.exe	Get hash	malicious	RHADAMANTHYS	Browse	microsoft-rage.world/Api/v3/qjqzqiiqayjq

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	file.exe	Get hash	malicious	Vidar	Browse	199.232.214.172
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	199.232.214.172
	file.exe	Get hash	malicious	Stealc	Browse	199.232.210.172
	https://email.oxblue.com/e3t/Ctc/Q+113/cdDrv04/VXdfjN46m5dxW4GJlKB4fd0DdW2sbCLr5lTFq6N7Hm8xT3qgyTW7Y8-PT6lZ3lzW1ccS1H8Y8rzXW1hrlTV77h1NhW5_pVzH8bsnn6W1PWxqV8D5TN_W4_z5yx2Cz_4sMrZF-GqDHzcW8pZQ3N3BhYgKW3tmwg72n4TxDW4fS46V1-s7dgW57YVF64HfrMMW2BxxC75X21XdW1nBYw_1PMVGyW8s_YKQ6BTQZmW8wDJ4k3-yNbbW2_BGfy66mfVdW937hqt5kq1CcW4XD3mN54BQSWW4G8TK98NTx7zW74frv25zlZbQW5ztJ6n6fGJFrMSqBjr36qwYW2tk9Xh21wMKrW5RXwDq1M2mmrW3nyq_P20wBvNN8-tVH1nqcD1W5m3Vz04sj9CQf2ygfDq04	Get hash	malicious	Unknown	Browse	199.232.214.172
	https://protect2.fireeye.com/v1/url?k=31323334-50bba2bf-3132a9b3-4544474f5631-9e1721db7158d01a&q=1&e=fd99754d-b74a-4ce2-bf27-63a41e808f94&u=https%3A%2F%2Fwww.rhris.com%2FEmailEmploymentValidation.cfm%3FEmploymentRefID%3DE84F959AEA960B8186C356E23E6C822C8E204B6A75564EECEC1823507D68DDBF	Get hash	malicious	Unknown	Browse	199.232.210.172
	https://future.nhs.uk	Get hash	malicious	Unknown	Browse	199.232.214.172
	https://eu.pbe.encryption.symantec.com/login.html?msgUserId=682e23d9f715c97c&enterprise=lgas&locale=en_US	Get hash	malicious	Unknown	Browse	199.232.210.172
	YSjOEAta07.exe	Get hash	malicious	FormBook	Browse	199.232.210.172
	gIXLkTvFeC.exe	Get hash	malicious	Vidar	Browse	199.232.210.172
	https://www.masonpost.com:443/cgi-bin/redir?https://ctrk.klclick3.com/l/01J9K8KGETH6JCWEWSWY0Z1M23_0?upn=u001.itvpsDR1UD2k9ruxjm0OAspgqcVOQ2hpn9lpb50VxZJdbi9nOzDV7HSnhKeIcaLQsgzZhAfJ867-2F8IcC-2BBYACBF80J8eA0O7PKeZKrlC1Q54Fj-2FS5ho91OPbLHjsGsZQWTyMbbJfNaQPKh9-2FKW31wr-2BMvAwYD85cdCTmlJyLauY-3D1xqt_Zis0fkz6H88oOTECUjdmAu-2FGkDDLbhQT-2B-2B9-2BD8-2Fn-2BuGRBn47ofPUerdduk-2BghIIr31LJs6iNd0rpuOZI5rlm3TOpkCWZ1eNCAWCuASI4dMP9Tv6jbA2UWTI2YWLmFZqgYeVzSc0Fb4o9iKg-2BzjSlX63m5ZgVPzXZ0W3SrrpOTDVmr8Vwd0xwSjxu9efo9kpJLVs7HOh7Cib6eG0OHldiYrljs5jy-2BsmDgNausa6sMCHSoHHj10FI3IfGuCnAD3e6jEbbsHVD11-2FD9cWADvkKxwETdgNpgixeie55jSwivWDLRKcdIczYG3CyTpA1Y18cj-2FBGLZEHTJvF1rd5yfWClPzV1Xw6x2CQgpVVbtrTE5NXtV8WFomzmraH-2FRE0uCvY#QE5lb19IYWNrZXJAb2ZmaWNlLmNvbQ==	Get hash	malicious	Unknown	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	https://t.dripemail3.com/c/eyJhbGciOiJIUzI1NiJ9.eyJhdWQiOiJkZXRvdXIiLCJpc3MiOiJtb25vbGl0aCIsInN1YiI6ImRldG91cl9saW5rIiwiaWF0IjoxNzI4MzEwODA2LCJuYmYiOjE3MjgzMTA4MDYsImFjY291bnRfaWQiOiIyNzYyNjA5IiwiZGVsaXZlcnlfaWQiOiJwODJtNGNzMzB4cXl2Zmh0NzQxaSIsInRva2VuIjoicDgybTRjczMweHF5dmZodDc0MWkiLCJzZW5kX2F0IjoxNzI4MzA5NzMyLCJlbWFpbF9pZCI6OTk2NDE4NiwiZW1haWxhYmxlX3R5cGUiOiJCcm9hZGNhc3QiLCJlbWFpbGFibGVfaWQiOjM5NTQwMTYsInVybCI6Imh0dHBzOi8vZGFpbHlhbGFza2EuY29tL25ld3M_X19zPWw5bzljOTZzbG8xZjF3aGFiODZrJnV0bV9zb3VyY2U9ZHJpcCZ1dG1fbWVkaXVtPWVtYWlsJnV0bV9jYW1wYWlnbj0lRjAlOUYlOTElOEMrV2UrTWFkZStJdCtFYXN5K0ZvcitZb3UrJUYwJTlGJTkxJThDIn0.MNRoosOspCCWwx3VuYY41W-crcEzfjjfIELlO_QMAdM	Get hash	malicious	HtmlDropper	Browse	172.67.212.190
	https://forms.office.com/Pages/ShareFormPage.aspx?id=W8eUhlA4rUOuklSyoCn21mtmgAvPzYFJuSM99R6gX3dUQ1IyWUM1UUhTS1pWQ0xXNkI3RzlRRkFIVi4u&sharetoken=93tGEOrxpFy3X0nnxFcr	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	Contract_Agreement_Monday October 2024.pdf	Get hash	malicious	Unknown	Browse	104.21.90.101
	CatalogApp.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	DocuSign-Docx.pdf	Get hash	malicious	Unknown	Browse	172.67.139.158
	RFQ Ref. No CRCCRFQHAFJIHDG2-KSU001 REV.01..exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	scan_374783.js	Get hash	malicious	AgentTesla	Browse	188.114.97.3
	https://email.oxblue.com/e3t/Ctc/Q+113/cdDrv04/VXdfjN46m5dxW4GJlKB4fd0DdW2sbCLr5lTFq6N7Hm8xT3qgyTW7Y8-PT6lZ3lzW1ccS1H8Y8rzXW1hrlTV77h1NhW5_pVzH8bsnn6W1PWxqV8D5TN_W4_z5yx2Cz_4sMrZF-GqDHzcW8pZQ3N3BhYgKW3tmwg72n4TxDW4fS46V1-s7dgW57YVF64HfrMMW2BxxC75X21XdW1nBYw_1PMVGyW8s_YKQ6BTQZmW8wDJ4k3-yNbbW2_BGfy66mfVdW937hqt5kq1CcW4XD3mN54BQSWW4G8TK98NTx7zW74frv25zlZbQW5ztJ6n6fGJFrMSqBjr36qwYW2tk9Xh21wMKrW5RXwDq1M2mmrW3nyq_P20wBvNN8-tVH1nqcD1W5m3Vz04sj9CQf2ygfDq04	Get hash	malicious	Unknown	Browse	104.17.223.152

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	https://t.dripemail3.com/c/eyJhbGciOiJIUzI1NiJ9.eyJhdWQiOiJkZXRvdXIiLCJpc3MiOiJtb25vbGl0aCIsInN1YiI6ImRldG91cl9saW5rIiwiaWF0IjoxNzI4MzEwODA2LCJuYmYiOjE3MjgzMTA4MDYsImFjY291bnRfaWQiOiIyNzYyNjA5IiwiZGVsaXZlcnlfaWQiOiJwODJtNGNzMzB4cXl2Zmh0NzQxaSIsInRva2VuIjoicDgybTRjczMweHF5dmZodDc0MWkiLCJzZW5kX2F0IjoxNzI4MzA5NzMyLCJlbWFpbF9pZCI6OTk2NDE4NiwiZW1haWxhYmxlX3R5cGUiOiJCcm9hZGNhc3QiLCJlbWFpbGFibGVfaWQiOjM5NTQwMTYsInVybCI6Imh0dHBzOi8vZGFpbHlhbGFza2EuY29tL25ld3M_X19zPWw5bzljOTZzbG8xZjF3aGFiODZrJnV0bV9zb3VyY2U9ZHJpcCZ1dG1fbWVkaXVtPWVtYWlsJnV0bV9jYW1wYWlnbj0lRjAlOUYlOTElOEMrV2UrTWFkZStJdCtFYXN5K0ZvcitZb3UrJUYwJTlGJTkxJThDIn0.MNRoosOspCCWwx3VuYY41W-crcEzfjjfIELlO_QMAdM	Get hash	malicious	HtmlDropper	Browse	13.107.246.45
	https://forms.office.com/Pages/ShareFormPage.aspx?id=W8eUhlA4rUOuklSyoCn21mtmgAvPzYFJuSM99R6gX3dUQ1IyWUM1UUhTS1pWQ0xXNkI3RzlRRkFIVi4u&sharetoken=93tGEOrxpFy3X0nnxFcr	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	Contract_Agreement_Monday October 2024.pdf	Get hash	malicious	Unknown	Browse	13.107.246.45
	file.exe	Get hash	malicious	Vidar	Browse	13.107.246.45
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	13.107.246.45
	file.exe	Get hash	malicious	Stealc	Browse	13.107.246.45
	DocuSign-Docx.pdf	Get hash	malicious	Unknown	Browse	13.107.246.45
	file.exe	Get hash	malicious	Credential Flusher	Browse	13.107.246.45
	https://email.oxblue.com/e3t/Ctc/Q+113/cdDrv04/VXdfjN46m5dxW4GJlKB4fd0DdW2sbCLr5lTFq6N7Hm8xT3qgyTW7Y8-PT6lZ3lzW1ccS1H8Y8rzXW1hrlTV77h1NhW5_pVzH8bsnn6W1PWxqV8D5TN_W4_z5yx2Cz_4sMrZF-GqDHzcW8pZQ3N3BhYgKW3tmwg72n4TxDW4fS46V1-s7dgW57YVF64HfrMMW2BxxC75X21XdW1nBYw_1PMVGyW8s_YKQ6BTQZmW8wDJ4k3-yNbbW2_BGfy66mfVdW937hqt5kq1CcW4XD3mN54BQSWW4G8TK98NTx7zW74frv25zlZbQW5ztJ6n6fGJFrMSqBjr36qwYW2tk9Xh21wMKrW5RXwDq1M2mmrW3nyq_P20wBvNN8-tVH1nqcD1W5m3Vz04sj9CQf2ygfDq04	Get hash	malicious	Unknown	Browse	13.107.246.45
	https://url.avanan.click/v2/r01/___https://www.tiktok.com/qnspdA7?fni=6cbb&qfsl=js&xhjsj=gnt_zwq&yfwljy=myyux:ddBBB.lttlqj.htr.gtdzwq?v=frudxdxrtxfilfrjx.htrd.iwtlt___.YXAzOnNvdXRoZXJua2l0Y2hlbmFuZGdyaWxsOmE6bzpjOGJiNWZiM2U4NjZhMDk1M2Y0MGVjY2U1MDhmYjQ4YTo3OmM4Y2I6MDdlZDdhNDI4N2UyMzc1NGJjZGQ1YjkyOWYyODg2OTI5ZDkyNzU0YTQ2NWI4MzhkYWZlMmM3NjA5ZGMyZGNmMzpoOlQ6VA#YnJhbmRvbi53YW5nQGludGVncmFjb25uZWN0LmNvbQ==	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
a0e9f5d64349fb13191bc781f81f42e1	CatalogApp.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	CatalogApp.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	scan_374783.js	Get hash	malicious	AgentTesla	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	uhwovHh7pS.msi	Get hash	malicious	VMdetect	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	BzLGqYKy7o.exe	Get hash	malicious	SmokeLoader	Browse	188.114.96.3

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MSBuild.exe_a7c83bcf6ac3ff550146223df713f817623037_05bdfb8c_f23c1e99-82ae-4bac-b94b-eac5ca96fd4e\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.023830899094957
Encrypted:	false
SSDEEP:	192:3/wrcOIfA05RLZjem+yCzuiFWZ24IO8f2:IzIfb5RLZjozuiFWY4IO8f
MD5:	15507E6EF223CBF536E92413051DB923
SHA1:	2B5E368145B12BEEE8243736E4EA577131E8BDC7
SHA-256:	1408C2723B30FCD7BC879FE25F5B46558B7A9D4907C88C898526A56228028591
SHA-512:	94356D33C01D14A7B8B96B896BA394B8DCFD8892E8334F0F68184E3D7F8FA17A70242762464307EA4DE22D3B148FAE243FC1D56DF2732A3DFC714EA6858B389F
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.2.7.9.0.4.2.5.8.1.6.0.7.7.0.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.2.7.9.0.4.2.6.2.8.4.8.3.3.6.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.f.2.3.c.1.e.9.9.-.8.2.a.e.-.4.b.a.c.-.b.9.4.b.-.e.a.c.5.c.a.9.6.f.d.4.e.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.4.f.5.f.b.f.0.5.-.d.9.d.e.-.4.b.f.7.-.8.7.f.7.-.0.0.b.d.8.5.c.2.b.7.4.a.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.M.S.B.u.i.l.d...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.M.S.B.u.i.l.d...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.d.b.4.-.0.0.0.1.-.0.0.1.4.-.4.1.4.0.-.2.c.0.4.d.2.1.8.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.e.6.2.5.6.a.0.1.5.9.6.8.8.f.0.5.6.0.b.0.1.5.d.a.4.d.9.6.7.f.4.1.c.b.f.8.c.9.b.d.!.M.S.B.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_bad_module_info_26851ced9dceca7ff813c34112d2afbecefcef_85207d7d_2c8b76b6-d73c-4c96-a4c3-1a0f668ee729\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.5817037743497709
Encrypted:	false
SSDEEP:	96:QT3grHqQu+uDsQhMov7JRqQXIDcQ4c6fcE+cw3tZAX/d5FMT2SlPkpXmTAgf/VXm:QjgrHe+uDN0WbkQzuiFWZ24IO8b
MD5:	7C775BF4831147FF006E59FB9992824E
SHA1:	DA17A07D53E6354E08CC892858AA83EDCD3582B8
SHA-256:	84910195278F0A11F357D5D4FC3B8ABC62E82BA9BD23D05DF852FA43508AB9F5
SHA-512:	D2EEA227A056EA7847399D423EBBEB11F97C2C4FAF64E8986BFA0B20F7FC7DC9C63B0ED77883E5AC244D4DC4E65829552650A76EBEFDA4EED5C201492E877E3E
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.2.7.9.0.4.4.3.4.4.5.1.6.2.4.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.2.7.9.0.4.4.3.6.6.3.8.9.5.6.....R.e.p.o.r.t.S.t.a.t.u.s.=.6.5.5.4.5.6.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.2.c.8.b.7.6.b.6.-.d.7.3.c.-.4.c.9.6.-.a.4.c.3.-.1.a.0.f.6.6.8.e.e.7.2.9.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.d.b.2.3.a.6.1.3.-.c.e.2.c.-.4.d.2.f.-.9.a.e.d.-.9.a.f.a.a.0.e.7.c.3.1.2.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.b.a.d._.m.o.d.u.l.e._.i.n.f.o.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.d.b.4.-.0.0.0.1.-.0.0.1.4.-.4.1.4.0.-.2.c.0.4.d.2.1.8.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.e.6.2.5.6.a.0.1.5.9.6.8.8.f.0.5.6.0.b.0.1.5.d.a.4.d.9.6.7.f.4.1.c.b.f.8.c.9.b.d.!.M.S.B.u.i.l.d...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_vEcIHT68pU.exe_2cbb3d2a264287c88ad2d657e7ba421935d5091_0c1dfcd1_bf82597f-35a2-4bae-b294-ab3c2288ee54\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.6557774231807176
Encrypted:	false
SSDEEP:	96:QcoF7jXBxM0HgBsjyavBAaSfuQXIDcQvc6QcEVcw3cE/9X1+HbHg/5hZAX/d5FM8:SdM5BX0BU/gjhzuiFWZ24IO85
MD5:	F3BB1B7B4766DB8264A724CBDB261564
SHA1:	587CFFC81AC75E939C2F5736EC23189EBCB99A6D
SHA-256:	D30F6C956F167DC4EBA86306C9708A89DC41E7062D656C21BC494957C0720E20
SHA-512:	922C9AB8C3576306CF08691DF1A305F85B78E06940E7AE999A7BD2304AB063EA14715EF3485C0FB9036003B08571E0AD067FF0274731A9F9400867054684CF00
Malicious:	true
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.2.7.9.0.4.2.3.3.8.1.3.6.5.6.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.2.7.9.0.4.2.3.7.7.1.9.9.1.6.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.b.f.8.2.5.9.7.f.-.3.5.a.2.-.4.b.a.e.-.b.2.9.4.-.a.b.3.c.2.2.8.8.e.e.5.4.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.1.e.e.6.2.d.3.d.-.9.b.c.3.-.4.1.a.8.-.b.b.a.e.-.1.6.4.f.c.1.c.2.0.1.a.5.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.v.E.c.I.H.T.6.8.p.U...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.p.r.o.q.u.o.t.a...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.d.9.c.-.0.0.0.1.-.0.0.1.4.-.e.e.e.a.-.1.4.0.4.d.2.1.8.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.9.7.d.0.3.f.6.a.1.a.a.4.5.0.5.0.f.7.b.e.5.5.f.8.7.6.f.e.a.2.d.c.0.0.0.0.0.9.0.4.!.0.0.0.0.7.e.6.8.8.7.0.1.1.b.6.0.0.8.5.8.d.5.b.0.d.2.d.5.9.5.6.4.b.3.e.4.4.c.0.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERAEC3.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Mon Oct 7 16:00:23 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	35284
Entropy (8bit):	1.6556060466665425
Encrypted:	false
SSDEEP:	96:5e89CaFHyn/SJZiSi77XYtsXpsgnSlpK/tTOxs54tmgyu5nf5BWIkWI4cI4oaKRv:b0nsZOTsxlpKoa54tm/UnAoaKRN/N
MD5:	30297D9877F831FC36BC1C6046547FA0
SHA1:	AA4C2B4D4C77976FA76505D8F77AC84FD03910FB
SHA-256:	749360D2F75433000B03229F22CA1D0E14A3E861FAB643ED503D1ED5BC3D86FB
SHA-512:	E57B5BD95C0FA44E3B824ADF8D4368D03A7D754C681ED6388BBA2468976677A81507F903303084754B41D4FBA864BDEE651BF188AD42027F5FF2F695E4F19DB0
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... ..........g........................d...........................T.......8...........T...............$.......................................................................................................eJ..............GenuineIntel............T..............g.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERAF12.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8328
Entropy (8bit):	3.6973139676749107
Encrypted:	false
SSDEEP:	192:R6l7wVeJ9A6k6YNTSU9gLgmfZyaMYOprZ89bOhsf2am:R6lXJa6k6YJSU9gLgmfZn7NOafi
MD5:	A52B90C8C93BDD96DD1D6C9C6FA0EBB3
SHA1:	427707FA455250BD86E4E0FA32589A47D407D1E5
SHA-256:	5A5C9837E9413E1F8DCA8823B26FD141CBA5C3FAC987BA2055E0ADC0F444EF12
SHA-512:	7991B6AFD2313935811A770C95FD4E1F3AB33C16F073B6E7A9A27C38EC603B5D88F450C56FEA9E9460E32A5BF0C7AF23B96A2CD4F9C63B2E7C66E9C59A0FE91E
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.5.8.0.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERAF42.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4678
Entropy (8bit):	4.486096604831638
Encrypted:	false
SSDEEP:	48:cvIwWl8zsUJg77aI9IDWpW8VYIYm8M4J2wFUBO+q803zan6zfd:uIjfSI72y7VMJGI9za6zfd
MD5:	F964E187CE78136ED4E398C471C29E8D
SHA1:	5A4A767B41183462B8C8C272AAE6D658AB16F537
SHA-256:	6CC74F0944750ED48760200C3DD5762EF504D4293F445F99521EA0256CFE589E
SHA-512:	77E6B0505B19195E29EEBBBFC580105060C86791AC6677898CD1B66D4C2E0A06948DA06D10B482C8EC6DEC4BEFAF3983465064474D8F0E8AEEF25A91FDA2D62A
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="533223" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB839.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Mon Oct 7 16:00:26 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	106344
Entropy (8bit):	2.0013245180066854
Encrypted:	false
SSDEEP:	384:QtBtkBcQQIHxdQfQEUwHL0KqxbVMAwIdRwiaWl8PnmZMmG2D4M:QtDkBcNIHwf08m1H4M
MD5:	25EA3B299CC2E5AB17A1E687FF1F4F89
SHA1:	BEEF378887DE635EBA809F7D8554F4FD9AD9EDD2
SHA-256:	D7C7F364E850A7502E49FFA1F9829023EA9E4B5E0466D05C64F1FDBB9E838F51
SHA-512:	B746005AA85D100BF4EC2C4CC81CA6206E32E4E90F95B2C4114A1DD7FFF5AC23CEF3806EC2F2031B686CC495276FF4DA46774FF5990CCF38E276D3F8117BB857
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... ..........g....................................<....!......t....G..........`.......8...........T............>...`...........!...........#..............................................................................eJ......p$......GenuineIntel............T..............g.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB915.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8342
Entropy (8bit):	3.6855029630645357
Encrypted:	false
SSDEEP:	192:R6l7wVeJj4VA646Yt/6sgmfjJUcpDO89bz4sfWRRm:R6lXJJ646YF6sgmfjJUGzrfx
MD5:	9CB647821258C014AB708391C4830994
SHA1:	AE049F882EC3BA758D1DA4444FA9FAD9474EAE40
SHA-256:	886825C4AFB721ABC27D5E36C5B84AF063A39DB03FBF7BCC8DB36DBCE757FD2A
SHA-512:	D22DF3784B72C242B8408668E3FCA126B243583492CC3971A609C0C9EFDF0A8D7F5435FA020B86B1AA22BB616A5FA3FFC802762A66ED49BAB5E2D3AD6D4E0B83
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.6.0.4.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB945.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4743
Entropy (8bit):	4.446143078162652
Encrypted:	false
SSDEEP:	48:cvIwWl8zsUJg77aI9IDWpW8VYnYm8M4JL1eF0+q8ve17mLCd:uIjfSI72y7VLJJDKk7mLCd
MD5:	AD06F768156217480B319F643661E3F6
SHA1:	E653A6D66B1483AD5A890A8C22A5932B41F1D983
SHA-256:	FA42957B74A1137CECE9E1E9500553AB1BB6E6A68D520AA4E6F3BBED9B2ECBD5
SHA-512:	079F6698094AA591FEB331034EF43A35AEC59DE28A4E076E9B7D12650A04FBE1F0CF944CAB0AEBA66B816174DBC281FB3F656065242B2FF5B271467D51F4FD49
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="533223" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF8BF.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8252
Entropy (8bit):	3.6741802393755143
Encrypted:	false
SSDEEP:	192:R6l7wVeJjLT6g6Yt36sgmffMprB89bIQsfh4m:R6lXJr6g6YN6sgmff/Ijfr
MD5:	B8701CCC2F687DB035B529F574ADBD0A
SHA1:	1FDFB7870BF9A168B1F1530D94D8BF9CEE6C81BB
SHA-256:	A15A2332DCA7D841F84B21334675D5D0FA908BA5C89AE0FA957B59C846D23743
SHA-512:	757D18AF505FA7A06D32DF9116820A7EA870D2A2830971EAF3AF48260CBEEF5BE6D90FD8380067257D7E157E5EC4B304DFC5727B541DDA250EFEA1E3EE7E29A9
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.6.0.4.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF8DF.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4572
Entropy (8bit):	4.432976140534463
Encrypted:	false
SSDEEP:	48:cvIwWl8zsUJg77aI9IDWpW8VYYYm8M4JTcFY+q8Ksm3R3d:uIjfSI72y7V4Jpam3R3d
MD5:	C0517BD8493C4BE94C5CD5629239A3D7
SHA1:	41E4E9509A353E2897AF8702390EB47BB1C125CC
SHA-256:	C289483A8D8B7AD2477057CE6B17E1D69AA64A871A7AAB92076BD5A4F10ADECE
SHA-512:	9440D78B9449B2FEBEBBE5400E154AEE9ECDE4555561145F824989E04E5BC129ACAE590C547206F160900BA09DB87E134F21D099ADA7EA9E48DA8917BFED16C0
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="533223" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Users\user\AppData\Local\Temp\WERF8AE.tmp.WERDataCollectionStatus.txt

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	1834
Entropy (8bit):	3.262275714850255
Encrypted:	false
SSDEEP:	48:pszehzSzbxGQI5Uhm9bnl2Cl20llhvcAQHKEULjErX:pszehzSzbxGQI5Uhm9spG5QhULjoX
MD5:	6F938C7F473C28C19EA6F2212E1F718A
SHA1:	A0FEA5C07E2C8993EACBC2F7E7B3EE5E5638699D
SHA-256:	8714FA04F39504376D3F9194B44D914A309D7172E0A9B7BBDAABC3B56404DD78
SHA-512:	CBC04EBF65F4962AE0C78494BA3137F0840B0E84A08FF388984A7314D3CDD1B1477933E823C5DEB104F7E6F7D4C526C11C4DAD51FE7F1B288C65E6236060E8BD
Malicious:	false
Preview:	......S.n.a.p.s.h.o.t. .D.u.m.p.e.r.....-. .S.n.a.p.s.h.o.t. .a.v.a.i.l.a.b.l.e. . . . . . . .:. .0.....-. .S.n.a.p.s.h.o.t.s. .d.i.s.a.b.l.e.d. . . . . . . .:. .0.0.....-. .S.n.a.p.s.h.o.t. .s.t.a.t.u.s. . . . . . . . . . .:. .0.0.0.0.0.0.0.0.....-. .D.u.m.p.e.r. .s.t.a.t.u.s. . . . . . . . . . . . .:. .0.0.0.0.0.0.0.1.....-. .P.r.o.c.e.s.s. .W.E.R. .f.l.a.g.s. . . . . . . . .:. .0.0.0.0.0.0.0.0.....-. .W.a.t.s.o.n. .r.e.q.u.e.s.t. .d.u.m.p. . . . . . .:. .0.0.1.2.0.1.a.4.........M.i.n.i.D.u.m.p.W.r.i.t.e.D.u.m.p. .t.o.o.k.:.....-. .T.i.c.k.s. . . . . .:. . . . . . . . . . . . . . .3. .m.s.......-. .C.y.c.l.e.s. . . . .:. . . . . . . . .6.7.4.0.4.4.6.......M.i.n.i.D.u.m.p.W.r.i.t.e.D.u.m.p. .I./.O. .c.o.u.n.t.e.r.s.:.....-. .R.e.a.d.s. . . . . .:. . . . . . . . . .0. .o.p.s.,. . . . . . . . . .0. .b.y.t.e.s.,. . . . . . .0. .K.B./.s.e.c.......-. .W.r.i.t.e.s. . . . .:. . . . . . . . . .0. .o.p.s.,. . . . . . . . . .0. .b.y.t.e.s.,. . . . . . .0. .K.B./.s.e.c.......-. .O.t.h.e.r. . . .

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.420594674415942
Encrypted:	false
SSDEEP:	6144:xcifpi6ceLPL9skLmb0mZSWSPtaJG8nAgex285i2MMhA20X4WABlGuNa5+:Oi58ZSWIZBk2MM6AFBoo
MD5:	D5599BEAA655A22EB6B149D0D2D81966
SHA1:	8D071A7A7D2F00004316003979BC4D65D30D38A4
SHA-256:	B31597AC33D16B2B81777D8025E03B3FDCF93C81695ACC7B6AE1ADCCDF61988D
SHA-512:	70EA3D5ED76F42EE94269455BABC301B901F1403B0DC8F47189DFB8B0FB33FDF610741134DA09F2A6C07565526CE5146375A7078BAA7DF7C8E1B8EB61338E28E
Malicious:	false
Preview:	regfE...E....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm:5e.................................................................................................................................................................................................................................................................................................................................................N.r0........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.723484124390298
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	vEcIHT68pU.exe
File size:	551'424 bytes
MD5:	64fe8dfa186f801847e6c710f30b2884
SHA1:	7e6887011b600858d5b0d2d59564b3e44c023965
SHA256:	5a7b7a57eba095cf41ef86faa906c39c7f26b7b09e8b2268d1e882ad8afb92a6
SHA512:	b69ee7bc2927ea1c69249e1494dce2d986d1ea730cd57c039555a1c6155177706fdb0af71fe99d5aa828327b11cb05f456c566a7b83e0d887f87fb69550a090e
SSDEEP:	12288:mxyHj9OPDUsb5J4VMrJhypkjvsoZMfG6jiHiprOTafN4S:mg9OJ4o4iLI+QiHipCTau
TLSH:	A7C4F112B5C18033D57315324AF0DA719E3EBDB04B625E9F67980FBE4F30291D662A6B
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......=.9.y.WUy.WUy.WU..TTu.WU..RT..WU..STl.WU..VTz.WUy.VU!.WUilTTm.WUilSTk.WUilRT4.WU1m^Tx.WU1m.Ux.WU1mUTx.WURichy.WU...............

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x406f52
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x670402DC [Mon Oct 7 15:48:44 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	d10af643340e1121562abe3e6bd5b0e1

Entrypoint Preview

Instruction
call 00007F1CFCC7E5B0h
jmp 00007F1CFCC7DB1Fh
push ebp
mov ebp, esp
mov eax, dword ptr [ebp+08h]
push esi
mov ecx, dword ptr [eax+3Ch]
add ecx, eax
movzx eax, word ptr [ecx+14h]
lea edx, dword ptr [ecx+18h]
add edx, eax
movzx eax, word ptr [ecx+06h]
imul esi, eax, 28h
add esi, edx
cmp edx, esi
je 00007F1CFCC7DCBBh
mov ecx, dword ptr [ebp+0Ch]
cmp ecx, dword ptr [edx+0Ch]
jc 00007F1CFCC7DCACh
mov eax, dword ptr [edx+08h]
add eax, dword ptr [edx+0Ch]
cmp ecx, eax
jc 00007F1CFCC7DCAEh
add edx, 28h
cmp edx, esi
jne 00007F1CFCC7DC8Ch
xor eax, eax
pop esi
pop ebp
ret
mov eax, edx
jmp 00007F1CFCC7DC9Bh
push esi
call 00007F1CFCC7E8C4h
test eax, eax
je 00007F1CFCC7DCC2h
mov eax, dword ptr fs:[00000018h]
mov esi, 00486754h
mov edx, dword ptr [eax+04h]
jmp 00007F1CFCC7DCA6h
cmp edx, eax
je 00007F1CFCC7DCB2h
xor eax, eax
mov ecx, edx
lock cmpxchg dword ptr [esi], ecx
test eax, eax
jne 00007F1CFCC7DC92h
xor al, al
pop esi
ret
mov al, 01h
pop esi
ret
push ebp
mov ebp, esp
cmp dword ptr [ebp+08h], 00000000h
jne 00007F1CFCC7DCA9h
mov byte ptr [00486758h], 00000001h
call 00007F1CFCC7DF5Ah
call 00007F1CFCC80E77h
test al, al
jne 00007F1CFCC7DCA6h
xor al, al
pop ebp
ret
call 00007F1CFCC898D9h
test al, al
jne 00007F1CFCC7DCACh
push 00000000h
call 00007F1CFCC80E7Eh
pop ecx
jmp 00007F1CFCC7DC8Bh
mov al, 01h
pop ebp
ret
push ebp
mov ebp, esp
cmp byte ptr [00486759h], 00000000h
je 00007F1CFCC7DCA6h
mov al, 01h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2c6c0	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x88000	0x3d8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x89000	0x1ad4	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x2abc0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x2ab00	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x23000	0x12c	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x210f0	0x21200	4ec85efae47afbc1be73e0f57ab77ac8	False	0.5865197523584905	data	6.666580955863751	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x23000	0x9d78	0x9e00	9496054ecf546b9692729c918cdb49bb	False	0.4350771360759494	data	4.954549701710955	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x2d000	0x5a380	0x59600	97a4f2e1a119078beeb6549079f4a8d5	False	0.9912286931818182	DOS executable (block device driver \377\377\377\377,32-bit sector-support)	7.992381018626445	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x88000	0x3d8	0x400	c67ba8481d4e7c92e5fe9f152983a3f3	False	0.439453125	data	3.287044161603086	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x89000	0x1ad4	0x1c00	d5034316f3193736196b1e4313c773a6	False	0.7269810267857143	data	6.389550090010284	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x88058	0x380	data	English	United States	0.46205357142857145

