Edit tour

Windows Analysis Report
SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe

Overview

General Information

Sample name:	SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe
Analysis ID:	1528395
MD5:	62748c6343849a0f64e1b8e92c871e6f
SHA1:	5ee8f634dff41ae1755518c03cbacee77e986bd6
SHA256:	4167b003ef7a7a9120b73685d3b04acc8055e0ad8728a103a8a7fd08bdc3c142
Tags:	exe
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Injects a PE file into a foreign processes

LummaC encrypted strings found

Machine Learning detection for sample

Sample uses string decryption to hide its real strings

Sigma detected: Silenttrinity Stager Msbuild Activity

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Checks if the current process is being debugged

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected non-DNS traffic on DNS port

Detected potential crypto function

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe (PID: 4716 cmdline: "C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe" MD5: 62748C6343849A0F64E1B8E92C871E6F)

MSBuild.exe (PID: 6700 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

WerFault.exe (PID: 7092 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 4716 -s 272 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["exilepolsiy.sbs", "invinjurhey.sbs", "exemplarou.sbs", "isoplethui.sbs", "wickedneatr.sbs", "frizzettei.sbs", "laddyirekyi.sbs", "bemuzzeki.sbs"], "Build id": "H8NgCl--"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmp	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
00000002.00000002.1269268783.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Unpacked PEs

Source	Rule	Description	Author
2.2.MSBuild.exe.400000.0.unpack	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
2.2.MSBuild.exe.400000.0.raw.unpack	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
0.2.SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe.380000.0.unpack	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security

Sigma Signatures

System Summary

Sigma detected: Silenttrinity Stager Msbuild Activity

Source: Network Connection

Author: Kiran kumar s, oscd.community: Data: DestinationIp: 92.122.104.90, DestinationIsIpv6: false, DestinationPort: 443, EventID: 3, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, Initiated: true, ProcessId: 6700, Protocol: tcp, SourceIp: 192.168.2.7, SourceIsIpv6: false, SourcePort: 49699

Suricata Signatures

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T21:53:06.917965+0200	2054653	1	A Network Trojan was detected	192.168.2.7	49701	172.67.206.204	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T21:53:06.917965+0200	2049836	1	A Network Trojan was detected	192.168.2.7	49701	172.67.206.204	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe

Avira: detected

Antivirus detection for URL or domain

Source: https://steamcommunity.com/profiles/76561199724331900	URL Reputation: Label: malware
Source: https://steamcommunity.com/profiles/76561199724331900/inventory/	URL Reputation: Label: malware

Found malware configuration

Source: 2.2.MSBuild.exe.400000.0.raw.unpack

Malware Configuration Extractor: LummaC {"C2 url": ["exilepolsiy.sbs", "invinjurhey.sbs", "exemplarou.sbs", "isoplethui.sbs", "wickedneatr.sbs", "frizzettei.sbs", "laddyirekyi.sbs", "bemuzzeki.sbs"], "Build id": "H8NgCl--"}

Multi AV Scanner detection for submitted file

Source: SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe

ReversingLabs: Detection: 36%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000002.00000002.1269268783.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: wickedneatr.sbs
Source: 00000002.00000002.1269268783.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: invinjurhey.sbs
Source: 00000002.00000002.1269268783.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: laddyirekyi.sbs
Source: 00000002.00000002.1269268783.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: exilepolsiy.sbs
Source: 00000002.00000002.1269268783.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: bemuzzeki.sbs
Source: 00000002.00000002.1269268783.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: exemplarou.sbs
Source: 00000002.00000002.1269268783.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: isoplethui.sbs
Source: 00000002.00000002.1269268783.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: frizzettei.sbs
Source: 00000002.00000002.1269268783.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: exemplarou.sbs
Source: 00000002.00000002.1269268783.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000002.00000002.1269268783.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000002.00000002.1269268783.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: - Screen Resoluton:
Source: 00000002.00000002.1269268783.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000002.00000002.1269268783.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: Workgroup: -
Source: 00000002.00000002.1269268783.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: H8NgCl--

Source: SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 92.122.104.90:443 -> 192.168.2.7:49699 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.7:49701 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.7:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.7:54343 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.7:54408 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.7:54458 version: TLS 1.2

Source: SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe

Code function: 0_2_00399ABF FindFirstFileExW,

0_2_00399ABF

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: 4x nop then movzx ebx, word ptr [ecx]	0_2_003D8051
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: 4x nop then mov eax, dword ptr [esp+0Ch]	0_2_003DA0B9
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: 4x nop then mov dword ptr [esp], 00000000h	0_2_003C82E8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: 4x nop then movzx eax, word ptr [esi+ecx]	0_2_003EE318
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_003CA3BF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 7789B0CBh	0_2_003F43F8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	0_2_003E8528
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: 4x nop then movzx ecx, word ptr [edi+eax]	0_2_003F45E8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_003F2601
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_003D665F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: 4x nop then mov eax, ebx	0_2_003C264D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	0_2_003DA687
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 62429966h	0_2_003F07F8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: 4x nop then mov byte ptr [edi], al	0_2_003E0813
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: 4x nop then cmp word ptr [ecx+eax+02h], 0000h	0_2_003CA86A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: 4x nop then jmp dword ptr [0044FDB4h]	0_2_003C2849
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 53F09CFAh	0_2_003F68A8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F8FD61B8h	0_2_003CC89C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	0_2_003E093D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: 4x nop then movzx edx, byte ptr [esi+ebx]	0_2_003B2928
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: 4x nop then jmp eax	0_2_003BE914
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: 4x nop then jmp eax	0_2_003BE9A5
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 53F09CFAh	0_2_003F6A38
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: 4x nop then mov eax, dword ptr [esp+000006B8h]	0_2_003CAA47
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: 4x nop then cmp word ptr [ebp+edi+02h], 0000h	0_2_003D4AD8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: 4x nop then mov eax, dword ptr [esp+40h]	0_2_003BEAC6
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], A70A987Fh	0_2_003ECB36
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: 4x nop then mov byte ptr [edi], al	0_2_003E0B22
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: 4x nop then mov eax, dword ptr [esp+04h]	0_2_003BCB78
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: 4x nop then mov byte ptr [edi], al	0_2_003E0B43
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_003F6BB8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: 4x nop then cmp dword ptr [ebp+edx*8+00h], 9ECF05EBh	0_2_003F6BB8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	0_2_003DAC81
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_003D4D38
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: 4x nop then mov eax, dword ptr [esp+40h]	0_2_003BED6B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_003D2D48
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: 4x nop then movzx ecx, word ptr [ebp+00h]	0_2_003B8D88
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_003ECE48
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: 4x nop then mov word ptr [edx], 0000h	0_2_003CCEB7
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: 4x nop then jmp ecx	0_2_003F2EAE
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], F3285E74h	0_2_003F4E98
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_003F4E98
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: 4x nop then jmp eax	0_2_003D6EC4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: 4x nop then mov dword ptr [esp+1Ch], 5E46585Eh	0_2_003DCF30
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	0_2_003E0F18
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: 4x nop then mov eax, dword ptr [esi+14h]	0_2_003E0F18
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F3285E74h	0_2_003F0F18
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: 4x nop then mov eax, dword ptr [esi+04h]	0_2_003C0F6F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: 4x nop then jmp ecx	0_2_003F2F6C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: 4x nop then mov word ptr [eax], dx	0_2_003CF138
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: 4x nop then mov word ptr [esi], ax	0_2_003CF138
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: 4x nop then mov ebp, eax	0_2_003B71D8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	0_2_003DF2B8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], C274D4CAh	0_2_003F3290
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: 4x nop then mov eax, dword ptr [esp+0Ch]	0_2_003D93AF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], C274D4CAh	0_2_003F3390
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: 4x nop then mov eax, dword ptr [esi+04h]	0_2_003C340E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: 4x nop then movzx ebx, byte ptr [ecx+esi+25h]	0_2_003B5468
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	0_2_003DB56A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: 4x nop then mov word ptr [eax], dx	0_2_003CF540
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: 4x nop then mov eax, dword ptr [esp+08h]	0_2_003F36C7
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 27BAF212h	0_2_003F3833
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], F3285E74h	0_2_003D5824
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: 4x nop then movzx edx, byte ptr [esi+edi]	0_2_003B1878
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F3285E74h	0_2_003F1918
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	0_2_003DDA58
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: 4x nop then cmp word ptr [eax+esi+02h], 0000h	0_2_003DBB20
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: 4x nop then mov word ptr [edx], ax	0_2_003D7B69
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: 4x nop then jmp eax	0_2_003D7B48
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], C85F7986h	0_2_003D9BA8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_003D9BA8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], C85F7986h	0_2_003D9BA8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: 4x nop then jmp eax	0_2_003D5C1B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_003F5C62
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: 4x nop then cmp byte ptr [ebx], 00000000h	0_2_003C3CBA
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: 4x nop then mov edi, ecx	0_2_003C1D02
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: 4x nop then movzx edi, byte ptr [ecx+esi]	0_2_003B3D78
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: 4x nop then mov eax, dword ptr [ebp-10h]	0_2_003BDDC4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: 4x nop then mov eax, dword ptr [esi+20h]	0_2_003C3E69
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: 4x nop then mov ecx, dword ptr [edx]	0_2_003ADED8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: 4x nop then dec ebx	0_2_003EBF08
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	0_2_003DFF74
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: 4x nop then jmp ecx	0_2_003B5FB0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_003B9FE8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_003B9FE8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	0_2_003DFFD5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp]	2_2_0040D110
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp]	2_2_0040D110
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], C274D4CAh	2_2_004463B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp]	2_2_00445700
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 27BAF212h	2_2_0044695B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp+04h]	2_2_0040FCA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [ebp-10h]	2_2_00410EEC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F3285E74h	2_2_00444040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov ecx, dword ptr [edx]	2_2_00401000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esi+20h]	2_2_00416F91
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then dec ebx	2_2_0043F030
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp ecx	2_2_00446094
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp+0Ch]	2_2_0042D1E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov word ptr [eax], dx	2_2_00422260
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov word ptr [esi], ax	2_2_00422260
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esi+04h]	2_2_004142FC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov ebp, eax	2_2_0040A300
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	2_2_004323E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	2_2_004323E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	2_2_004323E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov byte ptr [edi], al	2_2_004323E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	2_2_004323E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esi+14h]	2_2_004323E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx eax, word ptr [esi+ecx]	2_2_00441440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov word ptr [eax], cx	2_2_0041D457
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp+0Ch]	2_2_0042C470
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	2_2_0042E40C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov dword ptr [esp], 00000000h	2_2_0041B410
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], C274D4CAh	2_2_004464B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov word ptr [eax], cx	2_2_00429510
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 7789B0CBh	2_2_00447520
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esi+04h]	2_2_00416536
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx ebx, byte ptr [ecx+esi+25h]	2_2_00408590
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	2_2_0043B650
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	2_2_0042E66A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx ecx, word ptr [edi+eax]	2_2_00447710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp+08h]	2_2_004467EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	2_2_0042D7AF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov word ptr [eax], dx	2_2_004228E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp word ptr [ecx+eax+02h], 0000h	2_2_0041D961
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 62429966h	2_2_00443920
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 53F09CFAh	2_2_004499D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx edx, byte ptr [esi+edi]	2_2_004049A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F3285E74h	2_2_00444A40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx edx, byte ptr [esi+ebx]	2_2_00405A50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp eax	2_2_00411A3C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp eax	2_2_00411ACD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 53F09CFAh	2_2_00449B60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp+000006B8h]	2_2_0041DB6F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F8FD61B8h	2_2_0041DB6F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esi+04h]	2_2_00413BE2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp+40h]	2_2_00411BEE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	2_2_00430B80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp word ptr [eax+esi+02h], 0000h	2_2_0042EC48
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp word ptr [ebp+edi+02h], 0000h	2_2_00427C00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], A70A987Fh	2_2_0043FC20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], C85F7986h	2_2_0042CCD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp]	2_2_0042CCD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], C85F7986h	2_2_0042CCD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp]	2_2_00449CE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [ebp+edx*8+00h], 9ECF05EBh	2_2_00449CE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp eax	2_2_0042AC91
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov word ptr [edx], ax	2_2_0042AC91
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov dword ptr [esp+1Ch], 5E46585Eh	2_2_0042FD10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	2_2_0042DD29
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp]	2_2_00448D8A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx ebx, word ptr [ecx]	2_2_0042AE57
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov word ptr [eax], cx	2_2_00427E60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp]	2_2_00425E70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov edi, ecx	2_2_00414E2A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp+40h]	2_2_00411E93
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx edi, byte ptr [ecx+esi]	2_2_00406EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx ecx, word ptr [ebp+00h]	2_2_0040BEB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp byte ptr [ebx], 00000000h	2_2_00416EBF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp eax	2_2_00429F62
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp]	2_2_0043FF70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], F3285E74h	2_2_00447FC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp]	2_2_00447FC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp ecx	2_2_00408FD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp ecx	2_2_00445FD6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov word ptr [edx], 0000h	2_2_0041FFDF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esi+20h]	2_2_00416F91

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.7:49701 -> 172.67.206.204:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:49701 -> 172.67.206.204:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: exilepolsiy.sbs
Source: Malware configuration extractor	URLs: invinjurhey.sbs
Source: Malware configuration extractor	URLs: exemplarou.sbs
Source: Malware configuration extractor	URLs: isoplethui.sbs
Source: Malware configuration extractor	URLs: wickedneatr.sbs
Source: Malware configuration extractor	URLs: frizzettei.sbs
Source: Malware configuration extractor	URLs: laddyirekyi.sbs
Source: Malware configuration extractor	URLs: bemuzzeki.sbs

Source: global traffic

TCP traffic: 192.168.2.7:54333 -> 1.1.1.1:53

Source: Joe Sandbox View	IP Address: 92.122.104.90 92.122.104.90
Source: Joe Sandbox View	IP Address: 172.67.206.204 172.67.206.204

Source: Joe Sandbox View	ASN Name: AKAMAI-ASUS AKAMAI-ASUS
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: sergei-esenin.com

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com

Source: MSBuild.exe, 00000002.00000002.1269883843.0000000001162000.00000004.00000020.00020000.00000000.sdmp

String found in binary or memory: https://help.steampowered.com/ https://login.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://play equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: exemplarou.sbs
Source: global traffic	DNS traffic detected: DNS query: frizzettei.sbs
Source: global traffic	DNS traffic detected: DNS query: isoplethui.sbs
Source: global traffic	DNS traffic detected: DNS query: bemuzzeki.sbs
Source: global traffic	DNS traffic detected: DNS query: exilepolsiy.sbs
Source: global traffic	DNS traffic detected: DNS query: laddyirekyi.sbs
Source: global traffic	DNS traffic detected: DNS query: invinjurhey.sbs
Source: global traffic	DNS traffic detected: DNS query: wickedneatr.sbs
Source: global traffic	DNS traffic detected: DNS query: steamcommunity.com
Source: global traffic	DNS traffic detected: DNS query: sergei-esenin.com
Source: global traffic	DNS traffic detected: DNS query: time.windows.com

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: sergei-esenin.com

Source: MSBuild.exe, 00000002.00000002.1269883843.0000000001162000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:27060
Source: MSBuild.exe, 00000002.00000002.1269633613.0000000001134000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
Source: MSBuild.exe, 00000002.00000002.1269633613.0000000001134000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/privacy_agreement/
Source: MSBuild.exe, 00000002.00000002.1269633613.0000000001134000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/subscriber_agreement/
Source: Amcache.hve.5.dr	String found in binary or memory: http://upx.sf.net
Source: MSBuild.exe, 00000002.00000002.1269883843.0000000001162000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.steampowered.com/
Source: MSBuild.exe, 00000002.00000002.1269883843.0000000001162000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://broadcast.st.dl.eccdnx.com
Source: MSBuild.exe, 00000002.00000002.1269883843.0000000001162000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/
Source: MSBuild.exe, 00000002.00000002.1269883843.0000000001162000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/
Source: MSBuild.exe, 00000002.00000002.1269633613.0000000001134000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/applications/community/main.css?v=Ev2sBLgkgyWJ&a
Source: MSBuild.exe, 00000002.00000002.1269633613.0000000001134000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
Source: MSBuild.exe, 00000002.00000002.1269633613.0000000001134000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6
Source: MSBuild.exe, 00000002.00000002.1269633613.0000000001134000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/main.js?v=10oP_O2R
Source: MSBuild.exe, 00000002.00000002.1269633613.0000000001134000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/manifest.js?v=cdfm
Source: MSBuild.exe, 00000002.00000002.1269768801.0000000001139000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowe
Source: MSBuild.exe, 00000002.00000002.1269883843.0000000001162000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/
Source: MSBuild.exe, 00000002.00000002.1269883843.0000000001162000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.steampowered.com/
Source: MSBuild.exe, 00000002.00000002.1269883843.0000000001162000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://medal.tv
Source: MSBuild.exe, 00000002.00000002.1269883843.0000000001162000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net
Source: MSBuild.exe, 00000002.00000002.1269883843.0000000001162000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net/recaptcha/;
Source: MSBuild.exe, 00000002.00000002.1269883843.0000000001162000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s.ytimg.com;
Source: MSBuild.exe, 00000002.00000002.1269883843.000000000117B000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1269883843.0000000001162000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/
Source: MSBuild.exe, 00000002.00000002.1269883843.000000000117B000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1269633613.0000000001134000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/api
Source: MSBuild.exe, 00000002.00000002.1269883843.0000000001162000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sketchfab.com
Source: MSBuild.exe, 00000002.00000002.1269883843.0000000001162000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steam.tv/
Source: MSBuild.exe, 00000002.00000002.1269883843.0000000001162000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast-test.akamaized.net
Source: MSBuild.exe, 00000002.00000002.1269883843.0000000001162000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast.akamaized.net
Source: MSBuild.exe, 00000002.00000002.1269883843.0000000001162000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcastchat.akamaized.net
Source: MSBuild.exe, 00000002.00000002.1269883843.0000000001162000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1269883843.0000000001155000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/
Source: MSBuild.exe, 00000002.00000002.1269633613.0000000001134000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
Source: MSBuild.exe, 00000002.00000002.1269883843.0000000001155000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900
Source: MSBuild.exe, 00000002.00000002.1269768801.0000000001139000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/inventory/
Source: MSBuild.exe, 00000002.00000002.1269883843.0000000001155000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900koF?
Source: MSBuild.exe, 00000002.00000002.1269883843.0000000001162000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampower
Source: MSBuild.exe, 00000002.00000002.1269883843.0000000001162000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com
Source: MSBuild.exe, 00000002.00000002.1269883843.0000000001162000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/3
Source: MSBuild.exe, 00000002.00000002.1269633613.0000000001134000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/legal/
Source: MSBuild.exe, 00000002.00000002.1269883843.0000000001162000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: MSBuild.exe, 00000002.00000002.1269883843.0000000001162000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/recaptcha/
Source: MSBuild.exe, 00000002.00000002.1269883843.0000000001162000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.cn/recaptcha/
Source: MSBuild.exe, 00000002.00000002.1269883843.0000000001162000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/recaptcha/
Source: MSBuild.exe, 00000002.00000002.1269883843.0000000001162000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 54391 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54356 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54413 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54379 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54459 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 54436 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 54367 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 54516 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54424 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54527 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 54494 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 54505 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54460 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54448 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54380 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 54493 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 54344 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54401 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54482 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54355 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54412 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 54471 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 54437 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 54389 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54400 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 54423 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54526 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54503 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54495 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 54472 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 54484 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54449 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54357 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54378 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54345 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54368 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 54515 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54483 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54411 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 54438 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 54422 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54504 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54390 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54461 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54334 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 54450 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54513 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54462 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54485 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54382 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49698
Source: unknown	Network traffic detected: HTTP traffic on port 54371 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54502 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54410 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54439 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54473 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54421 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54335 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54358 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54474 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54369 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54394 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54451 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54514 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54409 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54383 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54440 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54525 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54496 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54452 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54498 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54337 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54408 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54420 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54512 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54392 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54463 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54487 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54381 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54523 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54360 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54370 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54393 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54464 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54501 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54441 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54524 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54348 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54497 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54419 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54430 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54486 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54359 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54475 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54419
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54418
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54417
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54412
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54411
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54410
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54416
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54415
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54414
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54413
Source: unknown	Network traffic detected: HTTP traffic on port 54465 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54488 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54522 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54453 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54476 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54429
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54428
Source: unknown	Network traffic detected: HTTP traffic on port 54396 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54423
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54422
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54421
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54420
Source: unknown	Network traffic detected: HTTP traffic on port 54407 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54427
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54426
Source: unknown	Network traffic detected: HTTP traffic on port 54350 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54425
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54424
Source: unknown	Network traffic detected: HTTP traffic on port 54442 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54430
Source: unknown	Network traffic detected: HTTP traffic on port 54385 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54418 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54477 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54511 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54439
Source: unknown	Network traffic detected: HTTP traffic on port 54406 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54431 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54397 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54434
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54433
Source: unknown	Network traffic detected: HTTP traffic on port 54374 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54432
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54431
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54438
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54437
Source: unknown	Network traffic detected: HTTP traffic on port 54429 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54436
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54435
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54441
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54440
Source: unknown	Network traffic detected: HTTP traffic on port 54361 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54499 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54338 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54445
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54444
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54442
Source: unknown	Network traffic detected: HTTP traffic on port 54443 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54449
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54448
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54447
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54446
Source: unknown	Network traffic detected: HTTP traffic on port 54500 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54452
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54451
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54450
Source: unknown	Network traffic detected: HTTP traffic on port 54349 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54454 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54395 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54372 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54417 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54363 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54432 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54455 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54340 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54508
Source: unknown	Network traffic detected: HTTP traffic on port 54428 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54507
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54506
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54505
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54509
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54500
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54504
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54503
Source: unknown	Network traffic detected: HTTP traffic on port 54466 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54502
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54501
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54490 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54519
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54518
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54517
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54516
Source: unknown	Network traffic detected: HTTP traffic on port 54509 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54351 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54511
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54510
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54339 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54467 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54515
Source: unknown	Network traffic detected: HTTP traffic on port 54444 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54514
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54513
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54512
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54384 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49698 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54409
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54408
Source: unknown	Network traffic detected: HTTP traffic on port 54405 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54407
Source: unknown	Network traffic detected: HTTP traffic on port 54478 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54510 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54406
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54527
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54401
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54522
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54400
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54521
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54520
Source: unknown	Network traffic detected: HTTP traffic on port 54373 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54405
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54526
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54404
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54525
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54403
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54524
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54402
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54523
Source: unknown	Network traffic detected: HTTP traffic on port 54416 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54489 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54521 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54362 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54433 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54404 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54427 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54507 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54379
Source: unknown	Network traffic detected: HTTP traffic on port 54376 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54378
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54499
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54377
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54498
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54376
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54497
Source: unknown	Network traffic detected: HTTP traffic on port 54353 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54382
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54381
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54380
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54386
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54385
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54384
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54383
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54491 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54388 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54389
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54388
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54387
Source: unknown	Network traffic detected: HTTP traffic on port 54480 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54445 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54393
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54392
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54391
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54390
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54397
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54396
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54395
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54394
Source: unknown	Network traffic detected: HTTP traffic on port 54399 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54364 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54456 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54399
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54398
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54415 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54377 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54520 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54434 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54457 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54426 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49677 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54508 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54352 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54468 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54519 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54479 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54341 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54366 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54335
Source: unknown	Network traffic detected: HTTP traffic on port 54446 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54456
Source: unknown	Network traffic detected: HTTP traffic on port 54517 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54334
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54455
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54454
Source: unknown	Network traffic detected: HTTP traffic on port 54469 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54453
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54339
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54338
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54459
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54337
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54458
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54457
Source: unknown	Network traffic detected: HTTP traffic on port 54481 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54342
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54463
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54341
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54462
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54340
Source: unknown	Network traffic detected: HTTP traffic on port 54386 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54461
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54460
Source: unknown	Network traffic detected: HTTP traffic on port 54403 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54506 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54375 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54467
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54345
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54466
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54344
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54465
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54343
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54464
Source: unknown	Network traffic detected: HTTP traffic on port 54354 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54349
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54348
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54469
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54468
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54470
Source: unknown	Network traffic detected: HTTP traffic on port 54414 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54353
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54474
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54352
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54473
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54351
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54472
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54350
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54471
Source: unknown	Network traffic detected: HTTP traffic on port 54435 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54343 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54402 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54357
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54478
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54356
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54477
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54355
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54476
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54354
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54475
Source: unknown	Network traffic detected: HTTP traffic on port 54425 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54359
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54358
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54479
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54360
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54481
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54480

Source: unknown	HTTPS traffic detected: 92.122.104.90:443 -> 192.168.2.7:49699 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.7:49701 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.7:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.7:54343 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.7:54408 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.7:54458 version: TLS 1.2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 2_2_00438720 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

2_2_00438720

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 2_2_00438720 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

2_2_00438720

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 2_2_004390EE GetDC,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetCurrentObject,GetObjectW,DeleteObject,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,

2_2_004390EE

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: 0_2_00382021	0_2_00382021
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: 0_2_003B2088	0_2_003B2088
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: 0_2_003B40C8	0_2_003B40C8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: 0_2_003DE132	0_2_003DE132
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: 0_2_003B2123	0_2_003B2123
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: 0_2_003DE1A8	0_2_003DE1A8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: 0_2_003AE1CF	0_2_003AE1CF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: 0_2_003AE27B	0_2_003AE27B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: 0_2_003B8278	0_2_003B8278
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: 0_2_003AE272	0_2_003AE272
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: 0_2_003AE455	0_2_003AE455
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: 0_2_003B0488	0_2_003B0488
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: 0_2_003AE527	0_2_003AE527
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: 0_2_003DE738	0_2_003DE738
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: 0_2_003E8798	0_2_003E8798
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: 0_2_003F4988	0_2_003F4988
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: 0_2_003CAA47	0_2_003CAA47
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: 0_2_0038CAF2	0_2_0038CAF2
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: 0_2_003B4AC8	0_2_003B4AC8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: 0_2_003B6D40	0_2_003B6D40
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: 0_2_003B8D88	0_2_003B8D88
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: 0_2_003DAD84	0_2_003DAD84
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: 0_2_003F4E98	0_2_003F4E98
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: 0_2_003F0F18	0_2_003F0F18
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: 0_2_003BEF08	0_2_003BEF08
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: 0_2_003F6FA8	0_2_003F6FA8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: 0_2_003BB078	0_2_003BB078
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: 0_2_003E51A8	0_2_003E51A8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: 0_2_003B71D8	0_2_003B71D8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: 0_2_0038729C	0_2_0038729C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: 0_2_0039D39B	0_2_0039D39B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: 0_2_003E33C8	0_2_003E33C8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: 0_2_003B5468	0_2_003B5468
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: 0_2_003C94C8	0_2_003C94C8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: 0_2_003B7728	0_2_003B7728
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: 0_2_0039572C	0_2_0039572C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: 0_2_003EB778	0_2_003EB778
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: 0_2_003F1918	0_2_003F1918
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: 0_2_0039BB36	0_2_0039BB36
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: 0_2_003D9BA8	0_2_003D9BA8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: 0_2_00393C92	0_2_00393C92
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: 0_2_00381D79	0_2_00381D79
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: 0_2_003B7DE8	0_2_003B7DE8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: 0_2_0038FEF0	0_2_0038FEF0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: 0_2_003ADED8	0_2_003ADED8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00410228	2_2_00410228
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00444040	2_2_00444040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00401000	2_2_00401000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00412030	2_2_00412030
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0044A0D0	2_2_0044A0D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00405160	2_2_00405160
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_004071F0	2_2_004071F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0040E1A0	2_2_0040E1A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_004382D0	2_2_004382D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_004312D0	2_2_004312D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_004012F7	2_2_004012F7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0040A300	2_2_0040A300
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_004323E0	2_2_004323E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0040B3A0	2_2_0040B3A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_004013A3	2_2_004013A3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0042C470	2_2_0042C470
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_004364F0	2_2_004364F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00414487	2_2_00414487
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0041049B	2_2_0041049B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0041C5F0	2_2_0041C5F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00408590	2_2_00408590
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_004035B0	2_2_004035B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0040164F	2_2_0040164F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00448652	2_2_00448652
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0043F620	2_2_0043F620
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_004486F0	2_2_004486F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0040A850	2_2_0040A850
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00431860	2_2_00431860
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0043B8C0	2_2_0043B8C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0043E8A0	2_2_0043E8A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0042098B	2_2_0042098B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_004489A0	2_2_004489A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00444A40	2_2_00444A40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00448A80	2_2_00448A80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00447AB0	2_2_00447AB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0041DB6F	2_2_0041DB6F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00407BF0	2_2_00407BF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00448C02	2_2_00448C02
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0042CCD0	2_2_0042CCD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00446CBF	2_2_00446CBF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00428D62	2_2_00428D62
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0042FD10	2_2_0042FD10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0042DD29	2_2_0042DD29
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0042AE57	2_2_0042AE57
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00448E70	2_2_00448E70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00414E2A	2_2_00414E2A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0040BEB0	2_2_0040BEB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00416EBF	2_2_00416EBF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0040AF10	2_2_0040AF10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00447FC0	2_2_00447FC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00408FD0	2_2_00408FD0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 0040CAA0 appears 48 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 0041D300 appears 152 times
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: String function: 00387B80 appears 49 times
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: String function: 003CA1D8 appears 152 times
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: String function: 003B9978 appears 93 times

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 4716 -s 272

Source: SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe, 00000000.00000000.1240939843.0000000000408000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameproquota.exej% vs SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe
Source: SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Binary or memory string: OriginalFilenameproquota.exej% vs SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe

Source: SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe

Static PE information: Section: .data ZLIB complexity 0.9912259615384615

Source: classification engine

Classification label: mal100.troj.evad.winEXE@4/5@11/2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 2_2_00438220 CoCreateInstance,

2_2_00438220

Source: C:\Windows\SysWOW64\WerFault.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess4716

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\345b3bc6-eb60-4ec4-8307-955254f9fbc7

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Command line argument: MZx	0_2_00382021
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Command line argument: MZx	0_2_00382021
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Command line argument: MZx	0_2_00382021

Source: SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe

ReversingLabs: Detection: 36%

Source: unknown	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 4716 -s 272
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dpapi.dll	Jump to behavior

Source: SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: 0_2_003871AD push ecx; ret		0_2_003871C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0044F23B push edx; ret		2_2_0044F24B

Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe

API coverage: 4.2 %

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5296

Thread sleep time: -60000s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe

Code function: 0_2_00399ABF FindFirstFileExW,

0_2_00399ABF

Source: Amcache.hve.5.dr	Binary or memory string: VMware
Source: MSBuild.exe, 00000002.00000002.1269633613.000000000112C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWx
Source: Amcache.hve.5.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.5.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.5.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.5.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.5.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.5.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.5.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: MSBuild.exe, 00000002.00000002.1269883843.0000000001162000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.5.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.5.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.5.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.5.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.5.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.5.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.5.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.5.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.5.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.5.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.5.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.5.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.5.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.5.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.5.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.5.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.5.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.5.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.5.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.5.dr	Binary or memory string: VMware-42 27 88 19 56 cc 59 1a-97 79 fb 8c bf a1 e2 9d
Source: Amcache.hve.5.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 2_2_00445BB0 LdrInitializeThunk,

2_2_00445BB0

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe

Code function: 0_2_00387922 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00387922

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: 0_2_00382003 mov edi, dword ptr fs:[00000030h]	0_2_00382003
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: 0_2_0039A64C mov eax, dword ptr fs:[00000030h]	0_2_0039A64C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: 0_2_00390F2E mov ecx, dword ptr fs:[00000030h]	0_2_00390F2E

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe

Code function: 0_2_0039CC4B GetProcessHeap,

0_2_0039CC4B

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: 0_2_00387610 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00387610
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: 0_2_00387922 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00387922
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: 0_2_0038DA73 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0038DA73
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: 0_2_00387AAF SetUnhandledExceptionFilter,	0_2_00387AAF

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 value starts with: 4D5A

Jump to behavior

LummaC encrypted strings found

Source: SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	String found in binary or memory: isoplethui.sbs
Source: SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	String found in binary or memory: frizzettei.sbs
Source: SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	String found in binary or memory: exemplarou.sbs
Source: SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	String found in binary or memory: wickedneatr.sbs
Source: SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	String found in binary or memory: invinjurhey.sbs
Source: SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	String found in binary or memory: laddyirekyi.sbs
Source: SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	String found in binary or memory: exilepolsiy.sbs
Source: SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	String found in binary or memory: bemuzzeki.sbs