Imports

DLL

Import

KERNEL32.dll

AttachConsole, MultiByteToWideChar, GetStringTypeW, WideCharToMultiByte, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionEx, DeleteCriticalSection, EncodePointer, DecodePointer, LCMapStringEx, GetCPInfo, IsProcessorFeaturePresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, GetStartupInfoW, GetModuleHandleW, CreateFileW, RaiseException, RtlUnwind, GetLastError, SetLastError, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, GetProcAddress, LoadLibraryExW, GetStdHandle, WriteFile, GetModuleFileNameW, ExitProcess, GetModuleHandleExW, HeapAlloc, HeapFree, GetFileType, LCMapStringW, GetLocaleInfoW, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, GetFileSizeEx, SetFilePointerEx, CloseHandle, FlushFileBuffers, GetConsoleOutputCP, GetConsoleMode, ReadFile, HeapReAlloc, FindClose, FindFirstFileExW, FindNextFileW, IsValidCodePage, GetACP, GetOEMCP, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetStdHandle, GetProcessHeap, ReadConsoleW, HeapSize, WriteConsoleW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-07T18:00:24.926091+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.7	49741	188.114.96.3	443	TCP
2024-10-07T18:00:24.926091+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.7	49741	188.114.96.3	443	TCP
2024-10-07T18:00:26.056636+0200	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.7	49747	188.114.96.3	443	TCP
2024-10-07T18:00:26.056636+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.7	49747	188.114.96.3	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 7, 2024 18:00:18.267654896 CEST	49705	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:18.315407038 CEST	443	49705	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:18.413557053 CEST	443	49705	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:18.413589954 CEST	443	49705	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:18.413606882 CEST	443	49705	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:18.413672924 CEST	49705	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:18.413685083 CEST	443	49705	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:18.413722038 CEST	49705	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:18.413744926 CEST	49705	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:18.470046043 CEST	443	49705	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:18.470077991 CEST	443	49705	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:18.470215082 CEST	49705	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:18.470226049 CEST	443	49705	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:18.470269918 CEST	49705	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:18.496496916 CEST	443	49705	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:18.496514082 CEST	443	49705	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:18.496596098 CEST	49705	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:18.496607065 CEST	443	49705	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:18.496648073 CEST	49705	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:18.553251982 CEST	443	49705	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:18.553277016 CEST	443	49705	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:18.553390026 CEST	49705	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:18.553406000 CEST	443	49705	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:18.553517103 CEST	49705	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:18.554292917 CEST	443	49705	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:18.554307938 CEST	443	49705	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:18.554379940 CEST	49705	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:18.554385900 CEST	443	49705	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:18.554424047 CEST	49705	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:18.556068897 CEST	443	49705	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:18.556085110 CEST	443	49705	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:18.556217909 CEST	49705	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:18.556224108 CEST	443	49705	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:18.556319952 CEST	49705	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:18.580384970 CEST	443	49705	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:18.580418110 CEST	443	49705	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:18.580503941 CEST	49705	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:18.580512047 CEST	443	49705	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:18.580557108 CEST	49705	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:18.636609077 CEST	443	49705	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:18.636635065 CEST	443	49705	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:18.636773109 CEST	49705	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:18.636785984 CEST	443	49705	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:18.636955976 CEST	49705	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:18.637614965 CEST	443	49705	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:18.637631893 CEST	443	49705	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:18.637691975 CEST	49705	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:18.637697935 CEST	443	49705	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:18.637744904 CEST	49705	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:18.638748884 CEST	443	49705	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:18.638766050 CEST	443	49705	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:18.638822079 CEST	49705	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:18.638828039 CEST	443	49705	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:18.638876915 CEST	49705	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:18.639067888 CEST	443	49705	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:18.639085054 CEST	443	49705	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:18.639128923 CEST	49705	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:18.639133930 CEST	443	49705	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:18.639173985 CEST	49705	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:18.640059948 CEST	443	49705	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:18.640077114 CEST	443	49705	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:18.640127897 CEST	49705	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:18.640132904 CEST	443	49705	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:18.640181065 CEST	49705	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:18.640952110 CEST	443	49705	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:18.640969038 CEST	443	49705	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:18.641022921 CEST	49705	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:18.641031981 CEST	443	49705	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:18.641086102 CEST	49705	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:18.641138077 CEST	443	49705	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:18.641200066 CEST	49705	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:18.641204119 CEST	443	49705	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:18.641216993 CEST	443	49705	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:18.641251087 CEST	49705	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:18.641284943 CEST	49705	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:18.641952991 CEST	49705	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:18.641973972 CEST	443	49705	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:18.641983986 CEST	49705	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:18.641990900 CEST	443	49705	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:18.693774939 CEST	49707	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:18.693866968 CEST	443	49707	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:18.693914890 CEST	49706	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:18.693953037 CEST	443	49706	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:18.694000959 CEST	49707	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:18.694036961 CEST	49706	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:18.694261074 CEST	49707	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:18.694302082 CEST	443	49707	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:18.694559097 CEST	49706	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:18.694571972 CEST	443	49706	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:18.695674896 CEST	49708	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:18.695693016 CEST	443	49708	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:18.695755005 CEST	49708	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:18.695849895 CEST	49708	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:18.695866108 CEST	443	49708	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:18.696775913 CEST	49709	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:18.696808100 CEST	443	49709	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:18.696865082 CEST	49709	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:18.697293997 CEST	49710	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:18.697300911 CEST	443	49710	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:18.697348118 CEST	49710	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:18.697436094 CEST	49709	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:18.697448015 CEST	443	49709	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:18.697473049 CEST	49710	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:18.697480917 CEST	443	49710	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:19.304945946 CEST	443	49709	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:19.309544086 CEST	443	49706	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:19.310405970 CEST	443	49708	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:19.334244967 CEST	443	49707	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:19.338020086 CEST	443	49710	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:19.355283976 CEST	49709	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:19.355284929 CEST	49706	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:19.357614994 CEST	49708	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:19.378042936 CEST	49710	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:19.378077030 CEST	443	49710	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:19.378299952 CEST	49710	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:19.378305912 CEST	443	49710	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:19.379424095 CEST	49709	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:19.379424095 CEST	49709	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:19.379430056 CEST	49706	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:19.379430056 CEST	49706	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:19.379435062 CEST	443	49709	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:19.379442930 CEST	443	49706	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:19.379450083 CEST	443	49709	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:19.379461050 CEST	443	49706	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:19.379606009 CEST	49708	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:19.379614115 CEST	443	49708	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:19.379976988 CEST	49708	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:19.379981995 CEST	443	49708	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:19.386435986 CEST	49707	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:19.392071009 CEST	49707	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:19.392090082 CEST	443	49707	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:19.392543077 CEST	49707	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:19.392554045 CEST	443	49707	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:19.470833063 CEST	443	49706	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:19.470895052 CEST	443	49706	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:19.471029043 CEST	49706	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:19.471055984 CEST	443	49706	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:19.471173048 CEST	49706	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:19.471183062 CEST	443	49706	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:19.471303940 CEST	443	49706	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:19.471344948 CEST	443	49709	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:19.471441984 CEST	49706	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:19.471499920 CEST	443	49709	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:19.471652985 CEST	49709	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:19.471671104 CEST	443	49709	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:19.472049952 CEST	49709	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:19.472073078 CEST	443	49709	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:19.472187042 CEST	443	49709	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:19.472297907 CEST	49709	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:19.472486019 CEST	443	49708	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:19.472508907 CEST	443	49708	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:19.472559929 CEST	49708	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:19.472572088 CEST	443	49708	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:19.473042011 CEST	443	49708	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:19.473097086 CEST	49708	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:19.474545956 CEST	443	49710	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:19.474606037 CEST	443	49710	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:19.474701881 CEST	49710	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:19.488114119 CEST	443	49707	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:19.488185883 CEST	443	49707	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:19.488267899 CEST	49707	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:19.528857946 CEST	49706	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:19.528912067 CEST	443	49706	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:19.528954983 CEST	49706	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:19.528965950 CEST	443	49706	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:19.529783010 CEST	49707	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:19.529815912 CEST	443	49707	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:19.529833078 CEST	49707	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:19.529841900 CEST	443	49707	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:19.535263062 CEST	49711	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:19.535289049 CEST	443	49711	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:19.535356998 CEST	49709	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:19.535356998 CEST	49709	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:19.535362959 CEST	49711	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:19.535378933 CEST	443	49709	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:19.535394907 CEST	443	49709	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:19.535406113 CEST	49708	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:19.535423994 CEST	49708	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:19.535433054 CEST	443	49708	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:19.535438061 CEST	443	49708	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:19.535562992 CEST	49711	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:19.535569906 CEST	443	49711	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:19.535690069 CEST	49710	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:19.535696030 CEST	443	49710	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:19.535732031 CEST	49710	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:19.535737991 CEST	443	49710	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:19.585381985 CEST	49712	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:19.585406065 CEST	443	49712	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:19.585495949 CEST	49712	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:19.598361015 CEST	49712	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:19.598376989 CEST	443	49712	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:19.644402981 CEST	49713	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:19.644469976 CEST	443	49713	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:19.644583941 CEST	49713	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:19.645070076 CEST	49714	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:19.645090103 CEST	443	49714	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:19.645164013 CEST	49714	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:19.645623922 CEST	49715	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:19.645665884 CEST	443	49715	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:19.645720959 CEST	49715	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:19.657885075 CEST	49713	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:19.657922983 CEST	443	49713	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:19.657946110 CEST	49714	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:19.657970905 CEST	443	49714	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:19.658056021 CEST	49715	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:19.658077955 CEST	443	49715	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:20.159667015 CEST	443	49711	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:20.160542011 CEST	49711	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:20.160564899 CEST	443	49711	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:20.161492109 CEST	49711	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:20.161497116 CEST	443	49711	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:20.215027094 CEST	443	49712	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:20.227545977 CEST	49712	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:20.227575064 CEST	443	49712	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:20.228509903 CEST	49712	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:20.228517056 CEST	443	49712	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:20.261734962 CEST	443	49711	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:20.261815071 CEST	443	49711	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:20.261883974 CEST	49711	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:20.267995119 CEST	49711	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:20.268011093 CEST	443	49711	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:20.268021107 CEST	49711	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:20.268026114 CEST	443	49711	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:20.290415049 CEST	443	49713	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:20.293581963 CEST	443	49715	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:20.303026915 CEST	49716	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:20.303075075 CEST	443	49716	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:20.303148985 CEST	49716	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:20.307998896 CEST	49713	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:20.308063030 CEST	443	49713	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:20.308619976 CEST	49713	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:20.308633089 CEST	443	49713	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:20.309298038 CEST	49715	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:20.309322119 CEST	443	49715	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:20.309706926 CEST	49715	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:20.309714079 CEST	443	49715	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:20.310323954 CEST	49716	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:20.310338020 CEST	443	49716	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:20.319866896 CEST	443	49712	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:20.319926023 CEST	443	49712	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:20.319999933 CEST	49712	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:20.321413994 CEST	49712	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:20.321430922 CEST	443	49712	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:20.321445942 CEST	49712	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:20.321451902 CEST	443	49712	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:20.332765102 CEST	49717	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:20.332811117 CEST	443	49717	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:20.332901955 CEST	49717	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:20.334119081 CEST	49717	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:20.334136009 CEST	443	49717	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:20.402805090 CEST	443	49713	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:20.402940989 CEST	443	49713	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:20.403033972 CEST	49713	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:20.403276920 CEST	443	49715	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:20.403335094 CEST	443	49715	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:20.403376102 CEST	49715	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:20.415349960 CEST	49713	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:20.415395021 CEST	443	49713	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:20.415435076 CEST	49715	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:20.415440083 CEST	49713	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:20.415447950 CEST	443	49713	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:20.415457964 CEST	443	49715	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:20.415472031 CEST	49715	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:20.415477991 CEST	443	49715	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:20.468508959 CEST	49718	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:20.468547106 CEST	443	49718	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:20.468636990 CEST	49718	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:20.468717098 CEST	49719	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:20.468769073 CEST	443	49719	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:20.468826056 CEST	49719	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:20.480477095 CEST	49718	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:20.480494976 CEST	443	49718	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:20.480585098 CEST	49719	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:20.480608940 CEST	443	49719	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:20.492440939 CEST	443	49714	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:20.495265007 CEST	49714	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:20.495305061 CEST	443	49714	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:20.496994972 CEST	49714	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:20.497009993 CEST	443	49714	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:20.661159992 CEST	443	49714	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:20.661289930 CEST	443	49714	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:20.661395073 CEST	49714	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:20.661695004 CEST	49714	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:20.661695004 CEST	49714	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:20.661725998 CEST	443	49714	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:20.661748886 CEST	443	49714	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:20.664405107 CEST	49720	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:20.664433956 CEST	443	49720	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:20.664501905 CEST	49720	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:20.664634943 CEST	49720	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:20.664649010 CEST	443	49720	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:20.978786945 CEST	443	49717	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:20.979371071 CEST	49717	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:20.979397058 CEST	443	49717	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:20.979815960 CEST	49717	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:20.979820013 CEST	443	49717	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:20.987679958 CEST	443	49716	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:20.988217115 CEST	49716	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:20.988240004 CEST	443	49716	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:20.988657951 CEST	49716	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:20.988665104 CEST	443	49716	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:21.116631031 CEST	443	49717	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:21.116698980 CEST	443	49717	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:21.116899967 CEST	49717	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:21.117079973 CEST	49717	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:21.117079973 CEST	49717	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:21.117100954 CEST	443	49717	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:21.117109060 CEST	443	49717	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:21.117714882 CEST	443	49716	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:21.117872953 CEST	443	49716	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:21.117927074 CEST	49716	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:21.118020058 CEST	49716	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:21.118038893 CEST	443	49716	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:21.118052959 CEST	49716	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:21.118058920 CEST	443	49716	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:21.121776104 CEST	49721	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:21.121807098 CEST	443	49721	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:21.121933937 CEST	49721	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:21.121959925 CEST	49722	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:21.121969938 CEST	443	49722	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:21.122036934 CEST	49722	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:21.122087955 CEST	49721	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:21.122097015 CEST	443	49721	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:21.122195005 CEST	49722	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:21.122208118 CEST	443	49722	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:21.130752087 CEST	443	49718	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:21.131407976 CEST	49718	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:21.131422043 CEST	443	49718	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:21.131756067 CEST	49718	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:21.131762028 CEST	443	49718	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:21.150290966 CEST	443	49719	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:21.151019096 CEST	49719	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:21.151047945 CEST	443	49719	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:21.151458025 CEST	49719	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:21.151464939 CEST	443	49719	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:21.236958981 CEST	443	49718	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:21.237096071 CEST	443	49718	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:21.237261057 CEST	49718	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:21.237436056 CEST	49718	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:21.237452030 CEST	443	49718	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:21.237484932 CEST	49718	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:21.237490892 CEST	443	49718	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:21.240567923 CEST	49723	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:21.240609884 CEST	443	49723	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:21.240714073 CEST	49723	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:21.240916014 CEST	49723	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:21.240931988 CEST	443	49723	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:21.261423111 CEST	49675	443	192.168.2.7	104.98.116.138
Oct 7, 2024 18:00:21.261507988 CEST	443	49719	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:21.261658907 CEST	443	49719	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:21.261697054 CEST	49674	443	192.168.2.7	104.98.116.138
Oct 7, 2024 18:00:21.261715889 CEST	49719	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:21.262134075 CEST	49719	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:21.262140036 CEST	443	49719	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:21.262156010 CEST	49719	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:21.262161016 CEST	443	49719	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:21.265024900 CEST	49724	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:21.265049934 CEST	443	49724	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:21.265188932 CEST	49724	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:21.265436888 CEST	49724	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:21.265450001 CEST	443	49724	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:21.328962088 CEST	443	49720	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:21.330032110 CEST	49720	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:21.330032110 CEST	49720	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:21.330045938 CEST	443	49720	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:21.330060005 CEST	443	49720	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:21.433296919 CEST	49672	443	192.168.2.7	104.98.116.138
Oct 7, 2024 18:00:21.569542885 CEST	443	49720	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:21.569624901 CEST	443	49720	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:21.569689035 CEST	49720	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:21.569950104 CEST	49720	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:21.569967031 CEST	443	49720	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:21.569984913 CEST	49720	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:21.569991112 CEST	443	49720	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:21.572937965 CEST	49725	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:21.572984934 CEST	443	49725	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:21.573088884 CEST	49725	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:21.573296070 CEST	49725	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:21.573308945 CEST	443	49725	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:21.904505014 CEST	443	49721	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:21.904596090 CEST	443	49722	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:21.905183077 CEST	49722	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:21.905208111 CEST	443	49722	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:21.905329943 CEST	49721	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:21.905349016 CEST	443	49721	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:21.905706882 CEST	49722	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:21.905713081 CEST	443	49722	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:21.905797958 CEST	49721	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:21.905805111 CEST	443	49721	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:21.998804092 CEST	443	49721	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:21.998917103 CEST	443	49721	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:21.998997927 CEST	49721	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:21.999156952 CEST	49721	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:21.999170065 CEST	443	49721	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:21.999186039 CEST	49721	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:21.999192953 CEST	443	49721	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:22.000876904 CEST	443	49722	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:22.000987053 CEST	443	49722	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:22.001049042 CEST	49722	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:22.001148939 CEST	49722	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:22.001154900 CEST	443	49722	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:22.001168966 CEST	49722	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:22.001173973 CEST	443	49722	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:22.002665997 CEST	49726	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:22.002696991 CEST	443	49726	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:22.002778053 CEST	49726	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:22.002995968 CEST	49726	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:22.003010988 CEST	443	49726	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:22.004004955 CEST	49727	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:22.004057884 CEST	443	49727	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:22.004136086 CEST	49727	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:22.004242897 CEST	49727	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:22.004261017 CEST	443	49727	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:22.020983934 CEST	443	49723	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:22.021617889 CEST	49723	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:22.021637917 CEST	443	49723	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:22.022298098 CEST	49723	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:22.022304058 CEST	443	49723	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:22.044982910 CEST	443	49724	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:22.045563936 CEST	49724	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:22.045592070 CEST	443	49724	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:22.046036005 CEST	49724	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:22.046046019 CEST	443	49724	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:22.142071009 CEST	443	49723	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:22.142235041 CEST	443	49723	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:22.142364979 CEST	49723	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:22.142463923 CEST	49723	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:22.142477989 CEST	443	49723	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:22.142543077 CEST	49723	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:22.142548084 CEST	443	49723	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:22.144932985 CEST	443	49724	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:22.145025969 CEST	443	49724	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:22.145116091 CEST	49724	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:22.145581961 CEST	49724	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:22.145581961 CEST	49724	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:22.145611048 CEST	443	49724	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:22.145638943 CEST	443	49724	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:22.146236897 CEST	49728	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:22.146253109 CEST	443	49728	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:22.146576881 CEST	49728	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:22.146576881 CEST	49728	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:22.146599054 CEST	443	49728	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:22.147653103 CEST	49729	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:22.147667885 CEST	443	49729	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:22.147726059 CEST	49729	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:22.147838116 CEST	49729	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:22.147850990 CEST	443	49729	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:22.274796963 CEST	443	49725	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:22.275512934 CEST	49725	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:22.275571108 CEST	443	49725	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:22.276061058 CEST	49725	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:22.276073933 CEST	443	49725	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:22.374962091 CEST	443	49725	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:22.375035048 CEST	443	49725	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:22.375112057 CEST	49725	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:22.375478983 CEST	49725	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:22.375518084 CEST	443	49725	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:22.375566959 CEST	49725	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:22.375582933 CEST	443	49725	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:22.378954887 CEST	49730	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:22.378984928 CEST	443	49730	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:22.379055023 CEST	49730	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:22.379267931 CEST	49730	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:22.379283905 CEST	443	49730	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:22.640583038 CEST	443	49727	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:22.641293049 CEST	49727	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:22.641304970 CEST	443	49727	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:22.641782045 CEST	49727	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:22.641803980 CEST	443	49727	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:22.672661066 CEST	443	49726	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:22.673362970 CEST	49726	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:22.673392057 CEST	443	49726	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:22.673958063 CEST	49726	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:22.673973083 CEST	443	49726	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:22.738634109 CEST	443	49727	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:22.738780022 CEST	443	49727	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:22.738967896 CEST	49727	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:22.739031076 CEST	49727	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:22.739031076 CEST	49727	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:22.739051104 CEST	443	49727	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:22.739059925 CEST	443	49727	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:22.742279053 CEST	49731	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:22.742319107 CEST	443	49731	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:22.742400885 CEST	49731	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:22.742605925 CEST	49731	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:22.742615938 CEST	443	49731	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:22.761461020 CEST	49671	443	192.168.2.7	204.79.197.203
Oct 7, 2024 18:00:22.773514986 CEST	443	49726	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:22.773689985 CEST	443	49726	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:22.773757935 CEST	49726	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:22.773907900 CEST	49726	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:22.773926973 CEST	443	49726	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:22.773940086 CEST	49726	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:22.773947001 CEST	443	49726	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:22.776757956 CEST	49732	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:22.776798010 CEST	443	49732	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:22.777230978 CEST	49732	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:22.777230978 CEST	49732	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:22.777266026 CEST	443	49732	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:22.785753012 CEST	443	49728	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:22.786362886 CEST	49728	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:22.786377907 CEST	443	49728	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:22.786652088 CEST	49728	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:22.786659956 CEST	443	49728	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:22.803800106 CEST	443	49729	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:22.804265976 CEST	49729	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:22.804277897 CEST	443	49729	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:22.804722071 CEST	49729	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:22.804727077 CEST	443	49729	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:22.881972075 CEST	443	49728	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:22.882121086 CEST	443	49728	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:22.882184982 CEST	49728	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:22.882322073 CEST	49728	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:22.882338047 CEST	443	49728	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:22.882344007 CEST	49728	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:22.882349014 CEST	443	49728	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:22.885999918 CEST	49733	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:22.886029005 CEST	443	49733	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:22.886116982 CEST	49733	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:22.886297941 CEST	49733	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:22.886305094 CEST	443	49733	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:22.900302887 CEST	443	49729	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:22.900461912 CEST	443	49729	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:22.900526047 CEST	49729	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:22.900685072 CEST	49729	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:22.900697947 CEST	443	49729	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:22.900707960 CEST	49729	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:22.900712967 CEST	443	49729	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:22.903912067 CEST	49734	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:22.903924942 CEST	443	49734	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:22.903999090 CEST	49734	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:22.904598951 CEST	49734	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:22.904612064 CEST	443	49734	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:22.989722967 CEST	443	49730	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:22.990344048 CEST	49730	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:22.990365982 CEST	443	49730	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:22.990904093 CEST	49730	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:22.990910053 CEST	443	49730	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:23.106910944 CEST	443	49730	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:23.107875109 CEST	443	49730	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:23.107995987 CEST	49730	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:23.108279943 CEST	49730	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:23.108290911 CEST	443	49730	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:23.108305931 CEST	49730	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:23.108310938 CEST	443	49730	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:23.118581057 CEST	49735	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:23.118624926 CEST	443	49735	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:23.118751049 CEST	49735	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:23.118982077 CEST	49735	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:23.118997097 CEST	443	49735	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:23.819955111 CEST	443	49731	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:23.821391106 CEST	49731	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:23.821399927 CEST	443	49731	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:23.822288990 CEST	49731	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:23.822293043 CEST	443	49731	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:23.933289051 CEST	49677	443	192.168.2.7	20.50.201.200
Oct 7, 2024 18:00:23.936217070 CEST	443	49731	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:23.936409950 CEST	443	49731	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:23.936572075 CEST	49731	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:23.936799049 CEST	49731	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:23.936826944 CEST	443	49731	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:23.936836958 CEST	49731	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:23.936842918 CEST	443	49731	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:23.940411091 CEST	49736	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:23.940449953 CEST	443	49736	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:23.940530062 CEST	49736	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:23.940769911 CEST	49736	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:23.940783024 CEST	443	49736	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:24.004021883 CEST	443	49734	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:24.004595041 CEST	49734	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:24.004626989 CEST	443	49734	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:24.004832029 CEST	443	49732	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:24.005049944 CEST	49734	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:24.005059004 CEST	443	49734	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:24.005440950 CEST	49732	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:24.005460024 CEST	443	49732	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:24.005986929 CEST	49732	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:24.006010056 CEST	443	49732	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:24.011689901 CEST	443	49735	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:24.012092113 CEST	49735	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:24.012106895 CEST	443	49735	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:24.012666941 CEST	49735	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:24.012672901 CEST	443	49735	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:24.013118029 CEST	443	49733	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:24.013608932 CEST	49733	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:24.013622046 CEST	443	49733	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:24.014128923 CEST	49733	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:24.014136076 CEST	443	49733	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:24.113285065 CEST	443	49732	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:24.113356113 CEST	443	49732	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:24.113501072 CEST	49732	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:24.113660097 CEST	443	49734	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:24.113735914 CEST	443	49734	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:24.113735914 CEST	443	49733	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:24.113743067 CEST	443	49735	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:24.113781929 CEST	49734	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:24.113785982 CEST	443	49733	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:24.113806009 CEST	443	49735	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:24.113821983 CEST	49733	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:24.113879919 CEST	49735	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:24.120373964 CEST	49732	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:24.120373964 CEST	49732	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:24.120379925 CEST	443	49732	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:24.120387077 CEST	443	49732	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:24.125164032 CEST	49734	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:24.125164032 CEST	49733	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:24.125180960 CEST	443	49734	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:24.125193119 CEST	443	49733	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:24.125205040 CEST	49733	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:24.125211000 CEST	443	49733	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:24.127232075 CEST	49735	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:24.127232075 CEST	49735	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:24.127238989 CEST	443	49735	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:24.127245903 CEST	443	49735	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:24.141172886 CEST	49737	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:24.141232014 CEST	443	49737	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:24.141324043 CEST	49737	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:24.142266989 CEST	49738	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:24.142281055 CEST	443	49738	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:24.142329931 CEST	49738	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:24.143651962 CEST	49737	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:24.143676996 CEST	443	49737	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:24.143763065 CEST	49738	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:24.143774986 CEST	443	49738	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:24.144500971 CEST	49739	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:24.144514084 CEST	443	49739	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:24.144579887 CEST	49739	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:24.144988060 CEST	49740	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:24.144999027 CEST	443	49740	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:24.145050049 CEST	49740	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:24.145071030 CEST	49739	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:24.145078897 CEST	443	49739	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:24.145802021 CEST	49740	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:24.145813942 CEST	443	49740	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:24.284832001 CEST	49741	443	192.168.2.7	188.114.96.3
Oct 7, 2024 18:00:24.284867048 CEST	443	49741	188.114.96.3	192.168.2.7
Oct 7, 2024 18:00:24.284940004 CEST	49741	443	192.168.2.7	188.114.96.3
Oct 7, 2024 18:00:24.289235115 CEST	49741	443	192.168.2.7	188.114.96.3
Oct 7, 2024 18:00:24.289248943 CEST	443	49741	188.114.96.3	192.168.2.7
Oct 7, 2024 18:00:24.567169905 CEST	443	49736	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:24.567714930 CEST	49736	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:24.567737103 CEST	443	49736	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:24.568133116 CEST	49736	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:24.568137884 CEST	443	49736	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:24.670950890 CEST	443	49736	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:24.671109915 CEST	443	49736	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:24.671184063 CEST	49736	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:24.671272993 CEST	49736	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:24.671288967 CEST	443	49736	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:24.671302080 CEST	49736	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:24.671307087 CEST	443	49736	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:24.683404922 CEST	49742	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:24.683443069 CEST	443	49742	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:24.683569908 CEST	49742	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:24.684381008 CEST	49742	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:24.684400082 CEST	443	49742	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:24.748948097 CEST	443	49741	188.114.96.3	192.168.2.7
Oct 7, 2024 18:00:24.749042988 CEST	49741	443	192.168.2.7	188.114.96.3
Oct 7, 2024 18:00:24.754960060 CEST	443	49740	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:24.757436037 CEST	49740	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:24.757463932 CEST	443	49740	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:24.757886887 CEST	49740	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:24.757898092 CEST	443	49740	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:24.760257006 CEST	443	49737	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:24.760642052 CEST	49737	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:24.760668993 CEST	443	49737	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:24.761027098 CEST	49737	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:24.761037111 CEST	443	49737	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:24.762084007 CEST	49741	443	192.168.2.7	188.114.96.3
Oct 7, 2024 18:00:24.762109041 CEST	443	49741	188.114.96.3	192.168.2.7
Oct 7, 2024 18:00:24.762430906 CEST	443	49741	188.114.96.3	192.168.2.7
Oct 7, 2024 18:00:24.767695904 CEST	443	49738	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:24.768013000 CEST	49738	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:24.768039942 CEST	443	49738	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:24.768623114 CEST	49738	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:24.768630981 CEST	443	49738	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:24.771433115 CEST	443	49739	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:24.771806955 CEST	49739	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:24.771825075 CEST	443	49739	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:24.772298098 CEST	49739	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:24.772303104 CEST	443	49739	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:24.808254004 CEST	49741	443	192.168.2.7	188.114.96.3
Oct 7, 2024 18:00:24.823450089 CEST	49741	443	192.168.2.7	188.114.96.3
Oct 7, 2024 18:00:24.823472023 CEST	49741	443	192.168.2.7	188.114.96.3
Oct 7, 2024 18:00:24.823597908 CEST	443	49741	188.114.96.3	192.168.2.7
Oct 7, 2024 18:00:24.852128029 CEST	443	49740	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:24.852195024 CEST	443	49740	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:24.852272987 CEST	49740	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:24.863882065 CEST	443	49737	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:24.864017010 CEST	443	49737	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:24.864084005 CEST	49737	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:24.876569986 CEST	443	49738	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:24.876636982 CEST	443	49738	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:24.876698017 CEST	49738	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:24.878493071 CEST	443	49739	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:24.878652096 CEST	443	49739	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:24.878711939 CEST	49739	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:24.884568930 CEST	49740	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:24.884596109 CEST	443	49740	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:24.884609938 CEST	49740	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:24.884615898 CEST	443	49740	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:24.885736942 CEST	49737	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:24.885782957 CEST	443	49737	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:24.885811090 CEST	49737	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:24.885828018 CEST	443	49737	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:24.886883020 CEST	49738	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:24.886883020 CEST	49738	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:24.886902094 CEST	443	49738	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:24.886923075 CEST	443	49738	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:24.887598038 CEST	49739	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:24.887619972 CEST	443	49739	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:24.887635946 CEST	49739	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:24.887644053 CEST	443	49739	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:24.890789986 CEST	49743	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:24.890820026 CEST	443	49743	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:24.890882015 CEST	49743	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:24.891951084 CEST	49744	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:24.892036915 CEST	443	49744	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:24.892101049 CEST	49744	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:24.893054008 CEST	49745	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:24.893099070 CEST	443	49745	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:24.893173933 CEST	49743	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:24.893193960 CEST	49745	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:24.893198967 CEST	443	49743	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:24.893594980 CEST	49744	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:24.893630981 CEST	443	49744	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:24.893661976 CEST	49745	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:24.893676996 CEST	443	49745	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:24.894432068 CEST	49746	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:24.894452095 CEST	443	49746	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:24.894627094 CEST	49746	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:24.894886017 CEST	49746	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:24.894900084 CEST	443	49746	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:24.926074028 CEST	443	49741	188.114.96.3	192.168.2.7
Oct 7, 2024 18:00:24.926104069 CEST	443	49741	188.114.96.3	192.168.2.7
Oct 7, 2024 18:00:24.926172972 CEST	443	49741	188.114.96.3	192.168.2.7
Oct 7, 2024 18:00:24.926177025 CEST	49741	443	192.168.2.7	188.114.96.3
Oct 7, 2024 18:00:24.926188946 CEST	443	49741	188.114.96.3	192.168.2.7
Oct 7, 2024 18:00:24.926215887 CEST	49741	443	192.168.2.7	188.114.96.3
Oct 7, 2024 18:00:24.926234007 CEST	49741	443	192.168.2.7	188.114.96.3
Oct 7, 2024 18:00:24.929438114 CEST	49741	443	192.168.2.7	188.114.96.3
Oct 7, 2024 18:00:24.929456949 CEST	443	49741	188.114.96.3	192.168.2.7
Oct 7, 2024 18:00:24.929471016 CEST	49741	443	192.168.2.7	188.114.96.3
Oct 7, 2024 18:00:24.929476023 CEST	443	49741	188.114.96.3	192.168.2.7
Oct 7, 2024 18:00:25.001000881 CEST	49747	443	192.168.2.7	188.114.96.3
Oct 7, 2024 18:00:25.001035929 CEST	443	49747	188.114.96.3	192.168.2.7
Oct 7, 2024 18:00:25.001142979 CEST	49747	443	192.168.2.7	188.114.96.3
Oct 7, 2024 18:00:25.002438068 CEST	49747	443	192.168.2.7	188.114.96.3
Oct 7, 2024 18:00:25.002449036 CEST	443	49747	188.114.96.3	192.168.2.7
Oct 7, 2024 18:00:25.317941904 CEST	443	49742	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:25.370805025 CEST	49742	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:25.405514956 CEST	49742	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:25.405529022 CEST	443	49742	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:25.405994892 CEST	49742	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:25.405998945 CEST	443	49742	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:25.464946032 CEST	443	49747	188.114.96.3	192.168.2.7
Oct 7, 2024 18:00:25.465102911 CEST	49747	443	192.168.2.7	188.114.96.3
Oct 7, 2024 18:00:25.467307091 CEST	49747	443	192.168.2.7	188.114.96.3
Oct 7, 2024 18:00:25.467330933 CEST	443	49747	188.114.96.3	192.168.2.7
Oct 7, 2024 18:00:25.467629910 CEST	443	49747	188.114.96.3	192.168.2.7
Oct 7, 2024 18:00:25.470062971 CEST	49747	443	192.168.2.7	188.114.96.3
Oct 7, 2024 18:00:25.470062971 CEST	49747	443	192.168.2.7	188.114.96.3
Oct 7, 2024 18:00:25.470130920 CEST	443	49747	188.114.96.3	192.168.2.7
Oct 7, 2024 18:00:25.501511097 CEST	443	49742	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:25.501899004 CEST	443	49742	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:25.501983881 CEST	49742	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:25.502626896 CEST	49742	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:25.502626896 CEST	49742	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:25.502646923 CEST	443	49742	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:25.502654076 CEST	443	49742	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:25.506449938 CEST	443	49743	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:25.507266998 CEST	49743	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:25.507286072 CEST	443	49743	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:25.507529020 CEST	49748	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:25.507576942 CEST	443	49748	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:25.507644892 CEST	49748	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:25.508385897 CEST	49743	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:25.508392096 CEST	443	49743	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:25.508718014 CEST	49748	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:25.508738041 CEST	443	49748	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:25.513516903 CEST	443	49744	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:25.558691978 CEST	49744	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:25.561253071 CEST	443	49745	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:25.568803072 CEST	443	49746	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:25.605226040 CEST	49745	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:25.605820894 CEST	443	49743	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:25.605990887 CEST	443	49743	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:25.606065989 CEST	49743	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:25.620779991 CEST	49746	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:25.632442951 CEST	49744	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:25.632469893 CEST	443	49744	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:25.633033991 CEST	49744	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:25.633043051 CEST	443	49744	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:25.636305094 CEST	49745	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:25.636305094 CEST	49745	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:25.636313915 CEST	443	49745	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:25.636336088 CEST	443	49745	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:25.636641979 CEST	49746	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:25.636646986 CEST	443	49746	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:25.637655020 CEST	49743	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:25.637671947 CEST	443	49743	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:25.637703896 CEST	49743	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:25.637710094 CEST	443	49743	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:25.638057947 CEST	49746	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:25.638081074 CEST	443	49746	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:25.641159058 CEST	49749	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:25.641201019 CEST	443	49749	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:25.641303062 CEST	49749	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:25.641421080 CEST	49749	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:25.641438007 CEST	443	49749	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:25.836457968 CEST	443	49744	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:25.837744951 CEST	443	49744	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:25.837970018 CEST	49744	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:25.839407921 CEST	443	49745	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:25.839572906 CEST	443	49745	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:25.839847088 CEST	49745	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:25.842874050 CEST	49744	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:25.842895031 CEST	443	49744	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:25.842911005 CEST	49744	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:25.842917919 CEST	443	49744	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:25.866548061 CEST	443	49746	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:25.866638899 CEST	443	49746	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:25.866837978 CEST	49746	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:25.967411041 CEST	49745	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:25.967411041 CEST	49745	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:25.967449903 CEST	443	49745	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:25.967458963 CEST	443	49745	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:25.969223976 CEST	49746	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:25.969228983 CEST	443	49746	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:25.969253063 CEST	49746	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:25.969258070 CEST	443	49746	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:25.973059893 CEST	49750	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:25.973114014 CEST	443	49750	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:25.973172903 CEST	49750	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:25.974463940 CEST	49751	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:25.974505901 CEST	443	49751	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:25.974565029 CEST	49751	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:25.975373030 CEST	49751	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:25.975382090 CEST	49750	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:25.975388050 CEST	443	49751	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:25.975402117 CEST	443	49750	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:25.976176023 CEST	49752	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:25.976207018 CEST	443	49752	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:25.976309061 CEST	49752	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:25.976573944 CEST	49752	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:25.976588964 CEST	443	49752	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:26.056634903 CEST	443	49747	188.114.96.3	192.168.2.7
Oct 7, 2024 18:00:26.056720018 CEST	443	49747	188.114.96.3	192.168.2.7
Oct 7, 2024 18:00:26.056786060 CEST	49747	443	192.168.2.7	188.114.96.3
Oct 7, 2024 18:00:26.071403980 CEST	49747	443	192.168.2.7	188.114.96.3
Oct 7, 2024 18:00:26.071403980 CEST	49747	443	192.168.2.7	188.114.96.3
Oct 7, 2024 18:00:26.071418047 CEST	443	49747	188.114.96.3	192.168.2.7
Oct 7, 2024 18:00:26.071425915 CEST	443	49747	188.114.96.3	192.168.2.7
Oct 7, 2024 18:00:26.291620970 CEST	443	49748	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:26.339498997 CEST	49748	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:26.372617006 CEST	443	49749	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:26.417634964 CEST	49749	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:26.501022100 CEST	49748	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:26.501039982 CEST	443	49748	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:26.501794100 CEST	49748	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:26.501799107 CEST	443	49748	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:26.502793074 CEST	49749	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:26.502808094 CEST	443	49749	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:26.503442049 CEST	49749	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:26.503458023 CEST	443	49749	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:26.595276117 CEST	443	49749	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:26.595351934 CEST	443	49749	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:26.595403910 CEST	49749	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:26.596147060 CEST	443	49748	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:26.596322060 CEST	443	49748	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:26.596369982 CEST	49748	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:26.603162050 CEST	443	49751	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:26.603907108 CEST	443	49752	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:26.603921890 CEST	443	49750	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:26.652029991 CEST	49751	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:26.652072906 CEST	49752	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:26.652128935 CEST	49750	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:26.661771059 CEST	49750	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:26.661783934 CEST	443	49750	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:26.662261009 CEST	49750	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:26.662266970 CEST	443	49750	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:26.662439108 CEST	49749	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:26.662461042 CEST	443	49749	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:26.662472010 CEST	49749	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:26.662480116 CEST	443	49749	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:26.664493084 CEST	49748	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:26.664505005 CEST	443	49748	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:26.664514065 CEST	49748	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:26.664518118 CEST	443	49748	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:26.666106939 CEST	49751	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:26.666110992 CEST	443	49751	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:26.666899920 CEST	49751	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:26.666903973 CEST	443	49751	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:26.667217970 CEST	49752	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:26.667231083 CEST	443	49752	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:26.667953014 CEST	49752	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:26.667958975 CEST	443	49752	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:26.674264908 CEST	49754	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:26.674292088 CEST	443	49754	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:26.674343109 CEST	49754	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:26.674666882 CEST	49754	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:26.674675941 CEST	443	49754	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:26.679238081 CEST	49755	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:26.679267883 CEST	443	49755	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:26.679315090 CEST	49755	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:26.679790020 CEST	49755	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:26.679816961 CEST	443	49755	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:26.753623962 CEST	443	49750	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:26.753699064 CEST	443	49750	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:26.753746033 CEST	49750	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:26.759608984 CEST	443	49751	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:26.759675026 CEST	443	49751	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:26.759722948 CEST	49751	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:26.761512995 CEST	443	49752	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:26.761687040 CEST	443	49752	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:26.761745930 CEST	49752	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:26.763484955 CEST	49750	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:26.763506889 CEST	443	49750	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:26.763520002 CEST	49750	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:26.763535976 CEST	443	49750	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:26.764550924 CEST	49751	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:26.764550924 CEST	49751	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:26.764560938 CEST	443	49751	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:26.764570951 CEST	443	49751	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:26.765517950 CEST	49752	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:26.765517950 CEST	49752	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:26.765536070 CEST	443	49752	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:26.765547037 CEST	443	49752	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:26.783920050 CEST	49756	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:26.783957005 CEST	443	49756	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:26.784015894 CEST	49756	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:26.785183907 CEST	49757	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:26.785204887 CEST	443	49757	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:26.785260916 CEST	49757	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:26.788789034 CEST	49758	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:26.788795948 CEST	443	49758	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:26.788852930 CEST	49758	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:26.789043903 CEST	49756	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:26.789086103 CEST	443	49756	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:26.789175034 CEST	49757	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:26.789186954 CEST	443	49757	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:26.792140961 CEST	49758	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:26.792150974 CEST	443	49758	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:27.293915033 CEST	443	49754	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:27.294367075 CEST	49754	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:27.294383049 CEST	443	49754	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:27.294800997 CEST	49754	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:27.294806957 CEST	443	49754	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:27.297802925 CEST	443	49755	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:27.298366070 CEST	49755	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:27.298381090 CEST	443	49755	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:27.298778057 CEST	49755	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:27.298784018 CEST	443	49755	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:27.389652014 CEST	443	49754	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:27.389832020 CEST	443	49754	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:27.389885902 CEST	49754	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:27.389995098 CEST	49754	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:27.390010118 CEST	443	49754	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:27.393621922 CEST	443	49755	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:27.393800974 CEST	443	49755	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:27.393843889 CEST	49755	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:27.396104097 CEST	49755	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:27.396104097 CEST	49755	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:27.396126986 CEST	443	49755	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:27.396140099 CEST	443	49755	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:27.398957968 CEST	49760	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:27.399003029 CEST	443	49760	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:27.399070978 CEST	49760	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:27.401853085 CEST	49760	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:27.401878119 CEST	443	49760	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:27.403367043 CEST	49761	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:27.403397083 CEST	443	49761	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:27.403454065 CEST	49761	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:27.403609991 CEST	49761	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:27.403619051 CEST	443	49761	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:27.441751003 CEST	443	49757	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:27.449690104 CEST	49757	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:27.449713945 CEST	443	49757	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:27.452173948 CEST	49757	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:27.452186108 CEST	443	49757	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:27.478501081 CEST	443	49756	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:27.478946924 CEST	49756	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:27.478979111 CEST	443	49756	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:27.479471922 CEST	49756	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:27.479476929 CEST	443	49756	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:27.483028889 CEST	443	49758	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:27.483500957 CEST	49758	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:27.483535051 CEST	443	49758	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:27.484066010 CEST	49758	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:27.484071970 CEST	443	49758	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:27.549885035 CEST	443	49757	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:27.550000906 CEST	443	49757	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:27.550070047 CEST	49757	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:27.550164938 CEST	49757	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:27.550177097 CEST	443	49757	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:27.550187111 CEST	49757	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:27.550193071 CEST	443	49757	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:27.553280115 CEST	49763	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:27.553306103 CEST	443	49763	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:27.553446054 CEST	49763	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:27.553699970 CEST	49763	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:27.553714037 CEST	443	49763	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:27.580427885 CEST	443	49756	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:27.580513954 CEST	443	49756	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:27.580780983 CEST	49756	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:27.580961943 CEST	49756	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:27.580961943 CEST	49756	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:27.580982924 CEST	443	49756	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:27.581002951 CEST	443	49756	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:27.583352089 CEST	49764	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:27.583391905 CEST	443	49764	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:27.583537102 CEST	49764	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:27.583698034 CEST	49764	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:27.583712101 CEST	443	49764	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:27.586395025 CEST	443	49758	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:27.586456060 CEST	443	49758	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:27.586723089 CEST	49758	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:27.586823940 CEST	49758	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:27.586841106 CEST	443	49758	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:27.586854935 CEST	49758	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:27.586862087 CEST	443	49758	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:27.590559006 CEST	49765	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:27.590585947 CEST	443	49765	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:27.590648890 CEST	49765	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:27.590840101 CEST	49765	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:27.590854883 CEST	443	49765	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:28.027755976 CEST	443	49760	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:28.028223991 CEST	49760	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:28.028244019 CEST	443	49760	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:28.028691053 CEST	49760	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:28.028695107 CEST	443	49760	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:28.063239098 CEST	443	49761	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:28.063808918 CEST	49761	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:28.063824892 CEST	443	49761	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:28.065547943 CEST	49761	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:28.065552950 CEST	443	49761	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:28.128128052 CEST	443	49760	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:28.128192902 CEST	443	49760	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:28.128242970 CEST	49760	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:28.128396988 CEST	49760	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:28.128420115 CEST	443	49760	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:28.128432989 CEST	49760	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:28.128437996 CEST	443	49760	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:28.131217003 CEST	49768	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:28.131237984 CEST	443	49768	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:28.131304026 CEST	49768	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:28.131436110 CEST	49768	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:28.131445885 CEST	443	49768	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:28.171674013 CEST	443	49761	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:28.171838045 CEST	443	49761	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:28.172028065 CEST	49761	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:28.172110081 CEST	49761	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:28.172125101 CEST	443	49761	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:28.172137976 CEST	49761	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:28.172142029 CEST	443	49761	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:28.175205946 CEST	49769	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:28.175249100 CEST	443	49769	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:28.175316095 CEST	49769	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:28.175457954 CEST	49769	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:28.175470114 CEST	443	49769	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:28.191744089 CEST	443	49763	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:28.192207098 CEST	49763	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:28.192233086 CEST	443	49763	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:28.192598104 CEST	49763	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:28.192603111 CEST	443	49763	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:28.209863901 CEST	443	49765	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:28.210321903 CEST	49765	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:28.210336924 CEST	443	49765	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:28.210741043 CEST	49765	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:28.210746050 CEST	443	49765	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:28.221554041 CEST	443	49764	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:28.221919060 CEST	49764	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:28.221934080 CEST	443	49764	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:28.222568989 CEST	49764	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:28.222575903 CEST	443	49764	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:29.321046114 CEST	443	49763	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:29.321113110 CEST	443	49763	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:29.321229935 CEST	49763	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:29.321398020 CEST	443	49765	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:29.321446896 CEST	443	49765	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:29.321530104 CEST	49765	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:29.325459957 CEST	443	49764	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:29.325524092 CEST	443	49764	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:29.325654030 CEST	49764	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:29.333949089 CEST	49763	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:29.333961964 CEST	443	49763	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:29.333988905 CEST	49763	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:29.333993912 CEST	443	49763	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:29.410561085 CEST	49765	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:29.410584927 CEST	443	49765	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:29.410598040 CEST	49765	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:29.410604954 CEST	443	49765	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:29.412878036 CEST	49764	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:29.412878036 CEST	49764	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:29.412899971 CEST	443	49764	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:29.412929058 CEST	443	49764	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:29.414684057 CEST	49770	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:29.414717913 CEST	443	49770	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:29.414794922 CEST	49770	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:29.414908886 CEST	49771	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:29.414932013 CEST	443	49771	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:29.414987087 CEST	49771	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:29.415196896 CEST	49770	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:29.415216923 CEST	443	49770	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:29.415297985 CEST	49771	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:29.415306091 CEST	443	49771	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:29.415846109 CEST	49772	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:29.415859938 CEST	443	49772	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:29.415954113 CEST	49772	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:29.416065931 CEST	49772	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:29.416074038 CEST	443	49772	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:29.507173061 CEST	443	49768	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:29.517326117 CEST	443	49769	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:29.560273886 CEST	49768	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:29.560295105 CEST	49769	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:29.627717018 CEST	49768	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:29.627732038 CEST	443	49768	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:29.628536940 CEST	49768	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:29.628549099 CEST	443	49768	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:29.629216909 CEST	49769	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:29.629224062 CEST	443	49769	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:29.629652023 CEST	49769	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:29.629656076 CEST	443	49769	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:29.719140053 CEST	443	49768	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:29.719536066 CEST	443	49768	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:29.719660997 CEST	49768	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:29.724818945 CEST	443	49769	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:29.724881887 CEST	443	49769	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:29.725142002 CEST	49769	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:29.728760004 CEST	49768	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:29.728760004 CEST	49768	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:29.728775978 CEST	443	49768	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:29.728785992 CEST	443	49768	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:29.729765892 CEST	49769	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:29.729800940 CEST	443	49769	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:29.732980967 CEST	49773	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:29.733012915 CEST	443	49773	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:29.733083963 CEST	49773	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:29.733504057 CEST	49773	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:29.733519077 CEST	443	49773	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:29.735673904 CEST	49774	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:29.735682011 CEST	443	49774	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:29.735923052 CEST	49774	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:29.736102104 CEST	49774	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:29.736120939 CEST	443	49774	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:30.036361933 CEST	443	49771	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:30.037034035 CEST	49771	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:30.037072897 CEST	443	49771	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:30.037549973 CEST	49771	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:30.037555933 CEST	443	49771	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:30.040041924 CEST	443	49770	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:30.040745974 CEST	49770	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:30.040760040 CEST	443	49770	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:30.040901899 CEST	49770	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:30.040904999 CEST	443	49770	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:30.131695032 CEST	443	49772	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:30.132244110 CEST	49772	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:30.132263899 CEST	443	49772	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:30.132874012 CEST	49772	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:30.132879019 CEST	443	49772	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:30.134828091 CEST	443	49771	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:30.134888887 CEST	443	49771	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:30.134936094 CEST	49771	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:30.135135889 CEST	49771	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:30.135135889 CEST	49771	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:30.135143995 CEST	443	49771	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:30.135152102 CEST	443	49771	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:30.137976885 CEST	49775	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:30.137996912 CEST	443	49775	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:30.138071060 CEST	49775	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:30.138215065 CEST	49775	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:30.138221025 CEST	443	49775	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:30.138338089 CEST	443	49770	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:30.138402939 CEST	443	49770	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:30.138444901 CEST	49770	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:30.138493061 CEST	49770	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:30.138504982 CEST	443	49770	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:30.138514042 CEST	49770	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:30.138519049 CEST	443	49770	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:30.140583992 CEST	49776	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:30.140597105 CEST	443	49776	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:30.140666008 CEST	49776	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:30.140784979 CEST	49776	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:30.140795946 CEST	443	49776	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:30.496159077 CEST	443	49772	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:30.496318102 CEST	443	49772	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:30.496368885 CEST	49772	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:30.496496916 CEST	49772	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:30.496509075 CEST	443	49772	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:30.496526957 CEST	49772	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:30.496531963 CEST	443	49772	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:30.499825954 CEST	49777	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:30.499861956 CEST	443	49777	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:30.499943018 CEST	49777	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:30.500232935 CEST	49777	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:30.500245094 CEST	443	49777	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:30.673875093 CEST	443	49774	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:30.674495935 CEST	49774	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:30.674513102 CEST	443	49774	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:30.675061941 CEST	49774	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:30.675065994 CEST	443	49774	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:30.684001923 CEST	443	49773	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:30.684497118 CEST	49773	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:30.684514046 CEST	443	49773	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:30.685302973 CEST	49773	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:30.685316086 CEST	443	49773	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:30.751316071 CEST	443	49775	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:30.751842022 CEST	49775	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:30.751859903 CEST	443	49775	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:30.752310991 CEST	49775	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:30.752319098 CEST	443	49775	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:30.772134066 CEST	443	49774	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:30.772195101 CEST	443	49774	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:30.772330046 CEST	49774	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:30.772727966 CEST	49774	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:30.772743940 CEST	443	49774	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:30.772902966 CEST	49774	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:30.772918940 CEST	443	49774	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:30.775563955 CEST	49778	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:30.775604963 CEST	443	49778	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:30.775681019 CEST	49778	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:30.775898933 CEST	49778	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:30.775918961 CEST	443	49778	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:30.781121016 CEST	443	49773	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:30.781183958 CEST	443	49773	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:30.781239986 CEST	49773	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:30.781347990 CEST	49773	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:30.781347990 CEST	49773	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:30.781358004 CEST	443	49773	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:30.781364918 CEST	443	49773	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:30.783951998 CEST	49779	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:30.783982038 CEST	443	49779	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:30.784041882 CEST	49779	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:30.784185886 CEST	49779	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:30.784200907 CEST	443	49779	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:30.801778078 CEST	443	49776	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:30.802264929 CEST	49776	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:30.802273035 CEST	443	49776	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:30.802860022 CEST	49776	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:30.802864075 CEST	443	49776	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:30.870743990 CEST	49675	443	192.168.2.7	104.98.116.138
Oct 7, 2024 18:00:30.870774984 CEST	49674	443	192.168.2.7	104.98.116.138
Oct 7, 2024 18:00:30.875951052 CEST	443	49775	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:30.876014948 CEST	443	49775	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:30.876082897 CEST	49775	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:30.876310110 CEST	49775	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:30.876348972 CEST	443	49775	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:30.876379013 CEST	49775	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:30.876401901 CEST	443	49775	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:30.878993988 CEST	49780	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:30.879023075 CEST	443	49780	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:30.879095078 CEST	49780	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:30.879291058 CEST	49780	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:30.879304886 CEST	443	49780	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:30.905278921 CEST	443	49776	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:30.905338049 CEST	443	49776	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:30.905379057 CEST	49776	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:30.905633926 CEST	49776	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:30.905637980 CEST	443	49776	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:30.905648947 CEST	49776	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:30.905652046 CEST	443	49776	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:30.908384085 CEST	49781	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:30.908442974 CEST	443	49781	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:30.908516884 CEST	49781	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:30.908670902 CEST	49781	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:30.908703089 CEST	443	49781	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:31.042637110 CEST	49672	443	192.168.2.7	104.98.116.138
Oct 7, 2024 18:00:31.170175076 CEST	443	49777	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:31.170679092 CEST	49777	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:31.170692921 CEST	443	49777	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:31.171091080 CEST	49777	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:31.171097040 CEST	443	49777	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:31.269957066 CEST	443	49777	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:31.270023108 CEST	443	49777	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:31.270168066 CEST	49777	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:31.270271063 CEST	49777	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:31.270271063 CEST	49777	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:31.270292044 CEST	443	49777	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:31.270298958 CEST	443	49777	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:31.272839069 CEST	49782	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:31.272881985 CEST	443	49782	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:31.273067951 CEST	49782	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:31.273220062 CEST	49782	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:31.273236036 CEST	443	49782	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:31.444535971 CEST	443	49778	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:31.445303917 CEST	49778	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:31.445317030 CEST	443	49778	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:31.446253061 CEST	49778	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:31.446259022 CEST	443	49778	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:31.450293064 CEST	443	49779	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:31.450661898 CEST	49779	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:31.450673103 CEST	443	49779	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:31.451188087 CEST	49779	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:31.451195002 CEST	443	49779	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:31.536041975 CEST	443	49780	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:31.536528111 CEST	49780	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:31.536547899 CEST	443	49780	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:31.537204027 CEST	49780	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:31.537209988 CEST	443	49780	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:31.547636032 CEST	443	49779	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:31.547791004 CEST	443	49779	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:31.547877073 CEST	49779	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:31.547916889 CEST	49779	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:31.547931910 CEST	443	49779	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:31.547962904 CEST	49779	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:31.547971010 CEST	443	49779	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:31.550841093 CEST	49783	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:31.550872087 CEST	443	49783	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:31.551039934 CEST	49783	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:31.551227093 CEST	49783	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:31.551239967 CEST	443	49783	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:31.559381008 CEST	443	49781	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:31.559849024 CEST	49781	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:31.559911966 CEST	443	49781	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:31.560350895 CEST	49781	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:31.560365915 CEST	443	49781	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:31.565922976 CEST	443	49778	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:31.565987110 CEST	443	49778	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:31.566282034 CEST	49778	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:31.566282988 CEST	49778	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:31.566282988 CEST	49778	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:31.568866968 CEST	49784	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:31.568903923 CEST	443	49784	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:31.569152117 CEST	49784	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:31.569305897 CEST	49784	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:31.569310904 CEST	443	49784	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:31.635838032 CEST	443	49780	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:31.635909081 CEST	443	49780	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:31.635962963 CEST	49780	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:31.638042927 CEST	49780	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:31.638058901 CEST	443	49780	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:31.638072014 CEST	49780	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:31.638077021 CEST	443	49780	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:31.641419888 CEST	49785	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:31.641462088 CEST	443	49785	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:31.641521931 CEST	49785	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:31.642117023 CEST	49785	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:31.642132044 CEST	443	49785	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:31.654146910 CEST	443	49781	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:31.654329062 CEST	443	49781	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:31.654396057 CEST	49781	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:31.654470921 CEST	49781	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:31.654470921 CEST	49781	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:31.654515982 CEST	443	49781	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:31.654542923 CEST	443	49781	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:31.656832933 CEST	49786	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:31.656869888 CEST	443	49786	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:31.656948090 CEST	49786	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:31.657156944 CEST	49786	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:31.657171011 CEST	443	49786	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:31.792644024 CEST	49778	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:31.792670965 CEST	443	49778	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:31.909394026 CEST	443	49782	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:31.910039902 CEST	49782	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:31.910073042 CEST	443	49782	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:31.910550117 CEST	49782	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:31.910562038 CEST	443	49782	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:32.015404940 CEST	443	49782	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:32.015464067 CEST	443	49782	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:32.015527010 CEST	49782	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:32.015767097 CEST	49782	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:32.015784025 CEST	443	49782	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:32.015808105 CEST	49782	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:32.015815020 CEST	443	49782	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:32.019412041 CEST	49787	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:32.019462109 CEST	443	49787	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:32.019563913 CEST	49787	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:32.019958973 CEST	49787	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:32.019984007 CEST	443	49787	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:32.202398062 CEST	443	49783	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:32.202981949 CEST	49783	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:32.202992916 CEST	443	49783	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:32.203418970 CEST	49783	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:32.203424931 CEST	443	49783	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:32.211477041 CEST	443	49784	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:32.212357998 CEST	49784	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:32.212357998 CEST	49784	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:32.212368965 CEST	443	49784	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:32.212383986 CEST	443	49784	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:32.294524908 CEST	443	49786	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:32.294533968 CEST	443	49785	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:32.295171976 CEST	49786	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:32.295171976 CEST	49785	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:32.295243025 CEST	443	49786	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:32.295284033 CEST	443	49785	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:32.295677900 CEST	49785	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:32.295677900 CEST	49786	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:32.295698881 CEST	443	49785	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:32.295731068 CEST	443	49786	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:32.301317930 CEST	443	49783	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:32.301395893 CEST	443	49783	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:32.301466942 CEST	49783	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:32.301724911 CEST	49783	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:32.301740885 CEST	443	49783	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:32.301754951 CEST	49783	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:32.301765919 CEST	443	49783	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:32.304667950 CEST	49788	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:32.304709911 CEST	443	49788	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:32.304804087 CEST	49788	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:32.305006027 CEST	49788	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:32.305020094 CEST	443	49788	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:32.313925982 CEST	443	49784	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:32.313980103 CEST	443	49784	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:32.314034939 CEST	49784	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:32.314225912 CEST	49784	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:32.314244032 CEST	443	49784	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:32.314383984 CEST	49784	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:32.314392090 CEST	443	49784	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:32.317029953 CEST	49789	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:32.317064047 CEST	443	49789	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:32.317151070 CEST	49789	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:32.317312956 CEST	49789	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:32.317320108 CEST	443	49789	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:32.390608072 CEST	443	49786	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:32.390774965 CEST	443	49786	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:32.390855074 CEST	49786	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:32.391009092 CEST	49786	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:32.391024113 CEST	443	49786	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:32.391035080 CEST	49786	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:32.391040087 CEST	443	49786	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:32.392225027 CEST	443	49785	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:32.392302990 CEST	443	49785	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:32.392357111 CEST	49785	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:32.392534018 CEST	49785	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:32.392539978 CEST	443	49785	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:32.392549038 CEST	49785	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:32.392553091 CEST	443	49785	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:32.394989014 CEST	49790	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:32.395013094 CEST	443	49790	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:32.395081997 CEST	49790	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:32.395433903 CEST	49790	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:32.395446062 CEST	443	49790	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:32.396028042 CEST	49791	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:32.396069050 CEST	443	49791	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:32.396147013 CEST	49791	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:32.396248102 CEST	49791	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:32.396271944 CEST	443	49791	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:32.644334078 CEST	443	49787	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:32.645222902 CEST	49787	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:32.645252943 CEST	443	49787	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:32.645811081 CEST	49787	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:32.645828962 CEST	443	49787	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:32.750348091 CEST	443	49787	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:32.750519037 CEST	443	49787	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:32.750612974 CEST	49787	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:32.756848097 CEST	49787	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:32.756889105 CEST	443	49787	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:32.756903887 CEST	49787	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:32.756911993 CEST	443	49787	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:32.760443926 CEST	49792	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:32.760478020 CEST	443	49792	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:32.760549068 CEST	49792	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:32.760725021 CEST	49792	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:32.760737896 CEST	443	49792	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:32.930053949 CEST	443	49788	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:32.930741072 CEST	49788	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:32.930753946 CEST	443	49788	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:32.931211948 CEST	49788	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:32.931216955 CEST	443	49788	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:32.975619078 CEST	443	49789	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:32.976439953 CEST	49789	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:32.976454973 CEST	443	49789	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:32.976908922 CEST	49789	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:32.976913929 CEST	443	49789	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:33.033514023 CEST	443	49791	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:33.033998013 CEST	49791	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:33.033998013 CEST	443	49790	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:33.034030914 CEST	443	49791	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:33.034538031 CEST	49791	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:33.034543037 CEST	443	49791	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:33.034828901 CEST	49790	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:33.034837961 CEST	443	49790	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:33.035218954 CEST	49790	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:33.035223961 CEST	443	49790	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:33.047414064 CEST	443	49788	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:33.047446012 CEST	443	49788	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:33.047527075 CEST	49788	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:33.047538042 CEST	443	49788	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:33.047961950 CEST	49788	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:33.047961950 CEST	49788	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:33.047976971 CEST	443	49788	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:33.048158884 CEST	443	49788	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:33.048192024 CEST	443	49788	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:33.048232079 CEST	49788	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:33.050306082 CEST	49794	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:33.050335884 CEST	443	49794	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:33.050405979 CEST	49794	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:33.050544977 CEST	49794	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:33.050559044 CEST	443	49794	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:33.080271959 CEST	443	49789	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:33.080342054 CEST	443	49789	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:33.080401897 CEST	49789	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:33.080570936 CEST	49789	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:33.080580950 CEST	443	49789	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:33.080590963 CEST	49789	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:33.080595016 CEST	443	49789	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:33.083158970 CEST	49795	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:33.083218098 CEST	443	49795	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:33.083287954 CEST	49795	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:33.083476067 CEST	49795	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:33.083502054 CEST	443	49795	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:33.135971069 CEST	443	49791	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:33.135998011 CEST	443	49791	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:33.136140108 CEST	49791	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:33.136141062 CEST	443	49791	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:33.136188030 CEST	49791	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:33.136506081 CEST	49791	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:33.136527061 CEST	443	49791	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:33.136539936 CEST	49791	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:33.136547089 CEST	443	49791	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:33.139262915 CEST	49796	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:33.139295101 CEST	443	49796	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:33.139383078 CEST	49796	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:33.139594078 CEST	49796	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:33.139605999 CEST	443	49796	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:33.203917027 CEST	443	49790	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:33.204082966 CEST	443	49790	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:33.204138041 CEST	49790	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:33.204279900 CEST	49790	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:33.204287052 CEST	443	49790	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:33.204296112 CEST	49790	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:33.204299927 CEST	443	49790	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:33.207158089 CEST	49797	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:33.207170963 CEST	443	49797	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:33.207231998 CEST	49797	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:33.207366943 CEST	49797	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:33.207380056 CEST	443	49797	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:33.421520948 CEST	443	49792	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:33.421977043 CEST	49792	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:33.421998024 CEST	443	49792	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:33.422451973 CEST	49792	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:33.422457933 CEST	443	49792	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:33.529923916 CEST	443	49704	104.98.116.138	192.168.2.7
Oct 7, 2024 18:00:33.530019045 CEST	49704	443	192.168.2.7	104.98.116.138
Oct 7, 2024 18:00:33.542890072 CEST	443	49792	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:33.542918921 CEST	443	49792	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:33.542969942 CEST	49792	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:33.542973995 CEST	443	49792	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:33.543016911 CEST	49792	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:33.543167114 CEST	49792	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:33.543191910 CEST	443	49792	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:33.543205023 CEST	49792	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:33.543216944 CEST	443	49792	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:33.546017885 CEST	49798	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:33.546047926 CEST	443	49798	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:33.546113014 CEST	49798	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:33.546257019 CEST	49798	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:33.546272039 CEST	443	49798	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:33.666800976 CEST	443	49794	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:33.670094967 CEST	49794	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:33.670104027 CEST	443	49794	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:33.670635939 CEST	49794	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:33.670639992 CEST	443	49794	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:33.731331110 CEST	443	49795	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:33.731903076 CEST	49795	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:33.731933117 CEST	443	49795	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:33.732419968 CEST	49795	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:33.732425928 CEST	443	49795	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:33.748074055 CEST	443	49796	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:33.748517990 CEST	49796	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:33.748536110 CEST	443	49796	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:33.749170065 CEST	49796	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:33.749176025 CEST	443	49796	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:33.763895988 CEST	443	49794	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:33.763941050 CEST	443	49794	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:33.764014006 CEST	443	49794	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:33.764013052 CEST	49794	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:33.764061928 CEST	49794	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:33.764210939 CEST	49794	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:33.764223099 CEST	443	49794	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:33.764233112 CEST	49794	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:33.764238119 CEST	443	49794	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:33.766792059 CEST	49799	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:33.766833067 CEST	443	49799	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:33.767404079 CEST	49799	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:33.767404079 CEST	49799	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:33.767437935 CEST	443	49799	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:33.830938101 CEST	443	49795	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:33.831070900 CEST	443	49797	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:33.831104994 CEST	443	49795	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:33.831171989 CEST	49795	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:33.831316948 CEST	49795	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:33.831338882 CEST	443	49795	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:33.831351995 CEST	49795	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:33.831358910 CEST	443	49795	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:33.831510067 CEST	49797	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:33.831526995 CEST	443	49797	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:33.831964016 CEST	49797	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:33.831970930 CEST	443	49797	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:33.833904982 CEST	49800	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:33.833926916 CEST	443	49800	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:33.834006071 CEST	49800	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:33.834151030 CEST	49800	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:33.834163904 CEST	443	49800	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:33.927783012 CEST	443	49797	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:33.927875996 CEST	443	49797	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:33.927927017 CEST	49797	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:33.928107977 CEST	49797	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:33.928117990 CEST	443	49797	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:33.928154945 CEST	49797	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:33.928158998 CEST	443	49797	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:33.930645943 CEST	49801	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:33.930677891 CEST	443	49801	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:33.930741072 CEST	49801	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:33.930891037 CEST	49801	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:33.930897951 CEST	443	49801	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:34.008548975 CEST	443	49796	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:34.008636951 CEST	443	49796	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:34.008733034 CEST	49796	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:34.008915901 CEST	49796	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:34.008938074 CEST	443	49796	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:34.009000063 CEST	49796	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:34.009006977 CEST	443	49796	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:34.012592077 CEST	49802	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:34.012633085 CEST	443	49802	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:34.012695074 CEST	49802	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:34.012877941 CEST	49802	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:34.012897968 CEST	443	49802	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:34.153865099 CEST	443	49798	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:34.154500961 CEST	49798	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:34.154511929 CEST	443	49798	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:34.155000925 CEST	49798	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:34.155005932 CEST	443	49798	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:34.249623060 CEST	443	49798	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:34.249794960 CEST	443	49798	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:34.249865055 CEST	49798	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:34.250009060 CEST	49798	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:34.250016928 CEST	443	49798	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:34.250031948 CEST	49798	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:34.250036955 CEST	443	49798	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:34.253390074 CEST	49803	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:34.253436089 CEST	443	49803	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:34.253554106 CEST	49803	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:34.253745079 CEST	49803	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:34.253763914 CEST	443	49803	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:34.382719994 CEST	443	49799	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:34.383266926 CEST	49799	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:34.383279085 CEST	443	49799	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:34.383641005 CEST	49799	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:34.383645058 CEST	443	49799	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:34.468668938 CEST	443	49800	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:34.469319105 CEST	49800	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:34.469331026 CEST	443	49800	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:34.470083952 CEST	49800	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:34.470088959 CEST	443	49800	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:34.478542089 CEST	443	49799	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:34.478795052 CEST	443	49799	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:34.478864908 CEST	49799	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:34.479018927 CEST	49799	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:34.479018927 CEST	49799	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:34.479038954 CEST	443	49799	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:34.479048014 CEST	443	49799	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:34.482821941 CEST	49805	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:34.482877016 CEST	443	49805	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:34.482989073 CEST	49805	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:34.483505011 CEST	49805	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:34.483519077 CEST	443	49805	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:34.565536022 CEST	443	49800	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:34.565784931 CEST	443	49800	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:34.565840960 CEST	49800	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:34.565881968 CEST	49800	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:34.565888882 CEST	443	49800	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:34.569113016 CEST	49806	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:34.569143057 CEST	443	49806	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:34.569225073 CEST	49806	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:34.569468021 CEST	49806	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:34.569482088 CEST	443	49806	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:34.582721949 CEST	443	49801	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:34.583353043 CEST	49801	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:34.583381891 CEST	443	49801	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:34.583923101 CEST	49801	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:34.583935022 CEST	443	49801	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:34.649642944 CEST	443	49802	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:34.650165081 CEST	49802	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:34.650188923 CEST	443	49802	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:34.650782108 CEST	49802	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:34.650798082 CEST	443	49802	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:34.687268972 CEST	443	49801	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:34.687462091 CEST	443	49801	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:34.687541962 CEST	49801	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:34.687953949 CEST	49801	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:34.687953949 CEST	49801	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:34.687974930 CEST	443	49801	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:34.687978029 CEST	443	49801	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:34.693118095 CEST	49807	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:34.693146944 CEST	443	49807	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:34.693279028 CEST	49807	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:34.693387032 CEST	49807	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:34.693396091 CEST	443	49807	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:34.755688906 CEST	443	49802	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:34.756911993 CEST	443	49802	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:34.757011890 CEST	49802	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:34.757011890 CEST	49802	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:34.757036924 CEST	49802	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:34.757050037 CEST	443	49802	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:34.759840965 CEST	49808	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:34.759867907 CEST	443	49808	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:34.759938002 CEST	49808	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:34.760107040 CEST	49808	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:34.760122061 CEST	443	49808	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:34.867538929 CEST	443	49803	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:34.868134022 CEST	49803	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:34.868164062 CEST	443	49803	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:34.868623018 CEST	49803	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:34.868633986 CEST	443	49803	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:34.963798046 CEST	443	49803	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:34.963973999 CEST	443	49803	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:34.964046955 CEST	49803	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:34.964204073 CEST	49803	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:34.964221001 CEST	443	49803	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:34.964234114 CEST	49803	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:34.964241028 CEST	443	49803	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:34.967376947 CEST	49809	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:34.967417955 CEST	443	49809	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:34.967523098 CEST	49809	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:34.967744112 CEST	49809	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:34.967758894 CEST	443	49809	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:35.114303112 CEST	443	49805	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:35.115046978 CEST	49805	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:35.115061998 CEST	443	49805	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:35.115550995 CEST	49805	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:35.115559101 CEST	443	49805	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:35.207437992 CEST	443	49806	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:35.208483934 CEST	49806	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:35.208483934 CEST	49806	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:35.208498001 CEST	443	49806	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:35.208513021 CEST	443	49806	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:35.211285114 CEST	443	49805	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:35.211484909 CEST	443	49805	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:35.211564064 CEST	49805	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:35.211586952 CEST	49805	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:35.211592913 CEST	443	49805	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:35.211604118 CEST	49805	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:35.211608887 CEST	443	49805	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:35.214265108 CEST	49810	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:35.214299917 CEST	443	49810	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:35.214397907 CEST	49810	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:35.214890957 CEST	49810	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:35.214901924 CEST	443	49810	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:35.337033987 CEST	443	49806	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:35.337285042 CEST	443	49806	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:35.337333918 CEST	443	49806	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:35.337333918 CEST	49806	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:35.337385893 CEST	49806	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:35.337441921 CEST	49806	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:35.337464094 CEST	443	49806	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:35.337476015 CEST	49806	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:35.337482929 CEST	443	49806	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:35.340171099 CEST	49811	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:35.340190887 CEST	443	49811	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:35.340332985 CEST	49811	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:35.340398073 CEST	49811	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:35.340404034 CEST	443	49811	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:35.375531912 CEST	443	49808	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:35.376177073 CEST	49808	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:35.376194000 CEST	443	49808	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:35.376733065 CEST	49808	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:35.376737118 CEST	443	49808	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:35.472246885 CEST	443	49808	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:35.472278118 CEST	443	49808	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:35.472321987 CEST	443	49808	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:35.472347975 CEST	49808	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:35.472368956 CEST	49808	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:35.472630024 CEST	49808	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:35.472636938 CEST	443	49808	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:35.472651958 CEST	49808	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:35.472656012 CEST	443	49808	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:35.476124048 CEST	49812	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:35.476151943 CEST	443	49812	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:35.476207972 CEST	49812	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:35.476375103 CEST	49812	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:35.476392031 CEST	443	49812	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:35.617043972 CEST	443	49809	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:35.617548943 CEST	49809	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:35.617558956 CEST	443	49809	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:35.618237019 CEST	49809	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:35.618242979 CEST	443	49809	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:35.717313051 CEST	443	49809	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:35.717535973 CEST	443	49809	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:35.717597961 CEST	49809	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:35.717782021 CEST	49809	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:35.717811108 CEST	443	49809	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:35.717822075 CEST	49809	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:35.717828989 CEST	443	49809	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:35.726747036 CEST	49814	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:35.726798058 CEST	443	49814	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:35.726871967 CEST	49814	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:35.727116108 CEST	49814	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:35.727129936 CEST	443	49814	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:35.839535952 CEST	49677	443	192.168.2.7	20.50.201.200
Oct 7, 2024 18:00:36.854541063 CEST	443	49810	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:36.855273008 CEST	49810	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:36.855283022 CEST	443	49810	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:36.855725050 CEST	49810	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:36.855730057 CEST	443	49810	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:36.860655069 CEST	443	49811	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:36.861172915 CEST	49811	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:36.861203909 CEST	443	49811	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:36.861705065 CEST	49811	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:36.861711025 CEST	443	49811	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:36.957437038 CEST	443	49810	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:36.957520008 CEST	443	49810	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:36.957571030 CEST	49810	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:36.957726955 CEST	49810	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:36.957726955 CEST	49810	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:36.957746983 CEST	443	49810	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:36.957756996 CEST	443	49810	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:36.960225105 CEST	49815	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:36.960253000 CEST	443	49815	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:36.960335970 CEST	49815	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:36.960483074 CEST	49815	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:36.960495949 CEST	443	49815	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:36.966233969 CEST	443	49811	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:36.967566013 CEST	443	49811	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:36.967622042 CEST	49811	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:36.967650890 CEST	49811	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:36.967664957 CEST	443	49811	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:36.967688084 CEST	49811	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:36.967691898 CEST	443	49811	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:36.970149994 CEST	49816	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:36.970190048 CEST	443	49816	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:36.970398903 CEST	49816	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:36.970398903 CEST	49816	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:36.970438004 CEST	443	49816	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:37.028517008 CEST	443	49807	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:37.029046059 CEST	49807	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:37.029086113 CEST	443	49807	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:37.029531002 CEST	49807	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:37.029542923 CEST	443	49807	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:37.037350893 CEST	443	49812	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:37.037727118 CEST	49812	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:37.037748098 CEST	443	49812	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:37.038114071 CEST	49812	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:37.038120031 CEST	443	49812	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:37.041141033 CEST	443	49814	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:37.041495085 CEST	49814	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:37.041555882 CEST	443	49814	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:37.041902065 CEST	49814	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:37.041915894 CEST	443	49814	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:37.123694897 CEST	443	49807	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:37.123758078 CEST	443	49807	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:37.123858929 CEST	49807	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:37.124083042 CEST	49807	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:37.124093056 CEST	443	49807	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:37.124104977 CEST	49807	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:37.124109983 CEST	443	49807	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:37.127111912 CEST	49817	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:37.127127886 CEST	443	49817	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:37.127213955 CEST	49817	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:37.127413988 CEST	49817	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:37.127429008 CEST	443	49817	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:37.133877993 CEST	443	49812	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:37.133954048 CEST	443	49812	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:37.134005070 CEST	49812	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:37.134016037 CEST	443	49812	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:37.134068012 CEST	443	49812	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:37.134124041 CEST	49812	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:37.134205103 CEST	49812	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:37.134215117 CEST	443	49812	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:37.134224892 CEST	49812	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:37.134231091 CEST	443	49812	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:37.135637999 CEST	443	49814	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:37.136189938 CEST	443	49814	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:37.136254072 CEST	49814	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:37.136291027 CEST	49814	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:37.136307001 CEST	443	49814	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:37.136785030 CEST	49818	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:37.136791945 CEST	443	49818	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:37.136842012 CEST	49818	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:37.136965036 CEST	49818	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:37.136976004 CEST	443	49818	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:37.138451099 CEST	49819	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:37.138480902 CEST	443	49819	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:37.138689041 CEST	49819	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:37.138689041 CEST	49819	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:37.138717890 CEST	443	49819	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:37.598186016 CEST	443	49815	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:37.598757029 CEST	49815	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:37.598767996 CEST	443	49815	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:37.599421978 CEST	49815	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:37.599428892 CEST	443	49815	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:37.602401972 CEST	443	49816	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:37.602845907 CEST	49816	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:37.602869987 CEST	443	49816	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:37.603457928 CEST	49816	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:37.603463888 CEST	443	49816	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:37.692281008 CEST	443	49815	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:37.692442894 CEST	443	49815	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:37.692506075 CEST	49815	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:37.692600965 CEST	49815	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:37.692610025 CEST	443	49815	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:37.692620993 CEST	49815	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:37.692625999 CEST	443	49815	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:37.697437048 CEST	49821	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:37.697462082 CEST	443	49821	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:37.697722912 CEST	49821	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:37.697722912 CEST	49821	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:37.697742939 CEST	443	49821	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:37.699549913 CEST	443	49816	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:37.699625015 CEST	443	49816	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:37.699670076 CEST	49816	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:37.699826002 CEST	49816	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:37.699826002 CEST	49816	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:37.699836969 CEST	443	49816	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:37.699845076 CEST	443	49816	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:37.702197075 CEST	49822	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:37.702208996 CEST	443	49822	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:37.702384949 CEST	49822	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:37.702384949 CEST	49822	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:37.702402115 CEST	443	49822	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:37.734529972 CEST	443	49817	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:37.735050917 CEST	49817	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:37.735074997 CEST	443	49817	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:37.735563040 CEST	49817	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:37.735570908 CEST	443	49817	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:37.743752003 CEST	443	49818	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:37.744278908 CEST	49818	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:37.744303942 CEST	443	49818	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:37.744795084 CEST	49818	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:37.744805098 CEST	443	49818	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:37.757801056 CEST	443	49819	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:37.758485079 CEST	49819	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:37.758501053 CEST	443	49819	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:37.758851051 CEST	49819	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:37.758860111 CEST	443	49819	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:37.835930109 CEST	443	49817	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:37.835959911 CEST	443	49817	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:37.836005926 CEST	443	49817	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:37.836077929 CEST	49817	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:37.836129904 CEST	49817	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:37.836455107 CEST	49817	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:37.836467028 CEST	443	49817	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:37.836478949 CEST	49817	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:37.836483002 CEST	443	49817	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:37.839533091 CEST	49823	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:37.839596033 CEST	443	49823	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:37.839777946 CEST	49823	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:37.839891911 CEST	49823	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:37.839904070 CEST	443	49823	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:37.846261978 CEST	443	49818	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:37.846352100 CEST	443	49818	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:37.846427917 CEST	49818	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:37.846566916 CEST	49818	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:37.846575975 CEST	443	49818	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:37.846601009 CEST	49818	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:37.846606016 CEST	443	49818	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:37.849178076 CEST	49824	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:37.849206924 CEST	443	49824	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:37.849277973 CEST	49824	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:37.849441051 CEST	49824	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:37.849455118 CEST	443	49824	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:37.857070923 CEST	443	49819	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:37.857098103 CEST	443	49819	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:37.857141972 CEST	443	49819	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:37.857302904 CEST	49819	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:37.857302904 CEST	49819	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:37.857464075 CEST	49819	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:37.857464075 CEST	49819	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:37.857472897 CEST	443	49819	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:37.857481003 CEST	443	49819	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:37.860163927 CEST	49825	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:37.860181093 CEST	443	49825	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:37.860306978 CEST	49825	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:37.860479116 CEST	49825	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:37.860491037 CEST	443	49825	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:39.305001020 CEST	443	49824	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:39.305880070 CEST	49824	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:39.305915117 CEST	443	49824	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:39.306051016 CEST	49824	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:39.306058884 CEST	443	49824	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:39.306925058 CEST	443	49822	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:39.307298899 CEST	49822	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:39.307312965 CEST	443	49822	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:39.307746887 CEST	49822	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:39.307751894 CEST	443	49822	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:39.308005095 CEST	443	49825	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:39.308259964 CEST	443	49821	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:39.308408976 CEST	49825	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:39.308414936 CEST	443	49825	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:39.308820009 CEST	49821	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:39.308820009 CEST	49825	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:39.308830976 CEST	443	49821	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:39.308854103 CEST	443	49825	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:39.309006929 CEST	49821	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:39.309011936 CEST	443	49821	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:39.316488028 CEST	443	49823	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:39.319417000 CEST	49823	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:39.319417000 CEST	49823	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:39.319453955 CEST	443	49823	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:39.319464922 CEST	443	49823	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:39.399323940 CEST	443	49824	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:39.399357080 CEST	443	49824	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:39.399411917 CEST	49824	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:39.399439096 CEST	443	49824	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:39.399458885 CEST	443	49824	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:39.399581909 CEST	49824	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:39.400767088 CEST	49824	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:39.400767088 CEST	49824	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:39.400799990 CEST	443	49824	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:39.400811911 CEST	443	49824	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:39.402462959 CEST	443	49822	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:39.402513027 CEST	443	49822	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:39.402569056 CEST	49822	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:39.402767897 CEST	443	49821	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:39.402906895 CEST	49822	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:39.402914047 CEST	443	49822	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:39.402932882 CEST	49822	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:39.402935982 CEST	443	49822	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:39.403340101 CEST	443	49821	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:39.403400898 CEST	49821	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:39.403613091 CEST	443	49825	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:39.403675079 CEST	443	49825	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:39.403728962 CEST	49825	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:39.403923988 CEST	49826	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:39.403942108 CEST	443	49826	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:39.403997898 CEST	49826	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:39.404705048 CEST	49821	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:39.404705048 CEST	49821	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:39.404710054 CEST	443	49821	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:39.404716969 CEST	443	49821	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:39.404815912 CEST	49825	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:39.404815912 CEST	49825	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:39.404820919 CEST	443	49825	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:39.404827118 CEST	443	49825	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:39.406521082 CEST	49826	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:39.406533003 CEST	443	49826	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:39.407846928 CEST	49827	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:39.407882929 CEST	443	49827	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:39.407958031 CEST	49827	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:39.408832073 CEST	49828	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:39.408864021 CEST	443	49828	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:39.408957958 CEST	49828	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:39.409006119 CEST	49827	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:39.409023046 CEST	443	49827	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:39.409030914 CEST	49829	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:39.409065008 CEST	443	49829	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:39.409116983 CEST	49829	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:39.409137011 CEST	49828	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:39.409148932 CEST	443	49828	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:39.409187078 CEST	49829	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:39.409202099 CEST	443	49829	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:39.417068005 CEST	443	49823	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:39.417521000 CEST	443	49823	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:39.417587042 CEST	49823	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:39.418010950 CEST	49823	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:39.418010950 CEST	49823	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:39.418045044 CEST	443	49823	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:39.418057919 CEST	443	49823	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:39.421087980 CEST	49830	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:39.421096087 CEST	443	49830	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:39.421155930 CEST	49830	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:39.421274900 CEST	49830	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:39.421288013 CEST	443	49830	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:40.026777983 CEST	443	49829	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:40.028186083 CEST	443	49827	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:40.029592991 CEST	49829	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:40.029606104 CEST	443	49829	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:40.030188084 CEST	49829	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:40.030190945 CEST	443	49829	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:40.030884027 CEST	49827	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:40.030890942 CEST	443	49827	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:40.031354904 CEST	49827	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:40.031362057 CEST	443	49827	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:40.034646988 CEST	443	49828	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:40.035301924 CEST	443	49830	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:40.035537004 CEST	49828	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:40.035545111 CEST	443	49828	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:40.036195040 CEST	49828	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:40.036206961 CEST	443	49828	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:40.036777973 CEST	49830	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:40.036792994 CEST	443	49830	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:40.037332058 CEST	49830	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:40.037337065 CEST	443	49830	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:40.053400040 CEST	443	49826	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:40.053862095 CEST	49826	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:40.053881884 CEST	443	49826	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:40.055011034 CEST	49826	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:40.055016041 CEST	443	49826	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:40.124082088 CEST	443	49827	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:40.124157906 CEST	443	49827	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:40.124337912 CEST	49827	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:40.124919891 CEST	49827	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:40.124919891 CEST	49827	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:40.124948025 CEST	443	49827	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:40.124968052 CEST	443	49827	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:40.129254103 CEST	49834	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:40.129251957 CEST	443	49830	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:40.129312992 CEST	443	49834	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:40.129379988 CEST	49834	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:40.129807949 CEST	49834	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:40.129827023 CEST	443	49834	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:40.130000114 CEST	443	49830	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:40.130057096 CEST	49830	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:40.130382061 CEST	49830	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:40.130394936 CEST	443	49830	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:40.130407095 CEST	49830	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:40.130412102 CEST	443	49830	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:40.134430885 CEST	49835	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:40.134459972 CEST	443	49835	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:40.134524107 CEST	49835	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:40.134818077 CEST	49835	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:40.134833097 CEST	443	49835	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:40.144771099 CEST	443	49829	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:40.144862890 CEST	443	49829	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:40.144915104 CEST	49829	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:40.144923925 CEST	443	49829	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:40.144973040 CEST	443	49829	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:40.145024061 CEST	49829	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:40.145085096 CEST	49829	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:40.145095110 CEST	443	49829	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:40.145107031 CEST	49829	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:40.145112038 CEST	443	49829	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:40.147903919 CEST	49836	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:40.147927046 CEST	443	49836	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:40.147988081 CEST	49836	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:40.148149967 CEST	49836	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:40.148160934 CEST	443	49836	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:40.152163029 CEST	443	49826	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:40.152699947 CEST	443	49826	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:40.152760029 CEST	49826	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:40.152880907 CEST	49826	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:40.152887106 CEST	443	49826	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:40.152956009 CEST	49826	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:40.152961016 CEST	443	49826	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:40.155611992 CEST	49837	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:40.155641079 CEST	443	49837	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:40.155704021 CEST	49837	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:40.155862093 CEST	49837	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:40.155874968 CEST	443	49837	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:40.160571098 CEST	443	49828	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:40.160626888 CEST	443	49828	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:40.160671949 CEST	49828	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:40.160876036 CEST	49828	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:40.160876036 CEST	49828	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:40.160888910 CEST	443	49828	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:40.160902023 CEST	443	49828	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:40.163484097 CEST	49838	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:40.163496017 CEST	443	49838	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:40.163552999 CEST	49838	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:40.163676977 CEST	49838	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:40.163686991 CEST	443	49838	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:40.887819052 CEST	443	49834	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:40.888319016 CEST	49834	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:40.888329983 CEST	443	49834	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:40.888813019 CEST	49834	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:40.888818979 CEST	443	49834	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:40.896976948 CEST	443	49835	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:40.897423029 CEST	49835	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:40.897437096 CEST	443	49835	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:40.897897959 CEST	49835	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:40.897902012 CEST	443	49835	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:40.903652906 CEST	443	49836	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:40.904090881 CEST	49836	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:40.904107094 CEST	443	49836	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:40.904604912 CEST	49836	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:40.904608965 CEST	443	49836	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:40.904833078 CEST	443	49837	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:40.905209064 CEST	49837	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:40.905227900 CEST	443	49837	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:40.905724049 CEST	49837	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:40.905729055 CEST	443	49837	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:40.909569979 CEST	443	49838	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:40.909940958 CEST	49838	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:40.909953117 CEST	443	49838	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:40.910367966 CEST	49838	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:40.910371065 CEST	443	49838	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:40.984699965 CEST	443	49834	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:40.985548973 CEST	443	49834	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:40.985625982 CEST	49834	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:40.985651016 CEST	49834	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:40.985672951 CEST	443	49834	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:40.985682011 CEST	49834	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:40.985687971 CEST	443	49834	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:40.988404989 CEST	49839	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:40.988426924 CEST	443	49839	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:40.988500118 CEST	49839	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:40.988672018 CEST	49839	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:40.988682985 CEST	443	49839	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:40.995753050 CEST	443	49835	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:40.996028900 CEST	443	49835	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:40.996083021 CEST	443	49835	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:40.996104002 CEST	49835	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:40.996140957 CEST	49835	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:40.998229027 CEST	49835	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:40.998245955 CEST	443	49835	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:40.998256922 CEST	49835	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:40.998262882 CEST	443	49835	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:40.999505043 CEST	443	49836	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:40.999742985 CEST	443	49836	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:40.999912977 CEST	49836	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:41.000102997 CEST	49836	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:41.000109911 CEST	443	49836	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:41.000122070 CEST	49836	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:41.000125885 CEST	443	49836	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:41.002253056 CEST	443	49837	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:41.002327919 CEST	443	49837	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:41.002438068 CEST	49837	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:41.002542019 CEST	49837	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:41.002547979 CEST	443	49837	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:41.002557993 CEST	49837	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:41.002563000 CEST	443	49837	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:41.004748106 CEST	49840	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:41.004756927 CEST	443	49840	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:41.004946947 CEST	49840	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:41.005090952 CEST	49840	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:41.005105972 CEST	443	49840	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:41.005528927 CEST	49841	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:41.005563021 CEST	443	49841	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:41.005688906 CEST	49841	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:41.006309986 CEST	443	49838	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:41.006469965 CEST	443	49838	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:41.007481098 CEST	49838	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:41.007567883 CEST	49838	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:41.007575989 CEST	443	49838	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:41.007585049 CEST	49838	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:41.007589102 CEST	443	49838	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:41.009454012 CEST	49843	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:41.009462118 CEST	443	49843	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:41.009640932 CEST	49843	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:41.009779930 CEST	49843	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:41.009792089 CEST	443	49843	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:41.009830952 CEST	49842	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:41.009876013 CEST	443	49842	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:41.009938955 CEST	49842	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:41.010097027 CEST	49841	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:41.010111094 CEST	443	49841	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:41.010330915 CEST	49842	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:41.010344982 CEST	443	49842	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:41.639825106 CEST	443	49842	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:41.640729904 CEST	49842	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:41.640755892 CEST	443	49842	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:41.641000986 CEST	49842	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:41.641005039 CEST	443	49842	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:41.653909922 CEST	443	49843	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:41.654375076 CEST	49843	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:41.654433012 CEST	443	49843	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:41.654881954 CEST	49843	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:41.654886961 CEST	443	49843	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:41.655555964 CEST	443	49840	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:41.655960083 CEST	49840	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:41.655967951 CEST	443	49840	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:41.656366110 CEST	49840	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:41.656371117 CEST	443	49840	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:41.656898975 CEST	443	49841	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:41.657485962 CEST	49841	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:41.657502890 CEST	443	49841	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:41.657588959 CEST	49841	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:41.657599926 CEST	443	49841	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:41.660195112 CEST	443	49839	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:41.660484076 CEST	49839	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:41.660495996 CEST	443	49839	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:41.660830975 CEST	49839	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:41.660840034 CEST	443	49839	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:41.752706051 CEST	443	49843	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:41.752978086 CEST	443	49843	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:41.753031015 CEST	443	49843	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:41.753084898 CEST	49843	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:41.753123045 CEST	49843	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:41.753135920 CEST	443	49843	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:41.753148079 CEST	49843	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:41.753153086 CEST	443	49843	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:41.754300117 CEST	443	49840	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:41.755032063 CEST	443	49840	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:41.755067110 CEST	443	49840	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:41.755125999 CEST	49840	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:41.755402088 CEST	49840	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:41.755409956 CEST	443	49840	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:41.755423069 CEST	49840	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:41.755428076 CEST	443	49840	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:41.756067038 CEST	443	49841	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:41.756222963 CEST	49846	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:41.756268978 CEST	443	49846	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:41.756445885 CEST	443	49841	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:41.756491899 CEST	49841	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:41.756498098 CEST	49846	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:41.756603956 CEST	49841	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:41.756603956 CEST	49841	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:41.756613016 CEST	443	49841	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:41.756622076 CEST	443	49841	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:41.756776094 CEST	49846	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:41.756802082 CEST	443	49846	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:41.757867098 CEST	443	49839	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:41.758044004 CEST	443	49839	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:41.758105993 CEST	49839	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:41.758119106 CEST	443	49839	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:41.758151054 CEST	443	49839	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:41.758198023 CEST	49839	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:41.758354902 CEST	49847	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:41.758382082 CEST	443	49847	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:41.758418083 CEST	49839	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:41.758424997 CEST	443	49839	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:41.758598089 CEST	49847	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:41.758625984 CEST	49847	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:41.758631945 CEST	443	49847	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:41.758841991 CEST	49848	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:41.758862019 CEST	443	49848	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:41.759052038 CEST	49848	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:41.759392977 CEST	49848	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:41.759403944 CEST	443	49848	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:41.760571003 CEST	49849	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:41.760586023 CEST	443	49849	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:41.760646105 CEST	49849	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:41.760759115 CEST	49849	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:41.760771036 CEST	443	49849	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:41.807277918 CEST	443	49842	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:41.808111906 CEST	443	49842	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:41.808221102 CEST	49842	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:41.812283039 CEST	49842	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:41.812283039 CEST	49842	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:41.812305927 CEST	443	49842	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:41.812315941 CEST	443	49842	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:41.816241026 CEST	49850	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:41.816261053 CEST	443	49850	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:41.816343069 CEST	49850	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:41.820759058 CEST	49850	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:41.820770025 CEST	443	49850	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:42.394387007 CEST	443	49847	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:42.398096085 CEST	49847	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:42.398118019 CEST	443	49847	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:42.398689985 CEST	49847	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:42.398700953 CEST	443	49847	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:42.402626991 CEST	443	49846	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:42.403414011 CEST	49846	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:42.403433084 CEST	443	49846	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:42.403453112 CEST	49846	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:42.403458118 CEST	443	49846	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:42.415415049 CEST	443	49848	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:42.415817976 CEST	49848	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:42.415838003 CEST	443	49848	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:42.416208982 CEST	49848	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:42.416213989 CEST	443	49848	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:42.441190958 CEST	443	49849	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:42.441643953 CEST	49849	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:42.441662073 CEST	443	49849	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:42.442104101 CEST	49849	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:42.442109108 CEST	443	49849	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:42.456675053 CEST	443	49850	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:42.457196951 CEST	49850	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:42.457214117 CEST	443	49850	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:42.457658052 CEST	49850	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:42.457663059 CEST	443	49850	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:42.516613960 CEST	443	49847	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:42.516699076 CEST	443	49847	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:42.516745090 CEST	49847	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:42.516767025 CEST	443	49847	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:42.516788006 CEST	443	49847	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:42.517000914 CEST	49847	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:42.517000914 CEST	49847	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:42.517029047 CEST	49847	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:42.517045021 CEST	443	49847	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:42.520037889 CEST	49851	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:42.520078897 CEST	443	49851	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:42.520148993 CEST	49851	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:42.520284891 CEST	49851	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:42.520301104 CEST	443	49851	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:42.528768063 CEST	443	49846	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:42.529279947 CEST	443	49846	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:42.529386997 CEST	49846	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:42.529386997 CEST	49846	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:42.529426098 CEST	49846	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:42.529444933 CEST	443	49846	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:42.532308102 CEST	49852	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:42.532337904 CEST	443	49852	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:42.532401085 CEST	49852	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:42.532557011 CEST	49852	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:42.532568932 CEST	443	49852	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:42.547602892 CEST	443	49848	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:42.547668934 CEST	443	49848	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:42.547719955 CEST	49848	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:42.548716068 CEST	49848	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:42.548732996 CEST	443	49848	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:42.548743010 CEST	49848	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:42.548748970 CEST	443	49848	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:42.552838087 CEST	49853	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:42.552874088 CEST	443	49853	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:42.552933931 CEST	49853	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:42.554462910 CEST	49853	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:42.554477930 CEST	443	49853	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:42.567956924 CEST	443	49850	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:42.568375111 CEST	443	49850	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:42.568434954 CEST	49850	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:42.568463087 CEST	49850	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:42.568479061 CEST	443	49850	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:42.568491936 CEST	49850	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:42.568497896 CEST	443	49850	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:42.571557045 CEST	49855	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:42.571604013 CEST	443	49855	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:42.571655989 CEST	49855	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:42.571790934 CEST	49855	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:42.571803093 CEST	443	49855	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:42.574115038 CEST	443	49849	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:42.574151039 CEST	443	49849	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:42.574203968 CEST	49849	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:42.574204922 CEST	443	49849	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:42.574249983 CEST	49849	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:42.574354887 CEST	49849	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:42.574364901 CEST	443	49849	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:42.574378014 CEST	49849	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:42.574383974 CEST	443	49849	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:42.577045918 CEST	49856	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:42.577058077 CEST	443	49856	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:42.577112913 CEST	49856	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:42.577370882 CEST	49856	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:42.577378988 CEST	443	49856	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:43.137012005 CEST	443	49851	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:43.137563944 CEST	49851	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:43.137583971 CEST	443	49851	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:43.138526917 CEST	49851	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:43.138539076 CEST	443	49851	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:43.206675053 CEST	443	49852	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:43.207009077 CEST	443	49853	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:43.209423065 CEST	49852	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:43.209454060 CEST	443	49852	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:43.209868908 CEST	49852	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:43.209875107 CEST	443	49852	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:43.210098982 CEST	49853	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:43.210124969 CEST	443	49853	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:43.210134029 CEST	443	49856	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:43.210462093 CEST	49853	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:43.210465908 CEST	443	49853	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:43.210675001 CEST	49856	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:43.210690975 CEST	443	49856	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:43.211004972 CEST	443	49855	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:43.211034060 CEST	49856	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:43.211040974 CEST	443	49856	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:43.211215019 CEST	49855	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:43.211227894 CEST	443	49855	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:43.211549044 CEST	49855	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:43.211553097 CEST	443	49855	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:43.232609987 CEST	443	49851	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:43.232681990 CEST	443	49851	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:43.232790947 CEST	49851	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:43.233468056 CEST	49851	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:43.233468056 CEST	49851	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:43.233490944 CEST	443	49851	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:43.233501911 CEST	443	49851	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:43.236589909 CEST	49858	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:43.236624002 CEST	443	49858	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:43.236680031 CEST	49858	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:43.237132072 CEST	49858	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:43.237148046 CEST	443	49858	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:43.305808067 CEST	443	49852	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:43.305881023 CEST	443	49856	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:43.306006908 CEST	443	49852	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:43.306061983 CEST	49852	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:43.306456089 CEST	443	49856	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:43.306504965 CEST	49856	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:43.306508064 CEST	443	49856	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:43.306550980 CEST	49856	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:43.307558060 CEST	443	49853	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:43.308075905 CEST	443	49853	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:43.308115005 CEST	443	49853	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:43.308123112 CEST	49853	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:43.308192968 CEST	49853	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:43.309010983 CEST	49852	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:43.309029102 CEST	443	49852	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:43.309041023 CEST	49852	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:43.309046984 CEST	443	49852	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:43.309305906 CEST	49856	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:43.309326887 CEST	443	49856	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:43.309449911 CEST	49853	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:43.309449911 CEST	49853	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:43.309459925 CEST	49856	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:43.309462070 CEST	443	49853	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:43.309467077 CEST	443	49856	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:43.309469938 CEST	443	49853	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:43.310053110 CEST	443	49855	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:43.310298920 CEST	443	49855	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:43.310337067 CEST	49855	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:43.321938992 CEST	49855	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:43.321938992 CEST	49855	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:43.321949959 CEST	443	49855	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:43.321957111 CEST	443	49855	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:43.325959921 CEST	49859	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:43.325983047 CEST	443	49859	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:43.326066971 CEST	49859	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:43.327827930 CEST	49859	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:43.327838898 CEST	443	49859	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:43.335387945 CEST	49860	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:43.335405111 CEST	443	49860	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:43.335458994 CEST	49860	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:43.335768938 CEST	49860	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:43.335781097 CEST	443	49860	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:43.341914892 CEST	49861	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:43.341938972 CEST	443	49861	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:43.341994047 CEST	49861	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:43.343414068 CEST	49862	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:43.343420029 CEST	443	49862	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:43.343471050 CEST	49862	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:43.343575001 CEST	49861	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:43.343588114 CEST	443	49861	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:43.343687057 CEST	49862	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:43.343698978 CEST	443	49862	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:43.891132116 CEST	443	49858	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:43.891628027 CEST	49858	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:43.891635895 CEST	443	49858	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:43.892087936 CEST	49858	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:43.892091990 CEST	443	49858	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:43.952970028 CEST	443	49862	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:43.953439951 CEST	49862	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:43.953465939 CEST	443	49862	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:43.954071045 CEST	49862	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:43.954076052 CEST	443	49862	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:43.968548059 CEST	443	49860	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:43.969000101 CEST	49860	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:43.969027042 CEST	443	49860	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:43.969506025 CEST	49860	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:43.969513893 CEST	443	49860	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:43.970288992 CEST	443	49861	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:43.970698118 CEST	49861	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:43.970705986 CEST	443	49861	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:43.971122026 CEST	49861	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:43.971127033 CEST	443	49861	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:43.980866909 CEST	443	49859	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:43.981293917 CEST	49859	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:43.981304884 CEST	443	49859	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:43.981918097 CEST	49859	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:43.981924057 CEST	443	49859	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:43.989346027 CEST	443	49858	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:43.989475012 CEST	443	49858	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:43.989567995 CEST	49858	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:43.989619970 CEST	49858	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:43.989630938 CEST	443	49858	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:43.989645958 CEST	49858	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:43.989650965 CEST	443	49858	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:43.992280006 CEST	49865	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:43.992312908 CEST	443	49865	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:43.992393970 CEST	49865	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:43.992899895 CEST	49865	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:43.992909908 CEST	443	49865	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:44.054409027 CEST	443	49862	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:44.054488897 CEST	443	49862	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:44.054560900 CEST	49862	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:44.054577112 CEST	443	49862	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:44.054605007 CEST	443	49862	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:44.054662943 CEST	49862	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:44.055094004 CEST	49862	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:44.055105925 CEST	443	49862	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:44.055118084 CEST	49862	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:44.055124044 CEST	443	49862	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:44.060213089 CEST	49866	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:44.060242891 CEST	443	49866	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:44.060394049 CEST	49866	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:44.061398029 CEST	49866	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:44.061408997 CEST	443	49866	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:44.066046000 CEST	443	49860	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:44.067918062 CEST	443	49860	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:44.067981005 CEST	49860	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:44.068028927 CEST	49860	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:44.068042040 CEST	443	49860	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:44.068052053 CEST	49860	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:44.068058968 CEST	443	49860	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:44.070566893 CEST	49867	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:44.070600033 CEST	443	49867	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:44.071204901 CEST	49867	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:44.071409941 CEST	49867	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:44.071425915 CEST	443	49867	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:44.080893040 CEST	443	49859	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:44.082017899 CEST	443	49859	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:44.082113981 CEST	49859	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:44.103766918 CEST	49859	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:44.103766918 CEST	49859	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:44.103795052 CEST	443	49859	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:44.103806019 CEST	443	49859	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:44.107026100 CEST	49868	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:44.107048988 CEST	443	49868	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:44.107120037 CEST	49868	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:44.107714891 CEST	49868	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:44.107728004 CEST	443	49868	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:44.175168991 CEST	443	49861	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:44.175242901 CEST	443	49861	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:44.175412893 CEST	49861	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:44.175649881 CEST	49861	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:44.175666094 CEST	443	49861	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:44.175677061 CEST	49861	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:44.175682068 CEST	443	49861	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:44.178601980 CEST	49869	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:44.178641081 CEST	443	49869	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:44.178735971 CEST	49869	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:44.178905010 CEST	49869	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:44.178920984 CEST	443	49869	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:44.651365995 CEST	443	49865	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:44.653742075 CEST	49865	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:44.653742075 CEST	49865	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:44.653760910 CEST	443	49865	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:44.653776884 CEST	443	49865	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:44.684119940 CEST	443	49866	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:44.684638977 CEST	49866	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:44.684653044 CEST	443	49866	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:44.685193062 CEST	49866	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:44.685198069 CEST	443	49866	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:44.748675108 CEST	443	49865	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:44.748708010 CEST	443	49865	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:44.748753071 CEST	49865	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:44.748754978 CEST	443	49865	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:44.748806000 CEST	49865	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:44.749052048 CEST	49865	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:44.749069929 CEST	443	49865	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:44.749130011 CEST	49865	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:44.749136925 CEST	443	49865	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:44.752223015 CEST	49870	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:44.752258062 CEST	443	49870	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:44.752337933 CEST	49870	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:44.752470016 CEST	49870	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:44.752476931 CEST	443	49870	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:44.767961979 CEST	443	49867	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:44.768485069 CEST	49867	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:44.768510103 CEST	443	49867	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:44.769257069 CEST	49867	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:44.769263983 CEST	443	49867	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:44.782264948 CEST	443	49866	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:44.782557011 CEST	443	49866	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:44.782744884 CEST	49866	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:44.790330887 CEST	49866	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:44.790330887 CEST	49866	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:44.790369987 CEST	443	49866	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:44.790380955 CEST	443	49866	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:44.794064045 CEST	49871	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:44.794090986 CEST	443	49871	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:44.794215918 CEST	49871	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:44.794373989 CEST	49871	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:44.794393063 CEST	443	49871	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:44.809379101 CEST	443	49869	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:44.810005903 CEST	49869	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:44.810023069 CEST	443	49869	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:44.810539961 CEST	49869	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:44.810553074 CEST	443	49869	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:44.867410898 CEST	443	49867	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:44.867832899 CEST	443	49867	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:44.867888927 CEST	49867	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:44.868345022 CEST	49867	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:44.868360996 CEST	443	49867	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:44.868374109 CEST	49867	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:44.868381023 CEST	443	49867	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:44.871736050 CEST	49872	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:44.871774912 CEST	443	49872	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:44.871997118 CEST	49872	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:44.872195959 CEST	49872	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:44.872215986 CEST	443	49872	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:44.904798031 CEST	443	49868	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:44.905424118 CEST	49868	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:44.905448914 CEST	443	49868	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:44.905817986 CEST	49868	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:44.905824900 CEST	443	49868	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:44.910506010 CEST	443	49869	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:44.910655022 CEST	443	49869	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:44.910718918 CEST	49869	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:44.910955906 CEST	49869	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:44.910970926 CEST	443	49869	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:44.910979986 CEST	49869	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:44.910985947 CEST	443	49869	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:44.914849997 CEST	49873	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:44.914882898 CEST	443	49873	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:44.914947987 CEST	49873	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:44.915143967 CEST	49873	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:44.915164948 CEST	443	49873	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:45.002811909 CEST	443	49868	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:45.002974033 CEST	443	49868	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:45.003038883 CEST	49868	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:45.003194094 CEST	49868	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:45.003194094 CEST	49868	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:45.003217936 CEST	443	49868	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:45.003228903 CEST	443	49868	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:45.005516052 CEST	49874	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:45.005548000 CEST	443	49874	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:45.005620003 CEST	49874	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:45.005793095 CEST	49874	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:45.005806923 CEST	443	49874	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:45.396552086 CEST	443	49870	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:45.397011995 CEST	49870	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:45.397032976 CEST	443	49870	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:45.397542000 CEST	49870	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:45.397547007 CEST	443	49870	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:45.464442968 CEST	443	49871	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:45.465003967 CEST	49871	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:45.465018034 CEST	443	49871	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:45.465711117 CEST	49871	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:45.465717077 CEST	443	49871	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:45.558343887 CEST	443	49870	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:45.558414936 CEST	443	49870	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:45.558459044 CEST	49870	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:45.558773994 CEST	49870	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:45.558789015 CEST	443	49870	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:45.558799982 CEST	49870	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:45.558804989 CEST	443	49870	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:45.560226917 CEST	443	49872	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:45.560676098 CEST	49872	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:45.560697079 CEST	443	49872	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:45.561098099 CEST	49872	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:45.561105013 CEST	443	49872	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:45.561803102 CEST	49876	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:45.561849117 CEST	443	49876	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:45.561918020 CEST	49876	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:45.562024117 CEST	49876	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:45.562040091 CEST	443	49876	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:45.567403078 CEST	443	49873	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:45.567743063 CEST	49873	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:45.567760944 CEST	443	49873	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:45.568176031 CEST	49873	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:45.568182945 CEST	443	49873	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:45.576733112 CEST	443	49871	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:45.577256918 CEST	443	49871	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:45.577318907 CEST	49871	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:45.577348948 CEST	49871	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:45.577363014 CEST	443	49871	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:45.579655886 CEST	49877	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:45.579695940 CEST	443	49877	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:45.579806089 CEST	49877	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:45.579932928 CEST	49877	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:45.579945087 CEST	443	49877	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:45.655210972 CEST	443	49874	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:45.655673981 CEST	49874	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:45.655715942 CEST	443	49874	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:45.656150103 CEST	49874	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:45.656162024 CEST	443	49874	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:45.662988901 CEST	443	49872	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:45.664000988 CEST	443	49872	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:45.664055109 CEST	49872	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:45.664105892 CEST	49872	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:45.664120913 CEST	443	49872	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:45.664130926 CEST	49872	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:45.664135933 CEST	443	49872	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:45.666676998 CEST	443	49873	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:45.666707039 CEST	443	49873	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:45.666754007 CEST	443	49873	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:45.666771889 CEST	49873	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:45.666807890 CEST	49873	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:45.666951895 CEST	49873	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:45.666971922 CEST	443	49873	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:45.666985989 CEST	49873	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:45.666992903 CEST	443	49873	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:45.667104006 CEST	49878	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:45.667138100 CEST	443	49878	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:45.667479038 CEST	49878	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:45.667895079 CEST	49878	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:45.667906046 CEST	443	49878	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:45.669379950 CEST	49879	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:45.669419050 CEST	443	49879	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:45.669487953 CEST	49879	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:45.669704914 CEST	49879	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:45.669719934 CEST	443	49879	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:45.767484903 CEST	443	49874	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:45.767647028 CEST	443	49874	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:45.767710924 CEST	49874	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:45.767890930 CEST	49874	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:45.767918110 CEST	443	49874	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:45.767932892 CEST	49874	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:45.767940998 CEST	443	49874	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:45.770704031 CEST	49880	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:45.770735979 CEST	443	49880	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:45.770875931 CEST	49880	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:45.771148920 CEST	49880	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:45.771161079 CEST	443	49880	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:46.221276999 CEST	443	49877	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:46.221802950 CEST	49877	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:46.221817017 CEST	443	49877	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:46.222282887 CEST	49877	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:46.222289085 CEST	443	49877	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:46.271445036 CEST	443	49876	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:46.271919966 CEST	49876	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:46.271934032 CEST	443	49876	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:46.272371054 CEST	49876	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:46.272375107 CEST	443	49876	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:46.310762882 CEST	443	49878	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:46.311412096 CEST	49878	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:46.311428070 CEST	443	49878	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:46.312274933 CEST	49878	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:46.312278986 CEST	443	49878	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:46.318790913 CEST	443	49877	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:46.318870068 CEST	443	49877	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:46.318953037 CEST	49877	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:46.319045067 CEST	49877	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:46.319092035 CEST	49877	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:46.319092035 CEST	49877	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:46.319108009 CEST	443	49877	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:46.319118023 CEST	443	49877	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:46.321747065 CEST	49881	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:46.321784973 CEST	443	49881	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:46.321855068 CEST	49881	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:46.322009087 CEST	49881	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:46.322024107 CEST	443	49881	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:46.376763105 CEST	443	49879	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:46.377295017 CEST	49879	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:46.377312899 CEST	443	49879	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:46.377743959 CEST	49879	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:46.377748966 CEST	443	49879	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:46.384943962 CEST	443	49876	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:46.385026932 CEST	443	49876	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:46.385107994 CEST	49876	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:46.385198116 CEST	49876	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:46.385205984 CEST	443	49876	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:46.385215998 CEST	49876	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:46.385220051 CEST	443	49876	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:46.387857914 CEST	49882	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:46.387875080 CEST	443	49882	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:46.388044119 CEST	49882	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:46.388201952 CEST	49882	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:46.388212919 CEST	443	49882	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:46.412251949 CEST	443	49878	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:46.412276983 CEST	443	49878	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:46.412328005 CEST	443	49878	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:46.412401915 CEST	49878	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:46.412401915 CEST	49878	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:46.412631989 CEST	49878	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:46.412631989 CEST	49878	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:46.412648916 CEST	443	49878	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:46.412659883 CEST	443	49878	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:46.415052891 CEST	49883	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:46.415066957 CEST	443	49883	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:46.415146112 CEST	49883	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:46.415301085 CEST	49883	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:46.415311098 CEST	443	49883	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:46.462430954 CEST	443	49880	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:46.463124037 CEST	49880	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:46.463151932 CEST	443	49880	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:46.463598013 CEST	49880	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:46.463603973 CEST	443	49880	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:46.501686096 CEST	443	49879	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:46.501725912 CEST	443	49879	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:46.501770020 CEST	443	49879	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:46.501864910 CEST	49879	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:46.501897097 CEST	49879	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:46.506997108 CEST	49879	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:46.507011890 CEST	443	49879	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:46.510037899 CEST	49884	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:46.510082960 CEST	443	49884	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:46.510174036 CEST	49884	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:46.510287046 CEST	49884	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:46.510305882 CEST	443	49884	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:46.563041925 CEST	443	49880	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:46.563117981 CEST	443	49880	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:46.563226938 CEST	49880	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:46.563229084 CEST	443	49880	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:46.563281059 CEST	49880	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:46.563477039 CEST	49880	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:46.563498974 CEST	443	49880	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:46.563508987 CEST	49880	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:46.563514948 CEST	443	49880	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:46.566740990 CEST	49885	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:46.566787004 CEST	443	49885	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:46.566874027 CEST	49885	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:46.567100048 CEST	49885	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:46.567112923 CEST	443	49885	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:46.937011957 CEST	443	49881	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:46.937607050 CEST	49881	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:46.937627077 CEST	443	49881	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:46.938076973 CEST	49881	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:46.938081980 CEST	443	49881	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:47.033333063 CEST	443	49882	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:47.034064054 CEST	49882	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:47.034074068 CEST	443	49882	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:47.034189939 CEST	443	49881	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:47.034250021 CEST	443	49881	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:47.034322977 CEST	49881	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:47.034545898 CEST	49882	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:47.034545898 CEST	49881	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:47.034555912 CEST	443	49882	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:47.034574032 CEST	443	49881	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:47.034583092 CEST	49881	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:47.034586906 CEST	443	49881	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:47.037447929 CEST	49886	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:47.037494898 CEST	443	49886	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:47.037591934 CEST	49886	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:47.037731886 CEST	49886	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:47.037745953 CEST	443	49886	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:47.054995060 CEST	443	49883	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:47.055416107 CEST	49883	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:47.055442095 CEST	443	49883	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:47.055810928 CEST	49883	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:47.055821896 CEST	443	49883	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:47.132087946 CEST	443	49882	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:47.132308006 CEST	443	49882	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:47.132406950 CEST	443	49882	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:47.132415056 CEST	49882	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:47.132673025 CEST	49882	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:47.132673025 CEST	49882	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:47.132673025 CEST	49882	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:47.132688999 CEST	443	49882	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:47.135272980 CEST	49887	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:47.135318995 CEST	443	49887	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:47.135421038 CEST	49887	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:47.135539055 CEST	49887	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:47.135549068 CEST	443	49887	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:47.154673100 CEST	443	49883	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:47.155231953 CEST	443	49883	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:47.155332088 CEST	49883	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:47.155540943 CEST	49883	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:47.155561924 CEST	443	49883	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:47.155589104 CEST	49883	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:47.155595064 CEST	443	49883	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:47.157974005 CEST	49888	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:47.157995939 CEST	443	49888	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:47.158085108 CEST	49888	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:47.158205986 CEST	49888	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:47.158216953 CEST	443	49888	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:47.201520920 CEST	443	49885	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:47.204098940 CEST	49885	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:47.204108000 CEST	443	49885	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:47.204442024 CEST	443	49884	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:47.204593897 CEST	49885	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:47.204597950 CEST	443	49885	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:47.204741955 CEST	49884	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:47.204754114 CEST	443	49884	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:47.205224037 CEST	49884	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:47.205229044 CEST	443	49884	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:47.296704054 CEST	443	49885	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:47.296852112 CEST	443	49885	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:47.296956062 CEST	49885	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:47.296962023 CEST	443	49885	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:47.297151089 CEST	49885	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:47.297158957 CEST	443	49885	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:47.297168970 CEST	49885	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:47.297173023 CEST	443	49885	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:47.300371885 CEST	49889	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:47.300400972 CEST	443	49889	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:47.300483942 CEST	49889	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:47.300633907 CEST	49889	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:47.300645113 CEST	443	49889	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:47.309292078 CEST	443	49884	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:47.309319973 CEST	443	49884	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:47.309376955 CEST	443	49884	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:47.309382915 CEST	49884	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:47.313466072 CEST	49884	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:47.313539028 CEST	49884	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:47.313555002 CEST	443	49884	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:47.313563108 CEST	49884	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:47.313569069 CEST	443	49884	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:47.315845013 CEST	49890	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:47.315855026 CEST	443	49890	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:47.315959930 CEST	49890	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:47.316103935 CEST	49890	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:47.316118002 CEST	443	49890	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:47.433382034 CEST	49882	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:47.433398008 CEST	443	49882	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:47.672785044 CEST	443	49886	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:47.673568010 CEST	49886	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:47.673593998 CEST	443	49886	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:47.673999071 CEST	49886	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:47.674007893 CEST	443	49886	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:47.761956930 CEST	443	49887	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:47.765877008 CEST	49887	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:47.765892029 CEST	443	49887	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:47.766350031 CEST	49887	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:47.766355038 CEST	443	49887	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:47.770908117 CEST	443	49888	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:47.773741007 CEST	49888	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:47.773749113 CEST	443	49888	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:47.774173021 CEST	49888	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:47.774178028 CEST	443	49888	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:47.775770903 CEST	443	49886	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:47.775804996 CEST	443	49886	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:47.775860071 CEST	443	49886	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:47.775928020 CEST	49886	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:47.776113987 CEST	49886	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:47.776132107 CEST	443	49886	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:47.776143074 CEST	49886	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:47.776148081 CEST	443	49886	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:47.778873920 CEST	49891	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:47.778913975 CEST	443	49891	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:47.778974056 CEST	49891	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:47.779123068 CEST	49891	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:47.779134989 CEST	443	49891	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:47.861284971 CEST	443	49887	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:47.861740112 CEST	443	49887	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:47.865454912 CEST	49887	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:47.865483046 CEST	49887	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:47.865499973 CEST	443	49887	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:47.865514040 CEST	49887	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:47.865518093 CEST	443	49887	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:47.866662025 CEST	443	49888	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:47.867496014 CEST	443	49888	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:47.867563009 CEST	49888	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:47.868201017 CEST	49892	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:47.868235111 CEST	443	49892	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:47.868299007 CEST	49892	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:47.868345976 CEST	49888	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:47.868354082 CEST	443	49888	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:47.868361950 CEST	49888	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:47.868365049 CEST	443	49888	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:47.869224072 CEST	49892	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:47.869239092 CEST	443	49892	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:47.870692015 CEST	49893	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:47.870718956 CEST	443	49893	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:47.870848894 CEST	49893	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:47.870930910 CEST	49893	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:47.870944023 CEST	443	49893	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:47.924891949 CEST	443	49889	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:47.925512075 CEST	49889	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:47.925542116 CEST	443	49889	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:47.925918102 CEST	49889	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:47.925923109 CEST	443	49889	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:47.949476957 CEST	443	49890	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:47.949940920 CEST	49890	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:47.949959993 CEST	443	49890	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:47.950310946 CEST	49890	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:47.950315952 CEST	443	49890	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:48.023066044 CEST	443	49889	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:48.023315907 CEST	443	49889	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:48.023416996 CEST	49889	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:48.023453951 CEST	49889	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:48.023453951 CEST	49889	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:48.023485899 CEST	443	49889	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:48.023495913 CEST	443	49889	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:48.026653051 CEST	49894	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:48.026686907 CEST	443	49894	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:48.026772022 CEST	49894	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:48.027018070 CEST	49894	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:48.027033091 CEST	443	49894	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:48.048868895 CEST	443	49890	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:48.048926115 CEST	443	49890	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:48.048969984 CEST	443	49890	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:48.049015045 CEST	49890	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:48.049031019 CEST	49890	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:48.049269915 CEST	49890	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:48.049282074 CEST	443	49890	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:48.049289942 CEST	49890	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:48.049294949 CEST	443	49890	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:48.052233934 CEST	49895	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:48.052284002 CEST	443	49895	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:48.052361965 CEST	49895	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:48.052527905 CEST	49895	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:48.052540064 CEST	443	49895	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:48.418211937 CEST	443	49891	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:48.418761015 CEST	49891	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:48.418776035 CEST	443	49891	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:48.419254065 CEST	49891	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:48.419260979 CEST	443	49891	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:48.491620064 CEST	443	49892	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:48.492155075 CEST	49892	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:48.492167950 CEST	443	49892	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:48.492621899 CEST	49892	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:48.492626905 CEST	443	49892	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:48.508565903 CEST	443	49893	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:48.508982897 CEST	49893	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:48.508991957 CEST	443	49893	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:48.509382010 CEST	49893	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:48.509387016 CEST	443	49893	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:48.517910004 CEST	443	49891	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:48.518615007 CEST	443	49891	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:48.518677950 CEST	49891	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:48.518709898 CEST	49891	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:48.518724918 CEST	443	49891	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:48.518733978 CEST	49891	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:48.518739939 CEST	443	49891	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:48.521049976 CEST	49896	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:48.521094084 CEST	443	49896	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:48.521173000 CEST	49896	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:48.521444082 CEST	49896	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:48.521459103 CEST	443	49896	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:48.603370905 CEST	443	49892	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:48.603458881 CEST	443	49892	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:48.603513956 CEST	49892	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:48.603535891 CEST	443	49892	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:48.603602886 CEST	443	49892	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:48.603652000 CEST	49892	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:48.603754044 CEST	49892	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:48.603770971 CEST	443	49892	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:48.603780985 CEST	49892	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:48.603785992 CEST	443	49892	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:48.606955051 CEST	49897	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:48.606986046 CEST	443	49897	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:48.607058048 CEST	49897	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:48.607192993 CEST	49897	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:48.607206106 CEST	443	49897	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:48.610727072 CEST	443	49893	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:48.622992992 CEST	443	49893	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:48.623045921 CEST	49893	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:48.623132944 CEST	49893	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:48.623146057 CEST	443	49893	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:48.623155117 CEST	49893	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:48.623161077 CEST	443	49893	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:48.625844002 CEST	49898	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:48.625864983 CEST	443	49898	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:48.625935078 CEST	49898	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:48.626065969 CEST	49898	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:48.626076937 CEST	443	49898	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:48.661636114 CEST	443	49894	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:48.662259102 CEST	49894	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:48.662266016 CEST	443	49894	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:48.662849903 CEST	49894	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:48.662853956 CEST	443	49894	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:48.692255974 CEST	443	49895	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:48.692842007 CEST	49895	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:48.692862034 CEST	443	49895	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:48.693326950 CEST	49895	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:48.693331003 CEST	443	49895	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:48.758299112 CEST	443	49894	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:48.758373022 CEST	443	49894	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:48.758459091 CEST	49894	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:48.758466959 CEST	443	49894	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:48.758485079 CEST	443	49894	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:48.758534908 CEST	49894	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:48.758738041 CEST	49894	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:48.758749962 CEST	443	49894	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:48.758758068 CEST	49894	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:48.758765936 CEST	443	49894	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:48.761554003 CEST	49899	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:48.761591911 CEST	443	49899	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:48.761663914 CEST	49899	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:48.761820078 CEST	49899	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:48.761831999 CEST	443	49899	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:48.791667938 CEST	443	49895	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:48.791742086 CEST	443	49895	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:48.791873932 CEST	49895	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:48.792170048 CEST	49895	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:48.792184114 CEST	443	49895	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:48.792216063 CEST	49895	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:48.792221069 CEST	443	49895	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:48.795201063 CEST	49900	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:48.795233011 CEST	443	49900	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:48.795326948 CEST	49900	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:48.795504093 CEST	49900	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:48.795520067 CEST	443	49900	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:49.138195992 CEST	443	49896	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:49.138778925 CEST	49896	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:49.138804913 CEST	443	49896	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:49.139255047 CEST	49896	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:49.139259100 CEST	443	49896	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:49.234731913 CEST	443	49896	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:49.235290051 CEST	443	49897	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:49.235328913 CEST	443	49896	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:49.235411882 CEST	49896	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:49.235791922 CEST	49897	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:49.235816002 CEST	443	49897	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:49.236381054 CEST	49897	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:49.236386061 CEST	443	49897	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:49.236428022 CEST	49896	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:49.236440897 CEST	443	49896	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:49.236457109 CEST	49896	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:49.236462116 CEST	443	49896	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:49.238997936 CEST	49901	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:49.239044905 CEST	443	49901	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:49.239129066 CEST	49901	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:49.239252090 CEST	49901	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:49.239269018 CEST	443	49901	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:49.261735916 CEST	443	49898	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:49.262317896 CEST	49898	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:49.262336969 CEST	443	49898	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:49.262801886 CEST	49898	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:49.262808084 CEST	443	49898	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:49.332190990 CEST	443	49897	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:49.332995892 CEST	443	49897	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:49.333095074 CEST	49897	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:49.333134890 CEST	49897	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:49.333134890 CEST	49897	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:49.333152056 CEST	443	49897	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:49.333161116 CEST	443	49897	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:49.336220980 CEST	49902	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:49.336256027 CEST	443	49902	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:49.336349964 CEST	49902	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:49.336539984 CEST	49902	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:49.336554050 CEST	443	49902	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:49.362085104 CEST	443	49898	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:49.362550020 CEST	443	49898	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:49.362623930 CEST	49898	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:49.362690926 CEST	49898	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:49.362704992 CEST	443	49898	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:49.362716913 CEST	49898	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:49.362721920 CEST	443	49898	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:49.365364075 CEST	49903	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:49.365401030 CEST	443	49903	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:49.365478039 CEST	49903	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:49.365607977 CEST	49903	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:49.365621090 CEST	443	49903	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:49.393493891 CEST	443	49899	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:49.394012928 CEST	49899	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:49.394032955 CEST	443	49899	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:49.394458055 CEST	49899	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:49.394462109 CEST	443	49899	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:49.438039064 CEST	443	49900	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:49.438683987 CEST	49900	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:49.438707113 CEST	443	49900	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:49.439156055 CEST	49900	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:49.439160109 CEST	443	49900	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:49.492971897 CEST	443	49899	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:49.493046045 CEST	443	49899	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:49.493104935 CEST	49899	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:49.493297100 CEST	49899	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:49.493310928 CEST	443	49899	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:49.493320942 CEST	49899	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:49.493325949 CEST	443	49899	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:49.496514082 CEST	49904	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:49.496548891 CEST	443	49904	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:49.496753931 CEST	49904	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:49.496757030 CEST	49904	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:49.496784925 CEST	443	49904	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:49.538532972 CEST	443	49900	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:49.538606882 CEST	443	49900	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:49.538666010 CEST	49900	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:49.538676977 CEST	443	49900	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:49.538722992 CEST	443	49900	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:49.538769007 CEST	49900	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:49.538808107 CEST	49900	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:49.538819075 CEST	443	49900	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:49.538827896 CEST	49900	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:49.538831949 CEST	443	49900	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:49.541665077 CEST	49905	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:49.541717052 CEST	443	49905	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:49.541784048 CEST	49905	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:49.541975975 CEST	49905	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:49.541990995 CEST	443	49905	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:49.854326963 CEST	443	49901	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:49.855236053 