Writes to foreign memory regions

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 401000	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 44B000	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 44E000	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 45E000	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: CB3008	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	0_2_0039C085
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: GetLocaleInfoW,	0_2_0039622B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: EnumSystemLocalesW,	0_2_0039C327
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: EnumSystemLocalesW,	0_2_0039C372
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: EnumSystemLocalesW,	0_2_0039C40D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_0039C498
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: GetLocaleInfoW,	0_2_0039C6EB
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_0039C814
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: GetLocaleInfoW,	0_2_0039C91A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_0039C9E9
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Code function: EnumSystemLocalesW,	0_2_00395D7F

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe

Code function: 0_2_00387815 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00387815

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Amcache.hve.5.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.5.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.5.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.5.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: Amcache.hve.5.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: 2.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.MSBuild.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe.380000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1269268783.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: 2.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.MSBuild.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe.380000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1269268783.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	311 Process Injection	2 Virtualization/Sandbox Evasion	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Screen Capture	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 PowerShell	Boot or Logon Initialization Scripts	1 DLL Side-Loading	311 Process Injection	LSASS Memory	41 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Deobfuscate/Decode Files or Information	Security Account Manager	2 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	2 Clipboard Data	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	3 Obfuscated Files or Information	NTDS	1 File and Directory Discovery	Distributed Component Object Model	Input Capture	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Software Packing	LSA Secrets	13 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label
SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	37%	ReversingLabs	Win32.Trojan.Generic
SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	100%	Avira	HEUR/AGEN.1310458
SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://steamcommunity.com/profiles/76561199724331900	100%	URL Reputation	malware
http://store.steampowered.com/privacy_agreement/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/	0%	URL Reputation	safe
https://recaptcha.net	0%	URL Reputation	safe
http://upx.sf.net	0%	URL Reputation	safe
https://www.gstatic.cn/recaptcha/	0%	URL Reputation	safe
http://store.steampowered.com/subscriber_agreement/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6	0%	URL Reputation	safe
https://recaptcha.net/recaptcha/;	0%	URL Reputation	safe
https://steamcommunity.com/profiles/76561199724331900/inventory/	100%	URL Reputation	malware
https://medal.tv	0%	URL Reputation	safe
https://broadcast.st.dl.eccdnx.com	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1	0%	URL Reputation	safe
https://help.steampowered.com/	0%	URL Reputation	safe
https://api.steampowered.com/	0%	URL Reputation	safe
http://store.steampowered.com/account/cookiepreferences/	0%	URL Reputation	safe
https://login.steampowered.com/	0%	URL Reputation	safe
https://store.steampowered.com/legal/	0%	URL Reputation	safe
https://steam.tv/	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
steamcommunity.com	92.122.104.90	true	true	unknown
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false	unknown
sergei-esenin.com	172.67.206.204	true	true	unknown
frizzettei.sbs	unknown	unknown	true	unknown
laddyirekyi.sbs	unknown	unknown	true	unknown
wickedneatr.sbs	unknown	unknown	true	unknown
bemuzzeki.sbs	unknown	unknown	true	unknown
invinjurhey.sbs	unknown	unknown	true	unknown
isoplethui.sbs	unknown	unknown	true	unknown
time.windows.com	unknown	unknown	false	unknown
exilepolsiy.sbs	unknown	unknown	true	unknown
exemplarou.sbs	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
frizzettei.sbs	true		unknown
https://steamcommunity.com/profiles/76561199724331900	true	URL Reputation: malware	unknown
invinjurhey.sbs	true		unknown
exilepolsiy.sbs	true		unknown
laddyirekyi.sbs	true		unknown
isoplethui.sbs	true		unknown
bemuzzeki.sbs	true		unknown
exemplarou.sbs	true		unknown
wickedneatr.sbs	true		unknown
https://sergei-esenin.com/api	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://community.akamai.steamstatic.com/public/javascript/applications/community/manifest.js?v=cdfm	MSBuild.exe, 00000002.00000002.1269633613.0000000001134000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://store.steampower	MSBuild.exe, 00000002.00000002.1269883843.0000000001162000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://store.steampowered.com/privacy_agreement/	MSBuild.exe, 00000002.00000002.1269633613.0000000001134000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/	MSBuild.exe, 00000002.00000002.1269883843.0000000001162000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/	MSBuild.exe, 00000002.00000002.1269883843.0000000001162000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://sergei-esenin.com/	MSBuild.exe, 00000002.00000002.1269883843.000000000117B000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1269883843.0000000001162000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://recaptcha.net	MSBuild.exe, 00000002.00000002.1269883843.0000000001162000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://upx.sf.net	Amcache.hve.5.dr	false	URL Reputation: safe	unknown
https://help.steampowe	MSBuild.exe, 00000002.00000002.1269768801.0000000001139000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.gstatic.cn/recaptcha/	MSBuild.exe, 00000002.00000002.1269883843.0000000001162000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://store.steampowered.com/subscriber_agreement/	MSBuild.exe, 00000002.00000002.1269633613.0000000001134000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org	MSBuild.exe, 00000002.00000002.1269633613.0000000001134000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6	MSBuild.exe, 00000002.00000002.1269633613.0000000001134000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://sketchfab.com	MSBuild.exe, 00000002.00000002.1269883843.0000000001162000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://recaptcha.net/recaptcha/;	MSBuild.exe, 00000002.00000002.1269883843.0000000001162000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/profiles/76561199724331900/inventory/	MSBuild.exe, 00000002.00000002.1269768801.0000000001139000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
http://127.0.0.1:27060	MSBuild.exe, 00000002.00000002.1269883843.0000000001162000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/css/applications/community/main.css?v=Ev2sBLgkgyWJ&a	MSBuild.exe, 00000002.00000002.1269633613.0000000001134000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com	MSBuild.exe, 00000002.00000002.1269883843.0000000001162000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.youtube.com	MSBuild.exe, 00000002.00000002.1269883843.0000000001162000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.google.com	MSBuild.exe, 00000002.00000002.1269883843.0000000001162000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/javascript/applications/community/main.js?v=10oP_O2R	MSBuild.exe, 00000002.00000002.1269633613.0000000001134000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://medal.tv	MSBuild.exe, 00000002.00000002.1269883843.0000000001162000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://broadcast.st.dl.eccdnx.com	MSBuild.exe, 00000002.00000002.1269883843.0000000001162000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1	MSBuild.exe, 00000002.00000002.1269633613.0000000001134000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/profiles/76561199724331900koF?	MSBuild.exe, 00000002.00000002.1269883843.0000000001155000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://www.google.com/recaptcha/	MSBuild.exe, 00000002.00000002.1269883843.0000000001162000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://help.steampowered.com/	MSBuild.exe, 00000002.00000002.1269883843.0000000001162000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.steampowered.com/	MSBuild.exe, 00000002.00000002.1269883843.0000000001162000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://store.steampowered.com/account/cookiepreferences/	MSBuild.exe, 00000002.00000002.1269633613.0000000001134000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/3	MSBuild.exe, 00000002.00000002.1269883843.0000000001162000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://s.ytimg.com;	MSBuild.exe, 00000002.00000002.1269883843.0000000001162000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com/	MSBuild.exe, 00000002.00000002.1269883843.0000000001162000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1269883843.0000000001155000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://login.steampowered.com/	MSBuild.exe, 00000002.00000002.1269883843.0000000001162000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/legal/	MSBuild.exe, 00000002.00000002.1269633613.0000000001134000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steam.tv/	MSBuild.exe, 00000002.00000002.1269883843.0000000001162000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
92.122.104.90	steamcommunity.com	European Union		16625	AKAMAI-ASUS	true
172.67.206.204	sergei-esenin.com	United States		13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1528395
Start date and time:	2024-10-07 21:52:08 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 1s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@4/5@11/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 69% Number of executed functions: 11 Number of non-executed functions: 165
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 40.126.31.73, 20.190.159.23, 20.190.159.71, 20.190.159.2, 20.190.159.73, 40.126.31.69, 20.190.159.64, 40.126.31.71, 88.221.110.91, 2.16.100.168, 20.101.57.9, 20.12.23.50, 40.69.42.241, 20.242.39.171, 52.165.164.15, 20.42.73.29, 13.95.31.18
Excluded domains from analysis (whitelisted): prdv4a.aadg.msidentity.com, ctldl.windowsupdate.com.delivery.microsoft.com, otelrules.azureedge.net, slscr.update.microsoft.com, www.tm.v4.a.prd.aadg.akadns.net, otelrules.afd.azureedge.net, twc.trafficmanager.net, ctldl.windowsupdate.com, a767.dspw65.akamai.net, login.msa.msidentity.com, download.windowsupdate.com.edgesuite.net, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, login.live.com, glb.cws.prod.dcat.dsp.trafficmanager.net, blobcollector.events.data.trafficmanager.net, onedsblobprdeus15.eastus.cloudapp.azure.com, sls.update.microsoft.com, azureedge-t-prod.trafficmanager.net, umwatson.events.data.microsoft.com, wu-b-net.trafficmanager.net, www.tm.lg.prod.aadmsa.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe

Simulations

Behavior and APIs

Time	Type	Description
15:53:03	API Interceptor	2x Sleep call for process: MSBuild.exe modified
15:53:23	API Interceptor	1x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
92.122.104.90	http://sneamcomnnumnlty.com/fact/actual/get	Get hash	malicious	Unknown	Browse
	https://u.to/xjPiIA	Get hash	malicious	Unknown	Browse
	https://sueamcoommunnlty.com/geting/active	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	LummaC, Vidar	Browse
	AD3SI7tuzs.exe	Get hash	malicious	LummaC	Browse
	http://steamcommuninty.com/playtestinvite/deadlock	Get hash	malicious	Unknown	Browse
	Setup.exe	Get hash	malicious	LummaC	Browse
	https://gtm.you1.cn/storesteam/app/835960?snr=2_9_100000_	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC	Browse
172.67.206.204	file.exe	Get hash	malicious	LummaC	Browse
	CatalogApp.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	xwZfYpo16i.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Stealc	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	p7SnjaA8NN.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	MSCy5UvBYg.exe	Get hash	malicious	LummaC, Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
sergei-esenin.com	file.exe	Get hash	malicious	LummaC	Browse	104.21.53.8
	CSY6k9gpVb.exe	Get hash	malicious	LummaC	Browse	104.21.53.8
	TuQlz67byH.exe	Get hash	malicious	LummaC	Browse	104.21.53.8
	file.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	CatalogApp.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	file.exe	Get hash	malicious	LummaC	Browse	104.21.53.8
	file.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	xwZfYpo16i.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Stealc	Browse	172.67.206.204
	c3KH2gLNrM.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Stealc, Vidar	Browse	104.21.53.8
	file.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
s-part-0017.t-0009.t-msedge.net	+18365366724753456-83736-10244688.html	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	https://s.craft.me/yB5midhwwaHUPW	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	https://t.dripemail3.com/c/eyJhbGciOiJIUzI1NiJ9.eyJhdWQiOiJkZXRvdXIiLCJpc3MiOiJtb25vbGl0aCIsInN1YiI6ImRldG91cl9saW5rIiwiaWF0IjoxNzI4MzA1Mzk4LCJuYmYiOjE3MjgzMDUzOTgsImFjY291bnRfaWQiOiIyNzYyNjA5IiwiZGVsaXZlcnlfaWQiOiJpeHI5d3pqeGcwZnI2NGJjbGwycyIsInRva2VuIjoiaXhyOXd6anhnMGZyNjRiY2xsMnMiLCJzZW5kX2F0IjoxNzI4MzA0MzU0LCJlbWFpbF9pZCI6OTk2Mzg3MCwiZW1haWxhYmxlX3R5cGUiOiJCcm9hZGNhc3QiLCJlbWFpbGFibGVfaWQiOjM5NTM4MjUsInVybCI6Imh0dHBzOi8vZGFpbHlhbGFza2EuY29tL25ld3M_X19zPWw5bzljOTZzbG8xZjF3aGFiODZrJnV0bV9zb3VyY2U9ZHJpcCZ1dG1fbWVkaXVtPWVtYWlsJnV0bV9jYW1wYWlnbj1TcHJpbmcraGFzK3NwcnVuZyslRjAlOUYlOEMlQjEifQ.HIDfaWGNVn-TCtUT4qZNHq7EdymoLEqvVA8XxZBU8z8	Get hash	malicious	HtmlDropper	Browse	13.107.246.45
	https://entertaininmotionre.pro/IQCm/	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	wULBz8VjH0.exe	Get hash	malicious	Vidar	Browse	13.107.246.45
	FdjDPFGTZS.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	13.107.246.45
	https://doccloudshareddrive.com/?auth=1&shareable=true&access=restricted&check_type=password&timestamp=2024-10-07T16%3A53%3A27.609Z&priority=high&include_details=true	Get hash	malicious	Unknown	Browse	13.107.246.45
	45Ywq5ad5H.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	13.107.246.45
	f1r6P3j3g7.exe	Get hash	malicious	LummaC, Vidar	Browse	13.107.246.45
	lCVFGKfczi.exe	Get hash	malicious	Vidar	Browse	13.107.246.45
steamcommunity.com	WiTqtf1aiE.exe	Get hash	malicious	LummaC, Vidar	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	out.exe	Get hash	malicious	Vidar	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	FdjDPFGTZS.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.102.49.254
	CSY6k9gpVb.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	TuQlz67byH.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	CatalogApp.exe	Get hash	malicious	LummaC	Browse	104.102.49.254

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	https://communications-chamber-confidentiality-limitation.trycloudflare.com/spec/#bWNhcnR3cmlnaHRAY2hlbXVuZ2NhbmFsLmNvbQ==	Get hash	malicious	Unknown	Browse	104.16.231.132
	+18365366724753456-83736-10244688.html	Get hash	malicious	HTMLPhisher	Browse	188.114.96.3
	https://url.avanan.click/v2/r01/___https://www.tiktok.com/qnspdA7?fni=6cbb&qfsl=js&xhjsj=gnt_zwq&yfwljy=myyux:ddBBB.lttlqj.hfdzwq?v=frudxdkniljyAkC.sEd.frl___.YXAzOnNvdXRoZXJua2l0Y2hlbmFuZGdyaWxsOmE6bzo2MGY0ZmI3MTkzODQ4OWRiOGFlZjY2ODI4ODlkMDk3NDo3OmRlYjY6NjI5YzkxZjFmNmQ3ZjI1NWIxN2UwYTI5ZTNmZjcyMTQyNTg3NmZhMDQyOWZlMDI4MDhmODRlNWVhYWU3MjJhZDpoOlQ6VA#ZHN5aHJlQG9sZ29vbmlrLmNvbQ==	Get hash	malicious	Unknown	Browse	172.66.0.235
	https://url.avanan.click/v2/r01/___https://www.tiktok.com/qnspdA7?fni=6cbb&qfsl=js&xhjsj=gnt_zwq&yfwljy=myyux:ddBBB.lttlqj.hfdzwq?v=frudxdkniljyAkC.sEd.frl___.YXAzOnNvdXRoZXJua2l0Y2hlbmFuZGdyaWxsOmE6bzo2MGY0ZmI3MTkzODQ4OWRiOGFlZjY2ODI4ODlkMDk3NDo3OmRlYjY6NjI5YzkxZjFmNmQ3ZjI1NWIxN2UwYTI5ZTNmZjcyMTQyNTg3NmZhMDQyOWZlMDI4MDhmODRlNWVhYWU3MjJhZDpoOlQ6VA#ZHN5aHJlQG9sZ29vbmlrLmNvbQ==	Get hash	malicious	Unknown	Browse	162.159.140.237
	https://statics.teams.cdn.office.net/evergreen-assets/safelinks/1/atp-safelinks.html?url=https%3A%2F%2Fphpstack-1335745-4931432.cloudwaysapps.com%2F%23%26%26%2B~XanJlZEBwcm9hZy5jb20=&locale=en-us&dest=https%3A%2F%2Fteams.microsoft.com%2Fapi%2Fmt%2Fpart%2Famer-03%2Fbeta%2Fatpsafelinks%2Fgeturlreputationsitev2%2F&pc=dqIG3sYngZE8N2eRBkF7CAkOWKg5g3tGjnQGJGQlc61U8QGlKCs5AzH6JKtW7FyetS1g5oEXSNBKJVlJbTCgrea0O041dBSjafsPfOc5KxbMkQRnpwalZQdhHfcjoeWL7rzuDGG%252fj2e7scaAUTCy2PY0WmBb87rgNNPdmEQne%252f00jq9aOpwCvhJrGkNK5f8MP5jaUwccFhr9IIoVaCOrXUhSnuRv%252fw%252bxhUGpneOsAgBs7CjJQbmepBIHfEqwCkqvDbYbxYB4Hm9sLVAOFaz9VFMFSXPJt4MqeWAChikWLAZATmvniptR3h97WVF%252fZtjtm3RxdNyPROzhUvL92w9fdWmSw%252bHBxn5rMHOUpaQU16ZpcfATiVaU51fqKaYO2v4ZnK7axAavLgOpgAJivuE6JO2sqksPH41Z6PVam5c4J%252bwwz5Z2pqrOSxPxEcPGeDff%252bxp9PApNxpvURRLl98WzRw%252ftZEOu%252foKPhjN0OiTGAQDLRWTF%252bMCzSQg37tk7ZYUYYc0Ycs4xDjchhFprJCCSfrZ8WyHq6cjqmnbgDKRQig28xGNFnSDEeWMDBQeeeVyNqDv0FAAxkSAMO%252b7t4Qu1y0h0MHJYEb5pxfOYe8Pyfcsn7pyR%252fkKEqziEQVGlIETrpjVMNyrhJrnX9S%252flWaxf0H3tD%252fqMhzPysO9QdPSJTG054WE4jq5GRqTKu8P25t4KJLY15Oz2j5iCg7Bd5lczhgv4PQevplLuCGckM%252fs5EPk2r2FkSOxHF51EB5FR2TgXQR5UAp2BbaWTm9irKwSSUK5z1MsGMDokVMEB4bQ9mpZrl1%252bDMixJ1mQyyLXpelmEyN8zw1nTsbXAvDQgIvPLPj0QUtphEMnmVEXMkQHiw2WHWUSxIxYcY%252fltyp6bnMrankPAnpChbWQmk95rKsUz8tqtLjNDclK1y1FLy%252fh7sed9duxDDFupXnhmXxGJOmUV6FG1arxXL8urm1F98thG8anfchv3DafKsyVHHgmdUFNH6Uhcu4sB8fo0kqm2y7IWS96w5BeG334JvnFDJPLDPvtK5ojeXfDXh%252boKJdBxXGC9NmPwgDp8XeOavQnNlJRfUAXkhukdjDg1EHGF%252b9luUuTH%252fEbKHniTzx4OvIWUnDvXcdpuEIAnW8mDJzMXpmxpl3nwtTqeQWMeSNzjute9yTZEU%252beQk498EMyU%252fuPUg%252fSOH5r%252fwjGCsPpm%252f%252bUA00SsNvWuDD0AbNIKYubFuNKQ3SX6N7M11wOksoUG%252fz9IheWtOawwl7F0lqN3xkTQhfiiHovdudAPiB%252fzt25Im27XxPQ9s1c%252bnOWOPh6m%252bvaCQcj6bcwkFbNl5Y1KL7XQvirYSFsNXnrYuQvTPMk1n5CRq6dxsl9FRGV9MMdrZduC%252bG4B0zxLA58d8fTW2zfEXnRcMTgQKLK%252fmeZT7K3wwAvQiA%253d%253d%3B%20expires%3DWed%2C%2009%20Oct%202024%2014%3A05%3A23%20GMT%3B%20path%3D%2F%3B%20SameSite%3DNone%3B%20secu	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	file.exe	Get hash	malicious	LummaC	Browse	104.21.53.8
	https://s.craft.me/yB5midhwwaHUPW	Get hash	malicious	HTMLPhisher	Browse	104.16.40.28
	https://t.dripemail3.com/c/eyJhbGciOiJIUzI1NiJ9.eyJhdWQiOiJkZXRvdXIiLCJpc3MiOiJtb25vbGl0aCIsInN1YiI6ImRldG91cl9saW5rIiwiaWF0IjoxNzI4MzA1Mzk4LCJuYmYiOjE3MjgzMDUzOTgsImFjY291bnRfaWQiOiIyNzYyNjA5IiwiZGVsaXZlcnlfaWQiOiJpeHI5d3pqeGcwZnI2NGJjbGwycyIsInRva2VuIjoiaXhyOXd6anhnMGZyNjRiY2xsMnMiLCJzZW5kX2F0IjoxNzI4MzA0MzU0LCJlbWFpbF9pZCI6OTk2Mzg3MCwiZW1haWxhYmxlX3R5cGUiOiJCcm9hZGNhc3QiLCJlbWFpbGFibGVfaWQiOjM5NTM4MjUsInVybCI6Imh0dHBzOi8vZGFpbHlhbGFza2EuY29tL25ld3M_X19zPWw5bzljOTZzbG8xZjF3aGFiODZrJnV0bV9zb3VyY2U9ZHJpcCZ1dG1fbWVkaXVtPWVtYWlsJnV0bV9jYW1wYWlnbj1TcHJpbmcraGFzK3NwcnVuZyslRjAlOUYlOEMlQjEifQ.HIDfaWGNVn-TCtUT4qZNHq7EdymoLEqvVA8XxZBU8z8	Get hash	malicious	HtmlDropper	Browse	104.21.23.186
	FW_ _EXTERNAL_ Completed_ iNH9Y_Contract_and_Agreement_3509750318S REF ID_iNH9Y.msg	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	https://entertaininmotionre.pro/IQCm/	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
AKAMAI-ASUS	https://statics.teams.cdn.office.net/evergreen-assets/safelinks/1/atp-safelinks.html?url=https%3A%2F%2Fphpstack-1335745-4931432.cloudwaysapps.com%2F%23%26%26%2B~XanJlZEBwcm9hZy5jb20=&locale=en-us&dest=https%3A%2F%2Fteams.microsoft.com%2Fapi%2Fmt%2Fpart%2Famer-03%2Fbeta%2Fatpsafelinks%2Fgeturlreputationsitev2%2F&pc=dqIG3sYngZE8N2eRBkF7CAkOWKg5g3tGjnQGJGQlc61U8QGlKCs5AzH6JKtW7FyetS1g5oEXSNBKJVlJbTCgrea0O041dBSjafsPfOc5KxbMkQRnpwalZQdhHfcjoeWL7rzuDGG%252fj2e7scaAUTCy2PY0WmBb87rgNNPdmEQne%252f00jq9aOpwCvhJrGkNK5f8MP5jaUwccFhr9IIoVaCOrXUhSnuRv%252fw%252bxhUGpneOsAgBs7CjJQbmepBIHfEqwCkqvDbYbxYB4Hm9sLVAOFaz9VFMFSXPJt4MqeWAChikWLAZATmvniptR3h97WVF%252fZtjtm3RxdNyPROzhUvL92w9fdWmSw%252bHBxn5rMHOUpaQU16ZpcfATiVaU51fqKaYO2v4ZnK7axAavLgOpgAJivuE6JO2sqksPH41Z6PVam5c4J%252bwwz5Z2pqrOSxPxEcPGeDff%252bxp9PApNxpvURRLl98WzRw%252ftZEOu%252foKPhjN0OiTGAQDLRWTF%252bMCzSQg37tk7ZYUYYc0Ycs4xDjchhFprJCCSfrZ8WyHq6cjqmnbgDKRQig28xGNFnSDEeWMDBQeeeVyNqDv0FAAxkSAMO%252b7t4Qu1y0h0MHJYEb5pxfOYe8Pyfcsn7pyR%252fkKEqziEQVGlIETrpjVMNyrhJrnX9S%252flWaxf0H3tD%252fqMhzPysO9QdPSJTG054WE4jq5GRqTKu8P25t4KJLY15Oz2j5iCg7Bd5lczhgv4PQevplLuCGckM%252fs5EPk2r2FkSOxHF51EB5FR2TgXQR5UAp2BbaWTm9irKwSSUK5z1MsGMDokVMEB4bQ9mpZrl1%252bDMixJ1mQyyLXpelmEyN8zw1nTsbXAvDQgIvPLPj0QUtphEMnmVEXMkQHiw2WHWUSxIxYcY%252fltyp6bnMrankPAnpChbWQmk95rKsUz8tqtLjNDclK1y1FLy%252fh7sed9duxDDFupXnhmXxGJOmUV6FG1arxXL8urm1F98thG8anfchv3DafKsyVHHgmdUFNH6Uhcu4sB8fo0kqm2y7IWS96w5BeG334JvnFDJPLDPvtK5ojeXfDXh%252boKJdBxXGC9NmPwgDp8XeOavQnNlJRfUAXkhukdjDg1EHGF%252b9luUuTH%252fEbKHniTzx4OvIWUnDvXcdpuEIAnW8mDJzMXpmxpl3nwtTqeQWMeSNzjute9yTZEU%252beQk498EMyU%252fuPUg%252fSOH5r%252fwjGCsPpm%252f%252bUA00SsNvWuDD0AbNIKYubFuNKQ3SX6N7M11wOksoUG%252fz9IheWtOawwl7F0lqN3xkTQhfiiHovdudAPiB%252fzt25Im27XxPQ9s1c%252bnOWOPh6m%252bvaCQcj6bcwkFbNl5Y1KL7XQvirYSFsNXnrYuQvTPMk1n5CRq6dxsl9FRGV9MMdrZduC%252bG4B0zxLA58d8fTW2zfEXnRcMTgQKLK%252fmeZT7K3wwAvQiA%253d%253d%3B%20expires%3DWed%2C%2009%20Oct%202024%2014%3A05%3A23%20GMT%3B%20path%3D%2F%3B%20SameSite%3DNone%3B%20secu	Get hash	malicious	HTMLPhisher	Browse	2.19.126.151
	WiTqtf1aiE.exe	Get hash	malicious	LummaC, Vidar	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	out.exe	Get hash	malicious	Vidar	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	cenSXPimaG.elf	Get hash	malicious	Mirai, Okiru	Browse	23.43.32.11
	FdjDPFGTZS.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.102.49.254
	CSY6k9gpVb.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	http://kendellseafoods.com/	Get hash	malicious	Unknown	Browse	104.102.44.86

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	https://communications-chamber-confidentiality-limitation.trycloudflare.com/spec/#bWNhcnR3cmlnaHRAY2hlbXVuZ2NhbmFsLmNvbQ==	Get hash	malicious	Unknown	Browse	13.107.246.45
	+18365366724753456-83736-10244688.html	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	https://mailstat.us/tr/t/5w8u1qwlwl61e4h/1/https:/krediti.ca/#Y2FyYS5jJGNiZmxvb3JzaW5jLmNvbQ==	Get hash	malicious	Outlook Phishing, HTMLPhisher	Browse	13.107.246.45
	https://url.avanan.click/v2/r01/___https://www.tiktok.com/qnspdA7?fni=6cbb&qfsl=js&xhjsj=gnt_zwq&yfwljy=myyux:ddBBB.lttlqj.hfdzwq?v=frudxdkniljyAkC.sEd.frl___.YXAzOnNvdXRoZXJua2l0Y2hlbmFuZGdyaWxsOmE6bzo2MGY0ZmI3MTkzODQ4OWRiOGFlZjY2ODI4ODlkMDk3NDo3OmRlYjY6NjI5YzkxZjFmNmQ3ZjI1NWIxN2UwYTI5ZTNmZjcyMTQyNTg3NmZhMDQyOWZlMDI4MDhmODRlNWVhYWU3MjJhZDpoOlQ6VA#ZHN5aHJlQG9sZ29vbmlrLmNvbQ==	Get hash	malicious	Unknown	Browse	13.107.246.45
	https://url.avanan.click/v2/r01/___https://www.tiktok.com/qnspdA7?fni=6cbb&qfsl=js&xhjsj=gnt_zwq&yfwljy=myyux:ddBBB.lttlqj.hfdzwq?v=frudxdkniljyAkC.sEd.frl___.YXAzOnNvdXRoZXJua2l0Y2hlbmFuZGdyaWxsOmE6bzo2MGY0ZmI3MTkzODQ4OWRiOGFlZjY2ODI4ODlkMDk3NDo3OmRlYjY6NjI5YzkxZjFmNmQ3ZjI1NWIxN2UwYTI5ZTNmZjcyMTQyNTg3NmZhMDQyOWZlMDI4MDhmODRlNWVhYWU3MjJhZDpoOlQ6VA#ZHN5aHJlQG9sZ29vbmlrLmNvbQ==	Get hash	malicious	Unknown	Browse	13.107.246.45
	WiTqtf1aiE.exe	Get hash	malicious	LummaC, Vidar	Browse	13.107.246.45
	https://s.craft.me/yB5midhwwaHUPW	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	https://t.dripemail3.com/c/eyJhbGciOiJIUzI1NiJ9.eyJhdWQiOiJkZXRvdXIiLCJpc3MiOiJtb25vbGl0aCIsInN1YiI6ImRldG91cl9saW5rIiwiaWF0IjoxNzI4MzA1Mzk4LCJuYmYiOjE3MjgzMDUzOTgsImFjY291bnRfaWQiOiIyNzYyNjA5IiwiZGVsaXZlcnlfaWQiOiJpeHI5d3pqeGcwZnI2NGJjbGwycyIsInRva2VuIjoiaXhyOXd6anhnMGZyNjRiY2xsMnMiLCJzZW5kX2F0IjoxNzI4MzA0MzU0LCJlbWFpbF9pZCI6OTk2Mzg3MCwiZW1haWxhYmxlX3R5cGUiOiJCcm9hZGNhc3QiLCJlbWFpbGFibGVfaWQiOjM5NTM4MjUsInVybCI6Imh0dHBzOi8vZGFpbHlhbGFza2EuY29tL25ld3M_X19zPWw5bzljOTZzbG8xZjF3aGFiODZrJnV0bV9zb3VyY2U9ZHJpcCZ1dG1fbWVkaXVtPWVtYWlsJnV0bV9jYW1wYWlnbj1TcHJpbmcraGFzK3NwcnVuZyslRjAlOUYlOEMlQjEifQ.HIDfaWGNVn-TCtUT4qZNHq7EdymoLEqvVA8XxZBU8z8	Get hash	malicious	HtmlDropper	Browse	13.107.246.45
	FW_ _EXTERNAL_ Completed_ iNH9Y_Contract_and_Agreement_3509750318S REF ID_iNH9Y.msg	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	file.exe	Get hash	malicious	Credential Flusher	Browse	13.107.246.45
a0e9f5d64349fb13191bc781f81f42e1	WiTqtf1aiE.exe	Get hash	malicious	LummaC, Vidar	Browse	92.122.104.90 172.67.206.204
	file.exe	Get hash	malicious	LummaC	Browse	92.122.104.90 172.67.206.204
	file.exe	Get hash	malicious	LummaC	Browse	92.122.104.90 172.67.206.204
	FdjDPFGTZS.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	92.122.104.90 172.67.206.204
	CSY6k9gpVb.exe	Get hash	malicious	LummaC	Browse	92.122.104.90 172.67.206.204
	file.exe	Get hash	malicious	LummaC	Browse	92.122.104.90 172.67.206.204
	TuQlz67byH.exe	Get hash	malicious	LummaC	Browse	92.122.104.90 172.67.206.204
	45Ywq5ad5H.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	92.122.104.90 172.67.206.204
	f1r6P3j3g7.exe	Get hash	malicious	LummaC, Vidar	Browse	92.122.104.90 172.67.206.204
	NdSXVNeoET.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	92.122.104.90 172.67.206.204