CEST	49901	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:49.855252981 CEST	443	49901	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:49.855735064 CEST	49901	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:49.855742931 CEST	443	49901	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:49.950191021 CEST	443	49901	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:49.950391054 CEST	443	49901	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:49.950483084 CEST	49901	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:49.958718061 CEST	49901	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:49.958736897 CEST	443	49901	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:49.958755016 CEST	49901	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:49.958761930 CEST	443	49901	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:49.961519957 CEST	49906	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:49.961569071 CEST	443	49906	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:49.961633921 CEST	49906	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:49.961776018 CEST	49906	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:49.961791039 CEST	443	49906	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:49.980715990 CEST	443	49902	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:49.981372118 CEST	49902	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:49.981388092 CEST	443	49902	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:49.981858969 CEST	49902	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:49.981864929 CEST	443	49902	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:49.986479998 CEST	443	49903	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:49.986829996 CEST	49903	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:49.986851931 CEST	443	49903	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:49.987185955 CEST	49903	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:49.987190962 CEST	443	49903	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:50.080840111 CEST	443	49902	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:50.080916882 CEST	443	49902	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:50.080977917 CEST	49902	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:50.080995083 CEST	443	49902	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:50.081032991 CEST	443	49902	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:50.081084967 CEST	49902	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:50.081149101 CEST	49902	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:50.081161976 CEST	443	49902	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:50.081171036 CEST	49902	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:50.081176043 CEST	443	49902	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:50.083476067 CEST	443	49903	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:50.083700895 CEST	443	49903	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:50.083762884 CEST	49907	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:50.083794117 CEST	443	49907	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:50.083828926 CEST	49903	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:50.083889961 CEST	49903	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:50.083904028 CEST	443	49903	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:50.083914042 CEST	49903	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:50.083920956 CEST	443	49903	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:50.084592104 CEST	49907	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:50.084592104 CEST	49907	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:50.084624052 CEST	443	49907	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:50.086054087 CEST	49908	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:50.086087942 CEST	443	49908	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:50.086158991 CEST	49908	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:50.086311102 CEST	49908	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:50.086323023 CEST	443	49908	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:50.118063927 CEST	443	49904	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:50.119057894 CEST	49904	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:50.119057894 CEST	49904	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:50.119097948 CEST	443	49904	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:50.119117975 CEST	443	49904	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:50.163327932 CEST	443	49905	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:50.163861990 CEST	49905	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:50.163883924 CEST	443	49905	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:50.164293051 CEST	49905	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:50.164298058 CEST	443	49905	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:50.213316917 CEST	443	49904	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:50.213392019 CEST	443	49904	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:50.213514090 CEST	443	49904	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:50.213548899 CEST	49904	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:50.213772058 CEST	49904	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:50.213772058 CEST	49904	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:50.213772058 CEST	49904	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:50.216538906 CEST	49909	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:50.216573000 CEST	443	49909	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:50.216653109 CEST	49909	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:50.216769934 CEST	49909	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:50.216784954 CEST	443	49909	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:50.266237020 CEST	443	49905	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:50.266304016 CEST	443	49905	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:50.266357899 CEST	49905	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:50.266494989 CEST	49905	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:50.266511917 CEST	443	49905	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:50.266521931 CEST	49905	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:50.266526937 CEST	443	49905	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:50.269098997 CEST	49910	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:50.269109964 CEST	443	49910	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:50.269191027 CEST	49910	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:50.269351006 CEST	49910	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:50.269361973 CEST	443	49910	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:50.526956081 CEST	49904	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:50.526978970 CEST	443	49904	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:50.597214937 CEST	443	49906	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:50.597877026 CEST	49906	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:50.597901106 CEST	443	49906	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:50.598361015 CEST	49906	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:50.598366976 CEST	443	49906	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:50.703224897 CEST	443	49906	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:50.703254938 CEST	443	49906	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:50.703299999 CEST	443	49906	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:50.703428030 CEST	49906	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:50.703649998 CEST	49906	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:50.703679085 CEST	443	49906	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:50.703692913 CEST	49906	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:50.703699112 CEST	443	49906	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:50.706307888 CEST	49911	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:50.706342936 CEST	443	49911	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:50.706412077 CEST	49911	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:50.706552029 CEST	49911	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:50.706564903 CEST	443	49911	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:50.714109898 CEST	443	49908	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:50.714498997 CEST	49908	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:50.714507103 CEST	443	49908	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:50.714915991 CEST	49908	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:50.714920044 CEST	443	49908	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:50.719973087 CEST	443	49907	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:50.720295906 CEST	49907	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:50.720312119 CEST	443	49907	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:50.720758915 CEST	49907	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:50.720763922 CEST	443	49907	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:50.840806961 CEST	443	49908	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:50.840823889 CEST	443	49908	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:50.840940952 CEST	49908	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:50.840950966 CEST	443	49908	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:50.841212034 CEST	49908	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:50.841222048 CEST	443	49908	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:50.841253996 CEST	49908	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:50.841366053 CEST	443	49908	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:50.841394901 CEST	443	49908	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:50.841439009 CEST	49908	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:50.843919039 CEST	49912	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:50.843959093 CEST	443	49912	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:50.844038010 CEST	49912	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:50.844172001 CEST	49912	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:50.844186068 CEST	443	49912	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:50.848246098 CEST	443	49907	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:50.849251986 CEST	443	49907	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:50.849364996 CEST	49907	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:50.849364996 CEST	49907	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:50.849390984 CEST	49907	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:50.849405050 CEST	443	49907	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:50.851738930 CEST	443	49909	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:50.851758003 CEST	49913	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:50.851799011 CEST	443	49913	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:50.851874113 CEST	49913	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:50.852025032 CEST	49913	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:50.852037907 CEST	443	49913	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:50.852204084 CEST	49909	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:50.852231979 CEST	443	49909	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:50.852648020 CEST	49909	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:50.852653027 CEST	443	49909	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:50.884536982 CEST	443	49910	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:50.885504961 CEST	49910	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:50.885531902 CEST	443	49910	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:50.885902882 CEST	49910	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:50.885907888 CEST	443	49910	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:50.961478949 CEST	443	49909	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:50.961509943 CEST	443	49909	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:50.961632013 CEST	49909	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:50.961663961 CEST	443	49909	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:50.961829901 CEST	49909	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:50.961849928 CEST	443	49909	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:50.961858034 CEST	49909	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:50.962191105 CEST	443	49909	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:50.962279081 CEST	443	49909	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:50.962347031 CEST	49909	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:50.964862108 CEST	49914	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:50.964903116 CEST	443	49914	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:50.964968920 CEST	49914	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:50.965132952 CEST	49914	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:50.965148926 CEST	443	49914	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:50.985654116 CEST	443	49910	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:50.985693932 CEST	443	49910	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:50.985748053 CEST	443	49910	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:50.985801935 CEST	49910	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:50.985990047 CEST	49910	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:50.985990047 CEST	49910	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:50.988720894 CEST	49910	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:50.988727093 CEST	49915	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:50.988742113 CEST	443	49910	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:50.988779068 CEST	443	49915	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:50.988842964 CEST	49915	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:50.988996029 CEST	49915	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:50.989007950 CEST	443	49915	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:51.602632999 CEST	443	49911	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:51.603414059 CEST	49911	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:51.603437901 CEST	443	49911	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:51.603899002 CEST	49911	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:51.603904963 CEST	443	49911	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:51.725294113 CEST	443	49911	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:51.725364923 CEST	443	49911	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:51.725493908 CEST	49911	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:51.725756884 CEST	49911	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:51.725780964 CEST	443	49911	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:51.725795031 CEST	49911	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:51.725802898 CEST	443	49911	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:51.729099989 CEST	49916	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:51.729141951 CEST	443	49916	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:51.729242086 CEST	49916	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:51.729676008 CEST	49916	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:51.729691029 CEST	443	49916	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:51.781892061 CEST	443	49913	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:51.782371044 CEST	49913	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:51.782386065 CEST	443	49913	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:51.782814026 CEST	49913	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:51.782818079 CEST	443	49913	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:51.783092022 CEST	443	49914	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:51.783494949 CEST	49914	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:51.783505917 CEST	443	49914	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:51.783833981 CEST	49914	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:51.783837080 CEST	443	49914	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:51.819171906 CEST	443	49915	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:51.819817066 CEST	49915	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:51.819829941 CEST	443	49915	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:51.820230961 CEST	49915	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:51.820235968 CEST	443	49915	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:51.822170973 CEST	443	49912	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:51.822459936 CEST	49912	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:51.822474957 CEST	443	49912	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:51.822805882 CEST	49912	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:51.822809935 CEST	443	49912	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:51.890808105 CEST	443	49914	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:51.891341925 CEST	443	49914	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:51.891433001 CEST	49914	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:51.891458988 CEST	443	49914	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:51.891486883 CEST	443	49914	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:51.891535997 CEST	49914	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:51.891573906 CEST	49914	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:51.891587973 CEST	443	49914	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:51.891593933 CEST	49914	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:51.891598940 CEST	443	49914	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:51.894243956 CEST	49917	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:51.894283056 CEST	443	49917	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:51.894349098 CEST	49917	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:51.894505024 CEST	49917	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:51.894520998 CEST	443	49917	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:51.900526047 CEST	443	49913	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:51.900609970 CEST	443	49913	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:51.900667906 CEST	49913	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:51.900798082 CEST	49913	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:51.900803089 CEST	443	49913	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:51.900810957 CEST	49913	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:51.900814056 CEST	443	49913	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:51.903048038 CEST	49918	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:51.903069019 CEST	443	49918	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:51.903130054 CEST	49918	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:51.903239012 CEST	49918	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:51.903248072 CEST	443	49918	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:51.919704914 CEST	443	49915	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:51.920115948 CEST	443	49915	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:51.920175076 CEST	49915	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:51.920200109 CEST	49915	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:51.920214891 CEST	443	49915	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:51.920224905 CEST	49915	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:51.920229912 CEST	443	49915	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:51.922318935 CEST	49919	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:51.922347069 CEST	443	49919	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:51.922410965 CEST	49919	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:51.922522068 CEST	49919	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:51.922528982 CEST	443	49919	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:51.925616980 CEST	443	49912	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:51.925647020 CEST	443	49912	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:51.925698996 CEST	443	49912	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:51.925698996 CEST	49912	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:51.925743103 CEST	49912	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:51.925873041 CEST	49912	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:51.925878048 CEST	443	49912	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:51.925884962 CEST	49912	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:51.925889015 CEST	443	49912	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:51.927922964 CEST	49920	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:51.927937031 CEST	443	49920	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:51.928002119 CEST	49920	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:51.928150892 CEST	49920	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:51.928163052 CEST	443	49920	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:52.418252945 CEST	443	49916	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:52.418837070 CEST	49916	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:52.418862104 CEST	443	49916	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:52.419287920 CEST	49916	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:52.419292927 CEST	443	49916	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:52.544466972 CEST	443	49916	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:52.544503927 CEST	443	49916	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:52.544550896 CEST	443	49916	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:52.544560909 CEST	49916	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:52.544590950 CEST	49916	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:52.544756889 CEST	49916	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:52.544770956 CEST	443	49916	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:52.544780970 CEST	49916	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:52.544785976 CEST	443	49916	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:52.547310114 CEST	49921	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:52.547341108 CEST	443	49921	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:52.547399044 CEST	49921	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:52.547538042 CEST	49921	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:52.547548056 CEST	443	49921	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:52.558547020 CEST	443	49917	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:52.558943033 CEST	49917	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:52.558965921 CEST	443	49917	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:52.559406042 CEST	49917	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:52.559411049 CEST	443	49917	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:52.570674896 CEST	443	49919	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:52.570962906 CEST	49919	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:52.570971012 CEST	443	49919	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:52.571343899 CEST	49919	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:52.571347952 CEST	443	49919	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:52.591365099 CEST	443	49918	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:52.591656923 CEST	443	49920	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:52.592178106 CEST	49918	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:52.592186928 CEST	443	49918	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:52.592762947 CEST	49918	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:52.592770100 CEST	443	49918	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:52.592803955 CEST	49920	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:52.592811108 CEST	443	49920	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:52.593270063 CEST	49920	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:52.593274117 CEST	443	49920	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:52.654324055 CEST	443	49917	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:52.654644966 CEST	443	49917	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:52.654700994 CEST	49917	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:52.654767036 CEST	49917	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:52.654779911 CEST	443	49917	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:52.654798031 CEST	49917	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:52.654803038 CEST	443	49917	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:52.657752037 CEST	49922	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:52.657777071 CEST	443	49922	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:52.657836914 CEST	49922	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:52.658027887 CEST	49922	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:52.658037901 CEST	443	49922	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:52.673475027 CEST	443	49919	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:52.673528910 CEST	443	49919	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:52.673585892 CEST	49919	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:52.673784018 CEST	49919	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:52.673799992 CEST	443	49919	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:52.673810959 CEST	49919	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:52.673815966 CEST	443	49919	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:52.676309109 CEST	49923	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:52.676342964 CEST	443	49923	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:52.676398993 CEST	49923	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:52.676532984 CEST	49923	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:52.676544905 CEST	443	49923	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:52.691395998 CEST	443	49920	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:52.692085981 CEST	443	49918	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:52.692121029 CEST	443	49918	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:52.692159891 CEST	49918	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:52.692167044 CEST	443	49918	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:52.692179918 CEST	443	49918	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:52.692225933 CEST	49918	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:52.692365885 CEST	49918	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:52.692370892 CEST	443	49918	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:52.692383051 CEST	49918	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:52.692387104 CEST	443	49918	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:52.692954063 CEST	443	49920	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:52.693005085 CEST	49920	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:52.693042040 CEST	49920	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:52.693046093 CEST	443	49920	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:52.694607019 CEST	49924	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:52.694623947 CEST	443	49924	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:52.694699049 CEST	49924	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:52.694829941 CEST	49924	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:52.694839001 CEST	443	49924	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:52.695029974 CEST	49925	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:52.695055962 CEST	443	49925	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:52.695108891 CEST	49925	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:52.695241928 CEST	49925	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:52.695252895 CEST	443	49925	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:53.237735033 CEST	443	49921	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:53.238241911 CEST	49921	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:53.238259077 CEST	443	49921	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:53.238699913 CEST	49921	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:53.238704920 CEST	443	49921	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:53.303797960 CEST	443	49922	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:53.304178953 CEST	443	49923	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:53.304357052 CEST	49922	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:53.304383993 CEST	443	49922	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:53.304452896 CEST	49923	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:53.304485083 CEST	443	49923	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:53.304842949 CEST	49922	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:53.304848909 CEST	443	49922	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:53.304924011 CEST	49923	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:53.304930925 CEST	443	49923	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:53.333504915 CEST	443	49925	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:53.334104061 CEST	49925	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:53.334126949 CEST	443	49925	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:53.334427118 CEST	49925	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:53.334433079 CEST	443	49925	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:53.338548899 CEST	443	49921	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:53.338618040 CEST	443	49921	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:53.338682890 CEST	49921	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:53.338696003 CEST	443	49921	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:53.338733912 CEST	443	49921	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:53.338781118 CEST	49921	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:53.338846922 CEST	49921	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:53.338854074 CEST	443	49921	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:53.338861942 CEST	49921	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:53.338865995 CEST	443	49921	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:53.341372967 CEST	49926	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:53.341411114 CEST	443	49926	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:53.341476917 CEST	49926	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:53.341600895 CEST	49926	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:53.341607094 CEST	443	49926	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:53.348159075 CEST	443	49924	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:53.348520994 CEST	49924	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:53.348535061 CEST	443	49924	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:53.348934889 CEST	49924	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:53.348938942 CEST	443	49924	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:53.401154041 CEST	443	49923	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:53.401213884 CEST	443	49923	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:53.401338100 CEST	49923	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:53.401586056 CEST	49923	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:53.401599884 CEST	443	49923	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:53.401608944 CEST	49923	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:53.401613951 CEST	443	49923	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:53.402821064 CEST	443	49922	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:53.402997971 CEST	443	49922	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:53.403065920 CEST	49922	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:53.403090000 CEST	49922	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:53.403095961 CEST	443	49922	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:53.403105974 CEST	49922	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:53.403110027 CEST	443	49922	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:53.404803038 CEST	49927	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:53.404827118 CEST	443	49927	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:53.404917955 CEST	49927	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:53.404968023 CEST	49928	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:53.405016899 CEST	443	49928	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:53.405051947 CEST	49927	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:53.405064106 CEST	443	49927	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:53.405066967 CEST	49928	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:53.405142069 CEST	49928	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:53.405149937 CEST	443	49928	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:53.429809093 CEST	443	49925	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:53.430318117 CEST	443	49925	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:53.430367947 CEST	49925	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:53.430540085 CEST	49925	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:53.430562973 CEST	443	49925	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:53.430572987 CEST	49925	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:53.430581093 CEST	443	49925	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:53.433079004 CEST	49929	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:53.433109999 CEST	443	49929	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:53.433188915 CEST	49929	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:53.433623075 CEST	49929	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:53.433638096 CEST	443	49929	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:53.445682049 CEST	443	49924	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:53.446870089 CEST	443	49924	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:53.446921110 CEST	49924	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:53.446930885 CEST	443	49924	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:53.446975946 CEST	443	49924	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:53.447017908 CEST	49924	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:53.447032928 CEST	443	49924	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:53.447046041 CEST	49924	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:53.447046041 CEST	49924	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:53.447052002 CEST	443	49924	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:53.447058916 CEST	443	49924	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:53.449549913 CEST	49930	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:53.449572086 CEST	443	49930	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:53.449630022 CEST	49930	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:53.450169086 CEST	49930	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:53.450182915 CEST	443	49930	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:53.980858088 CEST	443	49926	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:53.981585026 CEST	49926	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:53.981606960 CEST	443	49926	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:53.981947899 CEST	49926	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:53.981955051 CEST	443	49926	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:54.063576937 CEST	443	49929	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:54.067460060 CEST	49929	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:54.067476988 CEST	443	49929	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:54.068030119 CEST	49929	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:54.068034887 CEST	443	49929	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:54.069219112 CEST	443	49927	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:54.069629908 CEST	49927	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:54.069642067 CEST	443	49927	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:54.070256948 CEST	49927	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:54.070261002 CEST	443	49927	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:54.075571060 CEST	443	49930	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:54.077193975 CEST	49930	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:54.077208996 CEST	443	49930	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:54.078310966 CEST	49930	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:54.078315973 CEST	443	49930	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:54.081394911 CEST	443	49928	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:54.082438946 CEST	443	49926	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:54.082477093 CEST	443	49926	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:54.082530022 CEST	49926	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:54.082530975 CEST	443	49926	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:54.082580090 CEST	49926	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:54.086704016 CEST	49928	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:54.086725950 CEST	443	49928	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:54.087173939 CEST	49926	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:54.087198973 CEST	443	49926	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:54.087213039 CEST	49926	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:54.087220907 CEST	443	49926	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:54.087222099 CEST	49928	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:54.087227106 CEST	443	49928	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:54.089847088 CEST	49931	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:54.089885950 CEST	443	49931	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:54.089941025 CEST	49931	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:54.090116024 CEST	49931	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:54.090130091 CEST	443	49931	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:54.170397997 CEST	443	49929	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:54.170422077 CEST	443	49929	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:54.170448065 CEST	443	49929	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:54.170520067 CEST	49929	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:54.170520067 CEST	49929	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:54.170785904 CEST	49929	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:54.170785904 CEST	49929	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:54.170799971 CEST	443	49929	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:54.170808077 CEST	443	49929	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:54.171000957 CEST	443	49927	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:54.171133041 CEST	443	49927	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:54.171190023 CEST	49927	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:54.171209097 CEST	49927	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:54.171221972 CEST	443	49927	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:54.171231985 CEST	49927	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:54.171236038 CEST	443	49927	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:54.173235893 CEST	49932	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:54.173269033 CEST	443	49932	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:54.173307896 CEST	49933	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:54.173341036 CEST	443	49933	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:54.173341036 CEST	49932	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:54.173383951 CEST	49933	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:54.173449039 CEST	49932	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:54.173458099 CEST	443	49932	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:54.173546076 CEST	49933	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:54.173561096 CEST	443	49933	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:54.192380905 CEST	443	49930	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:54.192543983 CEST	443	49930	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:54.192831039 CEST	49930	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:54.192831039 CEST	49930	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:54.192856073 CEST	49930	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:54.192866087 CEST	443	49930	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:54.194741964 CEST	49934	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:54.194760084 CEST	443	49934	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:54.194824934 CEST	49934	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:54.194937944 CEST	49934	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:54.194952011 CEST	443	49934	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:54.210800886 CEST	443	49928	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:54.210845947 CEST	443	49928	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:54.210901022 CEST	49928	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:54.210988998 CEST	49928	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:54.211004019 CEST	443	49928	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:54.211011887 CEST	49928	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:54.211016893 CEST	443	49928	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:54.212765932 CEST	49935	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:54.212778091 CEST	443	49935	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:54.212838888 CEST	49935	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:54.212937117 CEST	49935	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:54.212946892 CEST	443	49935	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:54.769526958 CEST	443	49931	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:54.770138025 CEST	49931	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:54.770173073 CEST	443	49931	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:54.770612001 CEST	49931	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:54.770639896 CEST	443	49931	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:54.827748060 CEST	443	49932	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:54.828237057 CEST	49932	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:54.828263998 CEST	443	49932	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:54.828711033 CEST	49932	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:54.828716993 CEST	443	49932	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:54.841675043 CEST	443	49934	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:54.841980934 CEST	49934	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:54.842004061 CEST	443	49934	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:54.842359066 CEST	49934	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:54.842370987 CEST	443	49934	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:54.842767954 CEST	443	49933	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:54.843097925 CEST	49933	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:54.843130112 CEST	443	49933	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:54.843487024 CEST	49933	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:54.843497992 CEST	443	49933	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:54.878948927 CEST	443	49931	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:54.879101992 CEST	443	49931	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:54.879174948 CEST	49931	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:54.879232883 CEST	49931	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:54.879256964 CEST	443	49931	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:54.879267931 CEST	49931	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:54.879272938 CEST	443	49931	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:54.882569075 CEST	49936	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:54.882612944 CEST	443	49936	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:54.882690907 CEST	49936	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:54.883335114 CEST	49936	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:54.883348942 CEST	443	49936	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:54.928468943 CEST	443	49932	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:54.928541899 CEST	443	49932	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:54.928597927 CEST	49932	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:54.928610086 CEST	443	49932	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:54.928658962 CEST	443	49932	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:54.928706884 CEST	49932	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:54.928766966 CEST	49932	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:54.928781033 CEST	443	49932	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:54.928788900 CEST	49932	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:54.928792953 CEST	443	49932	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:54.930740118 CEST	49937	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:54.930783987 CEST	443	49937	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:54.930854082 CEST	49937	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:54.930958986 CEST	49937	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:54.930970907 CEST	443	49937	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:54.947201014 CEST	443	49934	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:54.947276115 CEST	443	49934	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:54.947529078 CEST	49934	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:54.947562933 CEST	443	49934	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:54.947603941 CEST	49934	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:54.947603941 CEST	49934	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:54.947619915 CEST	443	49934	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:54.948164940 CEST	443	49934	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:54.948225021 CEST	443	49933	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:54.948280096 CEST	443	49933	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:54.948335886 CEST	49933	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:54.948402882 CEST	49933	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:54.948402882 CEST	49933	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:54.948435068 CEST	443	49933	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:54.948457003 CEST	443	49933	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:54.950184107 CEST	49938	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:54.950192928 CEST	443	49938	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:54.950280905 CEST	49938	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:54.950407982 CEST	49938	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:54.950416088 CEST	443	49938	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:54.950701952 CEST	49939	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:54.950731039 CEST	443	49939	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:54.950894117 CEST	49939	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:54.950974941 CEST	49939	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:54.950989008 CEST	443	49939	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:55.499284983 CEST	443	49936	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:55.499866962 CEST	49936	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:55.499885082 CEST	443	49936	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:55.500406981 CEST	49936	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:55.500412941 CEST	443	49936	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:55.554884911 CEST	443	49937	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:55.555399895 CEST	49937	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:55.555421114 CEST	443	49937	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:55.555802107 CEST	49937	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:55.555805922 CEST	443	49937	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:55.569464922 CEST	443	49939	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:55.570103884 CEST	49939	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:55.570125103 CEST	443	49939	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:55.570162058 CEST	49939	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:55.570167065 CEST	443	49939	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:55.572062016 CEST	443	49938	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:55.572303057 CEST	49938	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:55.572315931 CEST	443	49938	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:55.572618008 CEST	49938	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:55.572623014 CEST	443	49938	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:55.808562994 CEST	443	49936	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:55.808624983 CEST	443	49936	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:55.808754921 CEST	49936	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:55.809000969 CEST	49936	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:55.809000969 CEST	49936	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:55.809017897 CEST	443	49936	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:55.809027910 CEST	443	49936	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:55.815608978 CEST	443	49937	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:55.815670967 CEST	443	49937	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:55.815773010 CEST	49937	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:55.817761898 CEST	49937	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:55.817761898 CEST	49937	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:55.817778111 CEST	443	49937	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:55.817785025 CEST	443	49937	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:55.819402933 CEST	49940	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:55.819453001 CEST	443	49940	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:55.819808960 CEST	49941	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:55.819842100 CEST	443	49941	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:55.819842100 CEST	49940	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:55.819883108 CEST	49941	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:55.819991112 CEST	49940	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:55.820002079 CEST	443	49940	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:55.820101976 CEST	49941	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:55.820116043 CEST	443	49941	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:55.909635067 CEST	443	49938	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:55.910021067 CEST	443	49938	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:55.910084963 CEST	49938	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:55.910099983 CEST	443	49938	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:55.910135984 CEST	443	49938	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:55.910187006 CEST	49938	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:55.910201073 CEST	443	49938	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:55.910213947 CEST	49938	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:55.910213947 CEST	49938	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:55.910219908 CEST	443	49938	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:55.910227060 CEST	443	49938	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:55.912431002 CEST	49942	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:55.912448883 CEST	443	49942	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:55.912516117 CEST	49942	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:55.912632942 CEST	49942	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:55.912640095 CEST	443	49942	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:55.931231022 CEST	443	49939	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:55.932636023 CEST	443	49939	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:55.932720900 CEST	49939	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:55.932749987 CEST	49939	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:55.932749987 CEST	49939	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:55.932765961 CEST	443	49939	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:55.932775021 CEST	443	49939	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:55.934936047 CEST	49943	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:55.934983969 CEST	443	49943	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:55.935044050 CEST	49943	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:55.935149908 CEST	49943	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:55.935159922 CEST	443	49943	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:56.194749117 CEST	443	49935	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:56.195403099 CEST	49935	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:56.195419073 CEST	443	49935	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:56.195853949 CEST	49935	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:56.195859909 CEST	443	49935	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:56.304733992 CEST	443	49935	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:56.304939032 CEST	443	49935	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:56.305077076 CEST	49935	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:56.305120945 CEST	49935	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:56.305120945 CEST	49935	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:56.305147886 CEST	443	49935	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:56.305160046 CEST	443	49935	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:56.307673931 CEST	49944	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:56.307713985 CEST	443	49944	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:56.307782888 CEST	49944	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:56.307928085 CEST	49944	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:56.307939053 CEST	443	49944	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:56.752643108 CEST	443	49943	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:56.752819061 CEST	443	49941	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:56.753134012 CEST	49943	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:56.753151894 CEST	443	49943	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:56.753200054 CEST	49941	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:56.753209114 CEST	443	49941	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:56.753618956 CEST	49943	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:56.753624916 CEST	443	49943	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:56.753647089 CEST	49941	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:56.753652096 CEST	443	49941	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:56.758368015 CEST	443	49940	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:56.758691072 CEST	49940	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:56.758699894 CEST	443	49940	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:56.759111881 CEST	49940	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:56.759118080 CEST	443	49940	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:56.759897947 CEST	443	49942	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:56.760185003 CEST	49942	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:56.760191917 CEST	443	49942	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:56.760555983 CEST	49942	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:56.760560036 CEST	443	49942	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:56.849278927 CEST	443	49943	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:56.849396944 CEST	443	49943	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:56.849447966 CEST	49943	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:56.849544048 CEST	49943	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:56.849561930 CEST	443	49943	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:56.849571943 CEST	49943	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:56.849577904 CEST	443	49943	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:56.854253054 CEST	443	49940	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:56.854265928 CEST	443	49941	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:56.854341030 CEST	443	49941	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:56.854409933 CEST	49941	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:56.854702950 CEST	443	49940	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:56.854746103 CEST	49940	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:56.854747057 CEST	443	49940	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:56.854790926 CEST	49940	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:56.855482101 CEST	443	49942	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:56.855873108 CEST	49940	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:56.855873108 CEST	49940	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:56.855880976 CEST	443	49940	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:56.855887890 CEST	443	49940	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:56.856295109 CEST	443	49942	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:56.856410027 CEST	443	49942	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:56.856415033 CEST	49942	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:56.856465101 CEST	49942	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:56.858206034 CEST	49941	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:56.858217955 CEST	443	49941	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:56.858308077 CEST	49941	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:56.858313084 CEST	443	49941	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:56.870866060 CEST	49945	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:56.870910883 CEST	443	49945	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:56.870980024 CEST	49945	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:56.871047020 CEST	49942	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:56.871052980 CEST	443	49942	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:56.871082067 CEST	49942	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:56.871085882 CEST	443	49942	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:56.871875048 CEST	49945	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:56.871891975 CEST	443	49945	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:56.874044895 CEST	49946	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:56.874057055 CEST	443	49946	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:56.874155998 CEST	49946	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:56.874404907 CEST	49946	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:56.874417067 CEST	443	49946	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:56.874656916 CEST	49947	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:56.874710083 CEST	443	49947	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:56.874763012 CEST	49947	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:56.874949932 CEST	49947	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:56.874969006 CEST	443	49947	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:56.875417948 CEST	49948	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:56.875442028 CEST	443	49948	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:56.875653028 CEST	49948	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:56.875653028 CEST	49948	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:56.875679016 CEST	443	49948	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:56.932337999 CEST	443	49944	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:56.932904959 CEST	49944	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:56.932934999 CEST	443	49944	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:56.933429003 CEST	49944	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:56.933440924 CEST	443	49944	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:57.034821033 CEST	443	49944	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:57.034992933 CEST	443	49944	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:57.035073996 CEST	49944	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:57.035172939 CEST	49944	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:57.035213947 CEST	443	49944	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:57.035242081 CEST	49944	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:57.035258055 CEST	443	49944	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:57.037834883 CEST	49949	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:57.037852049 CEST	443	49949	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:57.037914038 CEST	49949	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:57.038064003 CEST	49949	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:57.038074017 CEST	443	49949	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:57.629025936 CEST	443	49948	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:57.629304886 CEST	443	49945	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:57.629589081 CEST	49948	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:57.629607916 CEST	443	49948	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:57.629692078 CEST	49945	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:57.629717112 CEST	443	49945	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:57.630078077 CEST	49948	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:57.630083084 CEST	443	49948	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:57.630419970 CEST	49945	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:57.630428076 CEST	443	49945	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:57.631575108 CEST	443	49946	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:57.631714106 CEST	443	49947	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:57.632067919 CEST	49946	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:57.632077932 CEST	443	49946	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:57.632097960 CEST	49947	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:57.632136106 CEST	443	49947	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:57.632524967 CEST	49947	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:57.632538080 CEST	443	49947	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:57.632725954 CEST	49946	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:57.632734060 CEST	443	49946	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:57.724714994 CEST	443	49948	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:57.725179911 CEST	443	49948	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:57.725375891 CEST	443	49945	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:57.725416899 CEST	49948	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:57.725507021 CEST	49948	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:57.725507021 CEST	49948	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:57.725519896 CEST	443	49948	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:57.725528002 CEST	443	49948	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:57.725640059 CEST	443	49945	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:57.725696087 CEST	49945	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:57.725729942 CEST	49945	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:57.725748062 CEST	443	49945	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:57.725758076 CEST	49945	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:57.725764036 CEST	443	49945	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:57.728605032 CEST	49950	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:57.728646994 CEST	443	49950	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:57.728668928 CEST	49951	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:57.728691101 CEST	443	49951	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:57.728713989 CEST	49950	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:57.728892088 CEST	49951	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:57.728905916 CEST	49950	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:57.728919983 CEST	443	49950	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:57.728933096 CEST	49951	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:57.728940964 CEST	443	49951	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:57.729271889 CEST	443	49946	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:57.729346991 CEST	443	49946	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:57.729398012 CEST	49946	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:57.729408979 CEST	443	49946	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:57.729461908 CEST	443	49946	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:57.729509115 CEST	49946	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:57.729563951 CEST	49946	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:57.729568958 CEST	443	49946	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:57.729578018 CEST	49946	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:57.729582071 CEST	443	49946	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:57.729917049 CEST	443	49947	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:57.730690002 CEST	443	49947	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:57.730746031 CEST	49947	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:57.730779886 CEST	49947	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:57.730798006 CEST	443	49947	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:57.730809927 CEST	49947	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:57.730817080 CEST	443	49947	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:57.732125998 CEST	49952	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:57.732152939 CEST	443	49952	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:57.732330084 CEST	49952	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:57.732330084 CEST	49952	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:57.732359886 CEST	443	49952	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:57.732601881 CEST	49953	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:57.732613087 CEST	443	49953	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:57.732666969 CEST	49953	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:57.732780933 CEST	49953	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:57.732790947 CEST	443	49953	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:57.783570051 CEST	443	49949	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:57.784190893 CEST	49949	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:57.784210920 CEST	443	49949	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:57.784744978 CEST	49949	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:57.784749031 CEST	443	49949	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:57.908092976 CEST	443	49949	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:57.908253908 CEST	443	49949	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:57.908345938 CEST	49949	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:57.908617020 CEST	49949	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:57.908617020 CEST	49949	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:57.908636093 CEST	443	49949	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:57.908644915 CEST	443	49949	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:57.911597967 CEST	49954	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:57.911624908 CEST	443	49954	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:57.911722898 CEST	49954	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:57.911907911 CEST	49954	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:57.911920071 CEST	443	49954	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:58.378221035 CEST	443	49953	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:58.378927946 CEST	49953	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:58.378958941 CEST	443	49953	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:58.379626036 CEST	49953	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:58.379633904 CEST	443	49953	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:58.381341934 CEST	443	49951	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:58.381639004 CEST	49951	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:58.381650925 CEST	443	49951	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:58.382019997 CEST	49951	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:58.382024050 CEST	443	49951	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:58.384887934 CEST	443	49952	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:58.385164022 CEST	49952	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:58.385169983 CEST	443	49952	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:58.385504961 CEST	49952	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:58.385508060 CEST	443	49952	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:58.403284073 CEST	443	49950	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:58.403717995 CEST	49950	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:58.403748035 CEST	443	49950	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:58.404092073 CEST	49950	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:58.404098988 CEST	443	49950	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:58.473917961 CEST	443	49953	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:58.474431992 CEST	443	49953	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:58.474517107 CEST	49953	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:58.474548101 CEST	49953	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:58.474565983 CEST	443	49953	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:58.474575043 CEST	49953	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:58.474581957 CEST	443	49953	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:58.477272034 CEST	443	49951	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:58.477535009 CEST	443	49951	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:58.477574110 CEST	49955	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:58.477605104 CEST	443	49955	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:58.477618933 CEST	49951	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:58.477675915 CEST	49955	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:58.477694035 CEST	49951	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:58.477694035 CEST	49951	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:58.477704048 CEST	443	49951	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:58.477711916 CEST	443	49951	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:58.477853060 CEST	49955	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:58.477863073 CEST	443	49955	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:58.479878902 CEST	49956	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:58.479929924 CEST	443	49956	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:58.480046034 CEST	49956	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:58.480304003 CEST	49956	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:58.480329037 CEST	443	49956	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:58.481616974 CEST	443	49952	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:58.481801033 CEST	443	49952	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:58.481873035 CEST	49952	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:58.481928110 CEST	49952	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:58.481931925 CEST	443	49952	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:58.481942892 CEST	49952	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:58.481945992 CEST	443	49952	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:58.483802080 CEST	49957	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:58.483813047 CEST	443	49957	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:58.483890057 CEST	49957	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:58.484028101 CEST	49957	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:58.484039068 CEST	443	49957	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:58.506856918 CEST	443	49950	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:58.507493973 CEST	443	49950	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:58.507570028 CEST	49950	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:58.507611990 CEST	49950	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:58.507620096 CEST	443	49950	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:58.507637024 CEST	49950	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:58.507642031 CEST	443	49950	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:58.509663105 CEST	49958	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:58.509675026 CEST	443	49958	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:58.509747028 CEST	49958	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:58.509880066 CEST	49958	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:58.509891033 CEST	443	49958	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:58.582998037 CEST	443	49954	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:58.583511114 CEST	49954	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:58.583537102 CEST	443	49954	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:58.583987951 CEST	49954	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:58.583992958 CEST	443	49954	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:58.686496019 CEST	443	49954	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:58.686570883 CEST	443	49954	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:58.686628103 CEST	49954	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:58.686662912 CEST	443	49954	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:58.686686993 CEST	443	49954	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:58.686734915 CEST	49954	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:58.686887026 CEST	49954	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:58.686903954 CEST	443	49954	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:58.686913013 CEST	49954	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:58.686918020 CEST	443	49954	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:58.689881086 CEST	49959	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:58.689985991 CEST	443	49959	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:58.690078020 CEST	49959	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:58.690202951 CEST	49959	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:58.690232038 CEST	443	49959	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:59.122158051 CEST	443	49955	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:59.122164965 CEST	443	49956	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:59.122725010 CEST	49955	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:59.122740984 CEST	443	49955	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:59.123173952 CEST	49955	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:59.123178005 CEST	443	49955	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:59.123522043 CEST	49956	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:59.123589039 CEST	443	49956	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:59.123922110 CEST	49956	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:59.123934984 CEST	443	49956	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:59.125639915 CEST	443	49957	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:59.125920057 CEST	49957	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:59.125935078 CEST	443	49957	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:59.126262903 CEST	49957	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:59.126267910 CEST	443	49957	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:59.170701027 CEST	443	49958	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:59.171287060 CEST	49958	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:59.171300888 CEST	443	49958	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:59.171720982 CEST	49958	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:59.171726942 CEST	443	49958	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:59.225683928 CEST	443	49955	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:59.227257013 CEST	443	49955	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:59.227359056 CEST	49955	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:59.227380991 CEST	49955	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:59.227380991 CEST	49955	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:59.227401972 CEST	443	49955	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:59.227411032 CEST	443	49955	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:59.229859114 CEST	443	49956	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:59.229881048 CEST	443	49956	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:59.229921103 CEST	443	49956	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:59.230006933 CEST	49956	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:59.230081081 CEST	49956	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:59.241739988 CEST	49960	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:59.241784096 CEST	443	49960	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:59.241842985 CEST	49960	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:59.242449045 CEST	49956	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:59.242468119 CEST	443	49956	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:59.242492914 CEST	49956	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:59.242503881 CEST	443	49956	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:59.245008945 CEST	49961	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:59.245037079 CEST	443	49961	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:59.245109081 CEST	49961	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:59.245239973 CEST	49960	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:59.245255947 CEST	443	49960	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:59.245371103 CEST	49961	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:59.245384932 CEST	443	49961	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:59.263909101 CEST	443	49957	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:59.264084101 CEST	443	49957	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:59.264168978 CEST	49957	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:59.264264107 CEST	49957	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:59.264272928 CEST	443	49957	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:59.264297009 CEST	49957	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:59.264301062 CEST	443	49957	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:59.266836882 CEST	49962	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:59.266876936 CEST	443	49962	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:59.266942024 CEST	49962	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:59.267096043 CEST	49962	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:59.267113924 CEST	443	49962	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:59.284586906 CEST	443	49958	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:59.284661055 CEST	443	49958	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:59.284730911 CEST	49958	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:59.284739971 CEST	443	49958	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:59.284773111 CEST	443	49958	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:59.284822941 CEST	49958	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:59.284950018 CEST	49958	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:59.284955025 CEST	443	49958	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:59.284965038 CEST	49958	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:59.284969091 CEST	443	49958	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:59.287349939 CEST	49963	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:59.287417889 CEST	443	49963	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:59.287498951 CEST	49963	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:59.287647009 CEST	49963	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:59.287678003 CEST	443	49963	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:59.380630016 CEST	443	49959	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:59.381340027 CEST	49959	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:59.381431103 CEST	443	49959	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:59.381675959 CEST	49959	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:59.381692886 CEST	443	49959	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:59.477539062 CEST	443	49959	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:59.477694035 CEST	443	49959	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:59.477893114 CEST	49959	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:59.477893114 CEST	49959	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:59.477893114 CEST	49959	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:59.480917931 CEST	49964	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:59.480964899 CEST	443	49964	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:59.481101036 CEST	49964	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:59.481338024 CEST	49964	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:59.481370926 CEST	443	49964	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:59.792521954 CEST	49959	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:59.792562008 CEST	443	49959	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:59.913090944 CEST	443	49962	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:59.913723946 CEST	49962	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:59.913741112 CEST	443	49962	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:59.914360046 CEST	49962	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:59.914364100 CEST	443	49962	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:59.918195963 CEST	443	49961	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:59.918672085 CEST	49961	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:59.918678999 CEST	443	49961	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:59.919306040 CEST	49961	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:59.919308901 CEST	443	49961	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:59.921281099 CEST	443	49960	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:59.921727896 CEST	49960	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:59.921813965 CEST	443	49960	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:59.922256947 CEST	49960	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:59.922271013 CEST	443	49960	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:59.931598902 CEST	443	49963	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:59.935197115 CEST	49963	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:59.935220957 CEST	443	49963	13.107.246.45	192.168.2.7
Oct 7, 2024 18:00:59.935869932 CEST	49963	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:00:59.935875893 CEST	443	49963	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:00.008646011 CEST	443	49962	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:00.010111094 CEST	443	49962	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:00.010229111 CEST	443	49962	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:00.010273933 CEST	49962	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:00.010291100 CEST	49962	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:00.010363102 CEST	49962	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:00.010379076 CEST	443	49962	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:00.010389090 CEST	49962	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:00.010394096 CEST	443	49962	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:00.013092041 CEST	49965	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:00.013103962 CEST	443	49965	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:00.013195038 CEST	49965	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:00.013313055 CEST	49965	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:00.013324022 CEST	443	49965	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:00.018964052 CEST	443	49961	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:00.019048929 CEST	443	49961	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:00.019109011 CEST	49961	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:00.019229889 CEST	49961	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:00.019234896 CEST	443	49961	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:00.019243956 CEST	49961	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:00.019247055 CEST	443	49961	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:00.020564079 CEST	443	49960	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:00.020775080 CEST	443	49960	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:00.020832062 CEST	49960	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:00.020894051 CEST	49960	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:00.020922899 CEST	443	49960	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:00.020951033 CEST	49960	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:00.020963907 CEST	443	49960	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:00.021429062 CEST	49966	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:00.021439075 CEST	443	49966	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:00.021492004 CEST	49966	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:00.021625042 CEST	49966	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:00.021637917 CEST	443	49966	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:00.022789955 CEST	49967	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:00.022831917 CEST	443	49967	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:00.022912025 CEST	49967	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:00.023022890 CEST	49967	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:00.023041964 CEST	443	49967	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:00.030546904 CEST	443	49963	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:00.035155058 CEST	443	49963	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:00.035348892 CEST	49963	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:00.035423994 CEST	49963	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:00.035444975 CEST	443	49963	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:00.035468102 CEST	49963	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:00.035479069 CEST	443	49963	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:00.037187099 CEST	49968	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:00.037209988 CEST	443	49968	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:00.037262917 CEST	49968	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:00.037373066 CEST	49968	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:00.037385941 CEST	443	49968	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:00.418714046 CEST	443	49964	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:00.419399023 CEST	49964	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:00.419445038 CEST	443	49964	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:00.419780970 CEST	49964	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:00.419789076 CEST	443	49964	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:00.526060104 CEST	443	49964	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:00.526220083 CEST	443	49964	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:00.526300907 CEST	49964	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:00.526527882 CEST	49964	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:00.526551008 CEST	443	49964	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:00.526581049 CEST	49964	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:00.526587963 CEST	443	49964	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:00.530910015 CEST	49969	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:00.530966043 CEST	443	49969	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:00.531040907 CEST	49969	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:00.531240940 CEST	49969	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:00.531261921 CEST	443	49969	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:00.681706905 CEST	443	49966	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:00.682313919 CEST	49966	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:00.682344913 CEST	443	49966	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:00.682790995 CEST	49966	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:00.682796955 CEST	443	49966	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:00.716069937 CEST	443	49967	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:00.716794014 CEST	49967	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:00.716809034 CEST	443	49967	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:00.717468977 CEST	49967	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:00.717473984 CEST	443	49967	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:00.719582081 CEST	443	49965	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:00.720091105 CEST	49965	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:00.720103979 CEST	443	49965	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:00.720309019 CEST	443	49968	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:00.720665932 CEST	49965	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:00.720670938 CEST	443	49965	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:00.720824003 CEST	49968	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:00.720839977 CEST	443	49968	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:00.721215010 CEST	49968	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:00.721225977 CEST	443	49968	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:00.880932093 CEST	443	49967	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:00.880960941 CEST	443	49967	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:00.881005049 CEST	49967	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:00.881021976 CEST	443	49967	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:00.881257057 CEST	49967	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:00.881273985 CEST	443	49967	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:00.881283045 CEST	49967	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:00.881475925 CEST	443	49967	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:00.881516933 CEST	443	49967	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:00.881553888 CEST	49967	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:00.884089947 CEST	443	49968	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:00.884123087 CEST	443	49968	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:00.884179115 CEST	49968	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:00.884193897 CEST	443	49968	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:00.884208918 CEST	443	49968	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:00.884227991 CEST	49970	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:00.884248018 CEST	49968	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:00.884283066 CEST	443	49970	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:00.884345055 CEST	49970	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:00.884388924 CEST	49968	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:00.884407043 CEST	443	49968	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:00.884416103 CEST	49968	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:00.884421110 CEST	443	49968	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:00.884572983 CEST	49970	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:00.884593010 CEST	443	49970	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:00.885827065 CEST	443	49965	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:00.885883093 CEST	443	49965	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:00.885952950 CEST	49965	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:00.885962963 CEST	443	49965	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:00.886009932 CEST	443	49965	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:00.886055946 CEST	49965	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:00.886418104 CEST	49965	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:00.886428118 CEST	443	49965	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:00.886436939 CEST	49965	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:00.886440992 CEST	443	49965	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:00.888386011 CEST	49971	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:00.888410091 CEST	443	49971	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:00.888468981 CEST	49971	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:00.888686895 CEST	443	49966	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:00.888775110 CEST	443	49966	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:00.888818026 CEST	49966	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:00.889400959 CEST	49972	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:00.889426947 CEST	443	49972	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:00.889480114 CEST	49972	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:00.889528036 CEST	49971	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:00.889539003 CEST	443	49971	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:00.889715910 CEST	49966	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:00.889722109 CEST	443	49966	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:00.889730930 CEST	49966	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:00.889734030 CEST	443	49966	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:00.891405106 CEST	49972	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:00.891415119 CEST	443	49972	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:00.891417980 CEST	49973	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:00.891457081 CEST	443	49973	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:00.891993046 CEST	49973	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:00.891993046 CEST	49973	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:00.892023087 CEST	443	49973	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:01.414007902 CEST	443	49969	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:01.446259975 CEST	49969	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:01.446305990 CEST	443	49969	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:01.469341993 CEST	49969	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:01.469383955 CEST	443	49969	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:01.565248966 CEST	443	49969	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:01.565310001 CEST	443	49969	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:01.565385103 CEST	443	49969	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:01.565388918 CEST	49969	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:01.565462112 CEST	49969	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:01.568916082 CEST	49969	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:01.568916082 CEST	49969	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:01.568959951 CEST	443	49969	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:01.568989992 CEST	443	49969	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:01.577910900 CEST	49974	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:01.577945948 CEST	443	49974	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:01.579003096 CEST	49974	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:01.580817938 CEST	49974	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:01.580831051 CEST	443	49974	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:01.589102030 CEST	443	49973	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:01.589649916 CEST	49973	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:01.589657068 CEST	443	49973	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:01.590074062 CEST	49973	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:01.590078115 CEST	443	49973	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:01.594814062 CEST	443	49970	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:01.595563889 CEST	49970	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:01.595628023 CEST	443	49970	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:01.596122980 CEST	49970	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:01.596137047 CEST	443	49970	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:01.598870039 CEST	443	49972	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:01.599639893 CEST	49972	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:01.599656105 CEST	443	49972	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:01.600327015 CEST	49972	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:01.600334883 CEST	443	49972	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:01.605814934 CEST	443	49971	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:01.608402014 CEST	49971	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:01.608436108 CEST	443	49971	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:01.608957052 CEST	49971	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:01.608967066 CEST	443	49971	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:01.684072018 CEST	443	49973	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:01.684165955 CEST	443	49973	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:01.684267044 CEST	49973	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:01.690103054 CEST	49973	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:01.690103054 CEST	49973	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:01.690119982 CEST	443	49973	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:01.690129995 CEST	443	49973	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:01.693499088 CEST	49975	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:01.693521023 CEST	443	49975	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:01.693577051 CEST	49975	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:01.693887949 CEST	443	49970	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:01.693945885 CEST	443	49970	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:01.694003105 CEST	49970	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:01.694025993 CEST	443	49970	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:01.694067001 CEST	443	49970	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:01.694118977 CEST	49970	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:01.694226027 CEST	49975	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:01.694237947 CEST	443	49975	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:01.694483995 CEST	49970	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:01.694510937 CEST	443	49970	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:01.694540024 CEST	49970	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:01.694551945 CEST	443	49970	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:01.696929932 CEST	443	49972	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:01.696985960 CEST	443	49972	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:01.697030067 CEST	49972	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:01.697259903 CEST	49972	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:01.697259903 CEST	49972	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:01.697268009 CEST	443	49972	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:01.697276115 CEST	443	49972	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:01.702023029 CEST	49976	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:01.702059031 CEST	443	49976	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:01.702126026 CEST	49976	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:01.702986002 CEST	49976	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:01.703000069 CEST	443	49976	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:01.703748941 CEST	443	49971	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:01.703814983 CEST	443	49971	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:01.703852892 CEST	49971	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:01.704108953 CEST	49971	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:01.704128027 CEST	443	49971	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:01.704138994 CEST	49971	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:01.704144001 CEST	443	49971	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:01.716376066 CEST	49977	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:01.716417074 CEST	443	49977	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:01.716495037 CEST	49977	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:01.718626976 CEST	49977	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:01.718653917 CEST	443	49977	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:01.729260921 CEST	49978	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:01.729298115 CEST	443	49978	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:01.729348898 CEST	49978	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:01.730200052 CEST	49978	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:01.730216026 CEST	443	49978	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:02.248574018 CEST	443	49974	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:02.249305964 CEST	49974	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:02.249336004 CEST	443	49974	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:02.249872923 CEST	49974	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:02.249891996 CEST	443	49974	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:02.346689939 CEST	443	49974	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:02.346849918 CEST	443	49974	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:02.346971035 CEST	49974	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:02.347079039 CEST	49974	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:02.347079039 CEST	49974	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:02.347094059 CEST	443	49974	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:02.347101927 CEST	443	49974	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:02.349611044 CEST	49979	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:02.349651098 CEST	443	49979	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:02.349723101 CEST	49979	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:02.349859953 CEST	49979	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:02.349875927 CEST	443	49979	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:02.407686949 CEST	443	49977	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:02.408188105 CEST	49977	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:02.408199072 CEST	443	49977	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:02.408693075 CEST	49977	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:02.408699036 CEST	443	49977	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:02.418526888 CEST	443	49978	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:02.419078112 CEST	49978	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:02.419106007 CEST	443	49978	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:02.419411898 CEST	49978	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:02.419419050 CEST	443	49978	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:02.425899029 CEST	443	49976	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:02.426493883 CEST	49976	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:02.426517010 CEST	443	49976	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:02.427037954 CEST	49976	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:02.427042007 CEST	443	49976	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:02.443528891 CEST	443	49975	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:02.444016933 CEST	49975	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:02.444031000 CEST	443	49975	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:02.444411993 CEST	49975	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:02.444417000 CEST	443	49975	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:02.509891033 CEST	443	49977	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:02.509955883 CEST	443	49977	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:02.510016918 CEST	443	49977	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:02.510050058 CEST	49977	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:02.510061026 CEST	443	49977	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:02.510107040 CEST	49977	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:02.510107040 CEST	49977	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:02.522216082 CEST	443	49978	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:02.522239923 CEST	443	49978	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:02.522336960 CEST	443	49978	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:02.522349119 CEST	49978	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:02.522474051 CEST	49978	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:02.522567034 CEST	49978	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:02.522567034 CEST	49978	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:02.522586107 CEST	443	49978	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:02.522593975 CEST	443	49978	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:02.524252892 CEST	443	49976	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:02.524333954 CEST	443	49976	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:02.524419069 CEST	49976	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:02.524434090 CEST	443	49976	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:02.524475098 CEST	443	49976	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:02.524555922 CEST	49976	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:02.524580956 CEST	49976	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:02.524591923 CEST	443	49976	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:02.524601936 CEST	49976	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:02.524605989 CEST	443	49976	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:02.525738001 CEST	49980	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:02.525759935 CEST	443	49980	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:02.525851965 CEST	49980	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:02.525969028 CEST	49980	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:02.525976896 CEST	443	49980	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:02.526734114 CEST	49981	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:02.526801109 CEST	443	49981	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:02.526901007 CEST	49981	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:02.527000904 CEST	49981	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:02.527029037 CEST	443	49981	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:02.545238018 CEST	443	49975	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:02.545254946 CEST	443	49975	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:02.545320988 CEST	443	49975	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:02.545327902 CEST	49975	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:02.545365095 CEST	49975	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:02.545600891 CEST	49975	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:02.545619011 CEST	443	49975	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:02.545629025 CEST	49975	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:02.545634985 CEST	443	49975	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:02.548373938 CEST	49982	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:02.548402071 CEST	443	49982	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:02.548479080 CEST	49982	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:02.548603058 CEST	49982	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:02.548621893 CEST	443	49982	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:02.599266052 CEST	443	49977	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:02.599363089 CEST	443	49977	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:02.599534035 CEST	49977	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:02.599534035 CEST	49977	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:02.599534035 CEST	49977	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:02.599534035 CEST	49977	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:02.601984978 CEST	49983	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:02.602030993 CEST	443	49983	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:02.602118969 CEST	49983	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:02.602264881 CEST	49983	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:02.602281094 CEST	443	49983	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:02.902321100 CEST	49977	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:02.902358055 CEST	443	49977	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:02.964436054 CEST	443	49979	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:02.965078115 CEST	49979	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:02.965095043 CEST	443	49979	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:02.965529919 CEST	49979	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:02.965536118 CEST	443	49979	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:03.321847916 CEST	443	49981	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:03.322501898 CEST	49981	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:03.322554111 CEST	443	49981	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:03.322963953 CEST	49981	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:03.322982073 CEST	443	49981	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:03.323913097 CEST	443	49982	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:03.324274063 CEST	49982	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:03.324299097 CEST	443	49982	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:03.324655056 CEST	49982	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:03.324667931 CEST	443	49982	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:03.324925900 CEST	443	49979	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:03.324954033 CEST	443	49979	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:03.324970007 CEST	443	49979	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:03.325036049 CEST	49979	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:03.325052023 CEST	443	49979	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:03.325098038 CEST	49979	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:03.327224970 CEST	443	49980	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:03.327660084 CEST	49980	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:03.327682018 CEST	443	49980	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:03.328016996 CEST	49980	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:03.328026056 CEST	443	49980	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:03.328736067 CEST	443	49979	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:03.328779936 CEST	443	49979	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:03.328818083 CEST	49979	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:03.328824997 CEST	443	49979	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:03.328843117 CEST	443	49979	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:03.328851938 CEST	49979	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:03.328871965 CEST	49979	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:03.328897953 CEST	49979	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:03.329000950 CEST	49979	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:03.329010963 CEST	443	49979	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:03.329020977 CEST	49979	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:03.329026937 CEST	443	49979	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:03.331696033 CEST	49984	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:03.331715107 CEST	443	49984	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:03.331799984 CEST	49984	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:03.331945896 CEST	49984	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:03.331955910 CEST	443	49984	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:03.422204018 CEST	443	49981	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:03.422225952 CEST	443	49981	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:03.422307968 CEST	49981	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:03.422348976 CEST	443	49981	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:03.422600985 CEST	49981	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:03.422622919 CEST	443	49981	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:03.422646046 CEST	443	49981	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:03.422647953 CEST	49981	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:03.422672987 CEST	443	49981	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:03.425419092 CEST	49985	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:03.425461054 CEST	443	49985	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:03.425568104 CEST	49985	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:03.425714016 CEST	49985	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:03.425725937 CEST	443	49985	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:03.428397894 CEST	443	49980	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:03.428459883 CEST	443	49980	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:03.428525925 CEST	49980	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:03.428554058 CEST	443	49980	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:03.428592920 CEST	49980	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:03.428634882 CEST	443	49980	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:03.428735971 CEST	49980	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:03.428745031 CEST	443	49980	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:03.428755999 CEST	49980	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:03.428761959 CEST	443	49980	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:03.428771019 CEST	443	49980	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:03.431415081 CEST	49986	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:03.431432009 CEST	443	49986	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:03.431514025 CEST	49986	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:03.431576967 CEST	443	49982	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:03.431700945 CEST	49986	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:03.431713104 CEST	443	49986	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:03.432369947 CEST	443	49982	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:03.432426929 CEST	49982	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:03.432478905 CEST	49982	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:03.432478905 CEST	49982	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:03.432502031 CEST	443	49982	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:03.432524920 CEST	443	49982	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:03.434602976 CEST	49987	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:03.434631109 CEST	443	49987	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:03.434704065 CEST	49987	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:03.434844017 CEST	49987	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:03.434855938 CEST	443	49987	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:03.501405954 CEST	443	49983	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:03.501893997 CEST	49983	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:03.501924992 CEST	443	49983	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:03.502552986 CEST	49983	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:03.502566099 CEST	443	49983	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:03.600611925 CEST	443	49983	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:03.600778103 CEST	443	49983	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:03.600861073 CEST	49983	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:03.601083994 CEST	49983	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:03.601099014 CEST	443	49983	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:03.601111889 CEST	49983	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:03.601116896 CEST	443	49983	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:03.604357958 CEST	49988	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:03.604389906 CEST	443	49988	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:03.604486942 CEST	49988	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:03.604728937 CEST	49988	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:03.604743958 CEST	443	49988	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:03.945327044 CEST	443	49984	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:03.946077108 CEST	49984	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:03.946094990 CEST	443	49984	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:03.946435928 CEST	49984	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:03.946440935 CEST	443	49984	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:04.043319941 CEST	443	49984	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:04.044805050 CEST	443	49984	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:04.044886112 CEST	49984	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:04.051815987 CEST	443	49986	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:04.057419062 CEST	443	49987	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:04.073976994 CEST	443	49985	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:04.084120035 CEST	49984	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:04.084141970 CEST	443	49984	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:04.084167957 CEST	49984	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:04.084173918 CEST	443	49984	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:04.085340023 CEST	49986	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:04.085360050 CEST	443	49986	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:04.085798979 CEST	49986	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:04.085805893 CEST	443	49986	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:04.086034060 CEST	49987	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:04.086041927 CEST	443	49987	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:04.086397886 CEST	49987	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:04.086405039 CEST	443	49987	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:04.087176085 CEST	49985	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:04.087183952 CEST	443	49985	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:04.087542057 CEST	49985	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:04.087547064 CEST	443	49985	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:04.090208054 CEST	49989	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:04.090256929 CEST	443	49989	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:04.090332031 CEST	49989	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:04.090440035 CEST	49989	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:04.090449095 CEST	443	49989	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:04.203351021 CEST	443	49986	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:04.203391075 CEST	443	49987	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:04.203438044 CEST	443	49986	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:04.203491926 CEST	49986	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:04.203512907 CEST	443	49986	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:04.203551054 CEST	443	49986	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:04.203598022 CEST	49986	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:04.204114914 CEST	443	49987	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:04.204159021 CEST	49987	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:04.207551003 CEST	443	49985	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:04.207854033 CEST	443	49985	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:04.207901001 CEST	49985	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:04.209507942 CEST	49986	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:04.209527016 CEST	443	49986	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:04.209558010 CEST	49986	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:04.209563017 CEST	443	49986	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:04.217147112 CEST	49987	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:04.217171907 CEST	443	49987	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:04.217183113 CEST	49987	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:04.217189074 CEST	443	49987	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:04.228108883 CEST	49985	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:04.228131056 CEST	443	49985	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:04.228143930 CEST	49985	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:04.228151083 CEST	443	49985	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:04.257688999 CEST	443	49988	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:04.273027897 CEST	49988	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:04.273050070 CEST	443	49988	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:04.273391008 CEST	49988	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:04.273395061 CEST	443	49988	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:04.287797928 CEST	49990	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:04.287837029 CEST	443	49990	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:04.287903070 CEST	49990	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:04.288072109 CEST	49990	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:04.288084984 CEST	443	49990	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:04.475682020 CEST	443	49988	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:04.475760937 CEST	443	49988	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:04.475838900 CEST	49988	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:04.483150959 CEST	49988	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:04.483163118 CEST	443	49988	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:04.483202934 CEST	49988	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:04.483208895 CEST	443	49988	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:04.913763046 CEST	443	49989	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:04.918145895 CEST	49989	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:04.918190002 CEST	443	49989	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:04.918771982 CEST	49989	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:04.918785095 CEST	443	49989	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:05.016952991 CEST	443	49989	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:05.017119884 CEST	443	49989	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:05.017179012 CEST	49989	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:05.017251015 CEST	49989	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:05.017288923 CEST	443	49989	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:05.017318010 CEST	49989	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:05.017332077 CEST	443	49989	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:05.088712931 CEST	443	49990	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:05.089179993 CEST	49990	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:05.089215040 CEST	443	49990	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:05.089693069 CEST	49990	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:05.089700937 CEST	443	49990	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:05.204401016 CEST	443	49990	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:05.204567909 CEST	443	49990	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:05.204658985 CEST	49990	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:05.204751015 CEST	49990	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:05.204751015 CEST	49990	443	192.168.2.7	13.107.246.45
Oct 7, 2024 18:01:05.204802036 CEST	443	49990	13.107.246.45	192.168.2.7
Oct 7, 2024 18:01:05.204829931 CEST	443	49990	13.107.246.45	192.168.2.7