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_SecuriteInfo.com_c086986ef72da566936e540c9d0207bf0492b1a_cf265dec_7a4679c3-3ada-41cb-944a-a855ef24c584\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.6931088011658364
Encrypted:	false
SSDEEP:	96:LcFVdi0GOt7Ls9kyf9uACfuQXIDcQvc6QcEVcw3cE/91G1y+HbHg/5hZAX/d5FMl:o1inALH0BU/gjhzuiF6Z24IO8cv
MD5:	5C910918D39676849C7C2A39F617146F
SHA1:	D71B27376F6558FD562AA5E99E048B460981FD2F
SHA-256:	1506A4FC38CECB19BDA772AE116566842F7550B8D04603C232640DF675F2D334
SHA-512:	729AF3BE759EEF3BA268C7CA54844EB9C304644723559BE2054E18A87F49319DE5A35F51965B882712EC68DAFF9EA6A7EE57A1C4197C17781DB1287CB8313768
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.2.8.0.4.3.8.3.3.5.1.0.6.6.7.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.2.8.0.4.3.8.3.6.3.2.3.2.0.2.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.7.a.4.6.7.9.c.3.-.3.a.d.a.-.4.1.c.b.-.9.4.4.a.-.a.8.5.5.e.f.2.4.c.5.8.4.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.5.2.2.d.8.3.f.6.-.8.0.0.8.-.4.9.b.c.-.a.1.d.e.-.f.b.5.3.1.3.4.d.8.5.8.e.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.S.e.c.u.r.i.t.e.I.n.f.o...c.o.m...W.i.n.3.2...P.W.S.X.-.g.e.n...1.9.4.0.4...1.4.8.1.0...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.p.r.o.q.u.o.t.a...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.2.6.c.-.0.0.0.1.-.0.0.1.4.-.2.f.e.5.-.d.4.8.4.f.2.1.8.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.9.7.d.0.3.f.6.a.1.a.a.4.5.0.5.0.f.7.b.e.5.5.f.8.7.6.f.e.a.2.d.c.0.0.0.0.0.9.0.4.!.0.0.0.0.5.e.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3787.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Mon Oct 7 19:53:03 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	33798
Entropy (8bit):	1.729021723157787
Encrypted:	false
SSDEEP:	96:5V8hAwyyFhYbWzSC7DR0ZdZi77KTq47Nal239SgGWoa2qZKqah55BWIkWIksI4ut:MtFpSKl0ZDO6Nal23Ub3lwuYA6yTFXd
MD5:	DDC13D6CD370C78C419B8397B0F4DD3C
SHA1:	B0090595D1CA50CA02AB22EAABDEF00D29568040
SHA-256:	1F09E8690DDBD2FC9FD481167B5CEA0F7FCBB158A1FB80463B6AFBD57762547E
SHA-512:	697454254BB90831CECFC1FCC784B5D5BB877905A97E07A81D833E8CBA79E54E482F0F9C8F1B9A0F92CF81205E11DFDC55C3088E5BBC91C45B482A8CDE6A1169
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... ........<.g........................d...........................T.......8...........T...............Vy......................................................................................................eJ..............GenuineIntel............T.......l....<.g.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER37C7.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8522
Entropy (8bit):	3.700571140299547
Encrypted:	false
SSDEEP:	192:R6l7wVeJek68Kv/6YN3SULgmfahOEprt89blTsfC3m:R6lXJF6B6YNSULgmfahOrl4f7
MD5:	C719830FABEA32F21D38AD99A95F9E38
SHA1:	65EC3E25DC448AFB7D4A61FE2D78D0CEB8431C40
SHA-256:	D421EADE58638A07515414BE9CAC0258942E83695FD16E2B306525FEA1E13AC5
SHA-512:	DB3B66E5F24AB04D25AAFF452D86FE60AE57BE0846C99FED3D9AEDCE86632FAB15815C53BAF0C908047913EE2CB7EAD10107BF2DDEB39E6B5F8D591E082303AF
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.4.7.1.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER37F7.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4909
Entropy (8bit):	4.581969235438185
Encrypted:	false
SSDEEP:	48:cvIwWl8zs3Jg77aI9wTWpW8VY9vYm8M4JEYTZ0F2ZD+q81pkvao8rHjLrjd:uIjfZI7Oi7VyyJJtRabHjvjd
MD5:	8BCBF4E71E7C9D153832A6799066D5ED
SHA1:	C5CC8245CCB460A80B36113384F7E73624CD2359
SHA-256:	BA43B2C215D6792F848A99F34E2FC24C6AFABD92006F0FA5AAD90B4654C7824E
SHA-512:	B663845C1952D63EB558128C04B75D267D4DFF12404090E754C6497BB49F3C461B2219283686A4B96D3EE3A5F38B444A66B702A9EAED5AC231A0C0E237965E73
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="533455" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.417515079080006
Encrypted:	false
SSDEEP:	6144:Bcifpi6ceLPL9skLmb0moSWSPtaJG8nAgex285i2MMhA20X4WABlGuNS5+:ei58oSWIZBk2MM6AFBIo
MD5:	AD6C7B06A563CC6B14009C6E57BA6AA3
SHA1:	68AAE6D2AA8382A04B8196D4E828EB249FEB3571
SHA-256:	BD710846BE7C884667AC0BACA97BCB6DF30AF198B4BBB30D69CA49083F3E5E90
SHA-512:	904A3D4FD4088CDCC3B7E80AD5A3FC11FC338B2FDC8ADE4C35A724C9C72867C9F28009DCFB798D541E9C4409B00DECC37814FE3BD59472BFCD780E56445D0D82
Malicious:	false
Reputation:	low
Preview:	regfE...E....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm*.,.................................................................................................................................................................................................................................................................................................................................................~.;.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.722399300018807
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe
File size:	551'424 bytes
MD5:	62748c6343849a0f64e1b8e92c871e6f
SHA1:	5ee8f634dff41ae1755518c03cbacee77e986bd6
SHA256:	4167b003ef7a7a9120b73685d3b04acc8055e0ad8728a103a8a7fd08bdc3c142
SHA512:	cdd5b708f52362533d481b14552f917b165dd7497040fd2c85c215f433db8922277961501102c510ad7c2dfadcb96c8c2c00637d98fa97627411d83d053f0a87
SSDEEP:	12288:3yyHj9OPDU1uDEc870zOAduxUNwXEj0L4+vK3AsOEYca4S:3H9O8cz9dSUjAk+S/OEYc7
TLSH:	E9C4021175C1C072D57715320AF4DAB4AE3DBD700AA29D9F57980F7E4F20290EB359AB
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......=.9.y.WUy.WUy.WU..TTu.WU..RT..WU..STl.WU..VTz.WUy.VU!.WUilTTm.WUilSTk.WUilRT4.WU1m^Tx.WU1m.Ux.WU1mUTx.WURichy.WU...............

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x406f52
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x6704123F [Mon Oct 7 16:54:23 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	d10af643340e1121562abe3e6bd5b0e1

Entrypoint Preview

Instruction
call 00007EFF307D6E50h
jmp 00007EFF307D63BFh
push ebp
mov ebp, esp
mov eax, dword ptr [ebp+08h]
push esi
mov ecx, dword ptr [eax+3Ch]
add ecx, eax
movzx eax, word ptr [ecx+14h]
lea edx, dword ptr [ecx+18h]
add edx, eax
movzx eax, word ptr [ecx+06h]
imul esi, eax, 28h
add esi, edx
cmp edx, esi
je 00007EFF307D655Bh
mov ecx, dword ptr [ebp+0Ch]
cmp ecx, dword ptr [edx+0Ch]
jc 00007EFF307D654Ch
mov eax, dword ptr [edx+08h]
add eax, dword ptr [edx+0Ch]
cmp ecx, eax
jc 00007EFF307D654Eh
add edx, 28h
cmp edx, esi
jne 00007EFF307D652Ch
xor eax, eax
pop esi
pop ebp
ret
mov eax, edx
jmp 00007EFF307D653Bh
push esi
call 00007EFF307D7164h
test eax, eax
je 00007EFF307D6562h
mov eax, dword ptr fs:[00000018h]
mov esi, 00486754h
mov edx, dword ptr [eax+04h]
jmp 00007EFF307D6546h
cmp edx, eax
je 00007EFF307D6552h
xor eax, eax
mov ecx, edx
lock cmpxchg dword ptr [esi], ecx
test eax, eax
jne 00007EFF307D6532h
xor al, al
pop esi
ret
mov al, 01h
pop esi
ret
push ebp
mov ebp, esp
cmp dword ptr [ebp+08h], 00000000h
jne 00007EFF307D6549h
mov byte ptr [00486758h], 00000001h
call 00007EFF307D67FAh
call 00007EFF307D9717h
test al, al
jne 00007EFF307D6546h
xor al, al
pop ebp
ret
call 00007EFF307E2179h
test al, al
jne 00007EFF307D654Ch
push 00000000h
call 00007EFF307D971Eh
pop ecx
jmp 00007EFF307D652Bh
mov al, 01h
pop ebp
ret
push ebp
mov ebp, esp
cmp byte ptr [00486759h], 00000000h
je 00007EFF307D6546h
mov al, 01h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2c6c0	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x88000	0x3d8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x89000	0x1ad4	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x2abc0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x2ab00	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x23000	0x12c	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x210f0	0x21200	6c59d601b45f81c4b69b2561b280639e	False	0.5865197523584905	data	6.666581748768188	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x23000	0x9d78	0x9e00	d6164a70217c7aaa397b3b224ea1818b	False	0.4350771360759494	data	4.954563206770478	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x2d000	0x5a380	0x59600	338482d69e2c20445aea850feedddbf5	False	0.9912259615384615	DOS executable (block device driver \377\377\377\377,32-bit sector-support)	7.99234772637819	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x88000	0x3d8	0x400	c67ba8481d4e7c92e5fe9f152983a3f3	False	0.439453125	data	3.287044161603086	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x89000	0x1ad4	0x1c00	d5034316f3193736196b1e4313c773a6	False	0.7269810267857143	data	6.389550090010284	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x88058	0x380	data	English	United States	0.46205357142857145

Imports

DLL

Import

KERNEL32.dll

AttachConsole, MultiByteToWideChar, GetStringTypeW, WideCharToMultiByte, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionEx, DeleteCriticalSection, EncodePointer, DecodePointer, LCMapStringEx, GetCPInfo, IsProcessorFeaturePresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, GetStartupInfoW, GetModuleHandleW, CreateFileW, RaiseException, RtlUnwind, GetLastError, SetLastError, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, GetProcAddress, LoadLibraryExW, GetStdHandle, WriteFile, GetModuleFileNameW, ExitProcess, GetModuleHandleExW, HeapAlloc, HeapFree, GetFileType, LCMapStringW, GetLocaleInfoW, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, GetFileSizeEx, SetFilePointerEx, CloseHandle, FlushFileBuffers, GetConsoleOutputCP, GetConsoleMode, ReadFile, HeapReAlloc, FindClose, FindFirstFileExW, FindNextFileW, IsValidCodePage, GetACP, GetOEMCP, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetStdHandle, GetProcessHeap, ReadConsoleW, HeapSize, WriteConsoleW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-07T21:53:06.917965+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.7	49701	172.67.206.204	443	TCP
2024-10-07T21:53:06.917965+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.7	49701	172.67.206.204	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 7, 2024 21:52:58.813922882 CEST	49671	443	192.168.2.7	204.79.197.203
Oct 7, 2024 21:53:00.017170906 CEST	49671	443	192.168.2.7	204.79.197.203
Oct 7, 2024 21:53:00.579629898 CEST	49675	443	192.168.2.7	104.98.116.138
Oct 7, 2024 21:53:00.581558943 CEST	49674	443	192.168.2.7	104.98.116.138
Oct 7, 2024 21:53:00.704884052 CEST	49672	443	192.168.2.7	104.98.116.138
Oct 7, 2024 21:53:02.423317909 CEST	49671	443	192.168.2.7	204.79.197.203
Oct 7, 2024 21:53:04.430964947 CEST	49699	443	192.168.2.7	92.122.104.90
Oct 7, 2024 21:53:04.430989027 CEST	443	49699	92.122.104.90	192.168.2.7
Oct 7, 2024 21:53:04.431066036 CEST	49699	443	192.168.2.7	92.122.104.90
Oct 7, 2024 21:53:04.433891058 CEST	49699	443	192.168.2.7	92.122.104.90
Oct 7, 2024 21:53:04.433906078 CEST	443	49699	92.122.104.90	192.168.2.7
Oct 7, 2024 21:53:05.074063063 CEST	443	49699	92.122.104.90	192.168.2.7
Oct 7, 2024 21:53:05.074141979 CEST	49699	443	192.168.2.7	92.122.104.90
Oct 7, 2024 21:53:05.096117020 CEST	49699	443	192.168.2.7	92.122.104.90
Oct 7, 2024 21:53:05.096136093 CEST	443	49699	92.122.104.90	192.168.2.7
Oct 7, 2024 21:53:05.096534014 CEST	443	49699	92.122.104.90	192.168.2.7
Oct 7, 2024 21:53:05.150628090 CEST	49699	443	192.168.2.7	92.122.104.90
Oct 7, 2024 21:53:05.475281000 CEST	49699	443	192.168.2.7	92.122.104.90
Oct 7, 2024 21:53:05.519398928 CEST	443	49699	92.122.104.90	192.168.2.7
Oct 7, 2024 21:53:05.894320965 CEST	443	49699	92.122.104.90	192.168.2.7
Oct 7, 2024 21:53:05.894380093 CEST	443	49699	92.122.104.90	192.168.2.7
Oct 7, 2024 21:53:05.894399881 CEST	443	49699	92.122.104.90	192.168.2.7
Oct 7, 2024 21:53:05.894550085 CEST	49699	443	192.168.2.7	92.122.104.90
Oct 7, 2024 21:53:05.894550085 CEST	49699	443	192.168.2.7	92.122.104.90
Oct 7, 2024 21:53:05.894558907 CEST	443	49699	92.122.104.90	192.168.2.7
Oct 7, 2024 21:53:05.894570112 CEST	443	49699	92.122.104.90	192.168.2.7
Oct 7, 2024 21:53:05.894584894 CEST	443	49699	92.122.104.90	192.168.2.7
Oct 7, 2024 21:53:05.894603968 CEST	49699	443	192.168.2.7	92.122.104.90
Oct 7, 2024 21:53:05.894861937 CEST	49699	443	192.168.2.7	92.122.104.90
Oct 7, 2024 21:53:05.978977919 CEST	443	49699	92.122.104.90	192.168.2.7
Oct 7, 2024 21:53:05.979060888 CEST	49699	443	192.168.2.7	92.122.104.90
Oct 7, 2024 21:53:05.979068995 CEST	443	49699	92.122.104.90	192.168.2.7
Oct 7, 2024 21:53:05.979134083 CEST	49699	443	192.168.2.7	92.122.104.90
Oct 7, 2024 21:53:05.986037970 CEST	443	49699	92.122.104.90	192.168.2.7
Oct 7, 2024 21:53:05.986114979 CEST	49699	443	192.168.2.7	92.122.104.90
Oct 7, 2024 21:53:05.986128092 CEST	443	49699	92.122.104.90	192.168.2.7
Oct 7, 2024 21:53:05.986196995 CEST	443	49699	92.122.104.90	192.168.2.7
Oct 7, 2024 21:53:05.986217022 CEST	49699	443	192.168.2.7	92.122.104.90
Oct 7, 2024 21:53:05.986335993 CEST	49699	443	192.168.2.7	92.122.104.90
Oct 7, 2024 21:53:05.988315105 CEST	49699	443	192.168.2.7	92.122.104.90
Oct 7, 2024 21:53:05.988315105 CEST	49699	443	192.168.2.7	92.122.104.90
Oct 7, 2024 21:53:05.988322973 CEST	443	49699	92.122.104.90	192.168.2.7
Oct 7, 2024 21:53:05.988336086 CEST	443	49699	92.122.104.90	192.168.2.7
Oct 7, 2024 21:53:06.001894951 CEST	49701	443	192.168.2.7	172.67.206.204
Oct 7, 2024 21:53:06.001929998 CEST	443	49701	172.67.206.204	192.168.2.7
Oct 7, 2024 21:53:06.002007961 CEST	49701	443	192.168.2.7	172.67.206.204
Oct 7, 2024 21:53:06.002532005 CEST	49701	443	192.168.2.7	172.67.206.204
Oct 7, 2024 21:53:06.002543926 CEST	443	49701	172.67.206.204	192.168.2.7
Oct 7, 2024 21:53:06.439634085 CEST	49677	443	192.168.2.7	20.50.201.200
Oct 7, 2024 21:53:06.468512058 CEST	443	49701	172.67.206.204	192.168.2.7
Oct 7, 2024 21:53:06.468651056 CEST	49701	443	192.168.2.7	172.67.206.204
Oct 7, 2024 21:53:06.472986937 CEST	49701	443	192.168.2.7	172.67.206.204
Oct 7, 2024 21:53:06.472996950 CEST	443	49701	172.67.206.204	192.168.2.7
Oct 7, 2024 21:53:06.473329067 CEST	443	49701	172.67.206.204	192.168.2.7
Oct 7, 2024 21:53:06.474554062 CEST	49701	443	192.168.2.7	172.67.206.204
Oct 7, 2024 21:53:06.474570036 CEST	49701	443	192.168.2.7	172.67.206.204
Oct 7, 2024 21:53:06.474622965 CEST	443	49701	172.67.206.204	192.168.2.7
Oct 7, 2024 21:53:06.813921928 CEST	49677	443	192.168.2.7	20.50.201.200
Oct 7, 2024 21:53:06.917989016 CEST	443	49701	172.67.206.204	192.168.2.7
Oct 7, 2024 21:53:06.918231010 CEST	443	49701	172.67.206.204	192.168.2.7
Oct 7, 2024 21:53:06.918296099 CEST	49701	443	192.168.2.7	172.67.206.204
Oct 7, 2024 21:53:06.938069105 CEST	49701	443	192.168.2.7	172.67.206.204
Oct 7, 2024 21:53:06.938097954 CEST	443	49701	172.67.206.204	192.168.2.7
Oct 7, 2024 21:53:06.938108921 CEST	49701	443	192.168.2.7	172.67.206.204
Oct 7, 2024 21:53:06.938114882 CEST	443	49701	172.67.206.204	192.168.2.7
Oct 7, 2024 21:53:07.235843897 CEST	49671	443	192.168.2.7	204.79.197.203
Oct 7, 2024 21:53:07.563939095 CEST	49677	443	192.168.2.7	20.50.201.200
Oct 7, 2024 21:53:09.063970089 CEST	49677	443	192.168.2.7	20.50.201.200
Oct 7, 2024 21:53:10.188976049 CEST	49674	443	192.168.2.7	104.98.116.138
Oct 7, 2024 21:53:10.188976049 CEST	49675	443	192.168.2.7	104.98.116.138
Oct 7, 2024 21:53:10.313957930 CEST	49672	443	192.168.2.7	104.98.116.138
Oct 7, 2024 21:53:10.463907957 CEST	49706	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:10.463979006 CEST	443	49706	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:10.464067936 CEST	49706	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:10.464485884 CEST	49706	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:10.464503050 CEST	443	49706	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:11.184290886 CEST	443	49706	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:11.184370995 CEST	49706	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:11.192125082 CEST	49706	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:11.192132950 CEST	443	49706	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:11.192459106 CEST	443	49706	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:11.203490973 CEST	49706	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:11.251405954 CEST	443	49706	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:11.307825089 CEST	443	49706	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:11.307893038 CEST	443	49706	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:11.307993889 CEST	443	49706	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:11.308012009 CEST	49706	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:11.308026075 CEST	443	49706	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:11.308060884 CEST	49706	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:11.308082104 CEST	49706	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:11.392560959 CEST	443	49706	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:11.392636061 CEST	443	49706	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:11.392668962 CEST	49706	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:11.392687082 CEST	443	49706	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:11.392719030 CEST	49706	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:11.392735004 CEST	49706	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:11.394040108 CEST	443	49706	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:11.394084930 CEST	443	49706	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:11.394105911 CEST	49706	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:11.394112110 CEST	443	49706	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:11.394166946 CEST	49706	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:11.480756998 CEST	443	49706	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:11.480809927 CEST	443	49706	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:11.480842113 CEST	49706	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:11.480861902 CEST	443	49706	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:11.480889082 CEST	49706	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:11.480905056 CEST	49706	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:11.481575012 CEST	443	49706	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:11.481622934 CEST	443	49706	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:11.481651068 CEST	49706	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:11.481656075 CEST	443	49706	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:11.481683016 CEST	49706	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:11.481695890 CEST	49706	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:11.482789040 CEST	443	49706	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:11.482834101 CEST	443	49706	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:11.482851982 CEST	49706	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:11.482858896 CEST	443	49706	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:11.482884884 CEST	49706	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:11.482922077 CEST	49706	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:11.483875036 CEST	443	49706	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:11.483918905 CEST	443	49706	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:11.483939886 CEST	49706	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:11.483947992 CEST	443	49706	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:11.483971119 CEST	49706	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:11.483988047 CEST	49706	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:11.568830013 CEST	443	49706	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:11.568892956 CEST	443	49706	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:11.568916082 CEST	49706	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:11.568926096 CEST	443	49706	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:11.568970919 CEST	49706	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:11.569860935 CEST	443	49706	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:11.569902897 CEST	443	49706	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:11.569924116 CEST	49706	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:11.569927931 CEST	443	49706	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:11.569952965 CEST	49706	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:11.569968939 CEST	49706	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:11.570729017 CEST	443	49706	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:11.570774078 CEST	443	49706	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:11.570792913 CEST	49706	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:11.570797920 CEST	443	49706	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:11.570825100 CEST	49706	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:11.570849895 CEST	49706	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:11.572500944 CEST	443	49706	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:11.572540998 CEST	443	49706	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:11.572566986 CEST	49706	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:11.572571993 CEST	443	49706	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:11.572602034 CEST	49706	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:11.572618008 CEST	49706	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:11.573173046 CEST	443	49706	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:11.573210955 CEST	443	49706	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:11.573234081 CEST	49706	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:11.573237896 CEST	443	49706	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:11.573262930 CEST	49706	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:11.573281050 CEST	49706	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:11.573609114 CEST	443	49706	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:11.573648930 CEST	443	49706	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:11.573669910 CEST	49706	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:11.573674917 CEST	443	49706	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:11.573703051 CEST	49706	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:11.573719978 CEST	49706	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:11.574580908 CEST	443	49706	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:11.574644089 CEST	49706	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:11.574647903 CEST	443	49706	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:11.574683905 CEST	49706	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:11.574712038 CEST	49706	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:11.574714899 CEST	443	49706	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:11.574734926 CEST	443	49706	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:11.574753046 CEST	49706	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:11.574767113 CEST	443	49706	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:11.624514103 CEST	49707	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:11.624541998 CEST	443	49707	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:11.624619961 CEST	49707	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:11.625674963 CEST	49708	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:11.625706911 CEST	443	49708	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:11.626410961 CEST	49709	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:11.626461029 CEST	443	49709	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:11.626503944 CEST	49708	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:11.626588106 CEST	49709	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:11.626995087 CEST	49707	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:11.627011061 CEST	443	49707	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:11.628108025 CEST	49710	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:11.628129959 CEST	443	49710	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:11.628230095 CEST	49710	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:11.628463984 CEST	49710	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:11.628488064 CEST	443	49710	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:11.628618002 CEST	49708	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:11.628633976 CEST	443	49708	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:11.628938913 CEST	49709	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:11.628952980 CEST	443	49709	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:11.629998922 CEST	49711	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:11.630019903 CEST	443	49711	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:11.630076885 CEST	49711	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:11.630389929 CEST	49711	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:11.630405903 CEST	443	49711	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:12.048381090 CEST	49677	443	192.168.2.7	20.50.201.200
Oct 7, 2024 21:53:12.241611958 CEST	443	49710	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:12.242173910 CEST	49710	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:12.242188931 CEST	443	49710	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:12.242688894 CEST	49710	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:12.242697001 CEST	443	49710	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:12.245229959 CEST	443	49709	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:12.245573997 CEST	49709	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:12.245582104 CEST	443	49709	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:12.246063948 CEST	49709	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:12.246071100 CEST	443	49709	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:12.265424013 CEST	443	49708	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:12.265810013 CEST	49708	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:12.265819073 CEST	443	49708	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:12.266238928 CEST	49708	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:12.266242981 CEST	443	49708	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:12.274153948 CEST	443	49707	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:12.274509907 CEST	49707	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:12.274525881 CEST	443	49707	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:12.274945021 CEST	49707	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:12.274950027 CEST	443	49707	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:12.277689934 CEST	443	49711	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:12.278044939 CEST	49711	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:12.278062105 CEST	443	49711	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:12.278404951 CEST	49711	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:12.278409958 CEST	443	49711	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:12.338162899 CEST	443	49710	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:12.338228941 CEST	443	49710	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:12.338301897 CEST	49710	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:12.338481903 CEST	49710	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:12.338481903 CEST	49710	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:12.338504076 CEST	443	49710	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:12.338512897 CEST	443	49710	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:12.341334105 CEST	49712	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:12.341367006 CEST	443	49712	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:12.341559887 CEST	49712	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:12.341761112 CEST	49712	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:12.341773033 CEST	443	49712	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:12.345380068 CEST	443	49709	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:12.345401049 CEST	443	49709	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:12.345453978 CEST	49709	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:12.345473051 CEST	443	49709	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:12.345562935 CEST	49709	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:12.345649004 CEST	49709	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:12.345666885 CEST	443	49709	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:12.345698118 CEST	49709	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:12.345808029 CEST	443	49709	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:12.345838070 CEST	443	49709	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:12.346611023 CEST	49709	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:12.347625971 CEST	49713	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:12.347660065 CEST	443	49713	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:12.347749949 CEST	49713	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:12.347882032 CEST	49713	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:12.347896099 CEST	443	49713	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:12.369837046 CEST	443	49708	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:12.369921923 CEST	443	49708	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:12.369971991 CEST	49708	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:12.370047092 CEST	49708	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:12.370057106 CEST	443	49708	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:12.370141983 CEST	49708	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:12.370146990 CEST	443	49708	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:12.372060061 CEST	49714	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:12.372087002 CEST	443	49714	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:12.372256994 CEST	49714	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:12.372411013 CEST	49714	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:12.372421026 CEST	443	49714	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:12.379403114 CEST	443	49707	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:12.379473925 CEST	443	49707	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:12.379542112 CEST	49707	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:12.379555941 CEST	443	49707	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:12.379597902 CEST	49707	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:12.379640102 CEST	443	49707	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:12.379684925 CEST	49707	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:12.379749060 CEST	49707	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:12.379757881 CEST	443	49707	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:12.379766941 CEST	49707	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:12.379770994 CEST	443	49707	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:12.380593061 CEST	443	49711	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:12.380625010 CEST	443	49711	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:12.380713940 CEST	49711	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:12.380724907 CEST	443	49711	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:12.380930901 CEST	443	49711	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:12.381129026 CEST	49711	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:12.381351948 CEST	49711	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:12.381351948 CEST	49711	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:12.381359100 CEST	443	49711	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:12.381366014 CEST	443	49711	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:12.383550882 CEST	49715	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:12.383574963 CEST	443	49715	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:12.383663893 CEST	49715	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:12.383819103 CEST	49715	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:12.383833885 CEST	443	49715	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:12.384205103 CEST	49716	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:12.384241104 CEST	443	49716	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:12.384321928 CEST	49716	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:12.384433985 CEST	49716	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:12.384449959 CEST	443	49716	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:12.731244087 CEST	443	49698	104.98.116.138	192.168.2.7
Oct 7, 2024 21:53:12.731439114 CEST	49698	443	192.168.2.7	104.98.116.138
Oct 7, 2024 21:53:12.980355978 CEST	443	49712	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:12.980853081 CEST	49712	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:12.980866909 CEST	443	49712	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:12.981434107 CEST	49712	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:12.981439114 CEST	443	49712	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:12.981447935 CEST	443	49713	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:12.981875896 CEST	49713	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:12.981903076 CEST	443	49713	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:12.982248068 CEST	49713	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:12.982266903 CEST	443	49713	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:12.984117985 CEST	443	49714	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:12.984591961 CEST	49714	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:12.984616995 CEST	443	49714	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:12.985096931 CEST	49714	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:12.985112906 CEST	443	49714	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:13.022429943 CEST	443	49716	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:13.022813082 CEST	49716	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:13.022870064 CEST	443	49716	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:13.023169041 CEST	49716	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:13.023185968 CEST	443	49716	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:13.049546003 CEST	443	49715	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:13.050473928 CEST	49715	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:13.050499916 CEST	443	49715	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:13.050930977 CEST	49715	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:13.050935984 CEST	443	49715	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:13.076751947 CEST	443	49712	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:13.076908112 CEST	443	49712	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:13.076981068 CEST	49712	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:13.077065945 CEST	49712	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:13.077085972 CEST	443	49712	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:13.077111959 CEST	49712	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:13.077120066 CEST	443	49712	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:13.080565929 CEST	49717	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:13.080599070 CEST	443	49717	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:13.080658913 CEST	49717	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:13.080868959 CEST	49717	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:13.080878973 CEST	443	49717	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:13.083297014 CEST	443	49714	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:13.083372116 CEST	443	49714	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:13.083456039 CEST	49714	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:13.084163904 CEST	49714	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:13.084163904 CEST	49714	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:13.084196091 CEST	443	49714	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:13.084209919 CEST	443	49714	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:13.088684082 CEST	49718	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:13.088695049 CEST	443	49718	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:13.088756084 CEST	49718	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:13.089909077 CEST	49718	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:13.089920998 CEST	443	49718	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:13.123603106 CEST	443	49716	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:13.123667955 CEST	443	49716	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:13.123717070 CEST	49716	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:13.124026060 CEST	49716	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:13.124026060 CEST	49716	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:13.124062061 CEST	443	49716	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:13.124085903 CEST	443	49716	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:13.127301931 CEST	49719	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:13.127346992 CEST	443	49719	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:13.127434015 CEST	49719	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:13.127629042 CEST	49719	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:13.127646923 CEST	443	49719	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:13.129503965 CEST	443	49713	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:13.129570007 CEST	443	49713	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:13.129617929 CEST	49713	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:13.129718065 CEST	49713	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:13.129718065 CEST	49713	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:13.129740953 CEST	443	49713	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:13.129751921 CEST	443	49713	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:13.132854939 CEST	49720	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:13.132885933 CEST	443	49720	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:13.132983923 CEST	49720	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:13.133152008 CEST	49720	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:13.133178949 CEST	443	49720	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:13.151465893 CEST	443	49715	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:13.151623011 CEST	443	49715	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:13.151683092 CEST	49715	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:13.151906013 CEST	49715	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:13.151926041 CEST	443	49715	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:13.151949883 CEST	49715	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:13.151957989 CEST	443	49715	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:13.154438972 CEST	49721	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:13.154463053 CEST	443	49721	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:13.154561043 CEST	49721	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:13.154700041 CEST	49721	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:13.154712915 CEST	443	49721	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:13.710263968 CEST	443	49717	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:13.711644888 CEST	49717	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:13.711673975 CEST	443	49717	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:13.712063074 CEST	49717	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:13.712074995 CEST	443	49717	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:13.724488020 CEST	443	49718	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:13.726031065 CEST	49718	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:13.726038933 CEST	443	49718	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:13.726437092 CEST	49718	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:13.726440907 CEST	443	49718	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:13.737308979 CEST	443	49719	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:13.739100933 CEST	443	49720	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:13.741072893 CEST	49719	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:13.741118908 CEST	443	49719	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:13.741473913 CEST	49719	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:13.741486073 CEST	443	49719	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:13.743798971 CEST	49720	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:13.743798971 CEST	49720	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:13.743808031 CEST	443	49720	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:13.743832111 CEST	443	49720	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:13.812237978 CEST	443	49717	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:13.812390089 CEST	443	49717	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:13.812450886 CEST	49717	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:13.812561989 CEST	49717	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:13.812585115 CEST	443	49717	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:13.812598944 CEST	49717	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:13.812606096 CEST	443	49717	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:13.815721989 CEST	49722	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:13.815749884 CEST	443	49722	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:13.815809965 CEST	49722	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:13.816018105 CEST	49722	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:13.816030979 CEST	443	49722	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:13.828269958 CEST	443	49718	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:13.828336954 CEST	443	49718	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:13.828380108 CEST	49718	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:13.828469038 CEST	49718	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:13.828478098 CEST	443	49718	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:13.828490973 CEST	49718	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:13.828495979 CEST	443	49718	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:13.830605984 CEST	49723	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:13.830642939 CEST	443	49723	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:13.830842972 CEST	49723	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:13.830842972 CEST	49723	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:13.830867052 CEST	443	49723	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:13.831206083 CEST	443	49721	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:13.831655979 CEST	49721	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:13.831670046 CEST	443	49721	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:13.832030058 CEST	49721	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:13.832042933 CEST	443	49721	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:13.855572939 CEST	443	49720	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:13.855649948 CEST	443	49720	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:13.855787992 CEST	49720	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:13.855946064 CEST	49720	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:13.855946064 CEST	49720	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:13.855952024 CEST	443	49720	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:13.855959892 CEST	443	49720	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:13.856600046 CEST	443	49719	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:13.856662035 CEST	443	49719	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:13.856719017 CEST	49719	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:13.856842995 CEST	49719	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:13.856868982 CEST	443	49719	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:13.856884003 CEST	49719	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:13.856898069 CEST	443	49719	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:13.858232975 CEST	49724	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:13.858256102 CEST	443	49724	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:13.858311892 CEST	49724	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:13.858623981 CEST	49724	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:13.858634949 CEST	443	49724	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:13.858918905 CEST	49725	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:13.858944893 CEST	443	49725	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:13.859018087 CEST	49725	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:13.859101057 CEST	49725	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:13.859107971 CEST	443	49725	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:13.946156979 CEST	443	49721	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:13.946325064 CEST	443	49721	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:13.946393967 CEST	49721	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:13.946487904 CEST	49721	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:13.946487904 CEST	49721	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:13.946499109 CEST	443	49721	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:13.946507931 CEST	443	49721	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:13.948858976 CEST	49726	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:13.948879004 CEST	443	49726	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:13.948947906 CEST	49726	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:13.949088097 CEST	49726	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:13.949105024 CEST	443	49726	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:14.487709045 CEST	443	49723	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:14.488241911 CEST	49723	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:14.488256931 CEST	443	49723	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:14.488687992 CEST	49723	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:14.488692999 CEST	443	49723	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:14.499725103 CEST	443	49722	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:14.500159025 CEST	49722	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:14.500173092 CEST	443	49722	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:14.500575066 CEST	49722	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:14.500581026 CEST	443	49722	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:14.503354073 CEST	443	49725	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:14.503653049 CEST	49725	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:14.503669977 CEST	443	49725	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:14.503988028 CEST	49725	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:14.503993988 CEST	443	49725	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:14.507589102 CEST	443	49724	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:14.507884026 CEST	49724	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:14.507914066 CEST	443	49724	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:14.508205891 CEST	49724	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:14.508210897 CEST	443	49724	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:14.563894987 CEST	443	49726	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:14.564599991 CEST	49726	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:14.564610958 CEST	443	49726	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:14.565197945 CEST	49726	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:14.565203905 CEST	443	49726	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:14.584980011 CEST	443	49723	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:14.585081100 CEST	443	49723	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:14.585144043 CEST	49723	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:14.585360050 CEST	49723	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:14.585381031 CEST	443	49723	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:14.585391045 CEST	49723	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:14.585397005 CEST	443	49723	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:14.588305950 CEST	49727	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:14.588354111 CEST	443	49727	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:14.588440895 CEST	49727	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:14.588644028 CEST	49727	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:14.588656902 CEST	443	49727	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:14.597680092 CEST	443	49722	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:14.597812891 CEST	443	49722	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:14.597877026 CEST	49722	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:14.597903013 CEST	49722	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:14.597918987 CEST	443	49722	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:14.597934008 CEST	49722	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:14.597938061 CEST	443	49722	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:14.600264072 CEST	49728	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:14.600284100 CEST	443	49728	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:14.600344896 CEST	49728	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:14.600491047 CEST	49728	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:14.600502014 CEST	443	49728	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:14.606055975 CEST	443	49724	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:14.606197119 CEST	443	49724	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:14.606271982 CEST	49724	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:14.606317043 CEST	49724	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:14.606317043 CEST	49724	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:14.606338978 CEST	443	49724	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:14.606349945 CEST	443	49724	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:14.608675003 CEST	49729	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:14.608695984 CEST	443	49729	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:14.608767033 CEST	49729	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:14.608892918 CEST	49729	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:14.608912945 CEST	443	49729	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:14.643023968 CEST	443	49725	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:14.643098116 CEST	443	49725	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:14.643166065 CEST	49725	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:14.643381119 CEST	49725	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:14.643402100 CEST	443	49725	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:14.643419027 CEST	49725	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:14.643425941 CEST	443	49725	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:14.646239042 CEST	49730	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:14.646259069 CEST	443	49730	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:14.646356106 CEST	49730	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:14.646512985 CEST	49730	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:14.646532059 CEST	443	49730	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:14.659143925 CEST	443	49726	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:14.659286976 CEST	443	49726	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:14.659353971 CEST	49726	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:14.659564972 CEST	49726	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:14.659564972 CEST	49726	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:14.659574032 CEST	443	49726	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:14.659584999 CEST	443	49726	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:14.661600113 CEST	49731	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:14.661617041 CEST	443	49731	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:14.661834955 CEST	49731	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:14.661834955 CEST	49731	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:14.661860943 CEST	443	49731	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:15.281945944 CEST	443	49727	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:15.282805920 CEST	49727	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:15.282820940 CEST	443	49727	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:15.283258915 CEST	49727	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:15.283263922 CEST	443	49727	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:15.283905029 CEST	443	49730	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:15.284276962 CEST	49730	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:15.284287930 CEST	443	49730	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:15.284745932 CEST	49730	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:15.284750938 CEST	443	49730	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:15.286164999 CEST	443	49729	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:15.286412954 CEST	49729	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:15.286421061 CEST	443	49729	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:15.286745071 CEST	49729	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:15.286756992 CEST	443	49729	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:15.299981117 CEST	443	49728	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:15.300591946 CEST	49728	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:15.300599098 CEST	443	49728	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:15.301103115 CEST	49728	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:15.301107883 CEST	443	49728	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:15.309436083 CEST	443	49731	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:15.309900045 CEST	49731	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:15.309917927 CEST	443	49731	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:15.310350895 CEST	49731	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:15.310355902 CEST	443	49731	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:15.378072023 CEST	443	49727	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:15.378130913 CEST	443	49727	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:15.378174067 CEST	49727	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:15.378345966 CEST	49727	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:15.378362894 CEST	443	49727	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:15.378372908 CEST	49727	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:15.378377914 CEST	443	49727	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:15.379723072 CEST	443	49730	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:15.379785061 CEST	443	49730	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:15.379843950 CEST	49730	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:15.379981995 CEST	49730	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:15.379981995 CEST	49730	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:15.379988909 CEST	443	49730	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:15.379997015 CEST	443	49730	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:15.381268024 CEST	49732	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:15.381289005 CEST	443	49732	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:15.381376028 CEST	49732	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:15.381505013 CEST	49732	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:15.381513119 CEST	443	49732	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:15.382006884 CEST	49733	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:15.382035971 CEST	443	49733	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:15.382101059 CEST	49733	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:15.382232904 CEST	49733	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:15.382247925 CEST	443	49733	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:15.383089066 CEST	443	49729	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:15.383163929 CEST	443	49729	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:15.383239985 CEST	49729	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:15.383256912 CEST	49729	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:15.383260965 CEST	443	49729	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:15.383289099 CEST	49729	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:15.383294106 CEST	443	49729	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:15.385143042 CEST	49734	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:15.385152102 CEST	443	49734	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:15.385212898 CEST	49734	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:15.385320902 CEST	49734	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:15.385334969 CEST	443	49734	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:15.401251078 CEST	443	49728	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:15.401398897 CEST	443	49728	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:15.401478052 CEST	49728	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:15.401505947 CEST	49728	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:15.401505947 CEST	49728	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:15.401511908 CEST	443	49728	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:15.401519060 CEST	443	49728	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:15.403320074 CEST	49735	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:15.403331041 CEST	443	49735	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:15.403409004 CEST	49735	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:15.403508902 CEST	49735	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:15.403518915 CEST	443	49735	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:15.411902905 CEST	443	49731	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:15.412503958 CEST	443	49731	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:15.412568092 CEST	49731	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:15.412631989 CEST	49731	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:15.412631989 CEST	49731	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:15.412637949 CEST	443	49731	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:15.412646055 CEST	443	49731	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:15.414566994 CEST	49736	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:15.414589882 CEST	443	49736	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:15.414650917 CEST	49736	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:15.414758921 CEST	49736	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:15.414774895 CEST	443	49736	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:16.021388054 CEST	443	49732	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:16.021792889 CEST	49732	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:16.021811962 CEST	443	49732	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:16.022241116 CEST	49732	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:16.022252083 CEST	443	49732	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:16.025280952 CEST	443	49735	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:16.025629997 CEST	443	49734	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:16.025676012 CEST	49735	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:16.025691986 CEST	443	49735	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:16.025994062 CEST	49734	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:16.026012897 CEST	443	49734	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:16.026401043 CEST	49734	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:16.026410103 CEST	443	49734	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:16.026426077 CEST	49735	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:16.026436090 CEST	443	49735	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:16.031896114 CEST	443	49733	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:16.032229900 CEST	49733	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:16.032259941 CEST	443	49733	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:16.032634974 CEST	49733	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:16.032644033 CEST	443	49733	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:16.056801081 CEST	443	49736	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:16.057179928 CEST	49736	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:16.057219028 CEST	443	49736	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:16.057596922 CEST	49736	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:16.057604074 CEST	443	49736	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:16.120395899 CEST	443	49732	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:16.120461941 CEST	443	49732	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:16.120516062 CEST	49732	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:16.120731115 CEST	49732	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:16.120748997 CEST	443	49732	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:16.120778084 CEST	49732	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:16.120785952 CEST	443	49732	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:16.123684883 CEST	49737	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:16.123712063 CEST	443	49737	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:16.123780966 CEST	49737	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:16.123924017 CEST	49737	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:16.123938084 CEST	443	49737	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:16.125226974 CEST	443	49735	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:16.125303984 CEST	443	49735	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:16.125315905 CEST	443	49734	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:16.125354052 CEST	49735	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:16.125375986 CEST	443	49734	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:16.125417948 CEST	49734	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:16.125458002 CEST	49735	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:16.125474930 CEST	443	49735	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:16.125511885 CEST	49734	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:16.125529051 CEST	443	49734	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:16.125541925 CEST	49734	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:16.125549078 CEST	443	49734	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:16.128612995 CEST	49738	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:16.128623009 CEST	443	49738	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:16.128695011 CEST	49738	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:16.128786087 CEST	49738	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:16.128796101 CEST	443	49738	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:16.128997087 CEST	49739	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:16.129012108 CEST	443	49739	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:16.129070997 CEST	49739	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:16.129172087 CEST	49739	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:16.129180908 CEST	443	49739	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:16.135404110 CEST	443	49733	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:16.135458946 CEST	443	49733	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:16.135507107 CEST	49733	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:16.135620117 CEST	49733	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:16.135628939 CEST	443	49733	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:16.135641098 CEST	49733	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:16.135646105 CEST	443	49733	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:16.137872934 CEST	49740	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:16.137897015 CEST	443	49740	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:16.137954950 CEST	49740	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:16.138108015 CEST	49740	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:16.138122082 CEST	443	49740	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:16.155261993 CEST	443	49736	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:16.155317068 CEST	443	49736	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:16.155365944 CEST	49736	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:16.155493021 CEST	49736	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:16.155508041 CEST	443	49736	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:16.155520916 CEST	49736	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:16.155527115 CEST	443	49736	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:16.157989025 CEST	49741	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:16.158013105 CEST	443	49741	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:16.158070087 CEST	49741	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:16.158510923 CEST	49741	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:16.158521891 CEST	443	49741	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:16.726651907 CEST	443	49737	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:16.727535009 CEST	49737	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:16.727555990 CEST	443	49737	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:16.728022099 CEST	49737	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:16.728028059 CEST	443	49737	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:16.743486881 CEST	443	49738	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:16.744394064 CEST	49738	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:16.744405985 CEST	443	49738	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:16.744990110 CEST	49738	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:16.744995117 CEST	443	49738	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:16.792720079 CEST	443	49740	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:16.792886019 CEST	443	49741	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:16.793401957 CEST	49740	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:16.793412924 CEST	443	49740	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:16.793590069 CEST	49741	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:16.793606997 CEST	443	49741	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:16.793848991 CEST	49740	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:16.793854952 CEST	443	49740	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:16.793915033 CEST	443	49739	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:16.794056892 CEST	49741	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:16.794061899 CEST	443	49741	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:16.794178963 CEST	49739	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:16.794213057 CEST	443	49739	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:16.794557095 CEST	49739	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:16.794565916 CEST	443	49739	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:16.822102070 CEST	443	49737	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:16.822164059 CEST	443	49737	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:16.822348118 CEST	49737	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:16.822653055 CEST	49737	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:16.822653055 CEST	49737	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:16.822684050 CEST	443	49737	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:16.822707891 CEST	443	49737	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:16.825582027 CEST	49742	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:16.825613022 CEST	443	49742	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:16.825689077 CEST	49742	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:16.825850010 CEST	49742	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:16.825860023 CEST	443	49742	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:16.840046883 CEST	443	49738	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:16.840112925 CEST	443	49738	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:16.840209961 CEST	49738	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:16.840456963 CEST	49738	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:16.840462923 CEST	443	49738	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:16.840492010 CEST	49738	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:16.840497017 CEST	443	49738	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:16.842658997 CEST	49743	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:16.842683077 CEST	443	49743	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:16.842765093 CEST	49743	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:16.842920065 CEST	49743	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:16.842935085 CEST	443	49743	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:16.845231056 CEST	49671	443	192.168.2.7	204.79.197.203
Oct 7, 2024 21:53:16.891082048 CEST	443	49741	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:16.891156912 CEST	443	49741	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:16.891347885 CEST	49741	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:16.891450882 CEST	49741	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:16.891463995 CEST	443	49741	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:16.891474962 CEST	49741	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:16.891480923 CEST	443	49741	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:16.893142939 CEST	443	49740	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:16.893212080 CEST	443	49740	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:16.893254042 CEST	49740	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:16.893527031 CEST	49740	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:16.893532991 CEST	443	49740	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:16.893546104 CEST	49740	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:16.893551111 CEST	443	49740	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:16.896593094 CEST	443	49739	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:16.896666050 CEST	443	49739	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:16.896716118 CEST	49739	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:16.902733088 CEST	49739	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:16.902743101 CEST	443	49739	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:16.902755976 CEST	49739	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:16.902760983 CEST	443	49739	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:16.903661013 CEST	49744	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:16.903681993 CEST	443	49744	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:16.903749943 CEST	49744	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:16.904449940 CEST	49744	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:16.904468060 CEST	443	49744	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:16.904869080 CEST	49745	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:16.904894114 CEST	443	49745	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:16.904951096 CEST	49745	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:16.905181885 CEST	49746	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:16.905189037 CEST	443	49746	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:16.905242920 CEST	49746	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:16.905338049 CEST	49745	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:16.905349016 CEST	443	49745	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:16.905422926 CEST	49746	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:16.905431986 CEST	443	49746	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:17.623780012 CEST	443	49742	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:17.624695063 CEST	49742	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:17.624706030 CEST	443	49742	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:17.625808954 CEST	49742	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:17.625813961 CEST	443	49742	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:17.630877018 CEST	443	49745	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:17.631725073 CEST	49745	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:17.631742001 CEST	443	49745	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:17.631817102 CEST	49745	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:17.631829023 CEST	443	49745	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:17.715123892 CEST	443	49743	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:17.716355085 CEST	443	49744	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:17.717597008 CEST	49743	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:17.717607021 CEST	443	49743	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:17.718064070 CEST	49743	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:17.718069077 CEST	443	49743	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:17.718287945 CEST	49744	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:17.718297958 CEST	443	49744	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:17.718640089 CEST	49744	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:17.718645096 CEST	443	49744	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:17.721139908 CEST	443	49742	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:17.721291065 CEST	443	49742	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:17.721354961 CEST	49742	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:17.721918106 CEST	49742	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:17.721918106 CEST	49742	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:17.721937895 CEST	443	49742	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:17.721947908 CEST	443	49742	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:17.724505901 CEST	49748	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:17.724529982 CEST	443	49748	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:17.724716902 CEST	49748	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:17.724862099 CEST	49748	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:17.724875927 CEST	443	49748	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:17.745758057 CEST	443	49746	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:17.746236086 CEST	49746	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:17.746253967 CEST	443	49746	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:17.746639967 CEST	49746	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:17.746644974 CEST	443	49746	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:17.783617020 CEST	443	49745	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:17.783675909 CEST	443	49745	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:17.783715963 CEST	49745	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:17.783927917 CEST	49745	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:17.783941031 CEST	443	49745	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:17.783960104 CEST	49745	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:17.783972025 CEST	443	49745	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:17.786993027 CEST	49749	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:17.787039995 CEST	443	49749	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:17.787143946 CEST	49749	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:17.787282944 CEST	49749	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:17.787298918 CEST	443	49749	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:17.815431118 CEST	443	49744	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:17.815479040 CEST	443	49744	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:17.815552950 CEST	49744	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:17.815715075 CEST	49744	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:17.815728903 CEST	443	49744	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:17.816355944 CEST	49744	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:17.816360950 CEST	443	49744	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:17.818475962 CEST	49750	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:17.818512917 CEST	443	49750	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:17.818598032 CEST	49750	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:17.818914890 CEST	49750	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:17.818928003 CEST	443	49750	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:17.819580078 CEST	443	49743	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:17.819637060 CEST	443	49743	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:17.819683075 CEST	49743	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:17.819762945 CEST	49743	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:17.819777012 CEST	443	49743	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:17.819793940 CEST	49743	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:17.819799900 CEST	443	49743	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:17.821679115 CEST	49751	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:17.821698904 CEST	443	49751	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:17.821814060 CEST	49751	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:17.821921110 CEST	49751	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:17.821934938 CEST	443	49751	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:17.848409891 CEST	443	49746	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:17.848478079 CEST	443	49746	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:17.848572969 CEST	49746	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:17.848659039 CEST	49746	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:17.848673105 CEST	443	49746	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:17.848683119 CEST	49746	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:17.848687887 CEST	443	49746	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:17.851411104 CEST	49752	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:17.851423025 CEST	443	49752	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:17.851562023 CEST	49752	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:17.854598999 CEST	49752	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:17.854612112 CEST	443	49752	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:18.001589060 CEST	49677	443	192.168.2.7	20.50.201.200