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 7, 2024 18:00:24.239386082 CEST	56682	53	192.168.2.7	1.1.1.1
Oct 7, 2024 18:00:24.254694939 CEST	53	56682	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 7, 2024 18:00:24.239386082 CEST	192.168.2.7	1.1.1.1	0x9379	Standard query (0)	exemplarou.sbs	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Oct 7, 2024 18:00:24.254694939 CEST	1.1.1.1	192.168.2.7	0x9379	No error (0)	exemplarou.sbs	188.114.96.3	A (IP address)	IN (0x0001)	false
Oct 7, 2024 18:00:24.254694939 CEST	1.1.1.1	192.168.2.7	0x9379	No error (0)	exemplarou.sbs	188.114.97.3	A (IP address)	IN (0x0001)	false
Oct 7, 2024 18:00:26.890115023 CEST	1.1.1.1	192.168.2.7	0x801f	No error (0)	bg.microsoft.map.fastly.net	199.232.214.172	A (IP address)	IN (0x0001)	false
Oct 7, 2024 18:00:26.890115023 CEST	1.1.1.1	192.168.2.7	0x801f	No error (0)	bg.microsoft.map.fastly.net	199.232.210.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

exemplarou.sbs

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49741	188.114.96.3	443	7604	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 16:00:24 UTC	261	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: exemplarou.sbs
2024-10-07 16:00:24 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-10-07 16:00:24 UTC	549	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 16:00:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Frame-Options: SAMEORIGIN Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=EqjinWqJ8jkvMQsjlBfHYN0Y2m0515p4tByXrHTj%2BsYxlhHygBFrUtzPV5MwnLpDFSQRX8A5iGUgYFkTosOf2gI6HOCWStRf7P%2FS%2BWFDw15b6VRuo7OV08jaJTS2sc53bA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cef1a9b7a870f49-EWR
2024-10-07 16:00:24 UTC	820	IN	Data Raw: 31 31 32 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 37 5d 3e 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 36 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 37 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 37 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 38 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 38 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 Data Ascii: 112d<!DOCTYPE html>...[if lt IE 7]> <html class="no-js ie6 oldie" lang="en-US"> <![endif]-->...[if IE 7]> <html class="no-js ie7 oldie" lang="en-US"> <![endif]-->...[if IE 8]> <html class="no-js ie8 oldie" lang="en-US"> <![endif]-->...[if
2024-10-07 16:00:24 UTC	1369	IN	Data Raw: 2e 65 72 72 6f 72 73 2e 69 65 2e 63 73 73 22 20 2f 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 3c 2f 73 74 79 6c 65 3e 0a 0a 0a 3c 21 2d 2d 5b 69 66 20 67 74 65 20 49 45 20 31 30 5d 3e 3c 21 2d 2d 3e 0a 3c 73 63 72 69 70 74 3e 0a 20 20 69 66 20 28 21 6e 61 76 69 67 61 74 6f 72 2e 63 6f 6f 6b 69 65 45 6e 61 62 6c 65 64 29 20 7b 0a 20 20 20 20 77 69 6e 64 6f 77 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 27 44 4f 4d 43 6f 6e 74 65 6e 74 4c 6f 61 64 65 64 27 2c 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 0a 20 20 20 20 20 20 76 61 72 20 63 6f 6f 6b 69 65 45 6c 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 27 63 6f 6f 6b 69 65 Data Ascii: .errors.ie.css" /><![endif]--><style>body{margin:0;padding:0}</style>...[if gte IE 10]>...><script> if (!navigator.cookieEnabled) { window.addEventListener('DOMContentLoaded', function () { var cookieEl = document.getElementById('cookie
2024-10-07 16:00:24 UTC	1369	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 68 69 64 64 65 6e 22 20 6e 61 6d 65 3d 22 61 74 6f 6b 22 20 76 61 6c 75 65 3d 22 38 73 7a 73 48 4d 56 74 67 56 73 5f 70 6e 38 35 35 49 7a 71 70 45 39 69 51 73 50 53 4a 48 59 73 63 50 56 37 4f 4b 55 41 7a 7a 30 2d 31 37 32 38 33 31 36 38 32 34 2d 30 2e 30 2e 31 2e 31 2d 2f 61 70 69 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 6c 65 61 72 6e 69 6e 67 2f 61 63 63 65 73 73 2d 6d 61 6e 61 67 65 6d 65 6e 74 2f 70 68 69 73 68 69 6e 67 2d 61 74 74 61 63 6b 2f 22 20 63 6c 61 73 73 3d 22 63 66 2d 62 74 6e 22 20 73 74 79 6c Data Ascii: <input type="hidden" name="atok" value="8szsHMVtgVs_pn855IzqpE9iQsPSJHYscPV7OKUAzz0-1728316824-0.0.1.1-/api"> <a href="https://www.cloudflare.com/learning/access-management/phishing-attack/" class="cf-btn" styl
2024-10-07 16:00:24 UTC	847	IN	Data Raw: 68 69 64 64 65 6e 22 3e 26 62 75 6c 6c 3b 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 69 74 65 6d 20 73 6d 3a 62 6c 6f 63 6b 20 73 6d 3a 6d 62 2d 31 22 3e 3c 73 70 61 6e 3e 50 65 72 66 6f 72 6d 61 6e 63 65 20 26 61 6d 70 3b 20 73 65 63 75 72 69 74 79 20 62 79 3c 2f 73 70 61 6e 3e 20 3c 61 20 72 65 6c 3d 22 6e 6f 6f 70 65 6e 65 72 20 6e 6f 72 65 66 65 72 72 65 72 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 35 78 78 2d 65 72 72 6f 72 2d 6c 61 6e 64 69 6e 67 22 20 69 64 3d 22 62 72 61 6e 64 5f 6c 69 6e 6b 22 20 74 61 72 67 65 74 3d 22 5f 62 6c 61 6e 6b 22 3e 43 6c 6f 75 64 66 6c 61 72 65 3c 2f 61 3e 3c Data Ascii: hidden">•</span> </span> <span class="cf-footer-item sm:block sm:mb-1"><span>Performance & security by</span> <a rel="noopener noreferrer" href="https://www.cloudflare.com/5xx-error-landing" id="brand_link" target="_blank">Cloudflare</a><
2024-10-07 16:00:24 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49747	188.114.96.3	443	7604	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 16:00:25 UTC	351	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Cookie: __cf_mw_byp=8szsHMVtgVs_pn855IzqpE9iQsPSJHYscPV7OKUAzz0-1728316824-0.0.1.1-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 42 Host: exemplarou.sbs
2024-10-07 16:00:25 UTC	42	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 48 38 4e 67 43 6c 2d 2d 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=H8NgCl--&j=
2024-10-07 16:00:26 UTC	801	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 16:00:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=rer6rbekgs67n9sjutnje3jtod; expires=Fri, 31 Jan 2025 09:47:04 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=B%2Bg%2FGMiLrq1X%2BGLvB7Mmba0VUId%2B19LltI0pSYpTEw%2FTfBmzYJWXPYnBV%2BDfMtxMswxpjHpdngfdzoLHtmaBOVBnXPzzdG1RIpg88%2BbnsbqjPoXWloVxj2RocIWhqoaBHQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cef1a9fac3e0ca2-EWR
2024-10-07 16:00:26 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-10-07 16:00:26 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	12:00:22
Start date:	07/10/2024
Path:	C:\Users\user\Desktop\vEcIHT68pU.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\vEcIHT68pU.exe"
Imagebase:	0xa50000
File size:	551'424 bytes
MD5 hash:	64FE8DFA186F801847E6C710F30B2884
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_LummaCStealer_4, Description: Yara detected LummaC Stealer, Source: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	12:00:22
Start date:	07/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Imagebase:	0xe00000
File size:	262'432 bytes
MD5 hash:	8FDF47E0FF70C40ED3A17014AEEA4232
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_LummaCStealer_4, Description: Yara detected LummaC Stealer, Source: 00000002.00000002.1573299382.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	12:00:23
Start date:	07/10/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7580 -s 260
Imagebase:	0xfb0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	12:00:25
Start date:	07/10/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7604 -s 1624
Imagebase:	0xfb0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	12:00:43
Start date:	07/10/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7604 -s 1608
Imagebase:	0xfb0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	0.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	6.1%
Total number of Nodes:	229
Total number of Limit Nodes:	4