Oct 7, 2024 21:53:18.336400032 CEST	443	49748	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:18.355153084 CEST	49748	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:18.355161905 CEST	443	49748	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:18.359390020 CEST	49748	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:18.359395027 CEST	443	49748	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:18.401448011 CEST	443	49749	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:18.409396887 CEST	49749	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:18.409424067 CEST	443	49749	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:18.410218000 CEST	49749	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:18.410231113 CEST	443	49749	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:18.791966915 CEST	443	49748	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:18.792038918 CEST	443	49748	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:18.792330027 CEST	49748	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:18.792330027 CEST	49748	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:18.792330027 CEST	49748	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:18.794868946 CEST	49753	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:18.794928074 CEST	443	49753	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:18.795042038 CEST	49753	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:18.795222044 CEST	49753	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:18.795237064 CEST	443	49753	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:18.797130108 CEST	443	49749	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:18.797184944 CEST	443	49749	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:18.797307968 CEST	49749	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:18.797333956 CEST	49749	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:18.797346115 CEST	443	49749	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:18.797372103 CEST	49749	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:18.797378063 CEST	443	49749	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:18.799463034 CEST	49754	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:18.799488068 CEST	443	49754	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:18.799555063 CEST	49754	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:18.799712896 CEST	49754	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:18.799729109 CEST	443	49754	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:18.799947977 CEST	443	49751	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:18.800275087 CEST	443	49750	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:18.800313950 CEST	443	49752	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:18.800457001 CEST	49751	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:18.800465107 CEST	443	49751	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:18.800812006 CEST	49750	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:18.800827980 CEST	443	49750	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:18.800944090 CEST	49751	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:18.800949097 CEST	443	49751	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:18.801240921 CEST	49752	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:18.801255941 CEST	443	49752	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:18.801609993 CEST	49752	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:18.801615000 CEST	443	49752	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:18.801630974 CEST	49750	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:18.801636934 CEST	443	49750	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:18.911068916 CEST	443	49752	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:18.911130905 CEST	443	49752	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:18.911931992 CEST	49752	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:18.912130117 CEST	49752	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:18.912144899 CEST	443	49752	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:18.912156105 CEST	49752	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:18.912159920 CEST	443	49752	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:18.914597988 CEST	443	49751	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:18.914597988 CEST	443	49750	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:18.914661884 CEST	443	49750	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:18.914680958 CEST	443	49751	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:18.914730072 CEST	49750	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:18.914736032 CEST	49751	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:18.916140079 CEST	49755	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:18.916157007 CEST	443	49755	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:18.916254997 CEST	49755	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:18.916488886 CEST	49751	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:18.916488886 CEST	49751	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:18.916520119 CEST	443	49751	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:18.916527033 CEST	443	49751	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:18.918169022 CEST	49755	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:18.918180943 CEST	443	49755	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:18.918286085 CEST	49750	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:18.918286085 CEST	49750	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:18.918313026 CEST	443	49750	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:18.918322086 CEST	443	49750	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:18.919225931 CEST	49756	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:18.919241905 CEST	443	49756	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:18.919311047 CEST	49756	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:18.920209885 CEST	49756	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:18.920217991 CEST	443	49756	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:18.920265913 CEST	49758	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:18.920288086 CEST	443	49758	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:18.920341969 CEST	49758	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:18.920461893 CEST	49758	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:18.920479059 CEST	443	49758	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:19.095417976 CEST	49748	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:19.095431089 CEST	443	49748	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:19.446569920 CEST	443	49753	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:19.447377920 CEST	49753	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:19.447393894 CEST	443	49753	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:19.448029995 CEST	49753	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:19.448034048 CEST	443	49753	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:19.450706959 CEST	443	49754	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:19.451200962 CEST	49754	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:19.451209068 CEST	443	49754	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:19.451574087 CEST	49754	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:19.451579094 CEST	443	49754	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:19.545433044 CEST	443	49753	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:19.545495033 CEST	443	49753	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:19.545591116 CEST	49753	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:19.545806885 CEST	49753	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:19.545823097 CEST	443	49753	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:19.545836926 CEST	49753	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:19.545842886 CEST	443	49753	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:19.548168898 CEST	443	49755	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:19.548598051 CEST	49755	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:19.548629045 CEST	443	49755	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:19.548907042 CEST	49759	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:19.548943043 CEST	443	49759	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:19.549002886 CEST	49759	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:19.549067974 CEST	49755	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:19.549076080 CEST	443	49755	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:19.549262047 CEST	49759	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:19.549276114 CEST	443	49759	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:19.551707983 CEST	443	49758	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:19.552159071 CEST	49758	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:19.552192926 CEST	443	49758	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:19.552598953 CEST	49758	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:19.552608013 CEST	443	49758	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:19.553447008 CEST	443	49754	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:19.553498983 CEST	443	49754	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:19.553575993 CEST	49754	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:19.553659916 CEST	49754	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:19.553668022 CEST	443	49754	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:19.553673029 CEST	49754	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:19.553678036 CEST	443	49754	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:19.555015087 CEST	443	49756	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:19.555398941 CEST	49756	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:19.555408955 CEST	443	49756	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:19.555872917 CEST	49760	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:19.555887938 CEST	443	49760	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:19.555896044 CEST	49756	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:19.555900097 CEST	443	49756	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:19.555948973 CEST	49760	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:19.556068897 CEST	49760	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:19.556075096 CEST	443	49760	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:19.644141912 CEST	443	49755	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:19.644205093 CEST	443	49755	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:19.644268036 CEST	49755	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:19.644428015 CEST	49755	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:19.644449949 CEST	443	49755	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:19.644463062 CEST	49755	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:19.644469976 CEST	443	49755	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:19.646692991 CEST	49761	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:19.646729946 CEST	443	49761	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:19.646799088 CEST	49761	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:19.646924973 CEST	49761	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:19.646944046 CEST	443	49761	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:19.648945093 CEST	443	49758	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:19.649025917 CEST	443	49758	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:19.649071932 CEST	49758	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:19.649168015 CEST	49758	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:19.649177074 CEST	443	49758	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:19.649209976 CEST	49758	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:19.649216890 CEST	443	49758	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:19.651676893 CEST	49762	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:19.651688099 CEST	443	49762	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:19.651768923 CEST	49762	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:19.651923895 CEST	49762	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:19.651942015 CEST	443	49762	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:19.652919054 CEST	443	49756	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:19.652981997 CEST	443	49756	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:19.653033018 CEST	49756	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:19.653135061 CEST	49756	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:19.653148890 CEST	443	49756	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:19.653158903 CEST	49756	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:19.653162956 CEST	443	49756	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:19.655430079 CEST	49763	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:19.655451059 CEST	443	49763	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:19.655519009 CEST	49763	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:19.655666113 CEST	49763	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:19.655677080 CEST	443	49763	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:20.161566973 CEST	443	49760	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:20.162070036 CEST	49760	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:20.162089109 CEST	443	49760	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:20.162806034 CEST	49760	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:20.162811041 CEST	443	49760	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:20.167381048 CEST	443	49759	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:20.167952061 CEST	49759	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:20.167972088 CEST	443	49759	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:20.168247938 CEST	49759	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:20.168253899 CEST	443	49759	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:20.258590937 CEST	443	49760	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:20.258649111 CEST	443	49760	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:20.258694887 CEST	49760	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:20.258721113 CEST	443	49761	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:20.259011984 CEST	49760	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:20.259027958 CEST	443	49760	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:20.259037971 CEST	49760	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:20.259046078 CEST	443	49760	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:20.260158062 CEST	49761	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:20.260180950 CEST	443	49761	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:20.260754108 CEST	49761	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:20.260760069 CEST	443	49761	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:20.262784004 CEST	49765	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:20.262825966 CEST	443	49765	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:20.262896061 CEST	49765	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:20.263278008 CEST	49765	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:20.263298035 CEST	443	49765	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:20.263828993 CEST	443	49759	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:20.263906002 CEST	443	49759	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:20.263956070 CEST	49759	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:20.264098883 CEST	443	49763	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:20.266071081 CEST	49759	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:20.266079903 CEST	443	49759	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:20.266089916 CEST	49759	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:20.266093969 CEST	443	49759	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:20.266437054 CEST	49763	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:20.266444921 CEST	443	49763	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:20.267050028 CEST	49763	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:20.267055035 CEST	443	49763	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:20.270020008 CEST	49766	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:20.270032883 CEST	443	49766	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:20.270087957 CEST	49766	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:20.270224094 CEST	49766	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:20.270239115 CEST	443	49766	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:20.315284014 CEST	443	49762	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:20.315825939 CEST	49762	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:20.315839052 CEST	443	49762	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:20.316339016 CEST	49762	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:20.316345930 CEST	443	49762	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:20.355947971 CEST	443	49761	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:20.356025934 CEST	443	49761	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:20.356076956 CEST	49761	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:20.356960058 CEST	49761	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:20.356975079 CEST	443	49761	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:20.356991053 CEST	49761	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:20.356997967 CEST	443	49761	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:20.362483025 CEST	443	49763	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:20.362560987 CEST	443	49763	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:20.362612009 CEST	49763	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:20.375828981 CEST	49767	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:20.375884056 CEST	443	49767	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:20.375967026 CEST	49767	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:20.376043081 CEST	49763	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:20.376059055 CEST	443	49763	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:20.376069069 CEST	49763	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:20.376074076 CEST	443	49763	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:20.377739906 CEST	49767	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:20.377756119 CEST	443	49767	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:20.381105900 CEST	49768	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:20.381146908 CEST	443	49768	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:20.381232977 CEST	49768	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:20.381547928 CEST	49768	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:20.381567001 CEST	443	49768	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:20.440632105 CEST	443	49762	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:20.440704107 CEST	443	49762	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:20.440803051 CEST	49762	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:20.441057920 CEST	49762	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:20.441076994 CEST	443	49762	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:20.441092014 CEST	49762	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:20.441098928 CEST	443	49762	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:20.444489002 CEST	49769	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:20.444540024 CEST	443	49769	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:20.444678068 CEST	49769	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:20.444884062 CEST	49769	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:20.444912910 CEST	443	49769	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:20.893985987 CEST	443	49765	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:20.936537027 CEST	443	49766	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:20.938990116 CEST	49765	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:20.950594902 CEST	49765	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:20.950613022 CEST	443	49765	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:20.954495907 CEST	49765	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:20.954503059 CEST	443	49765	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:20.985857010 CEST	49766	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:20.990951061 CEST	443	49767	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:20.996155977 CEST	49766	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:20.996175051 CEST	443	49766	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:20.996577978 CEST	49766	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:20.996582985 CEST	443	49766	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:20.998342991 CEST	443	49768	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:21.001883030 CEST	49767	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:21.001902103 CEST	443	49767	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:21.002275944 CEST	49767	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:21.002280951 CEST	443	49767	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:21.002573013 CEST	49768	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:21.002608061 CEST	443	49768	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:21.002933025 CEST	49768	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:21.002940893 CEST	443	49768	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:21.048023939 CEST	443	49765	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:21.048093081 CEST	443	49765	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:21.048165083 CEST	49765	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:21.064778090 CEST	443	49769	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:21.093749046 CEST	443	49767	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:21.093817949 CEST	443	49767	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:21.093895912 CEST	49767	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:21.097429991 CEST	443	49766	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:21.097587109 CEST	443	49766	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:21.097642899 CEST	49766	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:21.097829103 CEST	443	49768	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:21.097902060 CEST	443	49768	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:21.098051071 CEST	49768	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:21.103647947 CEST	49765	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:21.103672028 CEST	443	49765	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:21.103688002 CEST	49765	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:21.103694916 CEST	443	49765	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:21.105964899 CEST	49768	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:21.105964899 CEST	49768	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:21.105983973 CEST	443	49768	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:21.106004000 CEST	443	49768	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:21.111367941 CEST	49769	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:21.121139050 CEST	49769	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:21.121161938 CEST	443	49769	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:21.122107029 CEST	49769	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:21.122123957 CEST	443	49769	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:21.123110056 CEST	49767	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:21.123148918 CEST	443	49767	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:21.123162031 CEST	49767	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:21.123168945 CEST	443	49767	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:21.125053883 CEST	49766	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:21.125065088 CEST	443	49766	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:21.135695934 CEST	49771	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:21.135723114 CEST	443	49771	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:21.135802984 CEST	49771	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:21.135979891 CEST	49771	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:21.135998011 CEST	443	49771	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:21.142211914 CEST	49772	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:21.142235994 CEST	443	49772	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:21.142297983 CEST	49772	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:21.170648098 CEST	49773	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:21.170690060 CEST	443	49773	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:21.170753002 CEST	49773	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:21.171214104 CEST	49772	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:21.171228886 CEST	443	49772	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:21.173578978 CEST	49773	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:21.173600912 CEST	443	49773	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:21.176924944 CEST	49774	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:21.176959038 CEST	443	49774	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:21.177011013 CEST	49774	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:21.177263975 CEST	49774	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:21.177278042 CEST	443	49774	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:21.321671963 CEST	49698	443	192.168.2.7	104.98.116.138
Oct 7, 2024 21:53:21.365852118 CEST	49775	443	192.168.2.7	104.98.116.138
Oct 7, 2024 21:53:21.365866899 CEST	443	49775	104.98.116.138	192.168.2.7
Oct 7, 2024 21:53:21.366055965 CEST	49775	443	192.168.2.7	104.98.116.138
Oct 7, 2024 21:53:21.367595911 CEST	49775	443	192.168.2.7	104.98.116.138
Oct 7, 2024 21:53:21.367611885 CEST	443	49775	104.98.116.138	192.168.2.7
Oct 7, 2024 21:53:21.449196100 CEST	443	49769	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:21.449269056 CEST	443	49769	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:21.449320078 CEST	49769	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:21.449613094 CEST	49769	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:21.449639082 CEST	443	49769	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:21.449650049 CEST	49769	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:21.449660063 CEST	443	49769	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:21.451925993 CEST	443	49698	104.98.116.138	192.168.2.7
Oct 7, 2024 21:53:21.452404022 CEST	49776	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:21.452431917 CEST	443	49776	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:21.452507973 CEST	49776	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:21.452691078 CEST	49776	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:21.452707052 CEST	443	49776	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:21.744801044 CEST	443	49771	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:21.745706081 CEST	49771	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:21.745728970 CEST	443	49771	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:21.746398926 CEST	49771	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:21.746406078 CEST	443	49771	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:21.808228970 CEST	443	49774	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:21.808840036 CEST	49774	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:21.808866024 CEST	443	49774	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:21.809391975 CEST	49774	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:21.809396982 CEST	443	49774	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:21.828414917 CEST	443	49773	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:21.828663111 CEST	443	49772	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:21.828855038 CEST	49773	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:21.828871012 CEST	443	49773	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:21.829159975 CEST	49772	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:21.829189062 CEST	443	49772	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:21.829334974 CEST	49773	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:21.829359055 CEST	443	49773	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:21.829394102 CEST	49772	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:21.829401970 CEST	443	49772	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:21.840193987 CEST	443	49771	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:21.840262890 CEST	443	49771	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:21.840321064 CEST	49771	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:21.840557098 CEST	49771	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:21.840558052 CEST	49771	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:21.840579033 CEST	443	49771	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:21.840594053 CEST	443	49771	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:21.842797041 CEST	49779	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:21.842842102 CEST	443	49779	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:21.842927933 CEST	49779	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:21.843044996 CEST	49779	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:21.843063116 CEST	443	49779	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:21.905806065 CEST	443	49774	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:21.905869007 CEST	443	49774	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:21.905932903 CEST	49774	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:21.906092882 CEST	49774	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:21.906094074 CEST	49774	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:21.906135082 CEST	443	49774	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:21.906148911 CEST	443	49774	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:21.908891916 CEST	49780	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:21.908932924 CEST	443	49780	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:21.908993959 CEST	49780	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:21.909121037 CEST	49780	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:21.909137964 CEST	443	49780	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:21.926847935 CEST	443	49773	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:21.926922083 CEST	443	49773	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:21.927050114 CEST	49773	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:21.927050114 CEST	49773	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:21.927141905 CEST	49773	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:21.927158117 CEST	443	49773	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:21.928265095 CEST	443	49772	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:21.928425074 CEST	443	49772	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:21.928515911 CEST	49772	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:21.928515911 CEST	49772	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:21.929141045 CEST	49781	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:21.929169893 CEST	443	49781	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:21.929193974 CEST	49772	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:21.929208040 CEST	443	49772	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:21.929230928 CEST	49781	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:21.929754972 CEST	49781	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:21.929766893 CEST	443	49781	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:21.931368113 CEST	49782	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:21.931375027 CEST	443	49782	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:21.931432962 CEST	49782	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:21.931541920 CEST	49782	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:21.931552887 CEST	443	49782	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:22.072885990 CEST	443	49776	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:22.075179100 CEST	49776	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:22.075193882 CEST	443	49776	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:22.075643063 CEST	49776	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:22.075649023 CEST	443	49776	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:22.170175076 CEST	443	49776	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:22.170238972 CEST	443	49776	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:22.170372963 CEST	49776	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:22.170468092 CEST	49776	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:22.170480013 CEST	443	49776	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:22.170490026 CEST	49776	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:22.170495033 CEST	443	49776	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:22.172928095 CEST	49783	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:22.172977924 CEST	443	49783	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:22.173783064 CEST	49783	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:22.173921108 CEST	49783	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:22.173942089 CEST	443	49783	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:22.460796118 CEST	443	49779	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:22.461282969 CEST	49779	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:22.461302996 CEST	443	49779	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:22.461735010 CEST	49779	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:22.461740017 CEST	443	49779	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:22.532582045 CEST	443	49780	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:22.533185005 CEST	49780	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:22.533219099 CEST	443	49780	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:22.533674002 CEST	49780	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:22.533680916 CEST	443	49780	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:22.548407078 CEST	443	49781	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:22.548924923 CEST	49781	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:22.548949003 CEST	443	49781	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:22.549384117 CEST	49781	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:22.549388885 CEST	443	49781	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:22.555685043 CEST	443	49779	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:22.555830956 CEST	443	49779	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:22.555931091 CEST	49779	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:22.555955887 CEST	49779	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:22.555967093 CEST	443	49779	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:22.555988073 CEST	49779	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:22.555993080 CEST	443	49779	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:22.558639050 CEST	49784	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:22.558682919 CEST	443	49784	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:22.558748960 CEST	49784	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:22.558901072 CEST	49784	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:22.558917046 CEST	443	49784	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:22.629467010 CEST	443	49780	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:22.629520893 CEST	443	49780	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:22.629642010 CEST	49780	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:22.629678011 CEST	49780	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:22.629678011 CEST	49780	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:22.629698992 CEST	443	49780	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:22.629719019 CEST	443	49780	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:22.631752014 CEST	49785	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:22.631782055 CEST	443	49785	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:22.631850004 CEST	49785	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:22.631987095 CEST	49785	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:22.632004976 CEST	443	49785	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:22.644153118 CEST	443	49781	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:22.644213915 CEST	443	49781	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:22.644269943 CEST	49781	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:22.644350052 CEST	49781	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:22.644361019 CEST	443	49781	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:22.644370079 CEST	49781	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:22.644376040 CEST	443	49781	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:22.646266937 CEST	49786	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:22.646279097 CEST	443	49786	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:22.646363974 CEST	49786	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:22.646472931 CEST	49786	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:22.646486998 CEST	443	49786	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:22.796858072 CEST	443	49783	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:22.798120022 CEST	49783	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:22.798142910 CEST	443	49783	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:22.798670053 CEST	49783	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:22.798676968 CEST	443	49783	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:22.805964947 CEST	54333	53	192.168.2.7	1.1.1.1
Oct 7, 2024 21:53:22.811063051 CEST	53	54333	1.1.1.1	192.168.2.7
Oct 7, 2024 21:53:22.811136007 CEST	54333	53	192.168.2.7	1.1.1.1
Oct 7, 2024 21:53:22.811180115 CEST	54333	53	192.168.2.7	1.1.1.1
Oct 7, 2024 21:53:22.816057920 CEST	53	54333	1.1.1.1	192.168.2.7
Oct 7, 2024 21:53:22.895567894 CEST	443	49783	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:22.895625114 CEST	443	49783	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:22.895749092 CEST	49783	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:22.895860910 CEST	49783	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:22.895879984 CEST	443	49783	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:22.895894051 CEST	49783	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:22.895901918 CEST	443	49783	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:22.898504972 CEST	54334	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:22.898544073 CEST	443	54334	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:22.898663044 CEST	54334	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:22.898802042 CEST	54334	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:22.898822069 CEST	443	54334	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:22.926889896 CEST	443	49782	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:22.927333117 CEST	49782	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:22.927361012 CEST	443	49782	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:22.927792072 CEST	49782	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:22.927803040 CEST	443	49782	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:23.040584087 CEST	443	49782	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:23.040658951 CEST	443	49782	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:23.040709972 CEST	49782	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:23.040873051 CEST	49782	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:23.040889025 CEST	443	49782	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:23.040911913 CEST	49782	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:23.040918112 CEST	443	49782	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:23.044781923 CEST	54335	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:23.044842005 CEST	443	54335	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:23.045001984 CEST	54335	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:23.045120001 CEST	54335	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:23.045145035 CEST	443	54335	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:23.170788050 CEST	443	49784	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:23.171252966 CEST	49784	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:23.171262026 CEST	443	49784	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:23.171668053 CEST	49784	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:23.171673059 CEST	443	49784	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:23.238892078 CEST	443	49785	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:23.239598989 CEST	49785	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:23.239620924 CEST	443	49785	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:23.239998102 CEST	53	54333	1.1.1.1	192.168.2.7
Oct 7, 2024 21:53:23.240185022 CEST	49785	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:23.240191936 CEST	443	49785	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:23.243078947 CEST	54333	53	192.168.2.7	1.1.1.1
Oct 7, 2024 21:53:23.248353004 CEST	53	54333	1.1.1.1	192.168.2.7
Oct 7, 2024 21:53:23.248400927 CEST	54333	53	192.168.2.7	1.1.1.1
Oct 7, 2024 21:53:23.258203983 CEST	443	49786	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:23.258941889 CEST	49786	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:23.258960009 CEST	443	49786	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:23.259382963 CEST	49786	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:23.259390116 CEST	443	49786	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:23.267975092 CEST	443	49784	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:23.268035889 CEST	443	49784	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:23.268248081 CEST	49784	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:23.268362045 CEST	49784	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:23.268378019 CEST	443	49784	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:23.268388987 CEST	49784	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:23.268399954 CEST	443	49784	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:23.271223068 CEST	54337	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:23.271255970 CEST	443	54337	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:23.271408081 CEST	54337	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:23.271596909 CEST	54337	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:23.271610975 CEST	443	54337	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:23.345314980 CEST	443	49785	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:23.345366955 CEST	443	49785	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:23.345452070 CEST	49785	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:23.345976114 CEST	49785	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:23.345989943 CEST	443	49785	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:23.346009970 CEST	49785	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:23.346015930 CEST	443	49785	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:23.351675987 CEST	54338	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:23.351703882 CEST	443	54338	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:23.351777077 CEST	54338	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:23.352508068 CEST	54338	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:23.352521896 CEST	443	54338	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:23.354373932 CEST	443	49786	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:23.354454994 CEST	443	49786	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:23.354638100 CEST	49786	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:23.354888916 CEST	49786	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:23.354893923 CEST	443	49786	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:23.354907990 CEST	49786	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:23.354912996 CEST	443	49786	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:23.358462095 CEST	54339	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:23.358517885 CEST	443	54339	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:23.358604908 CEST	54339	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:23.359234095 CEST	54339	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:23.359252930 CEST	443	54339	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:23.545810938 CEST	443	54334	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:23.548820019 CEST	54334	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:23.548844099 CEST	443	54334	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:23.552881956 CEST	54334	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:23.552890062 CEST	443	54334	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:23.650357962 CEST	443	54334	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:23.650418997 CEST	443	54334	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:23.650507927 CEST	54334	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:23.660275936 CEST	54334	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:23.660275936 CEST	54334	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:23.660312891 CEST	443	54334	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:23.660331964 CEST	443	54334	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:23.669981003 CEST	54340	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:23.670018911 CEST	443	54340	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:23.670083046 CEST	54340	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:23.674807072 CEST	54340	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:23.674818039 CEST	443	54340	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:23.709842920 CEST	443	54335	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:23.711482048 CEST	54335	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:23.711492062 CEST	443	54335	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:23.711895943 CEST	54335	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:23.711899996 CEST	443	54335	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:23.809384108 CEST	443	54335	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:23.809443951 CEST	443	54335	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:23.809494972 CEST	54335	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:23.809786081 CEST	54335	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:23.809809923 CEST	443	54335	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:23.809822083 CEST	54335	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:23.809828997 CEST	443	54335	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:23.847243071 CEST	54341	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:23.847282887 CEST	443	54341	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:23.847455978 CEST	54341	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:23.848556995 CEST	54341	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:23.848572969 CEST	443	54341	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:23.885140896 CEST	443	54337	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:23.885746956 CEST	54337	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:23.885761023 CEST	443	54337	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:23.886203051 CEST	54337	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:23.886207104 CEST	443	54337	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:23.971142054 CEST	443	54338	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:23.971997976 CEST	54338	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:23.972007990 CEST	443	54338	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:23.972467899 CEST	54338	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:23.972471952 CEST	443	54338	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:23.978842020 CEST	443	54339	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:23.979223013 CEST	54339	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:23.979257107 CEST	443	54339	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:23.979640961 CEST	54339	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:23.979652882 CEST	443	54339	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:23.983797073 CEST	443	54337	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:23.983819962 CEST	443	54337	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:23.983870983 CEST	54337	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:23.983882904 CEST	443	54337	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:23.984096050 CEST	54337	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:23.984107018 CEST	443	54337	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:23.984255075 CEST	443	54337	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:23.984282970 CEST	54337	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:23.984287977 CEST	443	54337	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:23.984298944 CEST	443	54337	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:23.984342098 CEST	54337	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:23.987446070 CEST	54342	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:23.987481117 CEST	443	54342	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:23.987603903 CEST	54342	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:23.987746000 CEST	54342	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:23.987763882 CEST	443	54342	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:24.067045927 CEST	443	54338	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:24.067131042 CEST	443	54338	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:24.067188978 CEST	54338	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:24.067665100 CEST	54338	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:24.067682028 CEST	443	54338	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:24.067692995 CEST	54338	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:24.067698002 CEST	443	54338	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:24.071105003 CEST	54343	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:24.071140051 CEST	443	54343	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:24.071222067 CEST	54343	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:24.071465015 CEST	54343	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:24.071476936 CEST	443	54343	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:24.076543093 CEST	443	54339	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:24.076607943 CEST	443	54339	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:24.076651096 CEST	54339	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:24.076899052 CEST	54339	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:24.076921940 CEST	443	54339	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:24.076972008 CEST	54339	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:24.076982021 CEST	443	54339	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:24.079530001 CEST	54344	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:24.079566956 CEST	443	54344	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:24.079633951 CEST	54344	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:24.080080986 CEST	54344	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:24.080095053 CEST	443	54344	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:24.335839987 CEST	443	54340	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:24.336493015 CEST	54340	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:24.336510897 CEST	443	54340	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:24.337007999 CEST	54340	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:24.337012053 CEST	443	54340	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:24.434963942 CEST	443	54340	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:24.434987068 CEST	443	54340	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:24.435039997 CEST	54340	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:24.435050011 CEST	443	54340	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:24.435127020 CEST	443	54340	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:24.435353041 CEST	54340	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:24.435364008 CEST	54340	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:24.435369015 CEST	443	54340	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:24.435379028 CEST	54340	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:24.435383081 CEST	443	54340	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:24.438146114 CEST	54345	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:24.438183069 CEST	443	54345	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:24.438252926 CEST	54345	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:24.438414097 CEST	54345	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:24.438426971 CEST	443	54345	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:24.454695940 CEST	443	54341	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:24.456221104 CEST	54341	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:24.456243038 CEST	443	54341	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:24.456671000 CEST	54341	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:24.456677914 CEST	443	54341	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:24.550184965 CEST	443	54341	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:24.550209045 CEST	443	54341	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:24.550256014 CEST	443	54341	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:24.550271988 CEST	54341	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:24.550316095 CEST	54341	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:24.550483942 CEST	54341	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:24.550508022 CEST	443	54341	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:24.550523043 CEST	54341	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:24.550529957 CEST	443	54341	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:24.553262949 CEST	54348	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:24.553308964 CEST	443	54348	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:24.553390026 CEST	54348	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:24.553570032 CEST	54348	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:24.553590059 CEST	443	54348	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:24.593192101 CEST	443	54342	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:24.593736887 CEST	54342	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:24.593759060 CEST	443	54342	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:24.594149113 CEST	54342	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:24.594156981 CEST	443	54342	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:24.637512922 CEST	443	54344	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:24.638009071 CEST	54344	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:24.638030052 CEST	443	54344	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:24.638501883 CEST	54344	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:24.638506889 CEST	443	54344	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:24.707906008 CEST	443	54342	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:24.707928896 CEST	443	54342	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:24.707967997 CEST	443	54342	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:24.708015919 CEST	54342	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:24.708204985 CEST	54342	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:24.708224058 CEST	443	54342	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:24.708240032 CEST	54342	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:24.708246946 CEST	443	54342	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:24.708762884 CEST	443	54343	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:24.709153891 CEST	54343	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:24.709178925 CEST	443	54343	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:24.709563017 CEST	54343	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:24.709568024 CEST	443	54343	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:24.711098909 CEST	54349	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:24.711127043 CEST	443	54349	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:24.711180925 CEST	54349	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:24.711318016 CEST	54349	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:24.711332083 CEST	443	54349	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:24.739655018 CEST	443	54344	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:24.739976883 CEST	443	54344	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:24.740032911 CEST	54344	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:24.740065098 CEST	54344	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:24.740081072 CEST	443	54344	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:24.740093946 CEST	54344	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:24.740099907 CEST	443	54344	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:24.742423058 CEST	54350	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:24.742438078 CEST	443	54350	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:24.742630005 CEST	54350	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:24.742783070 CEST	54350	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:24.742794991 CEST	443	54350	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:24.803925991 CEST	443	54343	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:24.803972006 CEST	443	54343	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:24.804055929 CEST	54343	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:24.804167032 CEST	54343	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:24.804167032 CEST	54343	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:24.804188013 CEST	443	54343	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:24.804199934 CEST	443	54343	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:24.806117058 CEST	54351	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:24.806159973 CEST	443	54351	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:24.806232929 CEST	54351	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:24.806422949 CEST	54351	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:24.806442976 CEST	443	54351	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:25.073000908 CEST	443	54345	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:25.073508024 CEST	54345	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:25.073534012 CEST	443	54345	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:25.073957920 CEST	54345	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:25.073964119 CEST	443	54345	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:25.159780979 CEST	443	54348	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:25.161359072 CEST	54348	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:25.161372900 CEST	443	54348	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:25.161823988 CEST	54348	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:25.161829948 CEST	443	54348	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:25.168704987 CEST	443	54345	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:25.169106007 CEST	443	54345	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:25.169158936 CEST	54345	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:25.169219017 CEST	54345	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:25.169243097 CEST	443	54345	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:25.169256926 CEST	54345	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:25.169264078 CEST	443	54345	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:25.171669006 CEST	54352	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:25.171684027 CEST	443	54352	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:25.171776056 CEST	54352	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:25.171906948 CEST	54352	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:25.171926022 CEST	443	54352	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:25.256642103 CEST	443	54348	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:25.256692886 CEST	443	54348	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:25.256885052 CEST	54348	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:25.256946087 CEST	54348	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:25.256956100 CEST	443	54348	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:25.257009983 CEST	54348	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:25.257015944 CEST	443	54348	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:25.260445118 CEST	54353	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:25.260473967 CEST	443	54353	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:25.260543108 CEST	54353	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:25.260890007 CEST	54353	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:25.260902882 CEST	443	54353	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:25.337054014 CEST	443	54349	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:25.337574959 CEST	54349	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:25.337603092 CEST	443	54349	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:25.338187933 CEST	54349	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:25.338192940 CEST	443	54349	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:25.353104115 CEST	443	54350	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:25.353545904 CEST	54350	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:25.353554010 CEST	443	54350	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:25.354151011 CEST	54350	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:25.354156017 CEST	443	54350	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:25.419625998 CEST	443	54351	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:25.420712948 CEST	54351	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:25.420712948 CEST	54351	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:25.420741081 CEST	443	54351	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:25.420761108 CEST	443	54351	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:25.434969902 CEST	443	54349	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:25.435203075 CEST	443	54349	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:25.435293913 CEST	54349	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:25.435389996 CEST	54349	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:25.435410976 CEST	443	54349	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:25.435424089 CEST	54349	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:25.435431004 CEST	443	54349	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:25.438832045 CEST	54354	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:25.438858986 CEST	443	54354	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:25.438941002 CEST	54354	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:25.439290047 CEST	54354	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:25.439306974 CEST	443	54354	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:25.447307110 CEST	443	54350	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:25.447495937 CEST	443	54350	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:25.447551012 CEST	54350	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:25.447575092 CEST	54350	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:25.447581053 CEST	443	54350	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:25.447592020 CEST	54350	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:25.447597027 CEST	443	54350	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:25.449771881 CEST	54355	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:25.449805975 CEST	443	54355	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:25.449867964 CEST	54355	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:25.450033903 CEST	54355	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:25.450052023 CEST	443	54355	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:25.517003059 CEST	443	54351	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:25.517169952 CEST	443	54351	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:25.517242908 CEST	54351	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:25.517961025 CEST	54351	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:25.517982006 CEST	443	54351	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:25.517997980 CEST	54351	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:25.518006086 CEST	443	54351	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:25.521754980 CEST	54356	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:25.521794081 CEST	443	54356	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:25.522080898 CEST	54356	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:25.522419930 CEST	54356	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:25.522432089 CEST	443	54356	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:25.791631937 CEST	443	54352	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:25.792172909 CEST	54352	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:25.792207956 CEST	443	54352	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:25.792777061 CEST	54352	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:25.792784929 CEST	443	54352	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:25.885948896 CEST	443	54352	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:25.886131048 CEST	443	54352	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:25.886219025 CEST	54352	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:25.886518955 CEST	54352	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:25.886538029 CEST	443	54352	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:25.886553049 CEST	54352	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:25.886559963 CEST	443	54352	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:25.890151978 CEST	54357	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:25.890192986 CEST	443	54357	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:25.890425920 CEST	54357	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:25.890793085 CEST	54357	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:25.890805960 CEST	443	54357	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:25.938189983 CEST	443	54353	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:25.938842058 CEST	54353	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:25.938864946 CEST	443	54353	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:25.939507008 CEST	54353	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:25.939513922 CEST	443	54353	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:26.062937021 CEST	443	54354	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:26.063457966 CEST	54354	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:26.063488007 CEST	443	54354	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:26.064136982 CEST	54354	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:26.064146996 CEST	443	54354	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:26.072320938 CEST	443	54355	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:26.072730064 CEST	54355	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:26.072762012 CEST	443	54355	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:26.073141098 CEST	54355	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:26.073148012 CEST	443	54355	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:26.126096964 CEST	443	54353	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:26.126321077 CEST	443	54353	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:26.126369953 CEST	54353	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:26.126764059 CEST	54353	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:26.126782894 CEST	443	54353	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:26.126796961 CEST	54353	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:26.126811028 CEST	443	54353	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:26.131031990 CEST	54358	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:26.131048918 CEST	443	54358	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:26.131115913 CEST	54358	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:26.131412029 CEST	54358	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:26.131424904 CEST	443	54358	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:26.146843910 CEST	443	54356	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:26.147660017 CEST	54356	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:26.147676945 CEST	443	54356	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:26.148407936 CEST	54356	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:26.148413897 CEST	443	54356	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:26.158054113 CEST	443	54354	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:26.158255100 CEST	443	54354	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:26.158298969 CEST	54354	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:26.158653975 CEST	54354	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:26.158674955 CEST	443	54354	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:26.158684969 CEST	54354	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:26.158691883 CEST	443	54354	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:26.168176889 CEST	54359	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:26.168206930 CEST	443	54359	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:26.168281078 CEST	54359	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:26.168697119 CEST	54359	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:26.168705940 CEST	443	54359	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:26.169362068 CEST	443	54355	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:26.169431925 CEST	443	54355	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:26.169533968 CEST	443	54355	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:26.169545889 CEST	54355	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:26.169603109 CEST	54355	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:26.169812918 CEST	54355	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:26.169827938 CEST	443	54355	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:26.169841051 CEST	54355	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:26.169846058 CEST	443	54355	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:26.172465086 CEST	54360	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:26.172506094 CEST	443	54360	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:26.172688007 CEST	54360	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:26.172832012 CEST	54360	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:26.172844887 CEST	443	54360	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:26.243586063 CEST	443	54356	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:26.243855000 CEST	443	54356	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:26.243918896 CEST	54356	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:26.244226933 CEST	54356	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:26.244240999 CEST	443	54356	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:26.244261980 CEST	54356	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:26.244266987 CEST	443	54356	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:26.247632980 CEST	54361	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:26.247672081 CEST	443	54361	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:26.247870922 CEST	54361	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:26.247940063 CEST	54361	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:26.247958899 CEST	443	54361	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:26.496248960 CEST	443	54357	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:26.496789932 CEST	54357	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:26.496803999 CEST	443	54357	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:26.497364998 CEST	54357	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:26.497369051 CEST	443	54357	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:26.592892885 CEST	443	54357	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:26.592926979 CEST	443	54357	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:26.592969894 CEST	443	54357	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:26.593018055 CEST	54357	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:26.593197107 CEST	54357	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:26.593221903 CEST	443	54357	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:26.593231916 CEST	54357	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:26.593238115 CEST	443	54357	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:26.596513033 CEST	54362	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:26.596539974 CEST	443	54362	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:26.596597910 CEST	54362	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:26.596730947 CEST	54362	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:26.596744061 CEST	443	54362	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:26.752657890 CEST	443	54358	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:26.753113985 CEST	54358	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:26.753129959 CEST	443	54358	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:26.753573895 CEST	54358	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:26.753578901 CEST	443	54358	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:26.796175003 CEST	443	54360	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:26.796641111 CEST	54360	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:26.796658039 CEST	443	54360	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:26.797123909 CEST	54360	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:26.797127962 CEST	443	54360	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:26.818414927 CEST	443	54359	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:26.818964005 CEST	54359	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:26.818981886 CEST	443	54359	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:26.819422960 CEST	54359	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:26.819428921 CEST	443	54359	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:26.849749088 CEST	443	54358	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:26.850349903 CEST	443	54358	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:26.850402117 CEST	54358	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:26.850425959 CEST	54358	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:26.850438118 CEST	443	54358	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:26.850452900 CEST	54358	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:26.850459099 CEST	443	54358	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:26.853446007 CEST	54363	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:26.853458881 CEST	443	54363	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:26.853518963 CEST	54363	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:26.853730917 CEST	54363	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:26.853744030 CEST	443	54363	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:26.880436897 CEST	443	54361	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:26.880868912 CEST	54361	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:26.880893946 CEST	443	54361	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:26.881346941 CEST	54361	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:26.881352901 CEST	443	54361	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:26.893836021 CEST	443	54360	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:26.893976927 CEST	443	54360	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:26.894032955 CEST	54360	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:26.894119978 CEST	54360	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:26.894129992 CEST	443	54360	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:26.894139051 CEST	54360	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:26.894143105 CEST	443	54360	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:26.898833036 CEST	54364	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:26.898873091 CEST	443	54364	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:26.898974895 CEST	54364	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:26.899132013 CEST	54364	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:26.899146080 CEST	443	54364	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:26.919281006 CEST	443	54359	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:26.919471979 CEST	443	54359	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:26.919529915 CEST	54359	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:26.919580936 CEST	54359	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:26.919590950 CEST	443	54359	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:26.919605017 CEST	54359	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:26.919610977 CEST	443	54359	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:26.922245026 CEST	54365	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:26.922290087 CEST	443	54365	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:26.922353983 CEST	54365	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:26.922487974 CEST	54365	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:26.922507048 CEST	443	54365	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:26.977298975 CEST	443	54361	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:26.977324963 CEST	443	54361	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:26.977372885 CEST	443	54361	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:26.977377892 CEST	54361	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:26.977413893 CEST	54361	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:26.977634907 CEST	54361	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:26.977650881 CEST	443	54361	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:26.977672100 CEST	54361	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:26.977677107 CEST	443	54361	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:26.980396986 CEST	54366	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:26.980426073 CEST	443	54366	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:26.980484009 CEST	54366	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:26.980603933 CEST	54366	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:26.980618000 CEST	443	54366	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:27.466270924 CEST	443	54362	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:27.466758966 CEST	54362	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:27.466778994 CEST	443	54362	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:27.467219114 CEST	54362	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:27.467225075 CEST	443	54362	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:27.472949982 CEST	443	54363	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:27.473381996 CEST	54363	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:27.473414898 CEST	443	54363	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:27.473818064 CEST	54363	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:27.473823071 CEST	443	54363	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:27.517719030 CEST	443	54364	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:27.518239975 CEST	54364	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:27.518261909 CEST	443	54364	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:27.518708944 CEST	54364	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:27.518713951 CEST	443	54364	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:27.535022020 CEST	443	54365	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:27.535543919 CEST	54365	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:27.535586119 CEST	443	54365	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:27.536022902 CEST	54365	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:27.536030054 CEST	443	54365	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:27.563132048 CEST	443	54362	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:27.563189030 CEST	443	54362	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:27.563466072 CEST	54362	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:27.563544035 CEST	54362	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:27.563544035 CEST	54362	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:27.563554049 CEST	443	54362	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:27.563566923 CEST	443	54362	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:27.566531897 CEST	54367	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:27.566557884 CEST	443	54367	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:27.566824913 CEST	54367	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:27.566824913 CEST	54367	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:27.566855907 CEST	443	54367	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:27.570601940 CEST	443	54363	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:27.570656061 CEST	443	54363	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:27.570857048 CEST	54363	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:27.570857048 CEST	54363	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:27.572613001 CEST	54363	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:27.572627068 CEST	443	54363	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:27.573633909 CEST	54368	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:27.573647976 CEST	443	54368	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:27.574112892 CEST	54368	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:27.574112892 CEST	54368	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:27.574137926 CEST	443	54368	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:27.614633083 CEST	443	54364	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:27.614698887 CEST	443	54364	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:27.614795923 CEST	54364	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:27.615124941 CEST	54364	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:27.615132093 CEST	443	54364	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:27.615154028 CEST	54364	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:27.615159035 CEST	443	54364	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:27.617755890 CEST	54369	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:27.617794037 CEST	443	54369	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:27.622817993 CEST	54369	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:27.622817993 CEST	54369	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:27.622854948 CEST	443	54369	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:27.625941038 CEST	443	54366	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:27.626514912 CEST	54366	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:27.626530886 CEST	443	54366	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:27.627438068 CEST	54366	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:27.627444983 CEST	443	54366	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:27.629136086 CEST	443	54365	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:27.629229069 CEST	443	54365	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:27.629281044 CEST	443	54365	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:27.629381895 CEST	54365	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:27.629381895 CEST	54365	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:27.629549980 CEST	54365	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:27.629549980 CEST	54365	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:27.629563093 CEST	443	54365	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:27.629571915 CEST	443	54365	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:27.632137060 CEST	54370	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:27.632155895 CEST	443	54370	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:27.632364988 CEST	54370	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:27.632364988 CEST	54370	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:27.632381916 CEST	443	54370	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:27.724884987 CEST	443	54366	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:27.724965096 CEST	443	54366	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:27.725241899 CEST	54366	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:27.725241899 CEST	54366	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:27.725332975 CEST	54366	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:27.725349903 CEST	443	54366	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:27.728296995 CEST	54371	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:27.728347063 CEST	443	54371	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:27.728604078 CEST	54371	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:27.728604078 CEST	54371	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:27.728638887 CEST	443	54371	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:28.172441959 CEST	443	54367	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:28.180244923 CEST	54367	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:28.180259943 CEST	443	54367	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:28.180690050 CEST	54367	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:28.180694103 CEST	443	54367	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:28.235806942 CEST	443	54368	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:28.242737055 CEST	443	54369	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:28.250117064 CEST	443	54370	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:28.275299072 CEST	443	54367	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:28.275322914 CEST	443	54367	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:28.275366068 CEST	443	54367	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:28.275404930 CEST	54367	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:28.275437117 CEST	54367	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:28.282771111 CEST	54368	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:28.298548937 CEST	54370	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:28.300277948 CEST	54369	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:28.345655918 CEST	443	54371	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:28.392151117 CEST	54371	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:28.401190996 CEST	54371	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:28.401209116 CEST	443	54371	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:28.402853012 CEST	54371	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:28.402861118 CEST	443	54371	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:28.403192997 CEST	54368	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:28.403199911 CEST	443	54368	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:28.413184881 CEST	54368	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:28.413207054 CEST	443	54368	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:28.413554907 CEST	54369	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:28.413594961 CEST	443	54369	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:28.417330027 CEST	54369	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:28.417345047 CEST	443	54369	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:28.417609930 CEST	54370	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:28.417622089 CEST	443	54370	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:28.418601990 CEST	54370	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:28.418612957 CEST	443	54370	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:28.430214882 CEST	54367	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:28.430253029 CEST	443	54367	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:28.430268049 CEST	54367	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:28.430275917 CEST	443	54367	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:28.435134888 CEST	54372	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:28.435188055 CEST	443	54372	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:28.435415030 CEST	54372	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:28.435542107 CEST	54372	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:28.435553074 CEST	443	54372	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:28.495527029 CEST	443	54371	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:28.495990992 CEST	443	54371	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:28.496037006 CEST	443	54371	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:28.496051073 CEST	54371	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:28.496092081 CEST	54371	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:28.496129990 CEST	54371	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:28.496145010 CEST	443	54371	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:28.496155977 CEST	54371	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:28.496160984 CEST	443	54371	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:28.498960972 CEST	54373	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:28.499027014 CEST	443	54373	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:28.499138117 CEST	54373	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:28.499281883 CEST	54373	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:28.499314070 CEST	443	54373	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:28.508446932 CEST	443	54368	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:28.508783102 CEST	443	54368	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:28.508846045 CEST	54368	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:28.508883953 CEST	54368	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:28.508897066 CEST	443	54368	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:28.508914948 CEST	54368	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:28.508920908 CEST	443	54368	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:28.510816097 CEST	443	54370	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:28.510974884 CEST	443	54370	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:28.511068106 CEST	54370	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:28.511188984 CEST	54370	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:28.511188984 CEST	54370	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:28.511255026 CEST	443	54370	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:28.511301041 CEST	443	54370	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:28.511610985 CEST	54374	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:28.511646032 CEST	443	54374	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:28.511810064 CEST	54374	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:28.511995077 CEST	443	54369	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:28.512140989 CEST	54374	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:28.512166977 CEST	443	54374	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:28.512181044 CEST	443	54369	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:28.512255907 CEST	54369	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:28.512326956 CEST	54369	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:28.512327909 CEST	54369	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:28.512362003 CEST	443	54369	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:28.512399912 CEST	443	54369	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:28.514029980 CEST	54375	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:28.514081001 CEST	443	54375	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:28.514350891 CEST	54376	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:28.514374018 CEST	443	54376	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:28.514411926 CEST	54375	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:28.514446974 CEST	54376	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:28.514528990 CEST	54375	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:28.514542103 CEST	443	54375	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:28.514631987 CEST	54376	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:28.514641047 CEST	443	54376	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:29.075670958 CEST	443	54372	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:29.076387882 CEST	54372	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:29.076404095 CEST	443	54372	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:29.076839924 CEST	54372	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:29.076845884 CEST	443	54372	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:29.143018961 CEST	443	54376	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:29.143573046 CEST	54376	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:29.143588066 CEST	443	54376	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:29.144090891 CEST	54376	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:29.144097090 CEST	443	54376	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:29.152806044 CEST	443	54374	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:29.153304100 CEST	54374	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:29.153337002 CEST	443	54374	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:29.153752089 CEST	54374	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:29.153759956 CEST	443	54374	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:29.159034967 CEST	443	54373	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:29.159436941 CEST	54373	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:29.159460068 CEST	443	54373	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:29.159835100 CEST	54373	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:29.159840107 CEST	443	54373	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:29.174161911 CEST	443	54372	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:29.174494028 CEST	443	54372	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:29.174561977 CEST	54372	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:29.174604893 CEST	54372	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:29.174618006 CEST	443	54372	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:29.174628973 CEST	54372	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:29.174634933 CEST	443	54372	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:29.175878048 CEST	443	54375	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:29.176547050 CEST	54375	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:29.176567078 CEST	443	54375	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:29.177054882 CEST	54375	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:29.177064896 CEST	443	54375	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:29.178594112 CEST	54377	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:29.178632021 CEST	443	54377	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:29.178705931 CEST	54377	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:29.178843021 CEST	54377	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:29.178857088 CEST	443	54377	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:29.238058090 CEST	443	54376	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:29.238149881 CEST	443	54376	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:29.238220930 CEST	54376	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:29.238373995 CEST	54376	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:29.238389969 CEST	443	54376	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:29.238399029 CEST	54376	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:29.238404036 CEST	443	54376	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:29.241241932 CEST	54378	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:29.241301060 CEST	443	54378	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:29.241357088 CEST	54378	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:29.241547108 CEST	54378	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:29.241578102 CEST	443	54378	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:29.249082088 CEST	443	54374	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:29.249207973 CEST	443	54374	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:29.249265909 CEST	54374	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:29.249330044 CEST	54374	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:29.249345064 CEST	443	54374	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:29.249358892 CEST	54374	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:29.249363899 CEST	443	54374	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:29.251996994 CEST	54379	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:29.252033949 CEST	443	54379	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:29.252100945 CEST	54379	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:29.252249956 CEST	54379	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:29.252264977 CEST	443	54379	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:29.254077911 CEST	443	54373	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:29.255040884 CEST	443	54373	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:29.255084038 CEST	54373	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:29.255114079 CEST	54373	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:29.255120039 CEST	443	54373	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:29.255130053 CEST	54373	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:29.255132914 CEST	443	54373	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:29.257316113 CEST	54380	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:29.257349014 CEST	443	54380	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:29.257407904 CEST	54380	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:29.257541895 CEST	54380	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:29.257559061 CEST	443	54380	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:29.297946930 CEST	443	54375	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:29.298084974 CEST	443	54375	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:29.298137903 CEST	54375	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:29.298170090 CEST	443	54375	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:29.298207045 CEST	443	54375	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:29.298252106 CEST	54375	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:29.298321009 CEST	54375	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:29.298335075 CEST	443	54375	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:29.301402092 CEST	54381	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:29.301449060 CEST	443	54381	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:29.301511049 CEST	54381	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:29.301656008 CEST	54381	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:29.301673889 CEST	443	54381	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:29.817773104 CEST	443	54377	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:29.818494081 CEST	54377	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:29.818504095 CEST	443	54377	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:29.818947077 CEST	54377	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:29.818950891 CEST	443	54377	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:29.877583981 CEST	443	54378	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:29.878566027 CEST	54378	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:29.878582001 CEST	443	54378	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:29.879056931 CEST	443	54379	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:29.879184008 CEST	54378	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:29.879189014 CEST	443	54378	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:29.879496098 CEST	54379	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:29.879524946 CEST	443	54379	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:29.879965067 CEST	54379	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:29.879970074 CEST	443	54379	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:29.883196115 CEST	443	54380	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:29.883526087 CEST	54380	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:29.883575916 CEST	443	54380	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:29.883956909 CEST	54380	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:29.883965969 CEST	443	54380	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:29.907877922 CEST	49677	443	192.168.2.7	20.50.201.200
Oct 7, 2024 21:53:29.918303013 CEST	443	54377	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:29.918394089 CEST	443	54377	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:29.918456078 CEST	54377	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:29.918577909 CEST	54377	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:29.918591022 CEST	443	54377	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:29.918601036 CEST	54377	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:29.918606997 CEST	443	54377	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:29.921050072 CEST	54382	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:29.921087027 CEST	443	54382	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:29.921288967 CEST	54382	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:29.921457052 CEST	54382	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:29.921468973 CEST	443	54382	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:29.975146055 CEST	443	54379	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:29.975681067 CEST	443	54379	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:29.975729942 CEST	443	54379	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:29.975758076 CEST	54379	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:29.975804090 CEST	54379	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:29.975851059 CEST	54379	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:29.975867987 CEST	443	54379	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:29.975879908 CEST	54379	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:29.975886106 CEST	443	54379	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:29.977669001 CEST	443	54380	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:29.977853060 CEST	443	54380	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:29.977905989 CEST	54380	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:29.977957010 CEST	54380	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:29.977976084 CEST	443	54380	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:29.977991104 CEST	54380	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:29.977998972 CEST	443	54380	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:29.978601933 CEST	54383	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:29.978625059 CEST	443	54383	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:29.978686094 CEST	54383	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:29.978920937 CEST	54383	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:29.978935957 CEST	443	54383	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:29.980027914 CEST	54384	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:29.980057955 CEST	443	54384	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:29.980129004 CEST	54384	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:29.980377913 CEST	54384	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:29.980391026 CEST	443	54384	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:29.983885050 CEST	443	54381	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:29.984234095 CEST	54381	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:29.984256029 CEST	443	54381	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:29.984674931 CEST	54381	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:29.984679937 CEST	443	54381	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:30.015077114 CEST	443	54378	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:30.015300035 CEST	443	54378	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:30.015403032 CEST	54378	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:30.015448093 CEST	54378	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:30.015470982 CEST	443	54378	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:30.015481949 CEST	54378	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:30.015489101 CEST	443	54378	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:30.018712997 CEST	54385	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:30.018754959 CEST	443	54385	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:30.018815994 CEST	54385	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:30.019097090 CEST	54385	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:30.019108057 CEST	443	54385	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:30.084296942 CEST	443	54381	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:30.084465027 CEST	443	54381	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:30.084553957 CEST	54381	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:30.084729910 CEST	54381	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:30.084729910 CEST	54381	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:30.084750891 CEST	443	54381	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:30.084762096 CEST	443	54381	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:30.087610006 CEST	54386	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:30.087656975 CEST	443	54386	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:30.087714911 CEST	54386	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:30.087861061 CEST	54386	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:30.087873936 CEST	443	54386	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:30.533498049 CEST	443	54382	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:30.534111977 CEST	54382	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:30.534121037 CEST	443	54382	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:30.534575939 CEST	54382	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:30.534579992 CEST	443	54382	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:30.618048906 CEST	443	54383	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:30.618719101 CEST	54383	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:30.618750095 CEST	443	54383	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:30.619154930 CEST	54383	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:30.619160891 CEST	443	54383	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:30.711503029 CEST	443	54382	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:30.711569071 CEST	443	54382	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:30.711610079 CEST	54382	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:30.711816072 CEST	54382	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:30.711838007 CEST	443	54382	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:30.711854935 CEST	54382	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:30.711859941 CEST	443	54382	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:30.712061882 CEST	443	54384	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:30.712459087 CEST	54384	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:30.712481976 CEST	443	54384	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:30.712672949 CEST	443	54385	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:30.712974072 CEST	54384	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:30.712980032 CEST	443	54384	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:30.713227987 CEST	54385	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:30.713243961 CEST	443	54385	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:30.713609934 CEST	54385	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:30.713614941 CEST	443	54385	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:30.714477062 CEST	54387	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:30.714503050 CEST	443	54387	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:30.714562893 CEST	54387	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:30.714678049 CEST	54387	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:30.714693069 CEST	443	54387	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:30.727257013 CEST	443	54386	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:30.727720976 CEST	54386	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:30.727744102 CEST	443	54386	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:30.728138924 CEST	54386	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:30.728142977 CEST	443	54386	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:30.779679060 CEST	443	54383	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:30.779715061 CEST	443	54383	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:30.779762983 CEST	443	54383	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:30.779897928 CEST	54383	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:30.780185938 CEST	54383	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:30.780200005 CEST	443	54383	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:30.780232906 CEST	54383	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:30.780237913 CEST	443	54383	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:30.783236027 CEST	54388	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:30.783266068 CEST	443	54388	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:30.783324957 CEST	54388	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:30.783492088 CEST	54388	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:30.783505917 CEST	443	54388	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:30.868593931 CEST	443	54385	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:30.868619919 CEST	443	54385	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:30.868663073 CEST	443	54385	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:30.868696928 CEST	54385	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:30.868746042 CEST	54385	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:30.868980885 CEST	54385	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:30.868999004 CEST	443	54385	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:30.869008064 CEST	54385	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:30.869014025 CEST	443	54385	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:30.871927023 CEST	443	54386	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:30.871993065 CEST	443	54386	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:30.871994019 CEST	54389	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:30.872037888 CEST	443	54389	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:30.872046947 CEST	54386	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:30.872093916 CEST	54389	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:30.872111082 CEST	54386	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:30.872116089 CEST	443	54386	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:30.872124910 CEST	54386	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:30.872128963 CEST	443	54386	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:30.872148037 CEST	443	54384	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:30.872329950 CEST	54389	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:30.872339010 CEST	443	54389	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:30.872389078 CEST	443	54384	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:30.872431040 CEST	54384	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:30.872468948 CEST	54384	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:30.872481108 CEST	443	54384	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:30.872494936 CEST	54384	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:30.872499943 CEST	443	54384	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:30.874537945 CEST	54390	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:30.874550104 CEST	443	54390	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:30.874620914 CEST	54390	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:30.874680042 CEST	54391	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:30.874699116 CEST	443	54391	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:30.874743938 CEST	54390	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:30.874752045 CEST	443	54390	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:30.874758959 CEST	54391	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:30.874907017 CEST	54391	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:30.874916077 CEST	443	54391	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:31.342550993 CEST	443	54387	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:31.343346119 CEST	54387	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:31.343380928 CEST	443	54387	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:31.343811989 CEST	54387	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:31.343821049 CEST	443	54387	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:31.441032887 CEST	443	54387	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:31.441133022 CEST	443	54387	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:31.441175938 CEST	443	54387	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:31.441188097 CEST	54387	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:31.441236019 CEST	54387	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:31.450845957 CEST	54387	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:31.450871944 CEST	443	54387	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:31.450894117 CEST	54387	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:31.450901031 CEST	443	54387	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:31.453533888 CEST	54392	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:31.453573942 CEST	443	54392	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:31.453640938 CEST	54392	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:31.453834057 CEST	54392	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:31.453845024 CEST	443	54392	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:31.500536919 CEST	443	54388	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:31.501146078 CEST	54388	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:31.501231909 CEST	443	54388	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:31.501786947 CEST	54388	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:31.501813889 CEST	443	54388	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:31.528831959 CEST	443	54390	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:31.529009104 CEST	443	54391	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:31.529575109 CEST	54391	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:31.529578924 CEST	54390	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:31.529602051 CEST	443	54390	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:31.529609919 CEST	443	54391	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:31.529978991 CEST	54390	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:31.529984951 CEST	443	54390	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:31.530026913 CEST	54391	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:31.530034065 CEST	443	54391	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:31.532607079 CEST	443	54389	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:31.532959938 CEST	54389	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:31.532977104 CEST	443	54389	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:31.533380985 CEST	54389	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:31.533405066 CEST	443	54389	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:31.603764057 CEST	443	54388	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:31.603945017 CEST	443	54388	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:31.604063034 CEST	54388	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:31.604161978 CEST	54388	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:31.604177952 CEST	443	54388	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:31.604209900 CEST	54388	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:31.604216099 CEST	443	54388	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:31.607218981 CEST	54393	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:31.607247114 CEST	443	54393	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:31.607333899 CEST	54393	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:31.607536077 CEST	54393	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:31.607549906 CEST	443	54393	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:31.624140978 CEST	443	54390	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:31.624221087 CEST	443	54390	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:31.624278069 CEST	54390	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:31.624485970 CEST	54390	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:31.624485970 CEST	54390	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:31.624501944 CEST	443	54390	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:31.624511003 CEST	443	54390	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:31.624810934 CEST	443	54391	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:31.625514984 CEST	443	54391	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:31.625581980 CEST	443	54391	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:31.625582933 CEST	54391	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:31.625624895 CEST	54391	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:31.625669003 CEST	54391	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:31.625684023 CEST	443	54391	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:31.625699997 CEST	54391	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:31.625705957 CEST	443	54391	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:31.627063036 CEST	54394	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:31.627091885 CEST	443	54394	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:31.627161980 CEST	54394	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:31.627295971 CEST	54394	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:31.627310991 CEST	443	54394	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:31.627671003 CEST	54395	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:31.627723932 CEST	443	54395	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:31.627785921 CEST	54395	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:31.627921104 CEST	54395	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:31.627933979 CEST	443	54395	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:31.635816097 CEST	443	54389	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:31.635926008 CEST	443	54389	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:31.635971069 CEST	443	54389	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:31.635979891 CEST	54389	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:31.636013985 CEST	54389	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:31.636059046 CEST	54389	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:31.636069059 CEST	443	54389	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:31.636080980 CEST	54389	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:31.636086941 CEST	443	54389	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:31.638026953 CEST	54396	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:31.638051033 CEST	443	54396	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:31.638125896 CEST	54396	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:31.638278008 CEST	54396	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:31.638290882 CEST	443	54396	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:32.085725069 CEST	443	54392	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:32.086469889 CEST	54392	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:32.086499929 CEST	443	54392	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:32.086884022 CEST	54392	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:32.086889982 CEST	443	54392	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:32.184844017 CEST	443	54392	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:32.185358047 CEST	443	54392	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:32.185533047 CEST	54392	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:32.185533047 CEST	54392	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:32.185533047 CEST	54392	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:32.188044071 CEST	54397	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:32.188066006 CEST	443	54397	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:32.188146114 CEST	54397	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:32.188451052 CEST	54397	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:32.188465118 CEST	443	54397	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:32.222116947 CEST	443	54393	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:32.222872972 CEST	54393	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:32.222898960 CEST	443	54393	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:32.223387957 CEST	54393	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:32.223395109 CEST	443	54393	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:32.232840061 CEST	443	54394	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:32.233241081 CEST	54394	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:32.233257055 CEST	443	54394	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:32.233678102 CEST	54394	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:32.233681917 CEST	443	54394	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:32.239263058 CEST	443	54395	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:32.239644051 CEST	54395	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:32.239664078 CEST	443	54395	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:32.240094900 CEST	54395	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:32.240098953 CEST	443	54395	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:32.245222092 CEST	443	54396	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:32.245554924 CEST	54396	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:32.245570898 CEST	443	54396	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:32.245939016 CEST	54396	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:32.245944977 CEST	443	54396	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:32.327966928 CEST	443	54393	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:32.328125954 CEST	443	54393	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:32.328197002 CEST	54393	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:32.328336000 CEST	54393	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:32.328361034 CEST	443	54393	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:32.328375101 CEST	54393	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:32.328382015 CEST	443	54393	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:32.331285954 CEST	54398	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:32.331326962 CEST	443	54398	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:32.331398964 CEST	54398	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:32.331593990 CEST	54398	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:32.331609964 CEST	443	54398	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:32.337681055 CEST	443	54394	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:32.337747097 CEST	443	54394	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:32.337801933 CEST	54394	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:32.337930918 CEST	54394	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:32.337930918 CEST	54394	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:32.337930918 CEST	54394	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:32.337939978 CEST	443	54394	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:32.337948084 CEST	443	54394	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:32.339543104 CEST	443	54395	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:32.339591980 CEST	443	54395	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:32.339637041 CEST	443	54395	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:32.339648962 CEST	54395	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:32.339688063 CEST	54395	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:32.339792013 CEST	54395	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:32.339814901 CEST	443	54395	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:32.339828014 CEST	54395	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:32.339834929 CEST	443	54395	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:32.340519905 CEST	54399	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:32.340550900 CEST	443	54399	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:32.340610027 CEST	54399	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:32.340739012 CEST	54399	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:32.340749979 CEST	443	54399	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:32.341799021 CEST	54400	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:32.341825962 CEST	443	54400	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:32.341890097 CEST	54400	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:32.342035055 CEST	54400	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:32.342042923 CEST	443	54400	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:32.346076965 CEST	443	54396	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:32.346524000 CEST	443	54396	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:32.346579075 CEST	54396	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:32.346611023 CEST	54396	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:32.346618891 CEST	443	54396	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:32.346628904 CEST	54396	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:32.346632957 CEST	443	54396	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:32.348588943 CEST	54401	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:32.348647118 CEST	443	54401	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:32.348727942 CEST	54401	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:32.348874092 CEST	54401	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:32.348910093 CEST	443	54401	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:32.486042023 CEST	54392	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:32.486078978 CEST	443	54392	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:32.805226088 CEST	443	54397	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:32.817796946 CEST	54397	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:32.817806005 CEST	443	54397	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:32.818455935 CEST	54397	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:32.818460941 CEST	443	54397	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:32.913923025 CEST	443	54397	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:32.913999081 CEST	443	54397	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:32.914041042 CEST	443	54397	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:32.914061069 CEST	54397	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:32.914087057 CEST	54397	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:32.914321899 CEST	54397	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:32.914340019 CEST	443	54397	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:32.914350986 CEST	54397	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:32.914356947 CEST	443	54397	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:32.917203903 CEST	54402	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:32.917270899 CEST	443	54402	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:32.917403936 CEST	54402	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:32.917548895 CEST	54402	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:32.917581081 CEST	443	54402	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:32.963463068 CEST	443	54398	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:32.963938951 CEST	54398	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:32.963974953 CEST	443	54398	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:32.964425087 CEST	54398	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:32.964435101 CEST	443	54398	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:32.966850042 CEST	443	54401	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:32.967207909 CEST	54401	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:32.967248917 CEST	443	54401	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:32.967597008 CEST	54401	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:32.967609882 CEST	443	54401	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:32.968223095 CEST	443	54399	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:32.968477964 CEST	54399	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:32.968488932 CEST	443	54399	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:32.968815088 CEST	54399	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:32.968820095 CEST	443	54399	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:32.977379084 CEST	443	54400	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:32.977849007 CEST	54400	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:32.977875948 CEST	443	54400	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:32.978122950 CEST	54400	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:32.978132010 CEST	443	54400	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:33.059319973 CEST	443	54398	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:33.059535027 CEST	443	54398	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:33.059716940 CEST	54398	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:33.059947014 CEST	54398	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:33.059947014 CEST	54398	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:33.059966087 CEST	443	54398	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:33.059979916 CEST	443	54398	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:33.061372995 CEST	443	54401	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:33.061418056 CEST	443	54401	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:33.061481953 CEST	443	54401	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:33.061479092 CEST	54401	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:33.061543941 CEST	54401	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:33.061634064 CEST	54401	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:33.061677933 CEST	443	54401	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:33.061706066 CEST	54401	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:33.061722994 CEST	443	54401	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:33.062714100 CEST	54403	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:33.062763929 CEST	443	54403	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:33.062855959 CEST	54403	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:33.062999964 CEST	54403	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:33.063013077 CEST	443	54403	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:33.063710928 CEST	54404	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:33.063749075 CEST	443	54404	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:33.063815117 CEST	54404	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:33.063973904 CEST	54404	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:33.063985109 CEST	443	54404	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:33.064809084 CEST	443	54399	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:33.064987898 CEST	443	54399	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:33.065033913 CEST	54399	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:33.065088034 CEST	54399	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:33.065099955 CEST	443	54399	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:33.065114975 CEST	54399	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:33.065119982 CEST	443	54399	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:33.067084074 CEST	54405	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:33.067131042 CEST	443	54405	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:33.067207098 CEST	54405	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:33.067342997 CEST	54405	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:33.067359924 CEST	443	54405	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:33.076997042 CEST	443	54400	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:33.077071905 CEST	443	54400	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:33.077126026 CEST	54400	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:33.077358007 CEST	54400	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:33.077358007 CEST	54400	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:33.077370882 CEST	443	54400	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:33.077378988 CEST	443	54400	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:33.079474926 CEST	54406	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:33.079508066 CEST	443	54406	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:33.079577923 CEST	54406	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:33.079837084 CEST	54406	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:33.079852104 CEST	443	54406	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:33.559593916 CEST	443	54402	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:33.560146093 CEST	54402	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:33.560205936 CEST	443	54402	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:33.560792923 CEST	54402	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:33.560806990 CEST	443	54402	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:33.654366016 CEST	443	54402	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:33.654854059 CEST	443	54402	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:33.655045033 CEST	54402	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:33.655045033 CEST	54402	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:33.655045033 CEST	54402	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:33.657685995 CEST	54407	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:33.657721043 CEST	443	54407	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:33.657826900 CEST	54407	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:33.657994986 CEST	54407	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:33.658004045 CEST	443	54407	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:33.707931042 CEST	443	54404	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:33.708710909 CEST	54404	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:33.708731890 CEST	443	54404	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:33.709144115 CEST	54404	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:33.709148884 CEST	443	54404	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:33.710621119 CEST	443	54403	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:33.710629940 CEST	443	54406	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:33.711008072 CEST	54406	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:33.711021900 CEST	443	54406	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:33.711149931 CEST	54403	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:33.711173058 CEST	443	54403	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:33.711381912 CEST	54406	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:33.711395979 CEST	443	54406	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:33.711733103 CEST	54403	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:33.711743116 CEST	443	54403	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:33.713800907 CEST	443	54405	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:33.714195967 CEST	54405	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:33.714210987 CEST	443	54405	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:33.714567900 CEST	54405	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:33.714574099 CEST	443	54405	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:33.805571079 CEST	443	54404	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:33.805653095 CEST	443	54404	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:33.805710077 CEST	54404	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:33.805886984 CEST	54404	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:33.805906057 CEST	443	54404	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:33.805919886 CEST	54404	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:33.805926085 CEST	443	54404	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:33.806658030 CEST	443	54403	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:33.806730986 CEST	443	54403	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:33.806803942 CEST	54403	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:33.806813955 CEST	443	54403	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:33.806859016 CEST	443	54403	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:33.806909084 CEST	54403	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:33.806921959 CEST	54403	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:33.806927919 CEST	443	54403	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:33.807950020 CEST	443	54406	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:33.808007002 CEST	443	54406	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:33.808064938 CEST	54406	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:33.808979988 CEST	54408	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:33.809015989 CEST	443	54408	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:33.809093952 CEST	54408	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:33.809220076 CEST	54408	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:33.809222937 CEST	54406	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:33.809222937 CEST	54406	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:33.809230089 CEST	443	54408	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:33.809250116 CEST	443	54406	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:33.809271097 CEST	443	54406	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:33.809278965 CEST	54409	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:33.809319019 CEST	443	54409	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:33.809344053 CEST	443	54405	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:33.809398890 CEST	54409	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:33.809480906 CEST	54409	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:33.809492111 CEST	443	54409	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:33.810235977 CEST	443	54405	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:33.810297012 CEST	54405	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:33.810353994 CEST	54405	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:33.810353994 CEST	54405	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:33.810369015 CEST	443	54405	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:33.810389042 CEST	443	54405	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:33.811532021 CEST	54410	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:33.811558008 CEST	443	54410	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:33.811616898 CEST	54410	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:33.811750889 CEST	54410	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:33.811760902 CEST	443	54410	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:33.812096119 CEST	54411	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:33.812118053 CEST	443	54411	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:33.812170982 CEST	54411	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:33.812423944 CEST	54411	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:33.812441111 CEST	443	54411	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:33.970299959 CEST	54402	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:33.970362902 CEST	443	54402	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:34.299735069 CEST	443	54407	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:34.300200939 CEST	54407	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:34.300216913 CEST	443	54407	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:34.300692081 CEST	54407	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:34.300698996 CEST	443	54407	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:34.395092010 CEST	443	54407	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:34.395229101 CEST	443	54407	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:34.395277977 CEST	54407	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:34.395484924 CEST	54407	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:34.395497084 CEST	443	54407	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:34.395508051 CEST	54407	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:34.395513058 CEST	443	54407	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:34.398263931 CEST	54412	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:34.398304939 CEST	443	54412	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:34.398379087 CEST	54412	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:34.398530960 CEST	54412	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:34.398542881 CEST	443	54412	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:34.416384935 CEST	443	54411	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:34.416903019 CEST	54411	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:34.416939974 CEST	443	54411	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:34.417463064 CEST	54411	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:34.417473078 CEST	443	54411	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:34.420316935 CEST	443	54408	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:34.420670986 CEST	54408	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:34.420681953 CEST	443	54408	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:34.421077967 CEST	54408	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:34.421084881 CEST	443	54408	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:34.421736956 CEST	443	54410	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:34.422019958 CEST	54410	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:34.422035933 CEST	443	54410	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:34.422131062 CEST	443	54409	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:34.422384024 CEST	54410	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:34.422393084 CEST	443	54410	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:34.422637939 CEST	54409	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:34.422646046 CEST	443	54409	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:34.423008919 CEST	54409	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:34.423017025 CEST	443	54409	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:34.510811090 CEST	443	54411	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:34.511327028 CEST	443	54411	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:34.511372089 CEST	443	54411	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:34.511394024 CEST	54411	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:34.511437893 CEST	54411	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:34.511477947 CEST	54411	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:34.511502028 CEST	443	54411	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:34.511518955 CEST	54411	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:34.511527061 CEST	443	54411	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:34.514230013 CEST	54413	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:34.514271975 CEST	443	54413	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:34.514342070 CEST	54413	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:34.514476061 CEST	54413	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:34.514482975 CEST	443	54413	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:34.514830112 CEST	443	54408	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:34.515285015 CEST	443	54408	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:34.515336037 CEST	54408	