Executed Functions

Function 00A52021 Relevance: 9.4, APIs: 1, Strings: 4, Instructions: 631
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(00AD5AD8,?,00000040,?), ref: 00A52738

Strings

S, xrefs: 00A5206A
', xrefs: 00A52718
MZx, xrefs: 00A5274B, 00A52757, 00A5275C
a, xrefs: 00A52296

Memory Dump Source

Source File: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID: '$MZx$S$a
API String ID: 544645111-3057195942
Opcode ID: 06bea901928e5bb58898171aee3ba640e08adb1546152af27ce0f08e539a2e52
Instruction ID: 2239c70bedb10ae6f3799d47a37f9201ca4ca154ef0cb5a9989528831604bb23
Opcode Fuzzy Hash: 06bea901928e5bb58898171aee3ba640e08adb1546152af27ce0f08e539a2e52
Instruction Fuzzy Hash: 7AF1CE27934E1B06E70861398D523E6A54AF7EB372F914333AE239B3F4E37909459384

Function 00A68E2E Relevance: 4.7, APIs: 3, Instructions: 202
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__freea.LIBCMT ref: 00A68FDD

Part of subcall function 00A63A83: HeapAlloc.KERNEL32(00000000,00A6A1AA,?,?,00A6A1AA,00000220,?,?,?), ref: 00A63AB5

__freea.LIBCMT ref: 00A68FF2
__freea.LIBCMT ref: 00A69002

Memory Dump Source

Source File: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID: __freea$AllocHeap
String ID:
API String ID: 85559729-0
Opcode ID: 8752d74e302d67ff6a776f0c26a33b60f61403a1033508fd29a4f6cf3c60f495
Instruction ID: ff3d3b633a86ecfa1c398f0325369f3e8750d5dd1d198fc063e70739242b223d
Opcode Fuzzy Hash: 8752d74e302d67ff6a776f0c26a33b60f61403a1033508fd29a4f6cf3c60f495
Instruction Fuzzy Hash: E851B0B2600206AFEF219F648D85EBF3ABEEF44750B190628FD09D6150EF79CC508760

Function 00A6A3A6 Relevance: 3.2, APIs: 2, Instructions: 177
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00A69ED6: GetOEMCP.KERNEL32(00000000,?,?,?,?), ref: 00A69F01

IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,?,?,?,?,00A6A1ED,?,00000000,?,?,?), ref: 00A6A407
GetCPInfo.KERNEL32(00000000,?,?,?,?,?,?,?,?,00A6A1ED,?,00000000,?,?,?), ref: 00A6A449

Memory Dump Source

Source File: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID: CodeInfoPageValid
String ID:
API String ID: 546120528-0
Opcode ID: a8835dfd3bbf0f034299f4f60fce88d5ada8b3233807f25364947faea25bef38
Instruction ID: ec78f577591c3a786909cb42a42cbd213ae749653905f1dde384b682eb80b0b0
Opcode Fuzzy Hash: a8835dfd3bbf0f034299f4f60fce88d5ada8b3233807f25364947faea25bef38
Instruction Fuzzy Hash: 34513771A003458FDB21CF75CC896AABBF5FFA5300F14806ED097AB251EAB49946CF52

Function 00A66368 Relevance: 3.0, APIs: 2, Instructions: 34
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LCMapStringEx.KERNELBASE(?,00A68F1C,?,?,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 00A6639C
LCMapStringW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,?,?,00A68F1C,?,?,00000000,?,00000000), ref: 00A663BA

Memory Dump Source

Source File: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID: String
String ID:
API String ID: 2568140703-0
Opcode ID: 8e852508d65470e9c08e722190992ffb409a509090357d2d8134497472447baa
Instruction ID: 6109eb2c70266d56641990c0cc9e31738cc29a5b308077961d7722a3c16a05b8
Opcode Fuzzy Hash: 8e852508d65470e9c08e722190992ffb409a509090357d2d8134497472447baa
Instruction Fuzzy Hash: A4F0243250015ABBCF12AFA0DD09ADE3F76EB487A4F058114FA1869120CB36D976BB95

Function 00A69FAA Relevance: 1.6, APIs: 1, Instructions: 147
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCPInfo.KERNEL32(E8458D00,?,00A6A1F9,00A6A1ED,00000000), ref: 00A69FDC

Memory Dump Source

Source File: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID: Info
String ID:
API String ID: 1807457897-0
Opcode ID: 68027c530734faead1446e3039cc85eb1adbc9de95b25f03080895c8b8ddca42
Instruction ID: 1d3de330c248c1dadb355c92890e4f5426ecf54826f0c4a0d001c2e413a9cbb3
Opcode Fuzzy Hash: 68027c530734faead1446e3039cc85eb1adbc9de95b25f03080895c8b8ddca42
Instruction Fuzzy Hash: 62518D719042589EDF218F28CD80BE67BBCEB66304F2405EDE19AE7142C375AD46DF21

Non-executed Functions

Function 00A9AA47 Relevance: 31.9, Strings: 24, Instructions: 1933COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00A9AD0F, 00A9AD1E
DCBA, xrefs: 00A9B75F, 00A9B76E
<=2, xrefs: 00A9B8D9
AR, xrefs: 00A9ABE8
WP, xrefs: 00A9ABC7
<=:;, xrefs: 00A9B808
@ONM, xrefs: 00A9B5B3
89&', xrefs: 00A9B813
lkji, xrefs: 00A9B616
QNOL, xrefs: 00A9B64D
`Y^_, xrefs: 00A9B876
D, xrefs: 00A9B71E
mjkh, xrefs: 00A9B6B0
tsrq, xrefs: 00A9B5D4
dcba, xrefs: 00A9B600
tuJK, xrefs: 00A9B83F
`onm, xrefs: 00A9B60B
()./, xrefs: 00A9B8A2
:WUE, xrefs: 00A9C58F, 00A9C59E
T, xrefs: 00A9C02F
|, xrefs: 00A9BB89
LKJI, xrefs: 00A9B5BE
xgfe, xrefs: 00A9B5F5
89>?, xrefs: 00A9B8CE

Memory Dump Source

Source File: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID:
String ID: %*+($()./$89&'$89>?$:WUE$<=2$<=:;$@ONM$AR$D$DCBA$LKJI$QNOL$T$WP$`Y^_$`onm$dcba$lkji$mjkh$tsrq$tuJK$xgfe$|
API String ID: 0-1418943773
Opcode ID: a9f1e68edfaf0ae1e626f109336ed9d19a6b5191b739eb3bbf20b7e6025201f9
Instruction ID: 592920c525b891650588c163ea5f607d7fa7abe7bf463af77a7f113f2eac3d0d
Opcode Fuzzy Hash: a9f1e68edfaf0ae1e626f109336ed9d19a6b5191b739eb3bbf20b7e6025201f9
Instruction Fuzzy Hash: 45F267B06093819FDB70CF14C984BAFBBE5AFD5350F54482DE4C99B291DB319885CBA2

Function 00AA6EC4 Relevance: 21.7, Strings: 17, Instructions: 438COMMON

Download Yara Rule

Strings

]{, xrefs: 00AA70BF, 00AA70CB
%e6g, xrefs: 00AA702A
WQ, xrefs: 00AA7503
/), xrefs: 00AA7545
N[, xrefs: 00AA724D
?m,o, xrefs: 00AA7014
=], xrefs: 00AA7242
(a*c, xrefs: 00AA701F
Gt, xrefs: 00AA6ED0
sm, xrefs: 00AA7708
kW, xrefs: 00AA7258
S], xrefs: 00AA750E
CG, xrefs: 00AA790A
hi, xrefs: 00AA7A75
JG, xrefs: 00AA78FF
_Y, xrefs: 00AA7519
WH, xrefs: 00AA78F4

Memory Dump Source

Source File: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID:
String ID: %e6g$(a*c$=]$?m,o$CG$Gt$JG$N[$WH$]{$hi$kW$/)$S]$WQ$_Y$sm
API String ID: 0-1131134755
Opcode ID: 7fe6c7d6d9efdaf882a2b9df3b8a54a15053ee68894a73401dbca1371ba866d9
Instruction ID: 9fed8e78bc9efdb8c7e381dcfd4adfaf7397d9640571ccf7e21b109142c300af
Opcode Fuzzy Hash: 7fe6c7d6d9efdaf882a2b9df3b8a54a15053ee68894a73401dbca1371ba866d9
Instruction Fuzzy Hash: 2742B6B414D3858AE274CF26D681B8EBAE1BB92740F608E1DE1ED5B255DB708049CF93

Function 00AA665F Relevance: 11.4, Strings: 9, Instructions: 103COMMON

Download Yara Rule

Strings

z=Q?, xrefs: 00AA66FE
|1]3, xrefs: 00AA66E6
W!Q#, xrefs: 00AA66C6
W5W7, xrefs: 00AA66EE
,A&C, xrefs: 00AA6706
I)C+, xrefs: 00AA66D6
!E4G, xrefs: 00AA670E
@-r/, xrefs: 00AA66DE
;IJK, xrefs: 00AA6716

Memory Dump Source

Source File: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID:
String ID: !E4G$,A&C$;IJK$@-r/$I)C+$W!Q#$W5W7$z=Q?$|1]3
API String ID: 0-2124749398
Opcode ID: f2cd62d45247a4721067a6d54a2199a1ff98fbe07b7bed4634b5cc81127c74ee
Instruction ID: 9affdc3dfcb8eb815bea5b652ed94f0e41d5b492fde066992e635ed5c0ca6eb6
Opcode Fuzzy Hash: f2cd62d45247a4721067a6d54a2199a1ff98fbe07b7bed4634b5cc81127c74ee
Instruction Fuzzy Hash: FC3140B41183819BC714EF95D99062BBBF0EF86789F48592CF8D68B261E334D944CF46

Function 00A6D39B Relevance: 10.2, APIs: 1, Strings: 4, Instructions: 1436COMMONLIBRARYCODE

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 00A6D57F

Strings

1#QNAN, xrefs: 00A6D4AE
1#INF, xrefs: 00A6D4D1
1#IND, xrefs: 00A6D4A0
1#SNAN, xrefs: 00A6D4A7

Memory Dump Source

Source File: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 95d563057f792b2efd5e52a84462278ed8c506b70cd33fc484d70fa66bf20202
Instruction ID: 87ae75af391f911360a23dd2d212742cd8bb611dd9517d1032759907e7fa9336
Opcode Fuzzy Hash: 95d563057f792b2efd5e52a84462278ed8c506b70cd33fc484d70fa66bf20202
Instruction Fuzzy Hash: E7D22A75E082288FDB65CF28DD44BEAB7B5EB45345F1441EAD40EE7240EB78AE818F41

Function 00AAF2B8 Relevance: 9.1, Strings: 7, Instructions: 359COMMON

Download Yara Rule

Strings

fedc, xrefs: 00AAF65A
{l`~, xrefs: 00AAF564
mlc@, xrefs: 00AAF634
ggxz, xrefs: 00AAF55D
`tii, xrefs: 00AAF56B
aenQ, xrefs: 00AAF642
f@~!, xrefs: 00AAF4D7

Memory Dump Source

Source File: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID:
String ID: `tii$aenQ$f@~!$fedc$ggxz$mlc@${l`~
API String ID: 0-3056062858
Opcode ID: 81e2fee55be0e0ed83158224188c4395161ee7ac948e32e04c625285de5dfabf
Instruction ID: e07db2830c423e388d80a793947f285982876ca4a8439cada3156023aebe6752
Opcode Fuzzy Hash: 81e2fee55be0e0ed83158224188c4395161ee7ac948e32e04c625285de5dfabf
Instruction Fuzzy Hash: 2ED14AB4800B409FD364AF398646797BFF0BB06300F844A5DE4EB5B686D731A41ACBD2

Function 00A6C814 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,00A6CB32,00000002,00000000,?,?,?,00A6CB32,?,00000000), ref: 00A6C8AD
GetLocaleInfoW.KERNEL32(?,20001004,00A6CB32,00000002,00000000,?,?,?,00A6CB32,?,00000000), ref: 00A6C8D6
GetACP.KERNEL32(?,?,00A6CB32,?,00000000), ref: 00A6C8EB

Strings

OCP, xrefs: 00A6C868
ACP, xrefs: 00A6C832

Memory Dump Source

Source File: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 86544771097c7134bf0c4e2b09fe531b9890c61c597b5968d73d83df0002439e
Instruction ID: 6d7e4d1f3ea35c029bde11e81f7306e1482e82e5cedb20a8149f32e23861e946
Opcode Fuzzy Hash: 86544771097c7134bf0c4e2b09fe531b9890c61c597b5968d73d83df0002439e
Instruction Fuzzy Hash: AC216D72A00201EADB34CF55CD01ABB73B6AF54F70B568465E98AEB101EB32DE41D350

Function 00A6C9E9 Relevance: 7.7, APIs: 5, Instructions: 183COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00A64EB1: GetLastError.KERNEL32(?,00000008,00A69482), ref: 00A64EB5
Part of subcall function 00A64EB1: SetLastError.KERNEL32(00000000,00A7C480,00000024,00A60419), ref: 00A64F57

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 00A6CAF5
IsValidCodePage.KERNEL32(00000000), ref: 00A6CB3E
IsValidLocale.KERNEL32(?,00000001), ref: 00A6CB4D
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 00A6CB95
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 00A6CBB4

Memory Dump Source

Source File: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID:
API String ID: 415426439-0
Opcode ID: d4325bd30ef0008eb8efdcf966c8dd5a811539f656ad2a20ced3c0fad7b3410e
Instruction ID: a1d4b66d0a1da3dd85fc6a392821e097216434c6aadd3704158a7f6822d905c3
Opcode Fuzzy Hash: d4325bd30ef0008eb8efdcf966c8dd5a811539f656ad2a20ced3c0fad7b3410e
Instruction Fuzzy Hash: 4651A072A00209ABDF10DFA5CC46ABEB7B8FF18750F148429E994EB190E770DA45CB61

Function 00AAAC81 Relevance: 7.5, Strings: 6, Instructions: 38COMMON

Download Yara Rule

Strings

%AUU, xrefs: 00AAAC91
iP`R, xrefs: 00AAAC8A
n\+H, xrefs: 00AAAC98
upH}, xrefs: 00AAACAD
1 G@, xrefs: 00AAACA6
hX]N, xrefs: 00AAAC9F

Memory Dump Source

Source File: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID:
String ID: %AUU$1 G@$hX]N$iP`R$n\+H$upH}
API String ID: 0-3520097955
Opcode ID: 6209497fda56ba42c0ca55be78a875de8b250e6332eb0d406aaca2855171a349
Instruction ID: 2ecc3b7b8b70e1d9ff6aff6ad699dad997cce3185a260056575a7e1358f4dd22
Opcode Fuzzy Hash: 6209497fda56ba42c0ca55be78a875de8b250e6332eb0d406aaca2855171a349
Instruction Fuzzy Hash: 900129B0801745CBDB21CF95C65066FFBF1EF06741F14480DD482A7A91C334AA44CBA6

Function 00A6C085 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 251COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00A64EB1: GetLastError.KERNEL32(?,00000008,00A69482), ref: 00A64EB5
Part of subcall function 00A64EB1: SetLastError.KERNEL32(00000000,00A7C480,00000024,00A60419), ref: 00A64F57

GetACP.KERNEL32(?,?,?,?,?,?,00A61848,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 00A6C146
IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,00A61848,?,?,?,00000055,?,-00000050,?,?), ref: 00A6C171
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 00A6C2D4

Strings

utf8, xrefs: 00A6C243

Memory Dump Source

Source File: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID: ErrorLast$CodeInfoLocalePageValid
String ID: utf8
API String ID: 607553120-905460609
Opcode ID: 49a7b1c9d27cdfc2de98527677cccdac4a07d5d3050cf4e9bf8fec728dc00480
Instruction ID: 497f368348d0f91051449aae1fbb996f8e783cfe368f04fe932213673126cd66
Opcode Fuzzy Hash: 49a7b1c9d27cdfc2de98527677cccdac4a07d5d3050cf4e9bf8fec728dc00480
Instruction Fuzzy Hash: 2A71F771A00302ABDB24BBB5CD52BBA73BCEF45B60F14452AF945D7181FB74E94187A0

Function 00A7E1CF Relevance: 7.2, Strings: 5, Instructions: 922COMMON

Download Yara Rule

Strings

i, xrefs: 00A7F7C2
0, xrefs: 00A7F316
0, xrefs: 00A7EC99
0, xrefs: 00A7ED60
@, xrefs: 00A80409

Memory Dump Source

Source File: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID:
String ID: 0$0$0$@$i
API String ID: 0-3124195287
Opcode ID: 12572a0e7900ef4fab88ceb8c21c045fe7f3c85080e9f8e24115e1caf920c67f
Instruction ID: f803d6a7673a0fb2cf88f23c5c97fb4a4fb1e4f3eacccf12977011e7014a30de
Opcode Fuzzy Hash: 12572a0e7900ef4fab88ceb8c21c045fe7f3c85080e9f8e24115e1caf920c67f
Instruction Fuzzy Hash: BC62C07160C3818FD319CF28C99076ABBE1AFD9304F18CA6DE4D997291D774DA49CB82

Function 00A63C92 Relevance: 6.3, APIs: 4, Instructions: 337COMMONLIBRARYCODE

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00A63D1F

Memory Dump Source

Source File: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 40f0e063838af908aa0c23a01ee66fead67f3bdac29e3056e6e3dd52480c6ad0
Instruction ID: 4fffcc729bd38c00e8a61c03066ffeb7096a4ef9fdf612cc8148112090998035
Opcode Fuzzy Hash: 40f0e063838af908aa0c23a01ee66fead67f3bdac29e3056e6e3dd52480c6ad0
Instruction Fuzzy Hash: 18B13673E042559FDF158F68C881BEEBBF5EF55310F14816AE905AB281D2359E07CBA0

Function 00A57922 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 00A5792E
IsDebuggerPresent.KERNEL32 ref: 00A579FA
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00A57A13
UnhandledExceptionFilter.KERNEL32(?), ref: 00A57A1D

Memory Dump Source

Source File: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 8d200fbecee9282c865bd64b855df4168c5cbbcf1aca60f340bd4107ca1e3e7a
Instruction ID: 596dfd187182a04124c7a81f4e949279a08e80576899c03fef86cd01539fc5eb
Opcode Fuzzy Hash: 8d200fbecee9282c865bd64b855df4168c5cbbcf1aca60f340bd4107ca1e3e7a
Instruction Fuzzy Hash: DC31E775D052189ADF20DFA4DD497CDBBB8BF08301F1041EAE90DAB250EB709B898F45

Function 00A7E455 Relevance: 5.5, Strings: 4, Instructions: 458COMMON

Download Yara Rule

Strings

gfff, xrefs: 00A7F0FE
-, xrefs: 00A7F0C5
gfff, xrefs: 00A7F16F
gfff, xrefs: 00A7F1B9

Memory Dump Source

Source File: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID:
String ID: -$gfff$gfff$gfff
API String ID: 0-3742897846
Opcode ID: 7718804b42ef8cf930431149c87fdc9c6f380754b2246168860b9e7f3cc38233
Instruction ID: b4301a7d2b94f1b4a916a2a79476a6d4e915884cba3c3dd0f7407ca3f502a565
Opcode Fuzzy Hash: 7718804b42ef8cf930431149c87fdc9c6f380754b2246168860b9e7f3cc38233
Instruction Fuzzy Hash: CCF1C57160C7518FC718CF29C89036ABBE2AFD9304F18CA7DE5998B396D634D945CB42

Function 00A9F138 Relevance: 5.4, Strings: 4, Instructions: 383COMMON

Download Yara Rule

Strings

sj, xrefs: 00A9F1FF
hu, xrefs: 00A9F207
a|, xrefs: 00A9F1EF
lc, xrefs: 00A9F3DF

Memory Dump Source

Source File: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID:
String ID: a|$hu$lc$sj
API String ID: 0-3748788050
Opcode ID: 2da6593b7bce017c5e70d307783f88ffe4697bf2d3fed1e3eddb71d2ace34cd3
Instruction ID: 7e518ac39f2ed08d57bdc869ff5abb5a94344fbabc9402a474154cb42f554e58
Opcode Fuzzy Hash: 2da6593b7bce017c5e70d307783f88ffe4697bf2d3fed1e3eddb71d2ace34cd3
Instruction Fuzzy Hash: 5EA19BB45083408FCB20DF18C881A6BB7F0FF96754F588A1CE8D59B291E339D951CB96

Function 00A8CB78 Relevance: 5.4, Strings: 4, Instructions: 373COMMON

Download Yara Rule

Strings

t, xrefs: 00A8CB96
J|BJ, xrefs: 00A8CEE5
VY^_, xrefs: 00A8CCD7
V, xrefs: 00A8CDB4

Memory Dump Source

Source File: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID:
String ID: J|BJ$V$VY^_$t
API String ID: 0-3701112211
Opcode ID: 43469e6f44eed1a9b836f895c9410751fc96af4312bcce639396a2a91bef0c87
Instruction ID: d6a6910f15b6ab0493eab9a225827566950eed5adcd7e52577ac1e3088383c74
Opcode Fuzzy Hash: 43469e6f44eed1a9b836f895c9410751fc96af4312bcce639396a2a91bef0c87
Instruction Fuzzy Hash: F7D168B150C3809BD310EF25859061FBBF2AB96B44F24882CF5D99B252D336CD49DFA2

Function 00AAA687 Relevance: 5.2, Strings: 4, Instructions: 213COMMON

Download Yara Rule

Strings

#', xrefs: 00AAA8C2
CV, xrefs: 00AAA863
KV, xrefs: 00AAA855
T>, xrefs: 00AAA85C

Memory Dump Source

Source File: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID:
String ID: #'$CV$KV$T>
API String ID: 0-95592268
Opcode ID: c69b9ea6594a5c43ac04cb82c4969c9d22671953c70c58e81f226922327a0ad4
Instruction ID: 3d81df4a476d43c8f104f64d40b471cffe99279c2ada535221beb2e0267daf60
Opcode Fuzzy Hash: c69b9ea6594a5c43ac04cb82c4969c9d22671953c70c58e81f226922327a0ad4
Instruction Fuzzy Hash: 6E8134F48017459BDB20DFA5C28556EBFB1FF16300F605608E486ABA95C334AA55CFA3

Function 00AA7B69 Relevance: 5.1, Strings: 4, Instructions: 80COMMON

Download Yara Rule

Strings

,{*y, xrefs: 00AA7BDF, 00AA7BEB
lk, xrefs: 00AA7B94
(g6e, xrefs: 00AA7B79
4c2a, xrefs: 00AA7B81

Memory Dump Source

Source File: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID:
String ID: (g6e$,{*y$4c2a$lk
API String ID: 0-1327526056
Opcode ID: f9dcc124c1b9a8638023c2dbdaf7777240da40c55f36b67bbdbdb3a86eb3612c
Instruction ID: 336b5163df393f36ef3bfe36727e85503c56b56f49cefdfe447508bbcb42f7e2
Opcode Fuzzy Hash: f9dcc124c1b9a8638023c2dbdaf7777240da40c55f36b67bbdbdb3a86eb3612c
Instruction Fuzzy Hash: 602159B44093818AC7309F20C5007AFB7F0FF82741F64595DE8D89B2A4DB7AC940CB96

Function 00A6C498 Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 00A64EB1: GetLastError.KERNEL32(?,00000008,00A69482), ref: 00A64EB5
Part of subcall function 00A64EB1: SetLastError.KERNEL32(00000000,00A7C480,00000024,00A60419), ref: 00A64F57

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00A6C4EC
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00A6C536
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00A6C5FC

Memory Dump Source

Source File: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID: InfoLocale$ErrorLast
String ID:
API String ID: 661929714-0
Opcode ID: 815109a47d2f840da7acba71e952ca3ae889cd36ba5c348b07aec8d5599bdf16
Instruction ID: 97e16b99e6d255d5f97e6104a1108b44d93beefccc51a3586c457ed81c3ed60e
Opcode Fuzzy Hash: 815109a47d2f840da7acba71e952ca3ae889cd36ba5c348b07aec8d5599bdf16
Instruction Fuzzy Hash: ED61A1769402079FEB28DF28CD82BBA77B8FF04324F10517AE946C6585EB34E985CB54

Function 00A5DA73 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 00A5DB6B
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 00A5DB75
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 00A5DB82

Memory Dump Source

Source File: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 0f8a54350b12bc97caecdc97b4f18d1d6b888cd5e92ae1e1f0b74500f5f67328
Instruction ID: c236960464abeb459c4f9242b948c5ff2a1db2da7aa343626f068c7d686c378a
Opcode Fuzzy Hash: 0f8a54350b12bc97caecdc97b4f18d1d6b888cd5e92ae1e1f0b74500f5f67328
Instruction Fuzzy Hash: 7131C6759012289BCB21DF64DD89BCDBBB8BF08311F5141DAE81CA7250E7749BC68F45

Function 00A7E527 Relevance: 4.2, Strings: 3, Instructions: 472COMMON

Download Yara Rule

Strings

gfff, xrefs: 00A7EE14
+, xrefs: 00A7E44B
gfff, xrefs: 00A7EE2F

Memory Dump Source

Source File: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID:
String ID: +$gfff$gfff
API String ID: 0-3646763964
Opcode ID: 35b728ad1705faf1f3b3f1732b5860e73b9f66d7c2269a3ae04d64dfcb9b7f2b
Instruction ID: d5cb8e49f3ca270faca2265d3506bb5433c5e757aa9faa24321f796b2e58830f
Opcode Fuzzy Hash: 35b728ad1705faf1f3b3f1732b5860e73b9f66d7c2269a3ae04d64dfcb9b7f2b
Instruction Fuzzy Hash: 9FF19F3160C3818FC715CF29C88426AFBE2ABD9304F18CA6EE4D987356D774D949CB92

Function 00A7E27B Relevance: 4.1, Strings: 3, Instructions: 390COMMON

Download Yara Rule

Strings

-, xrefs: 00A7EDFB
gfff, xrefs: 00A7EE14
gfff, xrefs: 00A7EE2F

Memory Dump Source

Source File: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID:
String ID: -$gfff$gfff
API String ID: 0-837351935
Opcode ID: d6ff6ad1442cbdf409bfd7bb2423588c0ae80e6daf78ca5f303bac0752b65028
Instruction ID: 3b31f14c14fed73fc7f7a5ff81f5e3ecfd6dcaee81311e5fd390811074b1d4cf
Opcode Fuzzy Hash: d6ff6ad1442cbdf409bfd7bb2423588c0ae80e6daf78ca5f303bac0752b65028
Instruction Fuzzy Hash: D0D17F3160C7818FC715CF29C88466AFBE2AFD9304F18CA6DE4D987356D634DA49CB92

Function 00A85468 Relevance: 4.1, Strings: 3, Instructions: 387COMMON

Download Yara Rule

Strings

), xrefs: 00A854E4
), xrefs: 00A854EE
IEND, xrefs: 00A858C8

Memory Dump Source

Source File: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID:
String ID: )$)$IEND
API String ID: 0-588110143
Opcode ID: 4c1adf4d3ddecd9b383167e0d128e5a9e29e2d1a0a5d0db94912750285bf625d
Instruction ID: 2ae9ed4d9d5f6077c9414f17d672ce0714978c3626072611683dddd2410a7f90
Opcode Fuzzy Hash: 4c1adf4d3ddecd9b383167e0d128e5a9e29e2d1a0a5d0db94912750285bf625d
Instruction Fuzzy Hash: 73E1F0B1A08B01AFE310EF29C88175ABBE0FF95314F14492DE99897391E775E914CBC2

Function 00AAFF74 Relevance: 4.0, Strings: 3, Instructions: 254COMMON

Download Yara Rule

Strings

LTDV, xrefs: 00AAFFE0
:, xrefs: 00AB01B5
3<, xrefs: 00AB01AE

Memory Dump Source

Source File: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID:
String ID: 3<$:$LTDV
API String ID: 0-2797654093
Opcode ID: 9e7e827bec4cf70078eb32fa0fd477bc959d63c8314f3fba064201532e789eb4
Instruction ID: 0c392275ac0b7cc48da398776ca63c74c2c30c4283c89c7e30d1e9f137a5f62c
Opcode Fuzzy Hash: 9e7e827bec4cf70078eb32fa0fd477bc959d63c8314f3fba064201532e789eb4
Instruction Fuzzy Hash: F37175700017818BDBA18F29C590B67BBF5BF16301F98598DE8D69BA93C339F805CB65

Function 00AAFFD5 Relevance: 4.0, Strings: 3, Instructions: 243COMMON

Download Yara Rule

Strings

LTDV, xrefs: 00AAFFE0
:, xrefs: 00AB01B5
3<, xrefs: 00AB01AE

Memory Dump Source

Source File: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID:
String ID: 3<$:$LTDV
API String ID: 0-2797654093
Opcode ID: 55370f4e5b9aebffe46f1c775ac834abbae90c9ef6c8401be1cb76cf2d82a942
Instruction ID: a487729f7e06d7a6969c24c590d3a06e5a5ddf5596b1e13377bbcc363fef76fa
Opcode Fuzzy Hash: 55370f4e5b9aebffe46f1c775ac834abbae90c9ef6c8401be1cb76cf2d82a942
Instruction Fuzzy Hash: 226177700157818BDB618F29C990B66BBF5BF17301F98588DE8C69FA93C339E815CB61

Function 00AACF30 Relevance: 3.8, Strings: 3, Instructions: 67COMMON

Download Yara Rule

Strings

^XF^, xrefs: 00AACF8B
:, xrefs: 00AACF5F
J\KR, xrefs: 00AACF50

Memory Dump Source

Source File: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID:
String ID: :$J\KR$^XF^
API String ID: 0-4266130588
Opcode ID: 64bd0f38261b9b9006df79643b90736e476ce14dd74394cd61dbc2cb2afcfc2a
Instruction ID: 1009df109347142561f0f144884409274d056830716a72972a87bf0a3603d04f
Opcode Fuzzy Hash: 64bd0f38261b9b9006df79643b90736e476ce14dd74394cd61dbc2cb2afcfc2a
Instruction Fuzzy Hash: 85214A7500C3908FD312DF29805062EFBE2AF87754F58495CE4E55B291C336D90A8B62

Function 00A5FEF0 Relevance: 3.4, APIs: 2, Instructions: 449COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b78e9bc5a25061f1abca4818c36b3245c47596756df3441acd3b4668cd2eb70a
Instruction ID: a0efb5fa3bfcb638832735cc0692acd3d38b610c242b9f083251f55c06a744f1
Opcode Fuzzy Hash: b78e9bc5a25061f1abca4818c36b3245c47596756df3441acd3b4668cd2eb70a
Instruction Fuzzy Hash: D9F15071E002199FDF14CFA9C894AAEF7B1FF89314F158269E919AB381D7309E45CB80

Function 00AC0F18 Relevance: 3.1, Strings: 2, Instructions: 577COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00AC0F7C, 00AC0F85
f, xrefs: 00AC10E4

Memory Dump Source

Source File: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID:
String ID: %*+($f
API String ID: 0-2038831151
Opcode ID: 89d37b99ddcec098b1c0d00c9a8877e78529c77cf73c3d1d79a6a6d3dd0eea3c
Instruction ID: e767667e46a7527c604a42c2613165b5e0a4014f3a2f243e2f42f0003e73fff9
Opcode Fuzzy Hash: 89d37b99ddcec098b1c0d00c9a8877e78529c77cf73c3d1d79a6a6d3dd0eea3c
Instruction Fuzzy Hash: B4129A716083819FC715CF18C880F2EBBE5FB8A314F198A2DE4959B392D735E945CB92

Function 00A9CEB7 Relevance: 2.7, Strings: 2, Instructions: 185COMMON

Download Yara Rule

Strings

Ye[g, xrefs: 00A9CFCE
BaBc, xrefs: 00A9D06F

Memory Dump Source

Source File: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID:
String ID: BaBc$Ye[g
API String ID: 0-286865133
Opcode ID: f1f7f391700c1d153706023ea2e533e08aec07d0302d054125fe460e923244f9
Instruction ID: 322d12e0fd2d69eed231e782c9e10949ca1c5ef3fe906bd4d28a81c0942cab58
Opcode Fuzzy Hash: f1f7f391700c1d153706023ea2e533e08aec07d0302d054125fe460e923244f9
Instruction Fuzzy Hash: A351CCB16083818BCB31DF15C481BABB7E1FF96320F18491DE49A9B690E3749884CB57

Function 00AB0F18 Relevance: 2.6, Strings: 2, Instructions: 128COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00AB0FC7
40F9, xrefs: 00AB0F21

Memory Dump Source

Source File: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID:
String ID: %*+($40F9
API String ID: 0-4141425864
Opcode ID: e36d9df26ce8d8e7db79f00bc2036a7f7c8980a0d99b81a382e9f2e5388ff683
Instruction ID: bae1fc0250dae58e64d0e22f035d0c43f9f78b2473f13f0b769951a0f7e488ef
Opcode Fuzzy Hash: e36d9df26ce8d8e7db79f00bc2036a7f7c8980a0d99b81a382e9f2e5388ff683
Instruction Fuzzy Hash: 31417970111B818BD7358F25C5A0B76BBB6BF16305FA4544DE4C69BA93C332F816CB64

Function 00A7DED8 Relevance: 2.5, Strings: 1, Instructions: 1295COMMON

Download Yara Rule

Strings

@, xrefs: 00A7FB18

Memory Dump Source

Source File: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: b9ab761e06cb60054b554ba1fd181e1af7336824aa7e9b9d9034564fed5e9b5a
Instruction ID: c40d80b614c5ba4cf0f428d4edb361f00fef79b998b02b2b5c5878bf09fc858e
Opcode Fuzzy Hash: b9ab761e06cb60054b554ba1fd181e1af7336824aa7e9b9d9034564fed5e9b5a
Instruction Fuzzy Hash: 6F92D1716083518FD718CF28C89466ABBE2AFC9314F18C63DE899DB391D674DE49CB81

Function 00A6572C Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00A65727,?,?,00000008,?,?,00A715F5,00000000), ref: 00A65959

Memory Dump Source

Source File: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 68af30562a56038d77f7887093c4558cddd3ddb833c407fe36b820be169d8c5c
Instruction ID: 2f91d79b8d44b4618815dc59abe3ef825ff28fdad60442e0c01a8d70731276ab
Opcode Fuzzy Hash: 68af30562a56038d77f7887093c4558cddd3ddb833c407fe36b820be169d8c5c
Instruction Fuzzy Hash: E8B12E32A10A05DFD719CF28C486B657BF0FF45365F258659E899CF2A1C335E991CB40

Function 00A5729C Relevance: 1.7, APIs: 1, Instructions: 242COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 00A572B2

Memory Dump Source

Source File: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: d56f5b1a6edf31907c511945011600f6edb0bb1fac067a3a2a88f3d2d91e4f7f
Instruction ID: ad473d9f13345d2c4ab32e1a6a2c1a684e618f797909085d904947bded9294fa
Opcode Fuzzy Hash: d56f5b1a6edf31907c511945011600f6edb0bb1fac067a3a2a88f3d2d91e4f7f
Instruction Fuzzy Hash: 41A140B19156058FDB18CFA4EC8569DBBF1FB48326F24912AD81AEB360D3349987CF50

Function 00AAE1A8 Relevance: 1.7, Strings: 1, Instructions: 484COMMON

Download Yara Rule

Strings

", xrefs: 00AAE4A9

Memory Dump Source

Source File: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: 1e36e4a90a5bcd9904d9a2755a98640d2f51fe7f53356f7c076c40d918f289ea
Instruction ID: 0e7d3ed2194d41eabf393f744ea3efa3d83a533c344ad10615fbd595ba6da250
Opcode Fuzzy Hash: 1e36e4a90a5bcd9904d9a2755a98640d2f51fe7f53356f7c076c40d918f289ea
Instruction Fuzzy Hash: 41F1F371A083515FDB25CF24C490A6BBBE6ABD6310F18C96DE89A8B3C2D734DD05C792

Function 00AA4D38 Relevance: 1.7, Strings: 1, Instructions: 425COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00AA513B, 00AA5143

Memory Dump Source

Source File: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: ccee2a807569c25fde004874fc692891e8030e5aaea5b8ac7fbb6ff0169ecf93
Instruction ID: 59f1665b03115fe1c7a4187e0897ee1b982bbfdda390dd5c35cc22401f7f8c3b
Opcode Fuzzy Hash: ccee2a807569c25fde004874fc692891e8030e5aaea5b8ac7fbb6ff0169ecf93
Instruction Fuzzy Hash: F9C1BFB1908300AFDB21AB24C981A6BB7F5EF96750F09891CF8C497291E375DD14CBA6

Function 00AB0813 Relevance: 1.6, Strings: 1, Instructions: 363COMMON

Download Yara Rule

Strings

Zvt~, xrefs: 00AB081F

Memory Dump Source

Source File: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID:
String ID: Zvt~
API String ID: 0-694600945
Opcode ID: a6c653d8a13b2bff62d9e48921e2962895175bf4283dfb7f1703a331fac975e3
Instruction ID: 11ae00e5e2286f2fe8dcf61f1384ada073f7c0d8cbfe32f39cb54f2fd6141ae9
Opcode Fuzzy Hash: a6c653d8a13b2bff62d9e48921e2962895175bf4283dfb7f1703a331fac975e3
Instruction Fuzzy Hash: ABC179701047818FD7668F39C190B66BBE1BF16304F68989DE4DA9BB93C736E806CB54

Function 00A69ABF Relevance: 1.6, APIs: 1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd2af48b65965926cfc307c1dc0c35430c1a6098e11ccd3ae54cee8e8f466eee
Instruction ID: 140360ece6df7d1356fa0411b6f7d7813625b5327441c80699e51df230cc4ed4
Opcode Fuzzy Hash: fd2af48b65965926cfc307c1dc0c35430c1a6098e11ccd3ae54cee8e8f466eee
Instruction Fuzzy Hash: D231F876900219AFCB20EFB9DC89EBBB7BDEB84354F144198F905D7244EA30EE418B50

Function 00AA9BA8 Relevance: 1.6, Strings: 1, Instructions: 357COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00AA9C9B, 00AA9CA3

Memory Dump Source

Source File: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: f162ee7309057f34a05e18a7188bb59e25b4a99871efe8703988e1fac2c245e9
Instruction ID: d1084038569cc4c1ea1abb59cd0fe133ab1eba5851a31c4ddb9e88fc21830d65
Opcode Fuzzy Hash: f162ee7309057f34a05e18a7188bb59e25b4a99871efe8703988e1fac2c245e9
Instruction Fuzzy Hash: A2B1DDB16083419FDB14EF19C880B6FBBE6EF96350F14492CE5C59B292E335D844CBA2

Function 00A5CAF2 Relevance: 1.6, Strings: 1, Instructions: 344COMMONLIBRARYCODE

Download Yara Rule

Strings

0, xrefs: 00A5CC80

Memory Dump Source

Source File: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: e90507b19fc3f19e916183200e18ae25d31edfd1b5953245886bf133873edc07
Instruction ID: e9d9eeb47cea0e6c0271fd00b15433a9481f959d8043da68f73b395e3308d54c
Opcode Fuzzy Hash: e90507b19fc3f19e916183200e18ae25d31edfd1b5953245886bf133873edc07
Instruction Fuzzy Hash: 32C1D07450074A8FCB28CF28C58267EBBB2BF05322F244619DC56DB299D734AD4DCB91

Function 00A6C6EB Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 00A64EB1: GetLastError.KERNEL32(?,00000008,00A69482), ref: 00A64EB5
Part of subcall function 00A64EB1: SetLastError.KERNEL32(00000000,00A7C480,00000024,00A60419), ref: 00A64F57

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00A6C73F

Memory Dump Source

Source File: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 430946614fcebb3c2e858a5989fd76f088feccae519643ce0fec06ff13266e8f
Instruction ID: 6594c3a7222ba752e4ad48ce7d2c92badbe0ade958af6f6a42f411d8cbb67259
Opcode Fuzzy Hash: 430946614fcebb3c2e858a5989fd76f088feccae519643ce0fec06ff13266e8f
Instruction Fuzzy Hash: E3219F72A01206ABEF28AF65DD42ABA77BCEF44720F10407AFD46D6181EB34ED458B50

Function 00AC4E98 Relevance: 1.6, Strings: 1, Instructions: 331COMMON

Download Yara Rule

Strings

P, xrefs: 00AC503F

Memory Dump Source

Source File: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID:
String ID: P
API String ID: 0-3110715001
Opcode ID: b4fda1ba9dc91e6581218cfb9f953b2bbd6cc257535fdb74648dd629dc9337cc
Instruction ID: fa0e85620f9d55775bcc881a1e6bcdccb635d6898cf0ad245dd77fc42da42374
Opcode Fuzzy Hash: b4fda1ba9dc91e6581218cfb9f953b2bbd6cc257535fdb74648dd629dc9337cc
Instruction Fuzzy Hash: 93B1DF719087618FC715CF28D890B2EB7E1EB85754F168A2CF8A59B380C775EC458BD2

Function 00A6C372 Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00A64EB1: GetLastError.KERNEL32(?,00000008,00A69482), ref: 00A64EB5
Part of subcall function 00A64EB1: SetLastError.KERNEL32(00000000,00A7C480,00000024,00A60419), ref: 00A64F57

EnumSystemLocalesW.KERNEL32(00A6C498,00000001,00000000,?,-00000050,?,00A6CAC9,00000000,?,?,?,00000055,?), ref: 00A6C3E4

Memory Dump Source

Source File: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 05e63556ec8d608a2ab7015994b5885e50e95ee9fb6a7c3ae40b4c56c95d3311
Instruction ID: 24f7a83bdda1e40face04baf2fb3cf2545991b7bc1525f7ef1dc3836c7557fc9
Opcode Fuzzy Hash: 05e63556ec8d608a2ab7015994b5885e50e95ee9fb6a7c3ae40b4c56c95d3311
Instruction Fuzzy Hash: A811023B2003055FDB18AF39C9A56BABBA1FF84768B14842DE9878BB40D771A942C740