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:34.515403986 CEST	54408	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:34.515424013 CEST	443	54408	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:34.515439987 CEST	54408	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:34.515446901 CEST	443	54408	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:34.516949892 CEST	443	54410	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:34.517005920 CEST	443	54410	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:34.517051935 CEST	54410	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:34.517139912 CEST	54410	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:34.517157078 CEST	443	54410	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:34.517184019 CEST	54410	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:34.517189980 CEST	443	54410	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:34.517220020 CEST	443	54409	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:34.517431974 CEST	443	54409	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:34.517478943 CEST	54409	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:34.517824888 CEST	54409	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:34.517838955 CEST	443	54409	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:34.517853022 CEST	54409	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:34.517858982 CEST	443	54409	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:34.524122000 CEST	54414	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:34.524133921 CEST	443	54414	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:34.524213076 CEST	54414	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:34.524343014 CEST	54414	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:34.524353981 CEST	443	54414	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:34.525764942 CEST	54415	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:34.525791883 CEST	443	54415	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:34.525886059 CEST	54415	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:34.526102066 CEST	54415	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:34.526113987 CEST	443	54415	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:34.526635885 CEST	54416	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:34.526683092 CEST	443	54416	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:34.526753902 CEST	54416	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:34.526848078 CEST	54416	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:34.526859045 CEST	443	54416	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:35.016369104 CEST	443	54412	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:35.017155886 CEST	54412	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:35.017222881 CEST	443	54412	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:35.017520905 CEST	54412	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:35.017529011 CEST	443	54412	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:35.136976957 CEST	443	54412	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:35.137048960 CEST	443	54412	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:35.137213945 CEST	54412	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:35.137429953 CEST	54412	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:35.137444019 CEST	443	54412	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:35.137480021 CEST	54412	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:35.137485981 CEST	443	54412	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:35.140101910 CEST	54417	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:35.140136957 CEST	443	54417	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:35.140208006 CEST	54417	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:35.140364885 CEST	54417	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:35.140372992 CEST	443	54417	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:35.142679930 CEST	443	54413	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:35.147027969 CEST	54413	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:35.147046089 CEST	443	54413	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:35.147484064 CEST	54413	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:35.147492886 CEST	443	54413	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:35.149252892 CEST	443	54415	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:35.151010036 CEST	54415	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:35.151019096 CEST	443	54415	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:35.151429892 CEST	54415	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:35.151433945 CEST	443	54415	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:35.152395010 CEST	443	54414	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:35.154994965 CEST	54414	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:35.155009031 CEST	443	54414	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:35.155414104 CEST	54414	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:35.155419111 CEST	443	54414	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:35.175226927 CEST	443	54416	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:35.179135084 CEST	54416	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:35.179168940 CEST	443	54416	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:35.179582119 CEST	54416	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:35.179593086 CEST	443	54416	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:35.239744902 CEST	443	54413	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:35.239819050 CEST	443	54413	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:35.239870071 CEST	54413	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:35.240020990 CEST	54413	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:35.240044117 CEST	443	54413	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:35.240055084 CEST	54413	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:35.240068913 CEST	443	54413	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:35.242523909 CEST	54418	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:35.242568970 CEST	443	54418	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:35.242629051 CEST	54418	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:35.242811918 CEST	54418	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:35.242819071 CEST	443	54418	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:35.254117966 CEST	443	54415	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:35.254132986 CEST	443	54415	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:35.254184008 CEST	443	54415	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:35.254195929 CEST	54415	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:35.254232883 CEST	54415	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:35.254465103 CEST	54415	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:35.254477978 CEST	443	54415	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:35.254487991 CEST	54415	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:35.254492044 CEST	443	54415	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:35.257025003 CEST	54419	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:35.257122993 CEST	443	54419	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:35.257199049 CEST	54419	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:35.257757902 CEST	54419	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:35.257793903 CEST	443	54419	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:35.264857054 CEST	443	54414	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:35.264925957 CEST	443	54414	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:35.264971018 CEST	54414	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:35.265173912 CEST	54414	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:35.265194893 CEST	443	54414	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:35.265207052 CEST	54414	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:35.265213013 CEST	443	54414	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:35.268188000 CEST	54420	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:35.268234968 CEST	443	54420	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:35.268306971 CEST	54420	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:35.268852949 CEST	54420	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:35.268886089 CEST	443	54420	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:35.275928974 CEST	443	54416	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:35.275964975 CEST	443	54416	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:35.276009083 CEST	443	54416	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:35.276076078 CEST	54416	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:35.276294947 CEST	54416	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:35.276294947 CEST	54416	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:35.276339054 CEST	443	54416	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:35.276367903 CEST	443	54416	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:35.279691935 CEST	54421	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:35.279748917 CEST	443	54421	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:35.279814959 CEST	54421	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:35.279947996 CEST	54421	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:35.279962063 CEST	443	54421	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:35.742646933 CEST	443	54417	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:35.747240067 CEST	54417	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:35.747257948 CEST	443	54417	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:35.747587919 CEST	54417	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:35.747595072 CEST	443	54417	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:35.838119984 CEST	443	54417	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:35.838238955 CEST	443	54417	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:35.838284016 CEST	443	54417	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:35.838293076 CEST	54417	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:35.838323116 CEST	54417	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:35.838479996 CEST	54417	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:35.838486910 CEST	443	54417	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:35.838514090 CEST	54417	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:35.838519096 CEST	443	54417	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:35.841368914 CEST	54422	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:35.841413021 CEST	443	54422	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:35.841758013 CEST	54422	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:35.841945887 CEST	54422	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:35.841954947 CEST	443	54422	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:35.881378889 CEST	443	54418	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:35.882031918 CEST	54418	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:35.882052898 CEST	443	54418	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:35.882503986 CEST	54418	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:35.882508993 CEST	443	54418	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:35.886924982 CEST	443	54419	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:35.887831926 CEST	443	54421	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:35.888199091 CEST	54419	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:35.888241053 CEST	443	54419	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:35.888609886 CEST	54419	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:35.888622999 CEST	443	54419	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:35.888907909 CEST	54421	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:35.888937950 CEST	443	54421	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:35.889316082 CEST	54421	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:35.889322042 CEST	443	54421	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:35.901299953 CEST	443	54420	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:35.903239965 CEST	54420	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:35.903299093 CEST	443	54420	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:35.903846025 CEST	54420	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:35.903860092 CEST	443	54420	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:35.976424932 CEST	443	54418	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:35.976579905 CEST	443	54418	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:35.976778030 CEST	54418	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:35.976824045 CEST	54418	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:35.976824045 CEST	54418	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:35.976847887 CEST	443	54418	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:35.976859093 CEST	443	54418	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:35.979741096 CEST	54423	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:35.979840040 CEST	443	54423	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:35.979940891 CEST	54423	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:35.980122089 CEST	54423	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:35.980159044 CEST	443	54423	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:35.982331991 CEST	443	54419	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:35.982785940 CEST	443	54419	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:35.982836962 CEST	443	54419	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:35.982848883 CEST	54419	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:35.982889891 CEST	443	54421	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:35.982903004 CEST	54419	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:35.982916117 CEST	443	54421	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:35.982944012 CEST	54419	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:35.982974052 CEST	54421	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:35.982976913 CEST	443	54419	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:35.982991934 CEST	443	54421	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:35.983006954 CEST	54419	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:35.983023882 CEST	443	54419	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:35.983213902 CEST	54421	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:35.983221054 CEST	443	54421	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:35.983236074 CEST	54421	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:35.983396053 CEST	443	54421	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:35.983437061 CEST	443	54421	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:35.983485937 CEST	54421	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:35.985600948 CEST	54424	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:35.985650063 CEST	443	54424	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:35.985691071 CEST	54425	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:35.985716105 CEST	443	54425	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:35.985735893 CEST	54424	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:35.985771894 CEST	54425	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:35.985861063 CEST	54424	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:35.985879898 CEST	443	54424	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:35.985954046 CEST	54425	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:35.985971928 CEST	443	54425	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:36.031624079 CEST	443	54420	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:36.032107115 CEST	443	54420	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:36.032206059 CEST	54420	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:36.032407045 CEST	54420	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:36.032407045 CEST	54420	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:36.032444954 CEST	443	54420	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:36.032470942 CEST	443	54420	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:36.035200119 CEST	54426	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:36.035214901 CEST	443	54426	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:36.035301924 CEST	54426	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:36.035480976 CEST	54426	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:36.035485983 CEST	443	54426	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:36.465918064 CEST	443	54422	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:36.466408014 CEST	54422	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:36.466430902 CEST	443	54422	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:36.466861010 CEST	54422	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:36.466871977 CEST	443	54422	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:36.603529930 CEST	443	54422	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:36.603570938 CEST	443	54422	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:36.603626966 CEST	443	54422	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:36.603682995 CEST	54422	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:36.603715897 CEST	54422	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:36.604671001 CEST	54422	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:36.604693890 CEST	443	54422	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:36.604707003 CEST	54422	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:36.604712963 CEST	443	54422	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:36.607681990 CEST	54427	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:36.607713938 CEST	443	54427	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:36.607790947 CEST	54427	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:36.607964993 CEST	54427	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:36.607980013 CEST	443	54427	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:36.608314991 CEST	443	54423	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:36.608689070 CEST	54423	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:36.608721018 CEST	443	54423	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:36.609114885 CEST	54423	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:36.609127998 CEST	443	54423	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:36.639009953 CEST	443	54425	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:36.639596939 CEST	54425	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:36.639611959 CEST	443	54425	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:36.640055895 CEST	54425	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:36.640062094 CEST	443	54425	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:36.666508913 CEST	443	54424	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:36.667020082 CEST	54424	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:36.667042017 CEST	443	54424	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:36.667362928 CEST	54424	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:36.667368889 CEST	443	54424	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:36.709486008 CEST	443	54423	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:36.709522963 CEST	443	54423	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:36.709563017 CEST	443	54423	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:36.709634066 CEST	54423	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:36.709894896 CEST	54423	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:36.709908009 CEST	443	54423	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:36.709923029 CEST	54423	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:36.709930897 CEST	443	54423	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:36.711088896 CEST	443	54426	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:36.711448908 CEST	54426	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:36.711462021 CEST	443	54426	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:36.711863995 CEST	54426	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:36.711869955 CEST	443	54426	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:36.712526083 CEST	54428	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:36.712562084 CEST	443	54428	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:36.712625980 CEST	54428	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:36.712810993 CEST	54428	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:36.712821007 CEST	443	54428	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:36.744518042 CEST	443	54425	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:36.744736910 CEST	443	54425	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:36.744791031 CEST	54425	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:36.744826078 CEST	54425	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:36.744841099 CEST	443	54425	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:36.744852066 CEST	54425	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:36.744858980 CEST	443	54425	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:36.747571945 CEST	54429	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:36.747605085 CEST	443	54429	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:36.747677088 CEST	54429	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:36.747850895 CEST	54429	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:36.747860909 CEST	443	54429	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:36.800292969 CEST	443	54424	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:36.800359011 CEST	443	54424	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:36.800421000 CEST	54424	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:36.800611019 CEST	54424	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:36.800616980 CEST	443	54424	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:36.800626993 CEST	54424	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:36.800632000 CEST	443	54424	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:36.803447008 CEST	54430	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:36.803459883 CEST	443	54430	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:36.803544044 CEST	54430	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:36.803699970 CEST	54430	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:36.803704023 CEST	443	54430	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:36.810463905 CEST	443	54426	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:36.810558081 CEST	443	54426	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:36.810616970 CEST	54426	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:36.810713053 CEST	54426	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:36.810734034 CEST	443	54426	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:36.810750008 CEST	54426	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:36.810759068 CEST	443	54426	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:36.813525915 CEST	54431	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:36.813570976 CEST	443	54431	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:36.813884020 CEST	54431	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:36.813884020 CEST	54431	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:36.813920021 CEST	443	54431	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:37.256041050 CEST	443	54427	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:37.256748915 CEST	54427	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:37.256757975 CEST	443	54427	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:37.257508039 CEST	54427	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:37.257513046 CEST	443	54427	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:37.318064928 CEST	443	54428	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:37.318700075 CEST	54428	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:37.318718910 CEST	443	54428	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:37.319179058 CEST	54428	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:37.319183111 CEST	443	54428	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:37.360630035 CEST	443	54427	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:37.360665083 CEST	443	54427	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:37.360707998 CEST	443	54427	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:37.360713005 CEST	54427	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:37.360744953 CEST	54427	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:37.361058950 CEST	54427	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:37.361078024 CEST	443	54427	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:37.361089945 CEST	54427	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:37.361094952 CEST	443	54427	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:37.363822937 CEST	54432	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:37.363859892 CEST	443	54432	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:37.363924980 CEST	54432	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:37.364125013 CEST	54432	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:37.364137888 CEST	443	54432	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:37.383286953 CEST	443	54429	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:37.383673906 CEST	54429	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:37.383698940 CEST	443	54429	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:37.384100914 CEST	54429	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:37.384105921 CEST	443	54429	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:37.416264057 CEST	443	54428	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:37.416443110 CEST	443	54428	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:37.416497946 CEST	54428	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:37.416532993 CEST	54428	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:37.416548014 CEST	443	54428	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:37.416558981 CEST	54428	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:37.416564941 CEST	443	54428	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:37.418782949 CEST	54433	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:37.418809891 CEST	443	54433	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:37.418872118 CEST	54433	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:37.418988943 CEST	54433	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:37.418996096 CEST	443	54433	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:37.430339098 CEST	443	54431	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:37.430835009 CEST	54431	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:37.430843115 CEST	443	54431	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:37.431253910 CEST	54431	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:37.431258917 CEST	443	54431	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:37.442810059 CEST	443	54430	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:37.443120003 CEST	54430	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:37.443136930 CEST	443	54430	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:37.443466902 CEST	54430	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:37.443475008 CEST	443	54430	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:37.526066065 CEST	443	54431	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:37.526143074 CEST	443	54431	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:37.526190042 CEST	54431	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:37.526207924 CEST	443	54431	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:37.526259899 CEST	443	54431	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:37.526313066 CEST	54431	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:37.526406050 CEST	54431	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:37.526431084 CEST	443	54431	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:37.526441097 CEST	54431	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:37.526447058 CEST	443	54431	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:37.528800011 CEST	54434	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:37.528832912 CEST	443	54434	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:37.528898001 CEST	54434	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:37.529081106 CEST	54434	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:37.529099941 CEST	443	54434	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:37.542151928 CEST	443	54430	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:37.542656898 CEST	443	54430	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:37.542790890 CEST	54430	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:37.542790890 CEST	54430	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:37.542814970 CEST	54430	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:37.542824984 CEST	443	54430	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:37.544449091 CEST	443	54429	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:37.544478893 CEST	443	54429	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:37.544526100 CEST	443	54429	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:37.544529915 CEST	54429	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:37.544569016 CEST	54429	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:37.544822931 CEST	54429	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:37.544831991 CEST	443	54429	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:37.544842958 CEST	54429	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:37.544847965 CEST	443	54429	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:37.545090914 CEST	54435	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:37.545116901 CEST	443	54435	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:37.545164108 CEST	54435	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:37.545274973 CEST	54435	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:37.545288086 CEST	443	54435	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:37.546962976 CEST	54436	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:37.546993971 CEST	443	54436	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:37.547049046 CEST	54436	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:37.547153950 CEST	54436	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:37.547169924 CEST	443	54436	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:37.971752882 CEST	443	54432	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:37.979235888 CEST	54432	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:37.979249954 CEST	443	54432	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:37.980087996 CEST	54432	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:37.980093002 CEST	443	54432	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:38.055336952 CEST	443	54433	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:38.055948973 CEST	54433	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:38.055984020 CEST	443	54433	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:38.056559086 CEST	54433	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:38.056567907 CEST	443	54433	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:38.071517944 CEST	443	54432	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:38.071574926 CEST	443	54432	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:38.071765900 CEST	54432	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:38.071955919 CEST	54432	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:38.071974039 CEST	443	54432	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:38.071985006 CEST	54432	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:38.071990013 CEST	443	54432	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:38.074652910 CEST	54437	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:38.074665070 CEST	443	54437	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:38.074749947 CEST	54437	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:38.074887991 CEST	54437	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:38.074896097 CEST	443	54437	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:38.141469955 CEST	443	54434	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:38.142010927 CEST	54434	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:38.142031908 CEST	443	54434	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:38.142559052 CEST	54434	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:38.142565966 CEST	443	54434	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:38.150716066 CEST	443	54433	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:38.150913000 CEST	443	54433	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:38.150971889 CEST	54433	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:38.151019096 CEST	54433	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:38.151036024 CEST	443	54433	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:38.151051044 CEST	54433	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:38.151057959 CEST	443	54433	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:38.153753042 CEST	54438	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:38.153776884 CEST	443	54438	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:38.153856993 CEST	54438	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:38.154015064 CEST	54438	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:38.154026031 CEST	443	54438	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:38.173645020 CEST	443	54436	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:38.174216986 CEST	54436	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:38.174232006 CEST	443	54436	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:38.174793005 CEST	54436	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:38.174798012 CEST	443	54436	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:38.189870119 CEST	443	54435	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:38.190452099 CEST	54435	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:38.190475941 CEST	443	54435	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:38.190831900 CEST	54435	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:38.190838099 CEST	443	54435	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:38.238032103 CEST	443	54434	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:38.238786936 CEST	443	54434	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:38.238857985 CEST	54434	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:38.238900900 CEST	54434	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:38.238900900 CEST	54434	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:38.238919973 CEST	443	54434	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:38.238933086 CEST	443	54434	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:38.241578102 CEST	54439	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:38.241611958 CEST	443	54439	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:38.241677999 CEST	54439	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:38.241799116 CEST	54439	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:38.241805077 CEST	443	54439	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:38.271673918 CEST	443	54436	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:38.271753073 CEST	443	54436	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:38.271802902 CEST	54436	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:38.271939993 CEST	54436	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:38.271960974 CEST	443	54436	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:38.271972895 CEST	54436	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:38.271981001 CEST	443	54436	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:38.274389982 CEST	54440	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:38.274430037 CEST	443	54440	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:38.274502039 CEST	54440	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:38.274627924 CEST	54440	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:38.274651051 CEST	443	54440	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:38.294018984 CEST	443	54435	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:38.296515942 CEST	443	54435	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:38.296565056 CEST	54435	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:38.296669960 CEST	54435	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:38.296688080 CEST	443	54435	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:38.296699047 CEST	54435	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:38.296704054 CEST	443	54435	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:38.300911903 CEST	54441	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:38.300947905 CEST	443	54441	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:38.301031113 CEST	54441	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:38.301153898 CEST	54441	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:38.301163912 CEST	443	54441	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:38.720042944 CEST	443	54437	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:38.720577002 CEST	54437	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:38.720588923 CEST	443	54437	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:38.721036911 CEST	54437	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:38.721043110 CEST	443	54437	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:38.786683083 CEST	443	54438	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:38.787247896 CEST	54438	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:38.787276030 CEST	443	54438	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:38.787656069 CEST	54438	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:38.787667036 CEST	443	54438	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:38.822882891 CEST	443	54437	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:38.822911978 CEST	443	54437	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:38.822947025 CEST	443	54437	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:38.822995901 CEST	54437	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:38.823028088 CEST	54437	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:38.823247910 CEST	54437	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:38.823255062 CEST	443	54437	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:38.823291063 CEST	54437	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:38.823298931 CEST	443	54437	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:38.826056957 CEST	54442	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:38.826096058 CEST	443	54442	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:38.826184988 CEST	54442	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:38.826368093 CEST	54442	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:38.826373100 CEST	443	54442	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:38.880486012 CEST	443	54440	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:38.881006002 CEST	54440	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:38.881047964 CEST	443	54440	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:38.881469965 CEST	54440	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:38.881478071 CEST	443	54440	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:38.881552935 CEST	443	54438	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:38.882951021 CEST	443	54438	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:38.883014917 CEST	54438	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:38.883053064 CEST	54438	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:38.883061886 CEST	443	54438	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:38.883078098 CEST	54438	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:38.883084059 CEST	443	54438	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:38.885731936 CEST	54443	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:38.885762930 CEST	443	54443	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:38.885828972 CEST	54443	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:38.885952950 CEST	54443	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:38.885967016 CEST	443	54443	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:38.887191057 CEST	443	54439	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:38.887551069 CEST	54439	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:38.887568951 CEST	443	54439	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:38.887947083 CEST	54439	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:38.887952089 CEST	443	54439	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:38.920953035 CEST	443	54441	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:38.921657085 CEST	54441	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:38.921684027 CEST	443	54441	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:38.922168016 CEST	54441	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:38.922174931 CEST	443	54441	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:38.976486921 CEST	443	54440	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:38.976548910 CEST	443	54440	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:38.976636887 CEST	54440	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:38.976799011 CEST	54440	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:38.976840019 CEST	443	54440	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:38.976888895 CEST	54440	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:38.976907969 CEST	443	54440	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:38.979547024 CEST	54444	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:38.979578972 CEST	443	54444	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:38.979675055 CEST	54444	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:38.979826927 CEST	54444	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:38.979856014 CEST	443	54444	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:38.984155893 CEST	443	54439	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:38.984230995 CEST	443	54439	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:38.984286070 CEST	54439	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:38.984302044 CEST	443	54439	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:38.984343052 CEST	443	54439	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:38.984373093 CEST	54439	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:38.984394073 CEST	443	54439	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:38.984405994 CEST	54439	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:38.984405994 CEST	54439	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:38.984412909 CEST	443	54439	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:38.984420061 CEST	443	54439	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:38.986243963 CEST	54445	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:38.986272097 CEST	443	54445	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:38.986326933 CEST	54445	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:38.986430883 CEST	54445	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:38.986439943 CEST	443	54445	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:39.020554066 CEST	443	54441	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:39.021337032 CEST	443	54441	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:39.021383047 CEST	443	54441	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:39.021414042 CEST	54441	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:39.021441936 CEST	54441	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:39.021488905 CEST	54441	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:39.021503925 CEST	443	54441	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:39.021512985 CEST	54441	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:39.021522045 CEST	443	54441	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:39.024071932 CEST	54446	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:39.024094105 CEST	443	54446	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:39.024173021 CEST	54446	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:39.024322987 CEST	54446	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:39.024336100 CEST	443	54446	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:39.459273100 CEST	443	54442	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:39.460014105 CEST	54442	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:39.460035086 CEST	443	54442	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:39.460449934 CEST	54442	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:39.460454941 CEST	443	54442	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:39.491379976 CEST	443	54443	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:39.491971016 CEST	54443	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:39.492022038 CEST	443	54443	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:39.492356062 CEST	54443	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:39.492369890 CEST	443	54443	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:39.557516098 CEST	443	54442	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:39.557740927 CEST	443	54442	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:39.557821035 CEST	54442	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:39.557919979 CEST	54442	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:39.557935953 CEST	443	54442	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:39.557946920 CEST	54442	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:39.557951927 CEST	443	54442	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:39.560775995 CEST	54447	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:39.560853004 CEST	443	54447	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:39.560973883 CEST	54447	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:39.561100960 CEST	54447	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:39.561131954 CEST	443	54447	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:39.588838100 CEST	443	54443	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:39.588870049 CEST	443	54443	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:39.588905096 CEST	443	54443	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:39.588957071 CEST	54443	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:39.589015961 CEST	54443	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:39.589230061 CEST	54443	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:39.589270115 CEST	443	54443	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:39.589299917 CEST	54443	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:39.589315891 CEST	443	54443	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:39.591783047 CEST	54448	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:39.591803074 CEST	443	54448	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:39.591897011 CEST	54448	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:39.591996908 CEST	54448	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:39.592009068 CEST	443	54448	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:39.599528074 CEST	443	54445	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:39.599862099 CEST	54445	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:39.599884987 CEST	443	54445	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:39.600219965 CEST	54445	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:39.600224018 CEST	443	54445	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:39.614078999 CEST	443	54444	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:39.614402056 CEST	54444	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:39.614439964 CEST	443	54444	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:39.614759922 CEST	54444	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:39.614777088 CEST	443	54444	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:39.630650043 CEST	443	54446	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:39.631128073 CEST	54446	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:39.631145954 CEST	443	54446	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:39.631681919 CEST	54446	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:39.631688118 CEST	443	54446	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:39.712863922 CEST	443	54444	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:39.713202953 CEST	443	54444	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:39.713320971 CEST	54444	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:39.713397980 CEST	54444	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:39.713397980 CEST	54444	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:39.713428974 CEST	443	54444	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:39.713457108 CEST	443	54444	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:39.716300964 CEST	54449	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:39.716341972 CEST	443	54449	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:39.716440916 CEST	54449	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:39.716564894 CEST	54449	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:39.716588020 CEST	443	54449	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:39.725500107 CEST	443	54446	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:39.725536108 CEST	443	54446	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:39.725609064 CEST	54446	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:39.725625038 CEST	443	54446	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:39.725692034 CEST	443	54446	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:39.725742102 CEST	54446	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:39.725871086 CEST	54446	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:39.725878954 CEST	443	54446	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:39.725888014 CEST	54446	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:39.725892067 CEST	443	54446	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:39.728513002 CEST	54450	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:39.728524923 CEST	443	54450	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:39.728625059 CEST	54450	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:39.728770018 CEST	54450	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:39.728812933 CEST	443	54450	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:39.742863894 CEST	443	54445	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:39.742930889 CEST	443	54445	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:39.743021965 CEST	54445	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:39.743040085 CEST	443	54445	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:39.743210077 CEST	443	54445	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:39.743269920 CEST	54445	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:39.743303061 CEST	54445	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:39.743310928 CEST	443	54445	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:39.743324041 CEST	54445	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:39.743326902 CEST	443	54445	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:39.745842934 CEST	54451	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:39.745856047 CEST	443	54451	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:39.745944023 CEST	54451	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:39.746062994 CEST	54451	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:39.746073961 CEST	443	54451	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:40.212490082 CEST	443	54447	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:40.213201046 CEST	54447	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:40.213255882 CEST	443	54447	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:40.213633060 CEST	54447	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:40.213646889 CEST	443	54447	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:40.219119072 CEST	443	54448	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:40.219537973 CEST	54448	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:40.219552040 CEST	443	54448	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:40.219825029 CEST	54448	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:40.219830036 CEST	443	54448	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:40.313568115 CEST	443	54447	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:40.313607931 CEST	443	54447	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:40.313652992 CEST	443	54447	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:40.313667059 CEST	54447	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:40.313723087 CEST	54447	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:40.313882113 CEST	54447	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:40.313882113 CEST	54447	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:40.313920975 CEST	443	54447	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:40.313946962 CEST	443	54447	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:40.317548037 CEST	54452	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:40.317595005 CEST	443	54452	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:40.317677975 CEST	54452	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:40.317825079 CEST	54452	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:40.317846060 CEST	443	54452	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:40.338675022 CEST	443	54449	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:40.339250088 CEST	54449	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:40.339260101 CEST	443	54449	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:40.339814901 CEST	54449	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:40.339818954 CEST	443	54449	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:40.350455046 CEST	443	54448	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:40.350657940 CEST	443	54448	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:40.350723028 CEST	54448	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:40.350811958 CEST	54448	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:40.350820065 CEST	443	54448	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:40.350840092 CEST	54448	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:40.350845098 CEST	443	54448	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:40.354373932 CEST	54453	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:40.354408026 CEST	443	54453	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:40.354480982 CEST	54453	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:40.354656935 CEST	54453	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:40.354669094 CEST	443	54453	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:40.360310078 CEST	443	54451	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:40.360815048 CEST	54451	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:40.360825062 CEST	443	54451	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:40.361728907 CEST	54451	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:40.361735106 CEST	443	54451	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:40.364396095 CEST	443	54450	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:40.374732018 CEST	54450	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:40.374748945 CEST	443	54450	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:40.375282049 CEST	54450	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:40.375287056 CEST	443	54450	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:40.436965942 CEST	443	54449	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:40.437000036 CEST	443	54449	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:40.437046051 CEST	443	54449	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:40.437051058 CEST	54449	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:40.437088013 CEST	54449	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:40.437371969 CEST	54449	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:40.437382936 CEST	443	54449	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:40.437395096 CEST	54449	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:40.437401056 CEST	443	54449	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:40.440644026 CEST	54454	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:40.440677881 CEST	443	54454	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:40.440751076 CEST	54454	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:40.440958977 CEST	54454	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:40.440970898 CEST	443	54454	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:40.454696894 CEST	443	54451	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:40.454802036 CEST	443	54451	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:40.454853058 CEST	54451	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:40.454862118 CEST	443	54451	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:40.454905987 CEST	443	54451	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:40.454957008 CEST	54451	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:40.454982996 CEST	54451	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:40.454987049 CEST	443	54451	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:40.455020905 CEST	54451	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:40.455024958 CEST	443	54451	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:40.457592964 CEST	54455	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:40.457628965 CEST	443	54455	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:40.457701921 CEST	54455	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:40.457890034 CEST	54455	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:40.457911968 CEST	443	54455	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:40.469767094 CEST	443	54450	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:40.470200062 CEST	443	54450	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:40.470351934 CEST	54450	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:40.470449924 CEST	54450	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:40.470454931 CEST	443	54450	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:40.470482111 CEST	54450	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:40.470487118 CEST	443	54450	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:40.472636938 CEST	54456	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:40.472650051 CEST	443	54456	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:40.472738981 CEST	54456	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:40.472908974 CEST	54456	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:40.472920895 CEST	443	54456	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:40.929101944 CEST	443	54452	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:40.929620028 CEST	54452	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:40.929637909 CEST	443	54452	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:40.930140972 CEST	54452	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:40.930151939 CEST	443	54452	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:41.003138065 CEST	443	54453	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:41.003628969 CEST	54453	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:41.003642082 CEST	443	54453	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:41.004074097 CEST	54453	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:41.004079103 CEST	443	54453	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:41.061203003 CEST	443	54454	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:41.061665058 CEST	54454	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:41.061676979 CEST	443	54454	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:41.062100887 CEST	54454	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:41.062105894 CEST	443	54454	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:41.071783066 CEST	443	54452	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:41.072590113 CEST	443	54455	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:41.072927952 CEST	54455	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:41.072953939 CEST	443	54452	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:41.072962999 CEST	443	54455	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:41.073010921 CEST	54452	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:41.073057890 CEST	54452	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:41.073074102 CEST	443	54452	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:41.073087931 CEST	54452	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:41.073096991 CEST	443	54452	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:41.073496103 CEST	54455	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:41.073503017 CEST	443	54455	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:41.075656891 CEST	54457	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:41.075740099 CEST	443	54457	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:41.075841904 CEST	54457	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:41.075961113 CEST	54457	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:41.075982094 CEST	443	54457	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:41.103624105 CEST	443	54453	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:41.103662968 CEST	443	54453	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:41.103707075 CEST	443	54453	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:41.103852987 CEST	54453	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:41.104132891 CEST	54453	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:41.104159117 CEST	443	54453	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:41.104172945 CEST	54453	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:41.104180098 CEST	443	54453	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:41.107255936 CEST	54458	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:41.107292891 CEST	443	54458	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:41.107383013 CEST	54458	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:41.107561111 CEST	54458	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:41.107577085 CEST	443	54458	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:41.108382940 CEST	443	54456	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:41.108758926 CEST	54456	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:41.108784914 CEST	443	54456	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:41.109194994 CEST	54456	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:41.109200954 CEST	443	54456	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:41.193414927 CEST	443	54454	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:41.196130037 CEST	443	54454	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:41.196203947 CEST	54454	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:41.196250916 CEST	54454	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:41.196269035 CEST	443	54454	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:41.196278095 CEST	54454	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:41.196283102 CEST	443	54454	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:41.199014902 CEST	54459	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:41.199050903 CEST	443	54459	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:41.199114084 CEST	54459	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:41.199259996 CEST	54459	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:41.199268103 CEST	443	54459	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:41.200695038 CEST	443	54455	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:41.201801062 CEST	443	54455	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:41.201858044 CEST	54455	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:41.201872110 CEST	443	54455	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:41.201914072 CEST	443	54455	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:41.201955080 CEST	54455	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:41.201973915 CEST	443	54455	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:41.201988935 CEST	54455	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:41.201988935 CEST	54455	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:41.201997995 CEST	443	54455	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:41.202008009 CEST	443	54455	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:41.203988075 CEST	54460	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:41.204005957 CEST	443	54460	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:41.204061031 CEST	54460	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:41.204199076 CEST	54460	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:41.204210043 CEST	443	54460	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:41.220195055 CEST	443	54456	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:41.220252991 CEST	443	54456	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:41.220324039 CEST	54456	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:41.226226091 CEST	54456	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:41.226236105 CEST	443	54456	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:41.226243973 CEST	54456	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:41.226247072 CEST	443	54456	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:41.228336096 CEST	54461	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:41.228355885 CEST	443	54461	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:41.228425026 CEST	54461	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:41.228550911 CEST	54461	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:41.228565931 CEST	443	54461	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:41.705347061 CEST	443	54457	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:41.705858946 CEST	54457	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:41.705873966 CEST	443	54457	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:41.706327915 CEST	54457	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:41.706335068 CEST	443	54457	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:41.760065079 CEST	443	54458	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:41.760811090 CEST	54458	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:41.760837078 CEST	443	54458	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:41.761243105 CEST	54458	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:41.761255026 CEST	443	54458	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:41.801361084 CEST	443	54457	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:41.801423073 CEST	443	54457	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:41.801518917 CEST	54457	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:41.801772118 CEST	54457	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:41.801809072 CEST	443	54457	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:41.801836967 CEST	54457	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:41.801853895 CEST	443	54457	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:41.804634094 CEST	54462	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:41.804671049 CEST	443	54462	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:41.804773092 CEST	54462	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:41.804920912 CEST	443	54459	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:41.804936886 CEST	54462	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:41.804944038 CEST	443	54462	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:41.805283070 CEST	54459	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:41.805298090 CEST	443	54459	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:41.805708885 CEST	54459	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:41.805716038 CEST	443	54459	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:41.819910049 CEST	443	54460	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:41.820250988 CEST	54460	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:41.820272923 CEST	443	54460	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:41.820578098 CEST	54460	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:41.820583105 CEST	443	54460	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:41.858588934 CEST	443	54458	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:41.858633041 CEST	443	54458	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:41.858671904 CEST	443	54458	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:41.858705997 CEST	54458	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:41.858736992 CEST	54458	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:41.858968973 CEST	54458	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:41.858989000 CEST	443	54458	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:41.859011889 CEST	54458	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:41.859024048 CEST	443	54458	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:41.862000942 CEST	54463	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:41.862030029 CEST	443	54463	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:41.862099886 CEST	54463	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:41.862236023 CEST	54463	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:41.862243891 CEST	443	54463	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:41.886584997 CEST	443	54461	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:41.887067080 CEST	54461	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:41.887073994 CEST	443	54461	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:41.887517929 CEST	54461	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:41.887521982 CEST	443	54461	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:41.900188923 CEST	443	54459	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:41.900288105 CEST	443	54459	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:41.900352001 CEST	54459	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:41.900464058 CEST	54459	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:41.900475979 CEST	443	54459	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:41.900506973 CEST	54459	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:41.900511980 CEST	443	54459	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:41.903074980 CEST	54464	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:41.903099060 CEST	443	54464	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:41.903181076 CEST	54464	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:41.903328896 CEST	54464	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:41.903337002 CEST	443	54464	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:41.917310953 CEST	443	54460	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:41.917506933 CEST	443	54460	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:41.917582989 CEST	54460	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:41.917615891 CEST	54460	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:41.917629004 CEST	443	54460	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:41.917639017 CEST	54460	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:41.917644978 CEST	443	54460	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:41.919820070 CEST	54465	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:41.919863939 CEST	443	54465	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:41.919974089 CEST	54465	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:41.920104980 CEST	54465	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:41.920129061 