Function 00A6C91A Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 00A64EB1: GetLastError.KERNEL32(?,00000008,00A69482), ref: 00A64EB5
Part of subcall function 00A64EB1: SetLastError.KERNEL32(00000000,00A7C480,00000024,00A60419), ref: 00A64F57

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,00A6C6B4,00000000,00000000,?), ref: 00A6C946

Memory Dump Source

Source File: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: e8612add5b830457f6f1bdc2c019af62424ef529b67b629b5bda1adac92af471
Instruction ID: 30d2a9eda43750c8838e848c105f3f01e6f9cc8ed2f2833e171c375e782bb703
Opcode Fuzzy Hash: e8612add5b830457f6f1bdc2c019af62424ef529b67b629b5bda1adac92af471
Instruction Fuzzy Hash: EAF0A933500111BBDF2497658C09BBA7778EF40774F154428ED96A3184DA74FE42C5A0

Function 00A6C40D Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00A64EB1: GetLastError.KERNEL32(?,00000008,00A69482), ref: 00A64EB5
Part of subcall function 00A64EB1: SetLastError.KERNEL32(00000000,00A7C480,00000024,00A60419), ref: 00A64F57

EnumSystemLocalesW.KERNEL32(00A6C6EB,00000001,?,?,-00000050,?,00A6CA8D,-00000050,?,?,?,00000055,?,-00000050,?,?), ref: 00A6C457

Memory Dump Source

Source File: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: be85a65078dbb8773cd8d850b78c1cb21eed98d8a741904cc786abf5a54948ed
Instruction ID: ff63203a17af0d7aa6615bd2f2b9047675d776f6217090b4302e3ec24f47c580
Opcode Fuzzy Hash: be85a65078dbb8773cd8d850b78c1cb21eed98d8a741904cc786abf5a54948ed
Instruction Fuzzy Hash: EEF0F6363043046FDB149F79DC99A7A7BA1FF80778F15842DF9868B690DA719C42C650

Function 00A65D7F Relevance: 1.5, APIs: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00A5DDC1: EnterCriticalSection.KERNEL32(?,?,00A64B89,?,00A7C2E0,00000008,00A64D4D,?,00A5C446,?), ref: 00A5DDD0

EnumSystemLocalesW.KERNEL32(00A65D72,00000001,00A7C3A0,0000000C,00A66127,00000000), ref: 00A65DB7

Memory Dump Source

Source File: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: 454cbc4089bd3ccccc5111791914c317e3069e3df9f0c579b45b66d409dc1285
Instruction ID: 5c35914a58caa27e38e714c502efe24952ac349e7a7a75f35e9f251213ed993a
Opcode Fuzzy Hash: 454cbc4089bd3ccccc5111791914c317e3069e3df9f0c579b45b66d409dc1285
Instruction Fuzzy Hash: 69F04972A04200EFD710EFA8E842B9D7BB0FB48721F10811AF406EB2E1D7759946CB44

Function 00A6C327 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00A64EB1: GetLastError.KERNEL32(?,00000008,00A69482), ref: 00A64EB5
Part of subcall function 00A64EB1: SetLastError.KERNEL32(00000000,00A7C480,00000024,00A60419), ref: 00A64F57

EnumSystemLocalesW.KERNEL32(00A6C280,00000001,?,?,?,00A6CAEB,-00000050,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 00A6C35E

Memory Dump Source

Source File: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 7f8b340b4068f2c7ab3e91878cbdde786505b7d4ae0fcbf38e60ba1adc72468c
Instruction ID: 5615dbe760e7442810369bd80b608b15b862ed556081e6937885d67e463d6ce9
Opcode Fuzzy Hash: 7f8b340b4068f2c7ab3e91878cbdde786505b7d4ae0fcbf38e60ba1adc72468c
Instruction Fuzzy Hash: 32F0E53630024567CB14AF75DC556BABFA4FFC1B70B068058EE098B690C6729987D790

Function 00A6622B Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,?,?,00A623AE,?,20001004,00000000,00000002,?,?,00A619B0), ref: 00A6625F

Memory Dump Source

Source File: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 97103b3333931d1bcc2a526fead2b840cd631b03c33efd57240578ef2fb3db64
Instruction ID: 7ab8076e6922e3037de8a07aed17d4e64450512fa063a4560de1eeed4db9fa0f
Opcode Fuzzy Hash: 97103b3333931d1bcc2a526fead2b840cd631b03c33efd57240578ef2fb3db64
Instruction Fuzzy Hash: 58E04F32900228BBCF126F70DC08AAE7F3AEF44760F01C010FD4965221CB728E21AB95

Function 00A7E272 Relevance: 1.5, Strings: 1, Instructions: 273COMMON

Download Yara Rule

Strings

@, xrefs: 00A7E78E

Memory Dump Source

Source File: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 33c5a5b9aaa3ad7d40147cb7931ce02fe19695e2396a5ce853ba19e0c001f1db
Instruction ID: a656b46dabb35a00080f91f0d9ddb86f1e0899d7866ccee5514c61366edf0a8d
Opcode Fuzzy Hash: 33c5a5b9aaa3ad7d40147cb7931ce02fe19695e2396a5ce853ba19e0c001f1db
Instruction Fuzzy Hash: A5A18B716087818FC718CF18C89476ABBE1AFD9308F18CA6DE5D997391D774D908CB82

Function 00A87728 Relevance: 1.5, Strings: 1, Instructions: 271COMMON

Download Yara Rule

Strings

,, xrefs: 00A8789B

Memory Dump Source

Source File: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID:
String ID: ,
API String ID: 0-3772416878
Opcode ID: 6a3fef2072c4110c7e08f213014c8aa891b97c95317c3c670d38149bab24221c
Instruction ID: 4df3df102bd751ac29ff68224118560e1bbd5edb17b065dc7da86a6107d9e9ff
Opcode Fuzzy Hash: 6a3fef2072c4110c7e08f213014c8aa891b97c95317c3c670d38149bab24221c
Instruction Fuzzy Hash: 7DB1157110C3819FD324DF68C88061FBBE0AFA9704F584A2DF5D997382D671EA18CB96

Function 00A57AAF Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00007ABB,00A56DC9), ref: 00A57AB4

Memory Dump Source

Source File: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 9edca2d52e386abd8e4e712e382d059d57ddf9593c0b9a05c593faa81ba351e3
Instruction ID: 8529ef8b9d7de0b8e2e2d391d78a9333cec53a8460a0b119fb6a0d7521a51be9
Opcode Fuzzy Hash: 9edca2d52e386abd8e4e712e382d059d57ddf9593c0b9a05c593faa81ba351e3
Instruction Fuzzy Hash:

Function 00AC1918 Relevance: 1.5, Strings: 1, Instructions: 220COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00AC1B0B, 00AC1B13

Memory Dump Source

Source File: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: 0caa54ea1a90315641ea19c1d2cce55cd527f95500d153b2503ff0c6c28a3b73
Instruction ID: 7591816d8b227020973c3af55b1ddb2ca94278f043c21b246067af91e0c4a31c
Opcode Fuzzy Hash: 0caa54ea1a90315641ea19c1d2cce55cd527f95500d153b2503ff0c6c28a3b73
Instruction Fuzzy Hash: 8861D1717093419BDB14DF55C880F2ABBE6EF86390F1A891CE5D58B292D731EC50CB52

Function 00AC07F8 Relevance: 1.4, Strings: 1, Instructions: 172COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00AC08BB, 00AC08C3

Memory Dump Source

Source File: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: 48588023ea1370a3b3f62b516369bf0138abb56be5ee286ad8c44f99da0f281a
Instruction ID: a2aa46389f491fe1dfe3f978b5cc6e5a4492c28627b3bb4855a7c45f83c0bf66
Opcode Fuzzy Hash: 48588023ea1370a3b3f62b516369bf0138abb56be5ee286ad8c44f99da0f281a
Instruction Fuzzy Hash: 0F516D70A09300DBDB24DF15C990F2ABBE6EF89745F16892CE4C597252D731EC50CB62

Function 00A51D79 Relevance: 1.4, Strings: 1, Instructions: 156COMMON

Download Yara Rule

Strings

Z81xbyuAua, xrefs: 00A51E9B

Memory Dump Source

Source File: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID:
String ID: Z81xbyuAua
API String ID: 0-3121583705
Opcode ID: fd6bee106d9e155f98ed135f7fa46da4b37fd30282e45e245758f8fee4a9762a
Instruction ID: eb14d0e63f74b5e80e670d9d68c477fde4e17e1d1f57f69eb7c057c90e8c0b85
Opcode Fuzzy Hash: fd6bee106d9e155f98ed135f7fa46da4b37fd30282e45e245758f8fee4a9762a
Instruction Fuzzy Hash: A7411776E2012B5BCB0CEEB888561BEBB69EB56351B04427ADD11DB3D1E2348A05CAD0

Function 00A8EAC6 Relevance: 1.4, Strings: 1, Instructions: 128COMMON

Download Yara Rule

Strings

L3, xrefs: 00A8EB16

Memory Dump Source

Source File: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID:
String ID: L3
API String ID: 0-2730849248
Opcode ID: bf5552e4f83f3bf5aa9e4b1957c4ed33519c9f7afd665e70c400cb02b69d6293
Instruction ID: c4d7800ef268a168ed66d150ac429283f8a3e16458e1281275fc7364483f9289
Opcode Fuzzy Hash: bf5552e4f83f3bf5aa9e4b1957c4ed33519c9f7afd665e70c400cb02b69d6293
Instruction Fuzzy Hash: 174152B41083809BDB14EF15C854A2FBBF0BF86714F04991CF9C69B2A1D736CA15CB5A

Function 00ABCB36 Relevance: 1.4, Strings: 1, Instructions: 127COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00ABCB7C, 00ABCB85

Memory Dump Source

Source File: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: c9c3511cf99027d5277ab4afa78953f19eeb9f45ac490c8b653ea83e395facf0
Instruction ID: b8854ec11f7ed75da550966512e163be763120e9f86fd359be8413de0ecb305d
Opcode Fuzzy Hash: c9c3511cf99027d5277ab4afa78953f19eeb9f45ac490c8b653ea83e395facf0
Instruction Fuzzy Hash: 1341BFB0608341ABD724DF54DD85F2EBBF9FB9A742F14882CE584A7252D331D8048B26

Function 00ABCE48 Relevance: 1.4, Strings: 1, Instructions: 124COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00ABCF0B, 00ABCF13

Memory Dump Source

Source File: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: e1a7b55e822f4c4c0b190b196c54346a81db642f877fb84c2c593a9f1511728d
Instruction ID: a031c2910e11a96d06f2b2d782dc49cef3d5b0d064e30bbd714fc26a8ab1b3b6
Opcode Fuzzy Hash: e1a7b55e822f4c4c0b190b196c54346a81db642f877fb84c2c593a9f1511728d
Instruction Fuzzy Hash: 4F31B2B1908311ABDA10EB28DD81F7BB7EEEB85754F144868F884D7253E231EC14C762

Function 00AA5824 Relevance: 1.4, Strings: 1, Instructions: 124COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00AA585B, 00AA5863

Memory Dump Source

Source File: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: 452cdd5390474614f0ddbf0a7bb649cabe469c3da803ff3115ae04a2fb717320
Instruction ID: 6b7a64056a7e668533f3d40f68a96d7737ca5dcd564bb27143260eef88970bda
Opcode Fuzzy Hash: 452cdd5390474614f0ddbf0a7bb649cabe469c3da803ff3115ae04a2fb717320
Instruction Fuzzy Hash: 0D41AE70A09741EFD719DF28C8C0B2EBBE5EB8A781F640A1CE1C087291D331E8108B5A

Function 00A93E69 Relevance: 1.4, Strings: 1, Instructions: 108COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00A93F13

Memory Dump Source

Source File: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: 532d68ad360e3601756663246d56755396bef2663983efa083b5df1ddb856f39
Instruction ID: f769d1f161281d29e14aaf910fb2a2c7284bd3d1bd391d308b4659791dbfa647
Opcode Fuzzy Hash: 532d68ad360e3601756663246d56755396bef2663983efa083b5df1ddb856f39
Instruction Fuzzy Hash: D4411776601B009FDF348F65C994B26BBF2FB49741F14891CE58B9BAA1E731F9108B14

Function 00AC3833 Relevance: 1.4, Strings: 1, Instructions: 100COMMON

Download Yara Rule

Strings

@, xrefs: 00AC389D

Memory Dump Source

Source File: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: c4c03cbc5544a13e512ffd9534df50902cc064df239456c5298f338a1898222a
Instruction ID: b466e12f4313ffacbb9737389778fb00a17b5c3fb3dff611c41ae7001dc8bccb
Opcode Fuzzy Hash: c4c03cbc5544a13e512ffd9534df50902cc064df239456c5298f338a1898222a
Instruction Fuzzy Hash: 313178B29083019FDB18EF18C8A0B2EB7F1EF89345F45892CE5C697261E375DA44CB56

Function 00AC6BB8 Relevance: 1.3, Strings: 1, Instructions: 87COMMON

Download Yara Rule

Strings

@, xrefs: 00AC6C08

Memory Dump Source

Source File: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: f17ffc2d6e27705a654a95a8f2915903712d92e1ab09fb38acfa9e2b53ebfc9f
Instruction ID: 86d4133c4b6c0887ec178353607e6631364e490477ce83b9de31806d906e7997
Opcode Fuzzy Hash: f17ffc2d6e27705a654a95a8f2915903712d92e1ab09fb38acfa9e2b53ebfc9f
Instruction Fuzzy Hash: 603187B090D3008BD714DF15D880A2EFBF5EF9A315F14892CE5C897251D332D904CBA6

Function 00A9C89C Relevance: 1.3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00A9C8EF

Memory Dump Source

Source File: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: 24268017a7ecd41d9c94378706e298c4005a58272b1363c3163575431a6d74e9
Instruction ID: d3ce25acc5dc1ed870150596c36887e57eb21aa3adb3338028bb70945f4d6a55
Opcode Fuzzy Hash: 24268017a7ecd41d9c94378706e298c4005a58272b1363c3163575431a6d74e9
Instruction Fuzzy Hash: CF218E71608342CFCB34CF18D894BAAB7E1FB95351F54082CE08983642D731A950CB86

Function 00AA93AF Relevance: 1.3, Strings: 1, Instructions: 67COMMON

Download Yara Rule

Strings

~/i!, xrefs: 00AA940F

Memory Dump Source

Source File: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID:
String ID: ~/i!
API String ID: 0-1642318302
Opcode ID: ca5e31d4c722cdb773ff07964b58c5f5501e65a1289eb1d493cab06e26b7a2d7
Instruction ID: 9d6a97c12a0ffb8389b71288d79d5cdccaafe1d9ff39f4b3ba6a13cf2f380cb2
Opcode Fuzzy Hash: ca5e31d4c722cdb773ff07964b58c5f5501e65a1289eb1d493cab06e26b7a2d7
Instruction Fuzzy Hash: 6941B8B481D3849EE3209F518545B8FFBF1BB91314FA08E0DE6E85B251D771940A8F97

Function 00AAB56A Relevance: 1.3, Strings: 1, Instructions: 46COMMON

Download Yara Rule

Strings

72?1, xrefs: 00AAB57A

Memory Dump Source

Source File: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID:
String ID: 72?1
API String ID: 0-1649870076
Opcode ID: 76f8ab0ed0d94e201e3e07d0fa783b670310ded641f28510d027d2591c6b76f4
Instruction ID: ee94a80c2fced6fa77b3031ff3759b97a5ac828b562db3f15d871b0fd24ab7c7
Opcode Fuzzy Hash: 76f8ab0ed0d94e201e3e07d0fa783b670310ded641f28510d027d2591c6b76f4
Instruction Fuzzy Hash: 48016DB18006459FDB25DF95D5849BFFBF6AB47301F50090CE482BB681C334AA05CB76

Function 00A6CC4B Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00A6CC4B

Memory Dump Source

Source File: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: bc2b7049d692c55a81958eb1563306794dc65fc4afa858e13ab60a6fa019cb5b
Instruction ID: 33e616db75796fac02ef4f07710bf9f382d35db2044616968332f4b47cf8e472
Opcode Fuzzy Hash: bc2b7049d692c55a81958eb1563306794dc65fc4afa858e13ab60a6fa019cb5b
Instruction Fuzzy Hash: F2A012301011008B4B00CF795D0520C37D46504180345C016D405C4020E62044817F01

Function 00A88D88 Relevance: .9, Instructions: 895COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6de66e3364744c6f46b7430cdf404bec020986853ce93ecd62be46533fc1686f
Instruction ID: 182a57b5edbe7f29d66391f5a64ed7f70cd8b89dfa71df26bf85d38028080978
Opcode Fuzzy Hash: 6de66e3364744c6f46b7430cdf404bec020986853ce93ecd62be46533fc1686f
Instruction Fuzzy Hash: 86522631A087128BC725EF18D8842BBB3E1FFD5315F6D4A2DD9D693280EB34A855C786

Function 00A88278 Relevance: .7, Instructions: 670COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31e46b44ab80c96838bc845868810fc41c008ea86121d9247d5acbc9ded64e9c
Instruction ID: d209cd898b8311fdd6bbecea5c37f17f325abb73accb1f62918032b93bbe26b9
Opcode Fuzzy Hash: 31e46b44ab80c96838bc845868810fc41c008ea86121d9247d5acbc9ded64e9c
Instruction Fuzzy Hash: F152B4B0908B848FEB35EB24C4843A7BBE1EF91310F94492DC5EA066C2DF7DA985C755

Function 00A840C8 Relevance: .7, Instructions: 657COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b06f627f8f7063155f207e74ffce46a74d4b27d2ae33735865de5c38f21a1d3
Instruction ID: 98ef1297ae7cf1119fc8fb450dc5de91f63262f962283ba25a2c4d6a989b2478
Opcode Fuzzy Hash: 6b06f627f8f7063155f207e74ffce46a74d4b27d2ae33735865de5c38f21a1d3
Instruction Fuzzy Hash: 5052B0315083468FCB18DF19C0906AEBBE1FF89314F598A6DE8D95B351D778E889CB81

Function 00A84AC8 Relevance: .6, Instructions: 592COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90a9ddde86f9f0d6dcf61a8da39fda9f839fcfb56b46b398fe7e1491a94c2c2e
Instruction ID: e1e4ddb8248d18c492c82d56e62520f74f890fc3210da15b54d6adc3c286fdf5
Opcode Fuzzy Hash: 90a9ddde86f9f0d6dcf61a8da39fda9f839fcfb56b46b398fe7e1491a94c2c2e
Instruction Fuzzy Hash: 82321270915B118FC368EF29C59066ABBF1BF49710BA04A2ED6A787F90D736F844CB10

Function 00A871D8 Relevance: .5, Instructions: 459COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8dbf8a9190905fd82ba4d34b3568b61c3c587483ba5650872ac470c2db95d517
Instruction ID: 0cbf23e11ea33a8310a1cfd15e2f4e2cf0d5ed7eb3e1ffa339934ac2060cf084
Opcode Fuzzy Hash: 8dbf8a9190905fd82ba4d34b3568b61c3c587483ba5650872ac470c2db95d517
Instruction Fuzzy Hash: CEF1AA7620C7418FC724DF29C88166BFBE6AFD8300F58882DE4D987751E635E948CB66

Function 00A80488 Relevance: .4, Instructions: 411COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da9e90a145ef812cea4a1aec4dc33611fe657f569e89895301b885733208a132
Instruction ID: 0d0545a26618a433e1411eab24c3c704549cb1eb78f65160883694632a3d654c
Opcode Fuzzy Hash: da9e90a145ef812cea4a1aec4dc33611fe657f569e89895301b885733208a132
Instruction Fuzzy Hash: A0D1E471A083119BC748DF28C980A1FB7E1EFC8750F158A3DF999973A1E675DC498B82

Function 00AC4988 Relevance: .4, Instructions: 354COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab695292c8b8be27e531aa2b31291d186ec3fa8c2225d2167c1a821e12252e0c
Instruction ID: f7945a8927c2479d4a9e40a54c3b0bfa008e601706cb15289b711b731822838e
Opcode Fuzzy Hash: ab695292c8b8be27e531aa2b31291d186ec3fa8c2225d2167c1a821e12252e0c
Instruction Fuzzy Hash: 42B118B1A083504BE714DF29CC51B6BB7E5EBC8310F0A492DF9A997351E735DC048796

Function 00AB0B22 Relevance: .3, Instructions: 330COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ee771dfa70001f925bfea03d664bd7776843dac40e7f18ab3edc6201f5f4258
Instruction ID: 6bdeb232156d974a637146190fbb31e62a0693ee1d822ddf99e04be151d37663
Opcode Fuzzy Hash: 0ee771dfa70001f925bfea03d664bd7776843dac40e7f18ab3edc6201f5f4258
Instruction Fuzzy Hash: 18B189705047818FD7668F29C190BA6BBE1BF16304F68889DE4DA9B793C736E802CB55

Function 00A6BB36 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID: ErrorLastProcess$CurrentFeatureInfoLocalePresentProcessorTerminate
String ID:
API String ID: 3471368781-0
Opcode ID: 4b01adc34d436e5810ccdca697cdc0c70a634aed9f479d6850935d342578888a
Instruction ID: a5614b6a0f6731b887e71d50b9b360fb2495f7afb8a163055d92ebfbf7371525
Opcode Fuzzy Hash: 4b01adc34d436e5810ccdca697cdc0c70a634aed9f479d6850935d342578888a
Instruction Fuzzy Hash: 58B1E5755107068BDB389F25CC92AB7B3B8FF44308F14456DEA87CA580EB75A9C6CB20

Function 00AB0B43 Relevance: .3, Instructions: 324COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b767dea67f4a2f7cf31decc1319bcbc18fec578ba60376257e9679b3c1f41b22
Instruction ID: 494e18589a7ade73f52fdd68fb6d61ed0eb4b216bd6f20e718d308028b860d20
Opcode Fuzzy Hash: b767dea67f4a2f7cf31decc1319bcbc18fec578ba60376257e9679b3c1f41b22
Instruction Fuzzy Hash: DBB188701047818FD7668F29C190B66BBE1BF56304F68889DE4DA9B793C736E806CB64

Function 00A87DE8 Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c6117061885288c1b39a5b943f8482e52345fd8b1a48c2f17ef7dcb0cf10c7c
Instruction ID: 99a10e39b50e1347c390968e43881a126d7427a45503e03b68c8b4fef4a7496e
Opcode Fuzzy Hash: 9c6117061885288c1b39a5b943f8482e52345fd8b1a48c2f17ef7dcb0cf10c7c
Instruction Fuzzy Hash: F2C15AB29487418FC370DF68CC86BABB7F1AF85318F48492DD1D9C6242EB78A155CB06

Function 00A9340E Relevance: .3, Instructions: 295COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d3e80e1e551c1b5307767355c273c929f276517553dab3428ab8c78f89de879
Instruction ID: 1225371c351df22fc7da205c06b2cde40b9079bc7b2135a43400c2dfa9d3c1f4
Opcode Fuzzy Hash: 4d3e80e1e551c1b5307767355c273c929f276517553dab3428ab8c78f89de879
Instruction Fuzzy Hash: D4B121B5600B409FDB21DF24CA80B57BBF5AF4A701F14885CE8AA8BB52D335F905CB61

Function 00AC45E8 Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a95dd50ec095db7a27f57ad37ec87d9359705260a1e90b17de809d3445c49d2e
Instruction ID: 65b588416bc14447e49dfd33cd811f3a875e213a8e585c1cee1c2675bd193348
Opcode Fuzzy Hash: a95dd50ec095db7a27f57ad37ec87d9359705260a1e90b17de809d3445c49d2e
Instruction Fuzzy Hash: 8091CF71608351ABDB24DB14CC60FAFB7E5EB8A350F56482CF99497351E731E840CB96

Function 00A82123 Relevance: .3, Instructions: 284COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2bc2c964d8783c56c0facf786f96d3b5996f0704cee37f54a01b38d77fa17338
Instruction ID: 3c1313a4168187f2d8cd6f72a89b90142528cc5de0008e829875d2517da8fc68
Opcode Fuzzy Hash: 2bc2c964d8783c56c0facf786f96d3b5996f0704cee37f54a01b38d77fa17338
Instruction Fuzzy Hash: 86A103B2A087428BE729AF19D990336FBE2EFE1304F19856DD8994B381E775DC09C741

Function 00AC6FA8 Relevance: .3, Instructions: 282COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a57c0111a676d4db74895e3ca6696bb045d8f27298eeec49787a9baf2036813
Instruction ID: 801301d88f40b503e15c3978f6ffdbe4d05e2ae0044f8acfa55949755828df01
Opcode Fuzzy Hash: 4a57c0111a676d4db74895e3ca6696bb045d8f27298eeec49787a9baf2036813
Instruction Fuzzy Hash: 4F817C342083018BDB25DF29D890F2EB7E5FF59750F1A892CE5868B261E731EC55CB92

Function 00AB33C8 Relevance: .2, Instructions: 246COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1cd372a116d043efc028469314845027128994ef8c54f150f525e54f19af1d2
Instruction ID: f09b0aa17504ed7a06cd40be92108c6afd7fa641afc4d2669a2e343abf3a3389
Opcode Fuzzy Hash: c1cd372a116d043efc028469314845027128994ef8c54f150f525e54f19af1d2
Instruction Fuzzy Hash: C5712B37B699904BC714993C4C913E6BA970BD7334B3EC379E9B08B3E6D62549064340

Function 00AA4AD8 Relevance: .2, Instructions: 242COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5eee379ce68d8c273bbc54570b7d3637e45457eb8161fd84b21c20bb6afda90
Instruction ID: 37a461303eb9d769cd106e349dae243eb1593357ace3f2a88f106cadadaa632d
Opcode Fuzzy Hash: e5eee379ce68d8c273bbc54570b7d3637e45457eb8161fd84b21c20bb6afda90
Instruction Fuzzy Hash: A6519FB1600304ABDB209F64CC86B7773B8EFCA764F188558F9498B2D1E3B5E905C762

Function 00AAAD84 Relevance: .2, Instructions: 242COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 390502a7dbc55b931af77b2cd4db89728a94f04527eb6b4d510d3d8de7dda55c
Instruction ID: 4658af11f8eab4ea854d43fbdcddfea6700a4a4bae949fb35feafb51a6caf296
Opcode Fuzzy Hash: 390502a7dbc55b931af77b2cd4db89728a94f04527eb6b4d510d3d8de7dda55c
Instruction Fuzzy Hash: 37817576E009154BCB1CCF69C85257EB6A3ABD9310B19C22DD927E73D5DF3499028B84

Function 00A9F540 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d945db3ddaf58208315b5268697068eceb6d853915d256c1e8a4390fd1e69238
Instruction ID: 71ea28d7d3df46579190e6acbc072e146a3fd2a965ee845cca8b7c47e94f2ac5
Opcode Fuzzy Hash: d945db3ddaf58208315b5268697068eceb6d853915d256c1e8a4390fd1e69238
Instruction Fuzzy Hash: BE5165B02183909FDB10EF59C891A2ABBF1FFA6750F18491CE5C59B261E379C910CB66

Function 00A82088 Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2039f829499ba2b7c9b1141e2c1bb0237ca780102234b95d4d22809a355a138f
Instruction ID: e7d2f712262ae1abf15a4264e29afa5dcbef936f6550e52cb6223c2f197b0631
Opcode Fuzzy Hash: 2039f829499ba2b7c9b1141e2c1bb0237ca780102234b95d4d22809a355a138f
Instruction Fuzzy Hash: F271D0B25083428BE7259F18D84037ABBA2EFE1304F2D866DD8994B391F775CC19C742

Function 00AAE738 Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d108e008403b3c92b59985e25fae4eb0cb21936506a5ffd7efe5999b9cc5533
Instruction ID: 27e0362cff4aa860039c73d88da55d80ceaa873d6411e0830f1a67407b201c82
Opcode Fuzzy Hash: 6d108e008403b3c92b59985e25fae4eb0cb21936506a5ffd7efe5999b9cc5533
Instruction Fuzzy Hash: 7B61BB32A083019FE764CF69C58462FFBE2ABCA350F64C82DE4998B395D374DC459B42

Function 00AB51A8 Relevance: .2, Instructions: 215COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c84dc754691bb308a9dbcbaee720ee309334a0e93e615c3737e2285dce66845
Instruction ID: 653eb659016351b2e6530a4235d64127abdbf0119c2e0208dfd1c1c4d6746fe1
Opcode Fuzzy Hash: 9c84dc754691bb308a9dbcbaee720ee309334a0e93e615c3737e2285dce66845
Instruction Fuzzy Hash: E7613537F5BE904BD314463D5C663EA6A9B5BE2370F3EC376D8B18B3E6C5A948024241

Function 00A91D02 Relevance: .2, Instructions: 203COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef974d5467c23934b05c42b7d635b16aa9e9ab43c254c6b335f5a0cd9b41eca7
Instruction ID: 2c5c1b5d733ffdcafdcf39a0ac91e4dfb76cdaa853074ea0f38ae8d115e276f8
Opcode Fuzzy Hash: ef974d5467c23934b05c42b7d635b16aa9e9ab43c254c6b335f5a0cd9b41eca7
Instruction Fuzzy Hash: 2C6137B0A00B418BDB35DF25C580B26B7F5AF56300F544A6DD49B8BA92E770F848CBA1

Function 00ABB778 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3bfe97d3e605c19e95649c7c2302aff60e9fd4c242a0f426c4f6abc5f87afd30
Instruction ID: 6d29e1a6396e6cb47b67bb9fe95f8c6f27e130cc544cc4b27f4f6e16c12e8fd8
Opcode Fuzzy Hash: 3bfe97d3e605c19e95649c7c2302aff60e9fd4c242a0f426c4f6abc5f87afd30
Instruction Fuzzy Hash: 19517CB15083548FE714DF29D89439BBBE5BBC4314F044A2DE5E987391E379DA088B92

Function 00A90F6F Relevance: .2, Instructions: 178COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48cdc4f15658e30105a6f08c7e73f5cf13de9fa3d5a0f874ad6e22d423ce7761
Instruction ID: b48abd1931e501bc0a90ade23ac763905d359d85b99eb54beb2c7e14bf5f9053
Opcode Fuzzy Hash: 48cdc4f15658e30105a6f08c7e73f5cf13de9fa3d5a0f874ad6e22d423ce7761
Instruction Fuzzy Hash: AD61B2B4D10B00AFD760AF39DA07757BEF4BB06601F504A1DE8EA96684E3316419CBE3

Function 00AC43F8 Relevance: .2, Instructions: 176COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 059aace7fb3d33d5b05fdb41d57cec956a4f2a5a1265165ba3f05433a5bfbe07
Instruction ID: 0cd91f210ee7399ee8da493d6d36de7effadc951118ed973ec2d67ff504007e6
Opcode Fuzzy Hash: 059aace7fb3d33d5b05fdb41d57cec956a4f2a5a1265165ba3f05433a5bfbe07
Instruction Fuzzy Hash: 06510471608304ABC7149F19DDA0F2EB7E6EB89754F2A862CF8A59B391C731EC108795

Function 00A8B078 Relevance: .2, Instructions: 175COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fb79119c8b7e9dc55afa4138464863e5f7e156fcefff6606c592a99b47a041b
Instruction ID: 1921adcfc9776b22d67d7f7d45d8cfa01e5ab0b2bb1f8d790e7446b2eef83e8e
Opcode Fuzzy Hash: 7fb79119c8b7e9dc55afa4138464863e5f7e156fcefff6606c592a99b47a041b
Instruction Fuzzy Hash: D25148377696904BD328AA3C5C653AA7EA30FD7334B3DC76AE5F58B3E1E61548018360

Function 00A89FE8 Relevance: .2, Instructions: 164COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a584769e959b28c720a83d526e0753d41a88e74ccf0ead47e7f50f9f79b33220
Instruction ID: 18831de9a139f8c6e3f48462e170a05f3e1c124ed44cb9c75aaa4d527d448022
Opcode Fuzzy Hash: a584769e959b28c720a83d526e0753d41a88e74ccf0ead47e7f50f9f79b33220
Instruction Fuzzy Hash: 7841477490C340ABE701BF68D648A2EFBF5AFA2741F048D1DE5C897252C336D8149B67

Function 00A82928 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c510111869ba92912451a7b0d7d7782332ddc64f2b9d570885866b3e77a8514
Instruction ID: 424bdc845175b50506187d60d5995bef91d858cb2da8220e8b25be656f0b07f1
Opcode Fuzzy Hash: 5c510111869ba92912451a7b0d7d7782332ddc64f2b9d570885866b3e77a8514
Instruction Fuzzy Hash: F651B3B1A043119FC714EF18C880A3AB7A5FF89364F19466DF8959B352D731EC42CB92

Function 00AC68A8 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d30d4e8a50d40c0e8e6fee20bdc4211b6d278f2fd574d11acf0e5d5d24d8c046
Instruction ID: c23a3a9f2f1588722ffb06fb3c5e61d516482c5063ba74a616f4db9f04a4d80a
Opcode Fuzzy Hash: d30d4e8a50d40c0e8e6fee20bdc4211b6d278f2fd574d11acf0e5d5d24d8c046
Instruction Fuzzy Hash: 18417D34608340AFD714DB55D990F2EBBF5EF89754F16882CF58AA7251D331EC118B62

Function 00AC6A38 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d5a67f3ffa23472cfb88f51fe90dd05ce35a88d56981a423dec3974e78b2c01
Instruction ID: 9c779b66f7a20e7f18234c9a5b68ed38cdbe928bc61a9da9da5f8a35e6d4819e
Opcode Fuzzy Hash: 4d5a67f3ffa23472cfb88f51fe90dd05ce35a88d56981a423dec3974e78b2c01
Instruction Fuzzy Hash: 0B416A34248340ABEB14DB15D990F2EB7F5EF89750F65882CF58A97252D331EC118B66

Function 00A8EF08 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a677d001378452f9222ddafdd89244ca075fbfc8bcdccc55e17e3a0b6c405d97
Instruction ID: 1cce05fe06d0d2c22967b94732bc83bc3d226e967092247571c714746fbb98b8
Opcode Fuzzy Hash: a677d001378452f9222ddafdd89244ca075fbfc8bcdccc55e17e3a0b6c405d97
Instruction Fuzzy Hash: 4541E572A083614FD75CDF2A849023ABBE2AFC5300F09C66EE4D68B2D1DA748D55DB81

Function 00AABB20 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10c2414fe1792f3da68675f1142f4c0fe16de70f006865abae02691a7f7a35df
Instruction ID: 7dabb959e79dee429978585a17c53e32612241861bdc329ec25612fcba5f90e1
Opcode Fuzzy Hash: 10c2414fe1792f3da68675f1142f4c0fe16de70f006865abae02691a7f7a35df
Instruction Fuzzy Hash: 10416BB89103259BDF20CF54DC90BBDB7B0FF0A310F444149E845AB2E1EB38A951CB65

Function 00A9A3BF Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e23e85b138a55b5785af51337ab17c150877dc4adb199558c55d9d3bc3a9249
Instruction ID: 88ffaf66a26311f43677b770554ca3d0e2d14ab861e1fb716052970c065e57a6
Opcode Fuzzy Hash: 5e23e85b138a55b5785af51337ab17c150877dc4adb199558c55d9d3bc3a9249
Instruction Fuzzy Hash: E9218D62A04214CBCB209B14C896676B3F0EFA5360B19551AE8969B391F3B4AD01C7A2

Function 00A8ED6B Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ba195b4828959f65e00ce52dd80ddb8fbff997edeacb4fd00185acfab274216
Instruction ID: e062874633890c1025b22a780ec4bb6a6d4b02d9ca6aa4a43e7780bc23ef1be0
Opcode Fuzzy Hash: 1ba195b4828959f65e00ce52dd80ddb8fbff997edeacb4fd00185acfab274216
Instruction Fuzzy Hash: DF41F074508380AFD720EB19C884B1EFBF5FB96745F14492CF6C497292C376D8188B6A

Function 00AC5C62 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a49b99cf3d7157d0ed907d3dfc7e1b3386e027d0657bcc432d1dbf0f3fdc52c
Instruction ID: 8f52ec57bb64b95ba15e9d268f15b82cc3f08c3dc32fa950a3f995e41d02f5c8
Opcode Fuzzy Hash: 9a49b99cf3d7157d0ed907d3dfc7e1b3386e027d0657bcc432d1dbf0f3fdc52c
Instruction Fuzzy Hash: 0341D231A0C7908FC704DF69C490A2EFBE6AF89300F5A4A2DE4D5D7251D735ED458B82

Function 00ABBF08 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5be6113664422e96713363ec41851647c31506b086c17a8b3ff98e201e465e1
Instruction ID: 98eb1c240379e9e10b44f8b2dd78fcb042b84fd4a6a067af54c361e2c723b066
Opcode Fuzzy Hash: c5be6113664422e96713363ec41851647c31506b086c17a8b3ff98e201e465e1
Instruction Fuzzy Hash: 15212C329082144BC724DB6DC88157BF7E8EF9A705F46C62EE8C4A7295D375DC148BE2

Function 00A9A86A Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 442e2041b7d4f0044f3b33030fef62c39f21b01d4b2ce6fbad3c99d345b53e03
Instruction ID: 995351488021c462f05f0950033fcd016b02ee9229a2faca1ba57cc73eb7e1b7
Opcode Fuzzy Hash: 442e2041b7d4f0044f3b33030fef62c39f21b01d4b2ce6fbad3c99d345b53e03
Instruction Fuzzy Hash: D7315AB16483818ADB349F14C485BAFB7F0FFA6360F05895EE4999BB91D3748841CB93

Function 00AC36C7 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22bb0a0a16351f1bf1c6c1539f0de18b004dbbca40553b19ee82d601e5bf0c89
Instruction ID: f0e25fb8e4a4308a27a1a856bb04d9e720b9318adb49412a874496265395eab9
Opcode Fuzzy Hash: 22bb0a0a16351f1bf1c6c1539f0de18b004dbbca40553b19ee82d601e5bf0c89
Instruction Fuzzy Hash: 763137B05183829ADB14CF14C491A2FFBF0EF96785F51980DF4C9A7261D334DA84CB9A

Function 00AA2D48 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad53ddb2add9dc148ccbfce0f9bbc6833265dcee60d8dc427d2cea672e24ee2f
Instruction ID: 1a9778884f6ed187d13765db052df44479e7367c95079f57f02624e484a4d81e
Opcode Fuzzy Hash: ad53ddb2add9dc148ccbfce0f9bbc6833265dcee60d8dc427d2cea672e24ee2f
Instruction Fuzzy Hash: 2B21AEB14093419BC720AF1CC945A6BBBF4EF93761F45891CE4D5AB292E334C950CBA2

Function 00AC3290 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef5757cbf0b0f317ecf1d42ae58ac30bf33f4febf434d18edb842894bb03324b
Instruction ID: f735e45ea16d34106a4befe2f47b6d8e2ca255393303967116ad6d289f04281b
Opcode Fuzzy Hash: ef5757cbf0b0f317ecf1d42ae58ac30bf33f4febf434d18edb842894bb03324b
Instruction Fuzzy Hash: 4431D2B1648341BBDE28DB04CD82F3EB7A5EB95B41F65C61CF2815B2E1C770E9108B56

Function 00A81878 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08fc7749f87834a0ac2745ce569e5a70dd2e905a0fab7b5503f7284ac12dee09
Instruction ID: 7483249cde6dedd125d16c8f57c88b1125635630ebb67b1401399349282b0369
Opcode Fuzzy Hash: 08fc7749f87834a0ac2745ce569e5a70dd2e905a0fab7b5503f7284ac12dee09
Instruction Fuzzy Hash: F731BF71A08300DBD714BF58C882A2AB7E9EF89354F18896DE89A9B241D331DD43CB42

Function 00AA8051 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8e389976b406287930bf639976c9266f6cf3b476f1ef4286262bb577516eb39
Instruction ID: bdf2dc1d61aeeb2c9bf49e411ee01e677873ec1a32e35bee11165ce5d76db841
Opcode Fuzzy Hash: b8e389976b406287930bf639976c9266f6cf3b476f1ef4286262bb577516eb39
Instruction Fuzzy Hash: 80219131908716878320DF25C4804ABB3F2FFD9791F15CA2CD88557264EB34AA5AD785

Function 00AC3390 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4be7152b6fc8e7c35516a89d2ef9863e36723042a04817cdefcf23ca02a08de
Instruction ID: 4305366c0f3b94e8c8c68dd448a6a990d469a6d8ca35ce5bd3071590090d204a
Opcode Fuzzy Hash: c4be7152b6fc8e7c35516a89d2ef9863e36723042a04817cdefcf23ca02a08de
Instruction Fuzzy Hash: 022139B16083809BCB04EF19D590A2EFBF1EB99741F19881CE4C59B362C735E951CB66

Function 00A93CBA Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b3d95a434817f6c973c9ff02e9ec9249f9d0004a7a7719806d7aee0d8c1105b
Instruction ID: 7e3ad5647c9a73136bc4adae453b7d0d9f80839af7836ccab282aba30537a36a
Opcode Fuzzy Hash: 6b3d95a434817f6c973c9ff02e9ec9249f9d0004a7a7719806d7aee0d8c1105b
Instruction Fuzzy Hash: 412168B1A00B00AFDF319F25C885B22B7F5AF49710F248D29E0968B6A1E774E904CB14

Function 00A8DDC4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01f69c16b9c6494f60613f818dcde7c35e0fbda7122440d87ad7206b78ff61d5
Instruction ID: ad37e95b4a1b2c5d4db376977545558d0f94bf570e4a1666dedb6bf069c778fa
Opcode Fuzzy Hash: 01f69c16b9c6494f60613f818dcde7c35e0fbda7122440d87ad7206b78ff61d5
Instruction Fuzzy Hash: 6921F5B590025A9FDB05DF94CC90BBEBBB2FB4A301F144859E911BB292C735A905CB64

Function 00A86D40 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73d1958f67b8eb9f3a7656a6591d9f0965aa8cf07a1fb854fe5963536110b1f1
Instruction ID: 319152caa0ab24131fa0c503674417ff92718d5611af283b2f5e31117f55a682
Opcode Fuzzy Hash: 73d1958f67b8eb9f3a7656a6591d9f0965aa8cf07a1fb854fe5963536110b1f1
Instruction Fuzzy Hash: A8215E1521E3C4AE8386C67D088048FBEE15EFA004F896E9EF4C4AB397C554C619C7AB

Function 00AB8528 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction ID: 35a193c223a60a1b48f4b91f445e383688ae4c26ea894df4877fa3b4d0a008b1
Opcode Fuzzy Hash: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction Fuzzy Hash: CC11C633A051D40EC3268D3C88405E5BFAB0BD3634F598399E4B59B2D7CA368D8AC354

Function 00AADA58 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90022ddfb32469098a8610d4b68e70bc315f5b0e8987f5b71d64abe4c0da561b
Instruction ID: ed9673ae7c3f4a882c9df613d4d253af7ddb14e211ff0575550d2dc5b446e570
Opcode Fuzzy Hash: 90022ddfb32469098a8610d4b68e70bc315f5b0e8987f5b71d64abe4c0da561b
Instruction Fuzzy Hash: AE0171F1A0430167DB20AF6585C1B7BB2A8AF93740F19442CE98697782DB76EC05C791

Function 00AAE132 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7acb281752a9f4735269b9b1cc002f9492d4fa73a4f259361f6e86e2b95aaaf8
Instruction ID: 4f8d7cacfd48430779ccd76ed3ce0beb3ad1fcf179e65138705aa8dfa0ba8300
Opcode Fuzzy Hash: 7acb281752a9f4735269b9b1cc002f9492d4fa73a4f259361f6e86e2b95aaaf8
Instruction Fuzzy Hash: 5421493689A2808BCB4A8F3088960517BB5FE4721936DC2EFCC968D467E76E5407DB21

Function 00AAA0B9 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab6512b1c667dcaa1cc604779a64c1ce391463726a027d9a9669059550eb36de
Instruction ID: 0c0c65782ff14479110b5158c3683bb6c13a1e8023231756eb0933d053c2830f
Opcode Fuzzy Hash: ab6512b1c667dcaa1cc604779a64c1ce391463726a027d9a9669059550eb36de
Instruction Fuzzy Hash: 0911ECB0408380AFD3209F618584A2FFBE1EBA6B14F548C0DF6A49B291C375E809CF56

Function 00A83D78 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 205e877a776a04d6abd7e4e09befea2a77073528980a632510507c7b4451283a
Instruction ID: d5643f1c7354390577e41ab283ffcf4f86ac531443f716152ca364ba52e67fa9
Opcode Fuzzy Hash: 205e877a776a04d6abd7e4e09befea2a77073528980a632510507c7b4451283a
Instruction Fuzzy Hash: C4F02B3F7152190B6610DEA698C4437B7D5D7C6715B145938DA41C3201DE71E8025294

Function 00AB8798 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dad40b8a8b0cf0c680be38028a9801f4e1e9da1297b4f3b9e1d9df466e9bee7e
Instruction ID: 6506d07c58c905065930edc77b6421f51c28c54387ea28b09faa2761b04cb969
Opcode Fuzzy Hash: dad40b8a8b0cf0c680be38028a9801f4e1e9da1297b4f3b9e1d9df466e9bee7e
Instruction Fuzzy Hash: 1E0162B3A199610B8348CE3DDC1156BBAD15BD5770F19872DBEF5CB3E0D230C8118695

Function 00A994C8 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8ebd7708255391ffa87ed53dd5dbf97c7cff7b52fcdad9dabb06971c835301f
Instruction ID: afd6f86e1ed7dc578beff9a6215ab27dc393fb41cabbec3b70aacfa27007612f
Opcode Fuzzy Hash: d8ebd7708255391ffa87ed53dd5dbf97c7cff7b52fcdad9dabb06971c835301f
Instruction Fuzzy Hash: EB014B72A196204B8308CE3C9C1112ABEE19B86330F158B2EBCFAD73E0D664CD548696

Function 00A9264D Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4320f5b54cd7c9a23a8005bed77f00b087a05b385b7ddd433214809cd8c5cbf
Instruction ID: e6c384509eba12e20c53ab49c7cb9b0796de6499dcfbb8f3a1b3471e02c827d4
Opcode Fuzzy Hash: f4320f5b54cd7c9a23a8005bed77f00b087a05b385b7ddd433214809cd8c5cbf
Instruction Fuzzy Hash: DEF0C232600706AFDB20DE28CC80A67B3F6FB8A304F48A93CE58597465C732F526DB40

Function 00A982E8 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 809ee23363f840c811a801533be2b64f834fb93f4c5a4ab9cc37b5a2fd812bb4
Instruction ID: e40ae15ef47c80321e67c52d03599e1a501827cb7987490f4ff5be9b16b1f4fa
Opcode Fuzzy Hash: 809ee23363f840c811a801533be2b64f834fb93f4c5a4ab9cc37b5a2fd812bb4
Instruction Fuzzy Hash: 3AF0E5B1B08251EBDF228B599CC0F3BBBDCCB8B724F151425E8859B142E5B59C44C3E6

Function 00AC2601 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 279a4f57a637f8128bfd8be77460e1d279c07fa6b9848119afc157391d6ef02f
Instruction ID: c4c2a03f3b2015a26f7e8dfbf7efd0f97bc821cc0be8af96fdc06f9c5fe3a81d
Opcode Fuzzy Hash: 279a4f57a637f8128bfd8be77460e1d279c07fa6b9848119afc157391d6ef02f
Instruction Fuzzy Hash: C7F0E27090C280ABD315AB58E954F1EFBF4EF96741F15882CE0C49B261D336D850CB6A

Function 00AB093D Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41ab932f2415c7df50655ebb21d4dd6f332960aa9c3ec918add296c67870008e
Instruction ID: e658f14a3a07403c1c8e03b2547618de6067740e49793cde2795f6f55873200c
Opcode Fuzzy Hash: 41ab932f2415c7df50655ebb21d4dd6f332960aa9c3ec918add296c67870008e
Instruction Fuzzy Hash: 8DF04474521B008BD3A28F24C680A53FBF1BF06300F946848E4969BB52D334F810CB45

Function 00A6A64C Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d30a52f00f890bd01d6e84b1357bca7669443c8ff688bb46904ed1c21e63159d
Instruction ID: 0d45e3cd08a179ef7b60622a6d74fae3960867e6bb76defebd741982f855bf57
Opcode Fuzzy Hash: d30a52f00f890bd01d6e84b1357bca7669443c8ff688bb46904ed1c21e63159d
Instruction Fuzzy Hash: 66E08C32921238EBCB15DB98CA0498AF3FDEB44B00B1545A6B501E3210C270DE00CBD0

Function 00ABE318 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4b5204e339133bf84330416a5308528dd9e98d6cb7a6fcb91640552a86da4e7
Instruction ID: 8e1a0bb1a94d54f2075594ddaaf87d8cf7e621677658af28e2a43cb62097e4b5
Opcode Fuzzy Hash: a4b5204e339133bf84330416a5308528dd9e98d6cb7a6fcb91640552a86da4e7
Instruction Fuzzy Hash: FFD05E2160832146AB64CE19A4008BBF7E4EA87B12B89A55EF582E7148D230EC41C269

Function 00A8E9A5 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cc908392028c27f7ecf30c78ebf6660cf32a01492e826555e3d9857673c97f4
Instruction ID: e4bfec8263ae3b86e8ee88bf41bf073eb441c3dcc6a4b440b9a2975c7db48671
Opcode Fuzzy Hash: 5cc908392028c27f7ecf30c78ebf6660cf32a01492e826555e3d9857673c97f4
Instruction Fuzzy Hash: 04C04C38A58100CBC244EF55FC96536B7B8A76720E7103039DA07FB262DE60D41A9A0D

Function 00A52003 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 217f245f429167e021dfe04843951de3037fbef6698b8f09b34b298dca0e7826
Instruction ID: 33bd11f92d36d418a6a62e984f7a4a97aaeeec6ac92cf5633f686ce4613aa7b3
Opcode Fuzzy Hash: 217f245f429167e021dfe04843951de3037fbef6698b8f09b34b298dca0e7826
Instruction Fuzzy Hash: FFD0923A605A209FC314CF09E440941F7B4FB996307164056E90597720C330FC42CAD0

Function 00A8E914 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1ade6ef58d6580d8cbff1d8d081264510f391430feb37eef4a632f827e8cdbb
Instruction ID: a80c259263f4e948508c571553fb49e3381385efc5aca98e6e509345bc008d70
Opcode Fuzzy Hash: e1ade6ef58d6580d8cbff1d8d081264510f391430feb37eef4a632f827e8cdbb
Instruction Fuzzy Hash: 20C09B39B5C004CBC244DF45D892432F7F8531730C710303ACA43F7261DD60D419860D

Function 00A60F2E Relevance: .0, Instructions: 12COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f509db719341cefea6c6c824f556d87c4149af31b656ab04d21882e9f704e7b0
Instruction ID: d69765fe9fb4c208e8b75b522c926f27e803621798f0a9f9d7e2966a08fd4eff
Opcode Fuzzy Hash: f509db719341cefea6c6c824f556d87c4149af31b656ab04d21882e9f704e7b0
Instruction Fuzzy Hash: 52C04C7814194086CF399A14C271BA63375E7B2782F9454CCDD1B4B7C3D51EACC6DB11

Function 00AC2F6C Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eda25dfc225e456b4df2f38464500c90323af58adcbdfe6e488d54600b94eb62
Instruction ID: 8ebcfa694efdb01289da22398b13e3f917de7dc07cc2e8e283c5e4e05068e626
Opcode Fuzzy Hash: eda25dfc225e456b4df2f38464500c90323af58adcbdfe6e488d54600b94eb62
Instruction Fuzzy Hash: B6C09B3465C20087910CCF04D951975F7779F97757714B02DC90633257D534F512951D

Function 00AC2EAE Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7e2c6ed00036b488e97d7b66a9e7c4df7905aef658a94aa0b4bf4ae83390246
Instruction ID: 5d07e073f59bc1d9ab006b13b9bdb4d2a63cac6ada5626c8abf9decc6d651ca6
Opcode Fuzzy Hash: e7e2c6ed00036b488e97d7b66a9e7c4df7905aef658a94aa0b4bf4ae83390246
Instruction Fuzzy Hash: 24C09224B682008BA24CCF18DD51935F2BB9B8BA9BB14B03DC906A3257E134E522860C

Function 00A85FB0 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2933151f0ac7f075621f0545018cb448e1da5df1c2a72fb1f6ef91afbd1dabd
Instruction ID: 90f083a07c24874d7646f44137cd52b4f4485f2d8af233f17395c09b59a772d3
Opcode Fuzzy Hash: a2933151f0ac7f075621f0545018cb448e1da5df1c2a72fb1f6ef91afbd1dabd
Instruction Fuzzy Hash: 53C04878908204CAC724CF2AC040AB9F3F5BB4F201F00A01AECA8A3240D638D800DF29

Function 00A92849 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c2b20021a969b34ebd9379bf9b485349b18f198d0552b071d404ad5cd0f597e
Instruction ID: f1c0c38a0b7feefcd14a7992d526c0f8ddc67da51ba104f186919c48afb70220
Opcode Fuzzy Hash: 8c2b20021a969b34ebd9379bf9b485349b18f198d0552b071d404ad5cd0f597e
Instruction Fuzzy Hash: CAB012B1C9C215CBC3008F10C40D1B0F335EE0B202F8071A5850527405C7328003CB0C

Function 00AA7B48 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f0846c5d1b29fa8c7eb75566415611b062c9094183590c26b2b47b45be6fc4b
Instruction ID: bb9825d44238991dd192075755b19327866138ce72804a29b080075e6f376ac3
Opcode Fuzzy Hash: 1f0846c5d1b29fa8c7eb75566415611b062c9094183590c26b2b47b45be6fc4b
Instruction Fuzzy Hash: CCB012309082408BD204CF04C450530F374D747109F003418D10AB3152C220E844C60C

Function 00AA5C1B Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05b00ae002dc55fb4e625dd24f5a9641755cf84b69f0189ba72e1364eef460e8
Instruction ID: 6fa0a1bee6cd81a0e7ee55e180bb11495692cb872df1a59e9b59285b5741de68
Opcode Fuzzy Hash: 05b00ae002dc55fb4e625dd24f5a9641755cf84b69f0189ba72e1364eef460e8
Instruction Fuzzy Hash: 4CA00138A883028B8209CE14E690875F3B8A74F602F103954E949B3216C620E8048A2E

Function 00A5A5C8 Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 00A5A6E7
___TypeMatch.LIBVCRUNTIME ref: 00A5A7F5
CallUnexpected.LIBVCRUNTIME ref: 00A5A962

Strings

csm, xrefs: 00A5A672
csm, xrefs: 00A5A605
csm, xrefs: 00A5A71E

Memory Dump Source

Source File: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID: CallMatchTypeUnexpectedtype_info::operator==
String ID: csm$csm$csm
API String ID: 1206542248-393685449
Opcode ID: e9ae7f645a50c7a64302e24dc14d30571ac82c541b25025b29adefbe79b9df58
Instruction ID: f82a7727156e6c4f6f3509612f1ed750051ff83b55794634b1b98ee7fd763fe2
Opcode Fuzzy Hash: e9ae7f645a50c7a64302e24dc14d30571ac82c541b25025b29adefbe79b9df58
Instruction Fuzzy Hash: BCB19E71A00219EFCF14DFA4C9819AEBBB5FF28312F148259EC156B212D731DA59CF92

Function 00A65F4A Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,F8250000,?,EE9E61B1,?,00A66057,00A5C446,?,F8250000,00000000), ref: 00A6600B

Strings

api-ms-, xrefs: 00A65FA1
ext-ms-, xrefs: 00A65FB5

Memory Dump Source

Source File: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 50fcfa3e5688d589c6be09ee6e8023b2b1059e941829fb308bfb6d6b3e7ae8af
Instruction ID: bba66894fbcae1a4c72c579f431272d5c0141eb05e07f8a7d87ea6fa2609347c
Opcode Fuzzy Hash: 50fcfa3e5688d589c6be09ee6e8023b2b1059e941829fb308bfb6d6b3e7ae8af
Instruction Fuzzy Hash: 0D21DA32E01620B7DB31DBB5DC44A5E7778AB417A4F254225F91AA72D0EB30EE42D6E0

Function 00A6F356 Relevance: 9.3, APIs: 6, Instructions: 298COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27d0b6817513ed2e10008298b26046911906fa18b31526124a8e7054c936c594
Instruction ID: 52684fc398a3bd9a3d36ea2881a439f9926ee8c2a48494a438e9838b5dba765b
Opcode Fuzzy Hash: 27d0b6817513ed2e10008298b26046911906fa18b31526124a8e7054c936c594
Instruction Fuzzy Hash: 76B1F575A04249AFDF11DFA9E980BADBBB1FF59300F148169E8119B3A2C7719D42CF60

Function 00A553B1 Relevance: 9.1, APIs: 6, Instructions: 65COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00A553B8
std::_Lockit::_Lockit.LIBCPMT ref: 00A553C2
int.LIBCPMT ref: 00A553D9

Part of subcall function 00A516B4: std::_Lockit::_Lockit.LIBCPMT ref: 00A516C5
Part of subcall function 00A516B4: std::_Lockit::~_Lockit.LIBCPMT ref: 00A516DF

std::_Facet_Register.LIBCPMT ref: 00A55413
std::_Lockit::~_Lockit.LIBCPMT ref: 00A55433
Concurrency::cancel_current_task.LIBCPMT ref: 00A55440

Memory Dump Source

Source File: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Register
String ID:
API String ID: 55977855-0
Opcode ID: 892303b62e0312aac3fd6ddcf394036e8a53f543639e6fb2aa49a147898aec9c
Instruction ID: 50a9423e0ff03efbcb2c333d4c8de6054b01757d8141fcc4ae5c726d9b33e21d
Opcode Fuzzy Hash: 892303b62e0312aac3fd6ddcf394036e8a53f543639e6fb2aa49a147898aec9c
Instruction Fuzzy Hash: 7F110F72910A149BCB14EBA4D9017BEB3B5BF44322F20410EFC06AB290DF74AE49CB80

Function 00A5A25A Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00A5A251,00A58978,00A57AFF), ref: 00A5A268
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00A5A276
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00A5A28F
SetLastError.KERNEL32(00000000,00A5A251,00A58978,00A57AFF), ref: 00A5A2E1

Memory Dump Source

Source File: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 39f6762bb09b18db0207cea473f62a6fbf3e10d174f4b941b7c4897f20f81c57
Instruction ID: 184a51b5ed5e88476172790798c72cb2aedd5660e11ca90a4f4568546a9b77c7
Opcode Fuzzy Hash: 39f6762bb09b18db0207cea473f62a6fbf3e10d174f4b941b7c4897f20f81c57
Instruction Fuzzy Hash: A101D27221C3112E9A2427B47C87AAA2764FB22777F208329F914510F1EF324C8B5152

Function 00A60F50 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,EE9E61B1,?,?,00000000,00A71FC8,000000FF,?,00A60EE0,00A61010,?,00A60EB4,00000000), ref: 00A60F85
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00A60F97
FreeLibrary.KERNEL32(00000000,?,?,00000000,00A71FC8,000000FF,?,00A60EE0,00A61010,?,00A60EB4,00000000), ref: 00A60FB9

Strings

mscoree.dll, xrefs: 00A60F7E
CorExitProcess, xrefs: 00A60F8F

Memory Dump Source

Source File: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: fc44f53c459a074fb7f522ad051913691712c58041b58668028074f102d525b3
Instruction ID: f37052e9dfbee40dd20a87f6dab87b9a71006d4d6cd5f583a031452a5d48422f
Opcode Fuzzy Hash: fc44f53c459a074fb7f522ad051913691712c58041b58668028074f102d525b3
Instruction Fuzzy Hash: 3F01A272A04615FFCB11CF90DC09FAFBBB8FB04B10F008629F815A2290DBB49946CA90

Function 00A54436 Relevance: 7.5, APIs: 5, Instructions: 48COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00A54442
int.LIBCPMT ref: 00A54455

Part of subcall function 00A516B4: std::_Lockit::_Lockit.LIBCPMT ref: 00A516C5
Part of subcall function 00A516B4: std::_Lockit::~_Lockit.LIBCPMT ref: 00A516DF

std::_Facet_Register.LIBCPMT ref: 00A54488
std::_Lockit::~_Lockit.LIBCPMT ref: 00A5449E
Concurrency::cancel_current_task.LIBCPMT ref: 00A544A9

Memory Dump Source

Source File: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 917504cb050be8a4da6fc32216f276fcb41da1982e1db86fbcd31c9368d971cd
Instruction ID: 64b46b1b19c53842476cc3e6fae53ab89d23d80d0ac8bfe0845b0b9f4a1101f4
Opcode Fuzzy Hash: 917504cb050be8a4da6fc32216f276fcb41da1982e1db86fbcd31c9368d971cd
Instruction Fuzzy Hash: DB01D672900114BBCB15EBA4D909ABD7778FF84765F240559FC06AB290EF309E8AD780

Function 00A53DB1 Relevance: 7.5, APIs: 5, Instructions: 48COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00A53DBD
int.LIBCPMT ref: 00A53DD0

Part of subcall function 00A516B4: std::_Lockit::_Lockit.LIBCPMT ref: 00A516C5
Part of subcall function 00A516B4: std::_Lockit::~_Lockit.LIBCPMT ref: 00A516DF

std::_Facet_Register.LIBCPMT ref: 00A53E03
std::_Lockit::~_Lockit.LIBCPMT ref: 00A53E19
Concurrency::cancel_current_task.LIBCPMT ref: 00A53E24

Memory Dump Source

Source File: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 8a75b65ac8921a8b6a861cb6f37491f99fb593ce1a94d915b70399f7c426b21c
Instruction ID: 94865b4ea7ad32358c671adeb502af53e94583383832bd385298ecf4ab944bc8
Opcode Fuzzy Hash: 8a75b65ac8921a8b6a861cb6f37491f99fb593ce1a94d915b70399f7c426b21c
Instruction Fuzzy Hash: 8101F733904114ABCF18EB54D9069AD77B8FF84361B240149FC015B290EB349E49C780

Function 00A54308 Relevance: 7.5, APIs: 5, Instructions: 47COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00A54315
int.LIBCPMT ref: 00A54328

Part of subcall function 00A516B4: std::_Lockit::_Lockit.LIBCPMT ref: 00A516C5
Part of subcall function 00A516B4: std::_Lockit::~_Lockit.LIBCPMT ref: 00A516DF

std::_Facet_Register.LIBCPMT ref: 00A5435B
std::_Lockit::~_Lockit.LIBCPMT ref: 00A54371
Concurrency::cancel_current_task.LIBCPMT ref: 00A5437C

Memory Dump Source

Source File: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: eb26c69b2ded20bc75c380c7b4a03beea34f913fbb894183f88f06b3d5b9d61d
Instruction ID: 3f1d95fc106354c9fd70e937c771636f00f1f284b8a917d0c487dcef579dd549
Opcode Fuzzy Hash: eb26c69b2ded20bc75c380c7b4a03beea34f913fbb894183f88f06b3d5b9d61d
Instruction Fuzzy Hash: 0001DB32900524ABCB15FBA8D9059ED7774BF88769B140155FC156F2A1EF309E8EDBC0

Function 00A5507A Relevance: 7.5, APIs: 5, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00A55081
std::_Lockit::_Lockit.LIBCPMT ref: 00A5508C
std::locale::_Setgloballocale.LIBCPMT ref: 00A550A7
_Yarn.LIBCPMT ref: 00A550BD
std::_Lockit::~_Lockit.LIBCPMT ref: 00A550FA

Memory Dump Source

Source File: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID: Lockitstd::_$H_prolog3Lockit::_Lockit::~_SetgloballocaleYarnstd::locale::_
String ID:
API String ID: 156189095-0
Opcode ID: 1e8877080d3d0edbd3c6b5d6c5555d77d08f5bac05a7878cf1d30562119c24f5
Instruction ID: f17cad6660947edd69e189eb6f718aa9dbc5def3d47bf06c699d64fa556f1a0f
Opcode Fuzzy Hash: 1e8877080d3d0edbd3c6b5d6c5555d77d08f5bac05a7878cf1d30562119c24f5
Instruction Fuzzy Hash: FB01B172A009509BCB05EB70ED51A7C7BB1BF88381B558009EC4117391DB34AE8ACFC5

Function 00A5B3A2 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,00A5B353,00000000,?,00AD6AE4,?,?,?,00A5B4F6,00000004,InitializeCriticalSectionEx,00A74BD8,InitializeCriticalSectionEx), ref: 00A5B3AF
GetLastError.KERNEL32(?,00A5B353,00000000,?,00AD6AE4,?,?,?,00A5B4F6,00000004,InitializeCriticalSectionEx,00A74BD8,InitializeCriticalSectionEx,00000000,?,00A5B2AD), ref: 00A5B3B9
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 00A5B3E1

Strings

api-ms-, xrefs: 00A5B3C6

Memory Dump Source

Source File: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 7300c18adf23ecd56ebefe26732992b4e14075dabb5cdd11740d8281caa967c0
Instruction ID: a1e611875d8ee3a4919840e50cf21052434e6d6e02df2ecdd5a1efbe12770783
Opcode Fuzzy Hash: 7300c18adf23ecd56ebefe26732992b4e14075dabb5cdd11740d8281caa967c0
Instruction Fuzzy Hash: 5DE04831240204B7EF115BB1EC4AB193F54BB00B53F108021FE0DF84E1E771DD569694

Function 00A67747 Relevance: 6.3, APIs: 4, Instructions: 338fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(EE9E61B1,00000000,00000000,00000000), ref: 00A677AA

Part of subcall function 00A6952A: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,00A68FD3,?,00000000,-00000008), ref: 00A695D6

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00A67A05
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00A67A4D
GetLastError.KERNEL32 ref: 00A67AF0

Memory Dump Source

Source File: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 9d80366af50b5e510a7fb7f44145013da282b4ef17088b2a4a13d3f4d021e5a6
Instruction ID: bf2758fc6c29fcbfc94ea2669d1a77d48bd111fc9818a758047077590cf41885
Opcode Fuzzy Hash: 9d80366af50b5e510a7fb7f44145013da282b4ef17088b2a4a13d3f4d021e5a6
Instruction Fuzzy Hash: DBD179B5D142589FCF15CFE8D8809ADBBB5FF09304F18856AE866EB351D730A942CB50

Function 00A5A371 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00A5A438
___AdjustPointer.LIBCMT ref: 00A5A45B
___AdjustPointer.LIBCMT ref: 00A5A4F7

Memory Dump Source

Source File: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: a90f33cb7eb0d6896920336528eb4776e1e8371bf8d91e3483fe2909fcd4c4d6
Instruction ID: 1eddfbb8c44a7cc6f5d9af75b2fdc96baa6ed750c65d968be4c81af458933621
Opcode Fuzzy Hash: a90f33cb7eb0d6896920336528eb4776e1e8371bf8d91e3483fe2909fcd4c4d6
Instruction Fuzzy Hash: 2E51F2B2700206AFDB258F94D945B7E77B5FF20322F248629EC165B191E771EC88C792

Function 00A706EF Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,0000000C,?,00000000,00000000,?,00A6F713,00000000,00000001,00000000,00000000,?,00A67B44,00000000,00000000,00000000), ref: 00A70706
GetLastError.KERNEL32(?,00A6F713,00000000,00000001,00000000,00000000,?,00A67B44,00000000,00000000,00000000,00000000,00000000,?,00A680CB,00000000), ref: 00A70712

Part of subcall function 00A706D8: CloseHandle.KERNEL32(FFFFFFFE,00A70722,?,00A6F713,00000000,00000001,00000000,00000000,?,00A67B44,00000000,00000000,00000000,00000000,00000000), ref: 00A706E8

___initconout.LIBCMT ref: 00A70722

Part of subcall function 00A7069A: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00A706C9,00A6F700,00000000,?,00A67B44,00000000,00000000,00000000,00000000), ref: 00A706AD

WriteConsoleW.KERNEL32(00000000,0000000C,?,00000000,?,00A6F713,00000000,00000001,00000000,00000000,?,00A67B44,00000000,00000000,00000000,00000000), ref: 00A70737

Memory Dump Source

Source File: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 0c720ffd93069d7c307c129911a27df728839d5696ce61b735ffe1a5a654ad47
Instruction ID: ec0feb6032b17ab7498e63a18d001c16205274de4696de44281c5fb36f65daf8
Opcode Fuzzy Hash: 0c720ffd93069d7c307c129911a27df728839d5696ce61b735ffe1a5a654ad47
Instruction Fuzzy Hash: F2F01C36100164BBCF225FD5DC08D997FA6FF493A1B41C120FA5DA5120CA328962EF94

Function 00A5A060 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 00A5A09F
__IsNonwritableInCurrentImage.LIBCMT ref: 00A5A153

Strings

csm, xrefs: 00A5A13D

Memory Dump Source

Source File: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID: CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 3480331319-1018135373
Opcode ID: 094c931fe0b31ccd0e87cf274b3906d1628f9139d29590999b5cc2a2e37bf4f4
Instruction ID: f50288210e347c8d8d43b3e8098b485710f708ea76ebee81de5037c436b1baa7
Opcode Fuzzy Hash: 094c931fe0b31ccd0e87cf274b3906d1628f9139d29590999b5cc2a2e37bf4f4
Instruction Fuzzy Hash: C341A230B10208ABCF10DF68CC81A9EBBB5BF55315F14C255EC196B292D7319A49CBA2

Function 00A5A96D Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?), ref: 00A5A992

Strings

MOC, xrefs: 00A5A9A4
RCC, xrefs: 00A5A9AC

Memory Dump Source

Source File: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 4a1a5cc41a1acd0074803fa0c2950eb04cec862a33eb9ce41472f978b891d870
Instruction ID: 0aeefb569ba1e53cd00091fad9c559af8c9a05d60ffaaf566cfd21c9a7766782
Opcode Fuzzy Hash: 4a1a5cc41a1acd0074803fa0c2950eb04cec862a33eb9ce41472f978b891d870
Instruction Fuzzy Hash: 08417971A00209AFCF16CF98CE81AEEBBB5BF18301F158259FE04A7211D3359954DB92

Function 00A515DF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00A515E6
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00A5161E

Part of subcall function 00A55178: _Yarn.LIBCPMT ref: 00A55197
Part of subcall function 00A55178: _Yarn.LIBCPMT ref: 00A551BB

Strings

bad locale name, xrefs: 00A5162C

Memory Dump Source

Source File: 00000000.00000002.1585945070.0000000000A51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A50000, based on PE: true

Associated: 00000000.00000002.1585917798.0000000000A50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585975999.0000000000A73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1585999056.0000000000A7D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586045331.0000000000AD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586066202.0000000000AD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1586086607.0000000000AD8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_vEcIHT68pU.jbxd

Yara matches

Similarity

API ID: Yarnstd::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 1908188788-1405518554
Opcode ID: bdfd5d7068e7eb932f1e955eeac6d135f96ff0d140807f061c7f694df22a9869
Instruction ID: 54b83db47be6198a0b576648f5ca69c2223f895e8b34d955d6b95f92d574c165
Opcode Fuzzy Hash: bdfd5d7068e7eb932f1e955eeac6d135f96ff0d140807f061c7f694df22a9869
Instruction Fuzzy Hash: 23F01772509B90AE83319F7A8581447FBE4BE2C311394CE2EE4DEC3A11D734A448CB6A

Analysis Process: MSBuild.exePID: 7604, Parent PID: 7580COMMON

Execution Graph

Execution Coverage:	1.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	4.8%
Total number of Nodes:	62
Total number of Limit Nodes:	9

Executed Functions

Function 0043F620 Relevance: 21.5, APIs: 10, Strings: 2, Instructions: 452
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SysAllocString.OLEAUT32 ref: 0043F67C
SysAllocString.OLEAUT32 ref: 0043F73C
VariantInit.OLEAUT32(00000000), ref: 0043F7BB
SysStringLen.OLEAUT32(?), ref: 0043F86B

Strings

dg, xrefs: 0043F7F5
hi, xrefs: 0043F6E6

Memory Dump Source

Source File: 00000002.00000002.1573299382.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: String$Alloc$InitVariant
String ID: dg$hi
API String ID: 3520221836-2859417413
Opcode ID: a29f64484bac79c51184cc7e0d437789df3d7f91ec00fbc448bf7e6117096322
Instruction ID: 76cd35575ce81f92284fb50bd1b390108f3350da4718470232658bad10f85c67
Opcode Fuzzy Hash: a29f64484bac79c51184cc7e0d437789df3d7f91ec00fbc448bf7e6117096322
Instruction Fuzzy Hash: E9F18776608301EFE704CF24D881B2ABBF5FB8A355F14992EF485872A1C738D845CB1A

Function 0040D110 Relevance: 6.2, APIs: 4, Instructions: 154
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetInputState.USER32 ref: 0040D121
GetCurrentThreadId.KERNEL32 ref: 0040D136
GetCurrentProcessId.KERNEL32 ref: 0040D13C
ExitProcess.KERNEL32 ref: 0040D2F0

Memory Dump Source

Source File: 00000002.00000002.1573299382.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: CurrentProcess$ExitInputStateThread
String ID:
API String ID: 1029096631-0
Opcode ID: 08eb499608fb6ca27a79879cc2e31d82174a6a7722ca31d8a5ded37d06d49044
Instruction ID: f02d3b79713e8d81e15a0fda541fde84aa13a8de9f5ea14ec3edbee07005130c
Opcode Fuzzy Hash: 08eb499608fb6ca27a79879cc2e31d82174a6a7722ca31d8a5ded37d06d49044
Instruction Fuzzy Hash: BD41697480D340ABC301BFA5D644A1EFBF1AF56709F048C6DE5C4A7292C339D8189B6B

Function 0043F420 Relevance: 1.6, APIs: 1, Instructions: 74
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoCreateInstance.OLE32(0044CCE0,00000000,00000001,0044CCD0,00000000), ref: 0043F539

Memory Dump Source

Source File: 00000002.00000002.1573299382.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: CreateInstance
String ID:
API String ID: 542301482-0
Opcode ID: a7e3e0413912112d246c505f3554be2b76a53fa2aed4f0f934377768ef79ba78
Instruction ID: cad02f87624d57c1cdc40f211277d8db0221b3b0836e1f39e7a2fcd58f906e49
Opcode Fuzzy Hash: a7e3e0413912112d246c505f3554be2b76a53fa2aed4f0f934377768ef79ba78
Instruction Fuzzy Hash: 4B2128B0118780AFE360CF25D885B1BBAF8FB8A705F54491DF6E48A2A1C775D4098F66

Function 004400D0 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1573299382.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38ec0c076dbd017b2889426329dc115abdd5396e4977fbe50d64591faca7a9f1
Instruction ID: 323a9e3b4d20264604ad69a68f3ef8c0e49c68e956c0c64c4dc5eed4853174bd
Opcode Fuzzy Hash: 38ec0c076dbd017b2889426329dc115abdd5396e4977fbe50d64591faca7a9f1
Instruction Fuzzy Hash: 8F210B3250C3104FE7295E2998D022FB7E2DBC5314F1A853FEAA64B381D93E9D51939A

Function 00412F94 Relevance: 20.1, APIs: 2, Strings: 9, Instructions: 859
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 0041338D
CoUninitialize.OLE32 ref: 00413757

Strings

exemplarou.sbs, xrefs: 0041334C, 00413B12
jxEJ, xrefs: 0041302B
IK, xrefs: 00413178
AR]J, xrefs: 0041303F
[Pcl, xrefs: 00413839
HLB6, xrefs: 00413855
YTfT, xrefs: 00413832
jXl>, xrefs: 00413847
6655FBD04D527CA1C64B7978A627876B, xrefs: 00412F94

Memory Dump Source

Source File: 00000002.00000002.1573299382.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: DirectorySystemUninitialize
String ID: 6655FBD04D527CA1C64B7978A627876B$AR]J$HLB6$YTfT$[Pcl$exemplarou.sbs$jXl>$jxEJ$IK
API String ID: 1148197201-628238951
Opcode ID: 793e2206155dee2c8d64786d4cb874d5cd942b2222fe80dd56f904ce3a752e2b
Instruction ID: 1a99fb5905588dc379b0a1440851df14c4505a7683fddce864a09a7df1459810
Opcode Fuzzy Hash: 793e2206155dee2c8d64786d4cb874d5cd942b2222fe80dd56f904ce3a752e2b
Instruction Fuzzy Hash: 1562BAB0500B408BD3229F31D8907E7BBE5EF1A309F44496EE4EB4B252D739B558CB69

Function 00445DCE Relevance: 3.0, APIs: 2, Instructions: 17
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetForegroundWindow.USER32 ref: 00445DCE
GetForegroundWindow.USER32 ref: 00445DE0

Memory Dump Source

Source File: 00000002.00000002.1573299382.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: 8c61841407d1a4852bfe4b40972173754e0679736d2baf3d56bf65322f3b4ff0
Instruction ID: 1e21c31d78f88c29f1ba1c45ad2c8465459836b227478d43c99d9611323569fd
Opcode Fuzzy Hash: 8c61841407d1a4852bfe4b40972173754e0679736d2baf3d56bf65322f3b4ff0
Instruction Fuzzy Hash: 11D05EE9A023405BEA08AB22FC0E4173615A78626E7040438E80B82312E535E924C64A

Function 00443220 Relevance: 1.6, APIs: 1, Instructions: 59
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL(?,00000000), ref: 004432A6

Memory Dump Source

Source File: 00000002.00000002.1573299382.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 50965382f7edf395daec22a3aa5bcca61c8fe5508095e75f982d05b7b9ec31b6
Instruction ID: 4bd1cfedf901e7341f085caf0d3c231c399316e56ace865125bd700590354386
Opcode Fuzzy Hash: 50965382f7edf395daec22a3aa5bcca61c8fe5508095e75f982d05b7b9ec31b6
Instruction Fuzzy Hash: 4B016D3450D3409BD701EF18E845A1ABBE8EF4AB02F054D6CE5C58B362D339DD60CB96

Function 0043F54B Relevance: 1.6, APIs: 1, Instructions: 51
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SysAllocString.OLEAUT32 ref: 0043F5CC

Memory Dump Source

Source File: 00000002.00000002.1573299382.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: AllocString
String ID:
API String ID: 2525500382-0
Opcode ID: df4ca342573cb0773ed0b4cdb48f2f62b6bccb5de52e28bea6cefa216972c723
Instruction ID: a5d125393194df8c58451964616b5ec9f7b35e85fcdd4b5bcc2a37469f9b676c
Opcode Fuzzy Hash: df4ca342573cb0773ed0b4cdb48f2f62b6bccb5de52e28bea6cefa216972c723
Instruction Fuzzy Hash: 67013274008340ABE340DF14D484A1FBFF5AB86355F84981DF5C98B262D739D844CB56

Function 00445BB0 Relevance: 1.5, APIs: 1, Instructions: 14
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL(0044973D,005C003F,00000006,?,?,00000018,8C8D8A8B,?,?), ref: 00445BDE

Memory Dump Source

Source File: 00000002.00000002.1573299382.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: b66ff63dfd389af1bc8afcc0025f999e8b2b47508af02e865142dda64173a8e3
Instruction ID: fb6f357373f259be8b0e83fffc5d2a3912a28e0da7d2036ce94b71e982b3a7e9
Opcode Fuzzy Hash: b66ff63dfd389af1bc8afcc0025f999e8b2b47508af02e865142dda64173a8e3
Instruction Fuzzy Hash: 76E0FE75908316AB9A09CF45C14444EFBE5BFC4714F11CC8DA4D867210D3B0AD46DF82

Function 0043F5FC Relevance: 1.5, APIs: 1, Instructions: 12
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoSetProxyBlanket.COMBASE(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 0043F60E

Memory Dump Source

Source File: 00000002.00000002.1573299382.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: BlanketProxy
String ID:
API String ID: 3890896728-0
Opcode ID: d1a4e97d1e483744f86715ec377607648d3115d5a7be471bf568486894f32836
Instruction ID: edccb986e9c107e0d1307fb25ee4a82716e2b96217dc24a1b85fe1fa1b43fe34
Opcode Fuzzy Hash: d1a4e97d1e483744f86715ec377607648d3115d5a7be471bf568486894f32836
Instruction Fuzzy Hash: 48D001347E4300BAF2320B14EC5BF082624B743F02F600425B781BC0E18AE2AA20AA0A

Function 00412F6F Relevance: 1.5, APIs: 1, Instructions: 12
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 00412F81

Memory Dump Source

Source File: 00000002.00000002.1573299382.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: InitializeSecurity
String ID:
API String ID: 640775948-0
Opcode ID: 7c2df3500eeb56551dcc952776d351a814cc1e2445ac7db9481c50070c109bac
Instruction ID: 76f42c36266f93e4ae202610683acb643f6c9172f5a9b97e76a18834848e9ada
Opcode Fuzzy Hash: 7c2df3500eeb56551dcc952776d351a814cc1e2445ac7db9481c50070c109bac
Instruction Fuzzy Hash: B8D092383C8300B6F9300B18BC17F043514A303F22F700320F328BC0E089E03100861D

Function 00443202 Relevance: 1.5, APIs: 1, Instructions: 6
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(?,00000000), ref: 00443208

Memory Dump Source

Source File: 00000002.00000002.1573299382.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: f4e883208b5af43432b1f7820fa52118579d54aaadfbe7b6ea97085ba09a0524
Instruction ID: d989c2ef34d315249fff67303ad5b66d5fc7957262475763486a37997b8dd8e1
Opcode Fuzzy Hash: f4e883208b5af43432b1f7820fa52118579d54aaadfbe7b6ea97085ba09a0524
Instruction Fuzzy Hash: CCB012304401005FDA141B00EC0AF003510EF00606F800070A100040B2D1619864C559

Function 00412F10 Relevance: 1.3, APIs: 1, Instructions: 32COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00412F5F

Memory Dump Source

Source File: 00000002.00000002.1573299382.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 33a14456f35e152bf9e5c001c1d7df45cc412803a33c529ef7b40827ed9b1f71
Instruction ID: 50822f4571a41e3a64219f4e3dfc663a775ae15c86e72b1d15465aac68fa1300
Opcode Fuzzy Hash: 33a14456f35e152bf9e5c001c1d7df45cc412803a33c529ef7b40827ed9b1f71
Instruction Fuzzy Hash: DDF0FEB5D107006BD7607B3D9E0B6177DB8A706660F400729E8E59A6C4F621A82D8BD7

Non-executed Functions

Function 00429510 Relevance: 30.2, APIs: 1, Strings: 16, Instructions: 426COMMON

Download Yara Rule

Strings

;IJK, xrefs: 0042983E
pq, xrefs: 004299E0
G+X5, xrefs: 00429AF3
B?Q9, xrefs: 00429B0B
!E4G, xrefs: 00429836
,A&C, xrefs: 0042982E
?M0K, xrefs: 00429968
2A"_, xrefs: 00429980
T#a-, xrefs: 00429AE3
B7U1, xrefs: 00429AFB
8;, xrefs: 00429B13
L3Y=, xrefs: 00429B03
G'M!, xrefs: 00429ADB
X/R), xrefs: 00429AEB
z=Q?, xrefs: 00429826
O+f), xrefs: 00429634, 0042963D

Memory Dump Source

Source File: 00000002.00000002.1573299382.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID:
String ID: !E4G$,A&C$2A"_$8;$;IJK$?M0K$B7U1$B?Q9$G'M!$G+X5$L3Y=$O+f)$T#a-$X/R)$pq$z=Q?
API String ID: 0-655414846
Opcode ID: 821277b00644bb46f69b775215d578a60cf2f50154e1c4f07745e3abcf78f76a
Instruction ID: 614779ad590eebcf7b8fe37e51d599c86efeb38568f1612107a067b093dacd9a
Opcode Fuzzy Hash: 821277b00644bb46f69b775215d578a60cf2f50154e1c4f07745e3abcf78f76a
Instruction Fuzzy Hash: 56F130B4608380ABD310DF15E881A2BBBF4FB86748F944D1DF4D59B252D378D908CB9A

Function 00438720 Relevance: 22.9, APIs: 6, Strings: 7, Instructions: 115clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00438738
GetWindowLongW.USER32 ref: 00438763
GetClipboardData.USER32 ref: 00438773
CloseClipboard.USER32 ref: 00438880

Strings

8, xrefs: 004387E5
9, xrefs: 004387D1
?, xrefs: 004387C9
6, xrefs: 004387D9
6, xrefs: 004387D5
9, xrefs: 004387DD
=, xrefs: 004387CD

Memory Dump Source

Source File: 00000002.00000002.1573299382.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Clipboard$CloseDataLongOpenWindow
String ID: 6$6$8$9$9$=$?
API String ID: 1647500905-2499364611
Opcode ID: 7c9163cd6bc49d62cda3546406a8a3a59e414d7ee2d25f2b6b977c001a77ad7b
Instruction ID: c6cecdc6b357f73a091e8619202f080a94ed584840656985310604660298186b
Opcode Fuzzy Hash: 7c9163cd6bc49d62cda3546406a8a3a59e414d7ee2d25f2b6b977c001a77ad7b
Instruction Fuzzy Hash: F741B170C08385CFDB01AFB8D5893AEBFB0AB5A314F14092EE485A7381D7794949C76B

Function 004390EE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 82COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32 ref: 00439124
GetSystemMetrics.USER32 ref: 00439133

Strings

, xrefs: 004391DE

Memory Dump Source

Source File: 00000002.00000002.1573299382.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: MetricsSystem
String ID:
API String ID: 4116985748-3916222277
Opcode ID: ab5555a52b31076e5eeb6519deaae68eca3c41e93bfc72b6c9b35e59f4d21b4a
Instruction ID: 7f7dffd27c621b542e95bdab6b7ee4d7f31120e949507c5ac4fca7aa65185fb2
Opcode Fuzzy Hash: ab5555a52b31076e5eeb6519deaae68eca3c41e93bfc72b6c9b35e59f4d21b4a
Instruction Fuzzy Hash: 6C3160B49183048FDB00EF6CDA8565EBBF4BF89704F11492DE498DB360D775A948CB86

Function 00439843 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 109COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32 ref: 00439891
GetSystemMetrics.USER32 ref: 004398A0

Strings

, xrefs: 00439974

Memory Dump Source

Source File: 00000002.00000002.1573299382.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: MetricsSystem
String ID:
API String ID: 4116985748-3916222277
Opcode ID: c81f12191cba6e53c0562e90626fcbcb1d354553d74947de8f13948612130a55
Instruction ID: eb4df33fe1d6a66542a4d5aad425eba8fef39bce69b1d50955d9d3d9aaf60553
Opcode Fuzzy Hash: c81f12191cba6e53c0562e90626fcbcb1d354553d74947de8f13948612130a55
Instruction Fuzzy Hash: 3B516DB4E142188FDB40EFACD985A9EBBF0BB48310F018529E898E7350D734A944CF96

Function 0040F1FB Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 88COMMON

Download Yara Rule

APIs

ShellExecuteW.SHELL32(00000000,57A649BB,0044D58A,832F8123,00000000,00000005), ref: 0040F32F

Strings

PQ, xrefs: 0040F2BF
8@-, xrefs: 0040F33A

Memory Dump Source

Source File: 00000002.00000002.1573299382.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: ExecuteShell
String ID: 8@-$PQ
API String ID: 587946157-876866189
Opcode ID: 1a0b4a114143d5ca3374a3cd52da601592b1729854c1c1369e379120faed14fe
Instruction ID: 32a7b61192442560c6f92bb2f4be214f77c1956f3597500a90fccf8073e86402
Opcode Fuzzy Hash: 1a0b4a114143d5ca3374a3cd52da601592b1729854c1c1369e379120faed14fe
Instruction Fuzzy Hash: 5F312878A012689FDB208F94DD45BDEBB71BF46301F1408E9E689AA281C7B54E848F56

Function 00435551 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 0043555A
VariantInit.OLEAUT32 ref: 00435566

Strings

2, xrefs: 004355B5

Memory Dump Source

Source File: 00000002.00000002.1573299382.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Variant$ClearInit
String ID: 2
API String ID: 2610073882-450215437
Opcode ID: 9656e49463a1eac2a2e27d608098374d928559fc5e9cd49b246a20351250d731
Instruction ID: 1309dba7e2d53283adf9958502b19f3f730abdb88899d5b7c892982ad23b04e6
Opcode Fuzzy Hash: 9656e49463a1eac2a2e27d608098374d928559fc5e9cd49b246a20351250d731
Instruction Fuzzy Hash: 6341D370108BC1CED722DF2CC494646BFA0AB56324F188A9CD8EA4F3DAC775E505CB62

Function 00435A84 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 81COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 00435AA6
VariantInit.OLEAUT32 ref: 00435AB2

Strings

2, xrefs: 00435B01

Memory Dump Source

Source File: 00000002.00000002.1573299382.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Variant$ClearInit
String ID: 2
API String ID: 2610073882-450215437
Opcode ID: b9a854552b158eee2be1d84dc97acde07f31a6659becb1d60da7bb16dc3eeda4
Instruction ID: 10a0ad4f487e5ee891bf26f48cdc5f2681f831964d1233476b22d4ecaaddf2d0
Opcode Fuzzy Hash: b9a854552b158eee2be1d84dc97acde07f31a6659becb1d60da7bb16dc3eeda4
Instruction Fuzzy Hash: B141C570108BC18ED725CF2CC494656BFE0AB5A324F18868DE8EA8F3D6C775D506DB62

Function 00435A99 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 00435AA6
VariantInit.OLEAUT32 ref: 00435AB2

Strings

2, xrefs: 00435B01

Memory Dump Source

Source File: 00000002.00000002.1573299382.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Variant$ClearInit
String ID: 2
API String ID: 2610073882-450215437
Opcode ID: fb5371bdd09d0e906117c41cc88a3a5b350ebddee64f3fa9cb34d119133aa536
Instruction ID: e960a9e32f486725a985871b83e160e2d060c1978967536bf2cf05e5ffba8ce9
Opcode Fuzzy Hash: fb5371bdd09d0e906117c41cc88a3a5b350ebddee64f3fa9cb34d119133aa536
Instruction Fuzzy Hash: A831C320008BC18EDB229F3C8488646BFA05F27224F1887DDD8EA4F3DBC365D506DB66

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report vEcIHT68pU.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MSBuild.exe_a7c83bcf6ac3ff550146223df713f817623037_05bdfb8c_f23c1e99-82ae-4bac-b94b-eac5ca96fd4e\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_bad_module_info_26851ced9dceca7ff813c34112d2afbecefcef_85207d7d_2c8b76b6-d73c-4c96-a4c3-1a0f668ee729\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_vEcIHT68pU.exe_2cbb3d2a264287c88ad2d657e7ba421935d5091_0c1dfcd1_bf82597f-35a2-4bae-b294-ab3c2288ee54\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WERAEC3.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERAF12.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERAF42.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB839.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB915.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB945.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF8BF.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF8DF.tmp.xml

C:\Users\user\AppData\Local\Temp\WERF8AE.tmp.WERDataCollectionStatus.txt

C:\Windows\appcompat\Programs\Amcache.hve

Windows Analysis Report
vEcIHT68pU.exe

Function 00A52021 Relevance: 9.4, APIs: 1, Strings: 4, Instructions: 631
memoryCOMMON

Function 00A68E2E Relevance: 4.7, APIs: 3, Instructions: 202
COMMON

Function 00A6A3A6 Relevance: 3.2, APIs: 2, Instructions: 177
COMMON

Function 00A66368 Relevance: 3.0, APIs: 2, Instructions: 34
COMMONLIBRARYCODE

Function 00A69FAA Relevance: 1.6, APIs: 1, Instructions: 147
COMMON