CEST	443	54465	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:41.985629082 CEST	443	54461	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:41.985671997 CEST	443	54461	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:41.985730886 CEST	443	54461	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:41.985774040 CEST	54461	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:41.985812902 CEST	54461	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:41.986066103 CEST	54461	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:41.986079931 CEST	443	54461	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:41.986090899 CEST	54461	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:41.986099005 CEST	443	54461	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:41.988893032 CEST	54466	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:41.988972902 CEST	443	54466	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:41.989073038 CEST	54466	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:41.989240885 CEST	54466	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:41.989276886 CEST	443	54466	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:42.425112009 CEST	443	54462	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:42.430814981 CEST	54462	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:42.430854082 CEST	443	54462	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:42.431243896 CEST	54462	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:42.431252003 CEST	443	54462	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:42.467159033 CEST	443	54463	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:42.467710972 CEST	54463	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:42.467731953 CEST	443	54463	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:42.468014956 CEST	54463	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:42.468019962 CEST	443	54463	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:42.521898985 CEST	443	54464	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:42.522381067 CEST	54464	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:42.522392988 CEST	443	54464	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:42.522753000 CEST	54464	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:42.522758007 CEST	443	54464	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:42.526001930 CEST	443	54462	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:42.526622057 CEST	443	54462	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:42.526680946 CEST	54462	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:42.526715994 CEST	54462	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:42.526732922 CEST	443	54462	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:42.526746035 CEST	54462	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:42.526753902 CEST	443	54462	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:42.529365063 CEST	54467	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:42.529386997 CEST	443	54467	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:42.529475927 CEST	54467	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:42.529628992 CEST	54467	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:42.529637098 CEST	443	54467	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:42.530544043 CEST	443	54465	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:42.530869007 CEST	54465	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:42.530881882 CEST	443	54465	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:42.531276941 CEST	54465	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:42.531282902 CEST	443	54465	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:42.565839052 CEST	443	54463	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:42.565946102 CEST	443	54463	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:42.565982103 CEST	443	54463	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:42.566001892 CEST	54463	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:42.566040993 CEST	54463	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:42.566173077 CEST	54463	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:42.566185951 CEST	443	54463	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:42.566195965 CEST	54463	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:42.566201925 CEST	443	54463	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:42.568680048 CEST	54468	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:42.568696976 CEST	443	54468	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:42.568770885 CEST	54468	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:42.568912029 CEST	54468	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:42.568921089 CEST	443	54468	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:42.625627995 CEST	443	54466	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:42.626281977 CEST	54466	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:42.626293898 CEST	443	54466	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:42.626744986 CEST	54466	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:42.626749992 CEST	443	54466	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:42.629199028 CEST	443	54464	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:42.631064892 CEST	443	54464	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:42.631122112 CEST	54464	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:42.631150007 CEST	54464	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:42.631165028 CEST	443	54464	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:42.631172895 CEST	54464	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:42.631177902 CEST	443	54464	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:42.631448030 CEST	443	54465	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:42.631603956 CEST	443	54465	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:42.631664038 CEST	54465	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:42.631685972 CEST	54465	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:42.631696939 CEST	443	54465	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:42.633855104 CEST	54469	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:42.633882046 CEST	443	54469	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:42.633968115 CEST	54469	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:42.633995056 CEST	54470	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:42.634004116 CEST	443	54470	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:42.634057999 CEST	54470	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:42.634123087 CEST	54469	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:42.634140015 CEST	443	54469	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:42.634211063 CEST	54470	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:42.634227037 CEST	443	54470	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:42.726978064 CEST	443	54466	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:42.727054119 CEST	443	54466	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:42.727099895 CEST	54466	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:42.727108955 CEST	443	54466	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:42.727122068 CEST	443	54466	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:42.727170944 CEST	54466	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:42.727322102 CEST	54466	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:42.727329016 CEST	443	54466	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:42.727340937 CEST	54466	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:42.727346897 CEST	443	54466	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:42.730062962 CEST	54471	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:42.730098963 CEST	443	54471	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:42.730184078 CEST	54471	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:42.730349064 CEST	54471	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:42.730364084 CEST	443	54471	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:43.209933043 CEST	443	54468	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:43.210593939 CEST	54468	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:43.210628986 CEST	443	54468	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:43.211119890 CEST	54468	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:43.211134911 CEST	443	54468	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:43.217009068 CEST	443	54467	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:43.217518091 CEST	54467	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:43.217531919 CEST	443	54467	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:43.217931986 CEST	54467	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:43.217937946 CEST	443	54467	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:43.243262053 CEST	443	54470	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:43.243591070 CEST	54470	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:43.243613005 CEST	443	54470	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:43.243993998 CEST	54470	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:43.243999004 CEST	443	54470	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:43.270571947 CEST	443	54469	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:43.270963907 CEST	54469	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:43.270973921 CEST	443	54469	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:43.271420002 CEST	54469	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:43.271426916 CEST	443	54469	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:43.312011957 CEST	443	54468	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:43.312184095 CEST	443	54468	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:43.312257051 CEST	54468	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:43.312376976 CEST	54468	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:43.312376976 CEST	54468	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:43.312413931 CEST	443	54468	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:43.312437057 CEST	443	54468	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:43.315212011 CEST	54472	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:43.315259933 CEST	443	54472	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:43.315340996 CEST	54472	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:43.315488100 CEST	54472	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:43.315506935 CEST	443	54472	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:43.315934896 CEST	443	54467	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:43.317559958 CEST	443	54467	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:43.317764997 CEST	54467	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:43.317852020 CEST	54467	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:43.317863941 CEST	443	54467	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:43.317883015 CEST	54467	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:43.317890882 CEST	443	54467	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:43.319796085 CEST	54473	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:43.319835901 CEST	443	54473	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:43.319905043 CEST	54473	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:43.320018053 CEST	54473	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:43.320030928 CEST	443	54473	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:43.342061996 CEST	443	54470	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:43.342125893 CEST	443	54470	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:43.342173100 CEST	54470	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:43.342266083 CEST	54470	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:43.342283010 CEST	443	54470	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:43.342293978 CEST	54470	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:43.342298985 CEST	443	54470	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:43.344472885 CEST	54474	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:43.344499111 CEST	443	54474	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:43.344556093 CEST	54474	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:43.344685078 CEST	54474	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:43.344697952 CEST	443	54474	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:43.361063957 CEST	443	54471	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:43.361537933 CEST	54471	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:43.361591101 CEST	443	54471	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:43.362026930 CEST	54471	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:43.362040043 CEST	443	54471	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:43.373400927 CEST	443	54469	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:43.373482943 CEST	443	54469	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:43.373534918 CEST	54469	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:43.373562098 CEST	443	54469	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:43.373594046 CEST	443	54469	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:43.373641968 CEST	54469	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:43.373694897 CEST	54469	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:43.373704910 CEST	443	54469	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:43.373716116 CEST	54469	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:43.373720884 CEST	443	54469	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:43.376285076 CEST	54475	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:43.376308918 CEST	443	54475	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:43.376370907 CEST	54475	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:43.376511097 CEST	54475	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:43.376521111 CEST	443	54475	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:43.459193945 CEST	443	54471	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:43.459230900 CEST	443	54471	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:43.459284067 CEST	443	54471	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:43.459338903 CEST	54471	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:43.459553003 CEST	54471	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:43.463608980 CEST	54471	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:43.463648081 CEST	443	54471	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:43.463675976 CEST	54471	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:43.463691950 CEST	443	54471	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:43.466454983 CEST	54476	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:43.466485023 CEST	443	54476	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:43.466572046 CEST	54476	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:43.466713905 CEST	54476	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:43.466726065 CEST	443	54476	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:43.988456964 CEST	443	54474	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:43.988955975 CEST	54474	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:43.988975048 CEST	443	54474	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:43.989517927 CEST	54474	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:43.989525080 CEST	443	54474	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:43.990309954 CEST	443	54473	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:43.990658998 CEST	54473	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:43.990668058 CEST	443	54473	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:43.991059065 CEST	54473	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:43.991064072 CEST	443	54473	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:43.999658108 CEST	443	54472	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:44.000112057 CEST	54472	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:44.000133991 CEST	443	54472	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:44.000482082 CEST	54472	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:44.000488997 CEST	443	54472	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:44.022028923 CEST	443	54475	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:44.022416115 CEST	54475	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:44.022425890 CEST	443	54475	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:44.022784948 CEST	54475	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:44.022790909 CEST	443	54475	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:44.084285021 CEST	443	54474	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:44.084595919 CEST	443	54474	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:44.084651947 CEST	54474	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:44.084686995 CEST	54474	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:44.084703922 CEST	443	54474	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:44.084714890 CEST	54474	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:44.084721088 CEST	443	54474	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:44.087224007 CEST	54477	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:44.087256908 CEST	443	54477	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:44.087327957 CEST	54477	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:44.087455034 CEST	54477	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:44.087462902 CEST	443	54477	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:44.089654922 CEST	443	54473	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:44.090162039 CEST	443	54473	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:44.090214014 CEST	54473	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:44.090270042 CEST	54473	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:44.090275049 CEST	443	54473	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:44.090285063 CEST	54473	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:44.090287924 CEST	443	54473	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:44.092050076 CEST	54478	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:44.092057943 CEST	443	54478	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:44.092113018 CEST	54478	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:44.092210054 CEST	54478	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:44.092220068 CEST	443	54478	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:44.101092100 CEST	443	54472	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:44.101356030 CEST	443	54472	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:44.101416111 CEST	54472	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:44.101445913 CEST	54472	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:44.101460934 CEST	443	54472	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:44.101475000 CEST	54472	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:44.101481915 CEST	443	54472	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:44.103300095 CEST	54479	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:44.103338957 CEST	443	54479	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:44.103398085 CEST	54479	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:44.103523970 CEST	54479	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:44.103543043 CEST	443	54479	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:44.113931894 CEST	443	54476	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:44.114281893 CEST	54476	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:44.114303112 CEST	443	54476	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:44.114696026 CEST	54476	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:44.114705086 CEST	443	54476	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:44.118083000 CEST	443	54475	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:44.118153095 CEST	443	54475	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:44.118207932 CEST	54475	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:44.118217945 CEST	443	54475	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:44.118266106 CEST	443	54475	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:44.118271112 CEST	54475	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:44.118280888 CEST	54475	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:44.118314028 CEST	443	54475	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:44.118318081 CEST	54475	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:44.118330956 CEST	443	54475	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:44.120223999 CEST	54480	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:44.120242119 CEST	443	54480	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:44.120337963 CEST	54480	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:44.120455027 CEST	54480	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:44.120469093 CEST	443	54480	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:44.220484018 CEST	443	54476	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:44.221131086 CEST	443	54476	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:44.221378088 CEST	54476	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:44.221378088 CEST	54476	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:44.221378088 CEST	54476	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:44.223934889 CEST	54481	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:44.224021912 CEST	443	54481	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:44.224109888 CEST	54481	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:44.224241972 CEST	54481	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:44.224261999 CEST	443	54481	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:44.532829046 CEST	54476	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:44.532855034 CEST	443	54476	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:44.711590052 CEST	443	54477	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:44.712146997 CEST	54477	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:44.712162971 CEST	443	54477	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:44.712611914 CEST	54477	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:44.712616920 CEST	443	54477	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:44.729743004 CEST	443	54479	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:44.730257988 CEST	54479	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:44.730283976 CEST	443	54479	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:44.730704069 CEST	443	54478	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:44.730734110 CEST	54479	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:44.730741024 CEST	443	54479	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:44.731070995 CEST	54478	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:44.731079102 CEST	443	54478	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:44.731462955 CEST	54478	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:44.731467009 CEST	443	54478	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:44.801460028 CEST	443	54480	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:44.801984072 CEST	54480	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:44.802015066 CEST	443	54480	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:44.802460909 CEST	54480	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:44.802469969 CEST	443	54480	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:44.808895111 CEST	443	54477	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:44.809416056 CEST	443	54477	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:44.809462070 CEST	443	54477	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:44.809468985 CEST	54477	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:44.809519053 CEST	54477	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:44.809570074 CEST	54477	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:44.809586048 CEST	443	54477	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:44.809597969 CEST	54477	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:44.809603930 CEST	443	54477	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:44.812385082 CEST	54482	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:44.812422037 CEST	443	54482	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:44.812498093 CEST	54482	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:44.812650919 CEST	54482	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:44.812664986 CEST	443	54482	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:44.827451944 CEST	443	54479	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:44.827960014 CEST	443	54479	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:44.827991962 CEST	443	54479	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:44.828012943 CEST	54479	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:44.828037977 CEST	54479	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:44.828084946 CEST	54479	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:44.828099012 CEST	443	54479	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:44.828109980 CEST	54479	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:44.828115940 CEST	443	54479	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:44.829988956 CEST	54483	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:44.830023050 CEST	443	54483	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:44.830097914 CEST	54483	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:44.830189943 CEST	54483	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:44.830205917 CEST	443	54483	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:44.832217932 CEST	443	54478	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:44.832498074 CEST	443	54478	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:44.832554102 CEST	54478	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:44.832565069 CEST	54478	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:44.832568884 CEST	443	54478	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:44.832577944 CEST	54478	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:44.832581043 CEST	443	54478	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:44.834263086 CEST	54484	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:44.834351063 CEST	443	54484	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:44.834497929 CEST	54484	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:44.834585905 CEST	54484	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:44.834630013 CEST	443	54484	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:44.891566992 CEST	443	54481	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:44.892455101 CEST	54481	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:44.892479897 CEST	443	54481	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:44.892916918 CEST	54481	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:44.892923117 CEST	443	54481	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:44.903558016 CEST	443	54480	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:44.903784990 CEST	443	54480	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:44.903852940 CEST	54480	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:44.903898954 CEST	54480	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:44.903913021 CEST	443	54480	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:44.903925896 CEST	54480	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:44.903929949 CEST	443	54480	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:44.907159090 CEST	54485	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:44.907196045 CEST	443	54485	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:44.907265902 CEST	54485	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:44.907438040 CEST	54485	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:44.907452106 CEST	443	54485	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:44.991400003 CEST	443	54481	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:44.991918087 CEST	443	54481	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:44.991992950 CEST	54481	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:44.992038012 CEST	54481	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:44.992057085 CEST	443	54481	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:44.992068052 CEST	54481	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:44.992073059 CEST	443	54481	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:44.994685888 CEST	54486	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:44.994726896 CEST	443	54486	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:44.994820118 CEST	54486	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:44.994977951 CEST	54486	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:44.994992018 CEST	443	54486	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:45.420465946 CEST	443	54482	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:45.420952082 CEST	54482	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:45.420978069 CEST	443	54482	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:45.421422005 CEST	54482	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:45.421427011 CEST	443	54482	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:45.441497087 CEST	443	54483	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:45.442101955 CEST	54483	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:45.442117929 CEST	443	54483	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:45.442724943 CEST	54483	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:45.442728996 CEST	443	54483	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:45.454727888 CEST	443	54484	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:45.455334902 CEST	54484	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:45.455363989 CEST	443	54484	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:45.455946922 CEST	54484	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:45.455960989 CEST	443	54484	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:45.516518116 CEST	443	54482	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:45.516623974 CEST	443	54482	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:45.516840935 CEST	54482	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:45.517064095 CEST	54482	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:45.517087936 CEST	443	54482	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:45.517097950 CEST	54482	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:45.517102957 CEST	443	54482	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:45.525232077 CEST	443	54485	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:45.528870106 CEST	54485	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:45.528893948 CEST	443	54485	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:45.529305935 CEST	54485	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:45.529311895 CEST	443	54485	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:45.530603886 CEST	54487	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:45.530637980 CEST	443	54487	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:45.530714989 CEST	54487	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:45.530869007 CEST	54487	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:45.530895948 CEST	443	54487	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:45.538992882 CEST	443	54483	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:45.539020061 CEST	443	54483	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:45.539061069 CEST	443	54483	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:45.539103031 CEST	54483	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:45.539136887 CEST	54483	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:45.539308071 CEST	54483	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:45.539313078 CEST	443	54483	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:45.539340019 CEST	54483	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:45.539345026 CEST	443	54483	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:45.541408062 CEST	54488	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:45.541446924 CEST	443	54488	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:45.541508913 CEST	54488	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:45.541637897 CEST	54488	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:45.541649103 CEST	443	54488	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:45.551795006 CEST	443	54484	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:45.552124977 CEST	443	54484	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:45.552187920 CEST	54484	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:45.552340031 CEST	54484	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:45.552340031 CEST	54484	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:45.552366018 CEST	443	54484	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:45.552390099 CEST	443	54484	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:45.554109097 CEST	54489	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:45.554140091 CEST	443	54489	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:45.554214954 CEST	54489	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:45.554322004 CEST	54489	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:45.554337025 CEST	443	54489	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:45.621606112 CEST	443	54485	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:45.621767044 CEST	443	54485	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:45.621881008 CEST	54485	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:45.622093916 CEST	54485	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:45.622103930 CEST	443	54485	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:45.622114897 CEST	54485	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:45.622118950 CEST	443	54485	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:45.624628067 CEST	54490	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:45.624654055 CEST	443	54490	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:45.624733925 CEST	54490	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:45.624877930 CEST	54490	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:45.624891996 CEST	443	54490	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:45.630167007 CEST	443	54486	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:45.630963087 CEST	54486	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:45.630978107 CEST	443	54486	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:45.631407976 CEST	54486	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:45.631412983 CEST	443	54486	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:45.730180025 CEST	443	54486	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:45.730262041 CEST	443	54486	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:45.730396986 CEST	54486	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:45.730642080 CEST	54486	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:45.730659962 CEST	443	54486	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:45.730673075 CEST	54486	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:45.730679989 CEST	443	54486	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:45.733675003 CEST	54491	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:45.733726978 CEST	443	54491	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:45.733824015 CEST	54491	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:45.733994007 CEST	54491	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:45.734003067 CEST	443	54491	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:46.161494017 CEST	443	54487	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:46.162003994 CEST	54487	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:46.162038088 CEST	443	54487	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:46.162457943 CEST	54487	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:46.162465096 CEST	443	54487	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:46.170809984 CEST	443	54488	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:46.171076059 CEST	54488	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:46.171091080 CEST	443	54488	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:46.171389103 CEST	54488	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:46.171394110 CEST	443	54488	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:46.186592102 CEST	443	54489	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:46.187000990 CEST	54489	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:46.187024117 CEST	443	54489	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:46.187427998 CEST	54489	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:46.187433958 CEST	443	54489	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:46.250376940 CEST	443	54490	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:46.250993967 CEST	54490	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:46.251023054 CEST	443	54490	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:46.251455069 CEST	54490	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:46.251460075 CEST	443	54490	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:46.258344889 CEST	443	54487	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:46.258528948 CEST	443	54487	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:46.258595943 CEST	54487	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:46.258645058 CEST	54487	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:46.258656979 CEST	443	54487	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:46.258666992 CEST	54487	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:46.258671999 CEST	443	54487	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:46.261158943 CEST	54492	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:46.261200905 CEST	443	54492	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:46.261440992 CEST	54492	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:46.261440992 CEST	54492	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:46.261475086 CEST	443	54492	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:46.268748999 CEST	443	54488	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:46.269248009 CEST	443	54488	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:46.269325018 CEST	54488	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:46.269350052 CEST	54488	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:46.269350052 CEST	54488	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:46.269370079 CEST	443	54488	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:46.269380093 CEST	443	54488	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:46.271341085 CEST	54493	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:46.271375895 CEST	443	54493	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:46.271482944 CEST	54493	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:46.271604061 CEST	54493	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:46.271625042 CEST	443	54493	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:46.303251982 CEST	443	54489	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:46.303354025 CEST	443	54489	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:46.303432941 CEST	54489	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:46.303600073 CEST	54489	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:46.303613901 CEST	443	54489	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:46.303625107 CEST	54489	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:46.303630114 CEST	443	54489	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:46.306057930 CEST	54494	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:46.306081057 CEST	443	54494	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:46.306154013 CEST	54494	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:46.306272030 CEST	54494	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:46.306288004 CEST	443	54494	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:46.339344025 CEST	443	54491	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:46.339801073 CEST	54491	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:46.339833975 CEST	443	54491	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:46.340254068 CEST	54491	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:46.340260029 CEST	443	54491	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:46.350460052 CEST	443	54490	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:46.350639105 CEST	443	54490	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:46.350707054 CEST	54490	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:46.350872993 CEST	54490	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:46.350888014 CEST	443	54490	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:46.350902081 CEST	54490	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:46.350907087 CEST	443	54490	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:46.353097916 CEST	54495	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:46.353112936 CEST	443	54495	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:46.353178024 CEST	54495	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:46.353283882 CEST	54495	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:46.353302002 CEST	443	54495	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:46.442111015 CEST	443	54491	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:46.442181110 CEST	443	54491	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:46.442230940 CEST	54491	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:46.442249060 CEST	443	54491	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:46.442287922 CEST	443	54491	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:46.442327976 CEST	54491	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:46.442472935 CEST	54491	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:46.442472935 CEST	54491	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:46.442490101 CEST	443	54491	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:46.442497015 CEST	443	54491	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:46.445266962 CEST	54496	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:46.445311069 CEST	443	54496	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:46.445360899 CEST	54496	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:46.445492983 CEST	54496	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:46.445499897 CEST	443	54496	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:47.172257900 CEST	443	54496	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:47.172821045 CEST	54496	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:47.172837973 CEST	443	54496	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:47.173268080 CEST	54496	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:47.173273087 CEST	443	54496	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:47.174654007 CEST	443	54492	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:47.174958944 CEST	54492	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:47.174966097 CEST	443	54492	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:47.175324917 CEST	54492	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:47.175328970 CEST	443	54492	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:47.183341026 CEST	443	54495	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:47.183624029 CEST	54495	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:47.183629990 CEST	443	54495	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:47.184019089 CEST	54495	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:47.184021950 CEST	443	54495	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:47.184392929 CEST	443	54493	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:47.184689045 CEST	54493	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:47.184698105 CEST	443	54493	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:47.185118914 CEST	54493	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:47.185125113 CEST	443	54493	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:47.245834112 CEST	443	54494	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:47.246315002 CEST	54494	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:47.246330976 CEST	443	54494	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:47.246702909 CEST	54494	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:47.246709108 CEST	443	54494	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:47.267807007 CEST	443	54496	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:47.267966032 CEST	443	54496	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:47.268040895 CEST	54496	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:47.268155098 CEST	54496	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:47.268172026 CEST	443	54496	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:47.268182039 CEST	54496	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:47.268187046 CEST	443	54496	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:47.270972967 CEST	54497	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:47.270999908 CEST	443	54497	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:47.271094084 CEST	54497	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:47.271248102 CEST	54497	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:47.271264076 CEST	443	54497	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:47.273487091 CEST	443	54492	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:47.273670912 CEST	443	54492	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:47.273719072 CEST	54492	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:47.273736954 CEST	54492	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:47.273740053 CEST	443	54492	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:47.273751020 CEST	54492	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:47.273753881 CEST	443	54492	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:47.275420904 CEST	54498	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:47.275437117 CEST	443	54498	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:47.275504112 CEST	54498	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:47.275626898 CEST	54498	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:47.275645018 CEST	443	54498	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:47.285049915 CEST	443	54493	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:47.285202026 CEST	443	54493	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:47.285258055 CEST	54493	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:47.285267115 CEST	443	54493	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:47.285320997 CEST	54493	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:47.285357952 CEST	54493	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:47.285367012 CEST	443	54493	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:47.285378933 CEST	54493	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:47.285384893 CEST	443	54493	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:47.287240028 CEST	54499	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:47.287257910 CEST	443	54499	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:47.287326097 CEST	54499	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:47.287456989 CEST	54499	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:47.287461996 CEST	443	54499	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:47.287708998 CEST	443	54495	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:47.287781954 CEST	443	54495	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:47.287832975 CEST	54495	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:47.287838936 CEST	443	54495	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:47.287892103 CEST	443	54495	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:47.287914038 CEST	54495	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:47.287924051 CEST	443	54495	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:47.287935019 CEST	54495	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:47.287935019 CEST	54495	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:47.287940025 CEST	443	54495	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:47.287949085 CEST	443	54495	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:47.289711952 CEST	54500	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:47.289724112 CEST	443	54500	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:47.289788961 CEST	54500	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:47.289932966 CEST	54500	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:47.289942980 CEST	443	54500	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:47.358234882 CEST	443	54494	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:47.358741999 CEST	443	54494	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:47.358815908 CEST	54494	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:47.358859062 CEST	54494	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:47.358881950 CEST	443	54494	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:47.358895063 CEST	54494	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:47.358902931 CEST	443	54494	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:47.361277103 CEST	54501	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:47.361320972 CEST	443	54501	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:47.361377001 CEST	54501	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:47.361742020 CEST	54501	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:47.361757994 CEST	443	54501	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:47.908015013 CEST	443	54499	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:47.908507109 CEST	54499	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:47.908523083 CEST	443	54499	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:47.908942938 CEST	54499	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:47.908947945 CEST	443	54499	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:47.909373045 CEST	443	54498	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:47.909609079 CEST	54498	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:47.909626007 CEST	443	54498	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:47.909723997 CEST	443	54500	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:47.909936905 CEST	54498	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:47.909946918 CEST	443	54498	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:47.909965038 CEST	54500	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:47.909975052 CEST	443	54500	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:47.910455942 CEST	54500	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:47.910460949 CEST	443	54500	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:47.930191994 CEST	443	54497	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:47.930547953 CEST	54497	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:47.930557013 CEST	443	54497	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:47.931039095 CEST	54497	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:47.931067944 CEST	443	54497	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:47.969660044 CEST	443	54501	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:47.970274925 CEST	54501	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:47.970314026 CEST	443	54501	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:47.970690012 CEST	54501	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:47.970698118 CEST	443	54501	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:48.009469986 CEST	443	54500	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:48.010123968 CEST	443	54500	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:48.010205030 CEST	54500	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:48.010252953 CEST	54500	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:48.010272980 CEST	443	54500	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:48.010282993 CEST	54500	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:48.010288954 CEST	443	54500	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:48.010627031 CEST	443	54499	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:48.010670900 CEST	443	54499	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:48.010724068 CEST	443	54499	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:48.010746002 CEST	54499	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:48.010761023 CEST	54499	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:48.010842085 CEST	54499	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:48.010859966 CEST	443	54499	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:48.010869026 CEST	54499	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:48.010874987 CEST	443	54499	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:48.012522936 CEST	443	54498	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:48.012790918 CEST	443	54498	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:48.012846947 CEST	54498	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:48.013082981 CEST	54502	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:48.013117075 CEST	443	54502	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:48.013133049 CEST	54503	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:48.013156891 CEST	443	54503	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:48.013175011 CEST	54502	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:48.013216972 CEST	54503	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:48.013356924 CEST	54502	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:48.013369083 CEST	443	54502	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:48.013386011 CEST	54503	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:48.013392925 CEST	443	54503	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:48.013398886 CEST	54498	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:48.013411999 CEST	443	54498	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:48.013436079 CEST	54498	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:48.013442993 CEST	443	54498	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:48.015429020 CEST	54504	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:48.015472889 CEST	443	54504	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:48.015542984 CEST	54504	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:48.015680075 CEST	54504	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:48.015700102 CEST	443	54504	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:48.026700020 CEST	443	54497	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:48.026947975 CEST	443	54497	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:48.027015924 CEST	54497	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:48.027060032 CEST	54497	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:48.027076006 CEST	443	54497	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:48.027090073 CEST	54497	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:48.027096033 CEST	443	54497	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:48.029481888 CEST	54505	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:48.029520035 CEST	443	54505	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:48.029606104 CEST	54505	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:48.029773951 CEST	54505	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:48.029788017 CEST	443	54505	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:48.086843014 CEST	443	54501	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:48.086920023 CEST	443	54501	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:48.086976051 CEST	54501	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:48.087135077 CEST	54501	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:48.087151051 CEST	443	54501	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:48.087167025 CEST	54501	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:48.087174892 CEST	443	54501	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:48.089539051 CEST	54506	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:48.089575052 CEST	443	54506	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:48.089798927 CEST	54506	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:48.089965105 CEST	54506	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:48.089973927 CEST	443	54506	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:48.622512102 CEST	443	54503	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:48.623071909 CEST	54503	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:48.623101950 CEST	443	54503	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:48.625886917 CEST	54503	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:48.625893116 CEST	443	54503	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:48.636492968 CEST	443	54502	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:48.636996984 CEST	54502	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:48.637012005 CEST	443	54502	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:48.637447119 CEST	54502	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:48.637453079 CEST	443	54502	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:48.640748024 CEST	443	54504	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:48.640994072 CEST	54504	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:48.641005993 CEST	443	54504	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:48.641303062 CEST	54504	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:48.641308069 CEST	443	54504	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:48.653491020 CEST	443	54505	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:48.653729916 CEST	54505	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:48.653749943 CEST	443	54505	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:48.654057026 CEST	54505	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:48.654062033 CEST	443	54505	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:48.707003117 CEST	443	54506	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:48.707496881 CEST	54506	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:48.707509041 CEST	443	54506	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:48.707885027 CEST	54506	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:48.707890034 CEST	443	54506	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:48.717730999 CEST	443	54503	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:48.717757940 CEST	443	54503	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:48.717839003 CEST	54503	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:48.717849970 CEST	443	54503	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:48.718107939 CEST	54503	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:48.718116045 CEST	443	54503	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:48.718148947 CEST	443	54503	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:48.718219042 CEST	54503	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:48.718230963 CEST	443	54503	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:48.720633030 CEST	54507	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:48.720660925 CEST	443	54507	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:48.720733881 CEST	54507	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:48.720885038 CEST	54507	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:48.720900059 CEST	443	54507	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:48.731554031 CEST	443	54502	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:48.731698990 CEST	443	54502	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:48.731795073 CEST	54502	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:48.731962919 CEST	54502	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:48.731978893 CEST	443	54502	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:48.731992960 CEST	54502	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:48.732000113 CEST	443	54502	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:48.734359980 CEST	54508	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:48.734373093 CEST	443	54508	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:48.734457016 CEST	54508	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:48.734596014 CEST	54508	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:48.734611988 CEST	443	54508	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:48.739850998 CEST	443	54504	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:48.739875078 CEST	443	54504	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:48.739934921 CEST	54504	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:48.739967108 CEST	443	54504	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:48.740045071 CEST	54504	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:48.740045071 CEST	54504	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:48.740055084 CEST	443	54504	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:48.740077019 CEST	443	54504	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:48.740103960 CEST	54504	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:48.740117073 CEST	443	54504	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:48.741725922 CEST	54509	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:48.741739988 CEST	443	54509	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:48.741801023 CEST	54509	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:48.741902113 CEST	54509	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:48.741914034 CEST	443	54509	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:48.748002052 CEST	443	54505	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:48.748080015 CEST	443	54505	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:48.748117924 CEST	54505	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:48.748131037 CEST	443	54505	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:48.748188972 CEST	54505	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:48.748199940 CEST	443	54505	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:48.748224974 CEST	54505	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:48.748361111 CEST	443	54505	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:48.748402119 CEST	443	54505	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:48.748442888 CEST	54505	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:48.749718904 CEST	54510	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:48.749726057 CEST	443	54510	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:48.749778032 CEST	54510	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:48.749866009 CEST	54510	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:48.749876022 CEST	443	54510	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:48.802130938 CEST	443	54506	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:48.802149057 CEST	443	54506	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:48.802345991 CEST	54506	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:48.802357912 CEST	443	54506	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:48.802480936 CEST	54506	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:48.802486897 CEST	443	54506	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:48.802500010 CEST	54506	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:48.802630901 CEST	443	54506	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:48.802659988 CEST	443	54506	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:48.802695036 CEST	54506	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:48.804681063 CEST	54511	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:48.804754019 CEST	443	54511	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:48.804833889 CEST	54511	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:48.804961920 CEST	54511	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:48.804996967 CEST	443	54511	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:49.357646942 CEST	443	54507	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:49.358342886 CEST	54507	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:49.358416080 CEST	443	54507	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:49.358622074 CEST	54507	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:49.358638048 CEST	443	54507	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:49.361661911 CEST	443	54510	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:49.362009048 CEST	54510	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:49.362030029 CEST	443	54510	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:49.362396955 CEST	54510	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:49.362404108 CEST	443	54510	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:49.364902973 CEST	443	54509	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:49.365427971 CEST	54509	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:49.365437031 CEST	443	54509	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:49.365824938 CEST	54509	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:49.365829945 CEST	443	54509	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:49.386396885 CEST	443	54508	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:49.386756897 CEST	54508	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:49.386780977 CEST	443	54508	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:49.387092113 CEST	54508	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:49.387099028 CEST	443	54508	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:49.409122944 CEST	443	54511	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:49.409617901 CEST	54511	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:49.409647942 CEST	443	54511	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:49.410099983 CEST	54511	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:49.410113096 CEST	443	54511	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:49.457083941 CEST	443	54507	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:49.457093954 CEST	443	54510	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:49.457104921 CEST	443	54507	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:49.457165003 CEST	443	54507	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:49.457178116 CEST	54507	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:49.457223892 CEST	54507	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:49.457395077 CEST	54507	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:49.457423925 CEST	443	54507	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:49.457452059 CEST	54507	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:49.457465887 CEST	443	54507	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:49.457690954 CEST	443	54510	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:49.457739115 CEST	54510	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:49.457773924 CEST	54510	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:49.457786083 CEST	443	54510	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:49.457797050 CEST	54510	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:49.457802057 CEST	443	54510	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:49.460644007 CEST	54512	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:49.460683107 CEST	443	54512	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:49.460750103 CEST	54512	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:49.460786104 CEST	54513	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:49.460797071 CEST	443	54513	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:49.460843086 CEST	54513	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:49.460988045 CEST	54512	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:49.461004972 CEST	443	54512	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:49.461061001 CEST	54513	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:49.461074114 CEST	443	54513	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:49.462570906 CEST	443	54509	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:49.462656021 CEST	443	54509	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:49.462707996 CEST	54509	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:49.462791920 CEST	54509	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:49.462796926 CEST	443	54509	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:49.462821007 CEST	54509	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:49.462826014 CEST	443	54509	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:49.464958906 CEST	54514	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:49.464967012 CEST	443	54514	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:49.465030909 CEST	54514	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:49.465133905 CEST	54514	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:49.465143919 CEST	443	54514	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:49.486464024 CEST	443	54508	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:49.486625910 CEST	443	54508	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:49.486701012 CEST	54508	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:49.486763954 CEST	54508	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:49.486763954 CEST	54508	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:49.486797094 CEST	443	54508	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:49.486821890 CEST	443	54508	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:49.488905907 CEST	54515	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:49.488924026 CEST	443	54515	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:49.488995075 CEST	54515	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:49.489094973 CEST	54515	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:49.489111900 CEST	443	54515	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:49.505047083 CEST	443	54511	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:49.505265951 CEST	443	54511	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:49.505326986 CEST	54511	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:49.505373001 CEST	54511	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:49.505373001 CEST	54511	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:49.505393028 CEST	443	54511	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:49.505414009 CEST	443	54511	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:49.507316113 CEST	54516	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:49.507349014 CEST	443	54516	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:49.507416010 CEST	54516	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:49.507527113 CEST	54516	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:49.507544994 CEST	443	54516	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:50.090681076 CEST	443	54513	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:50.091236115 CEST	54513	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:50.091253042 CEST	443	54513	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:50.091548920 CEST	54513	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:50.091555119 CEST	443	54513	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:50.101182938 CEST	443	54515	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:50.101545095 CEST	54515	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:50.101557016 CEST	443	54515	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:50.102019072 CEST	54515	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:50.102026939 CEST	443	54515	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:50.107978106 CEST	443	54512	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:50.108309984 CEST	54512	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:50.108318090 CEST	443	54512	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:50.108721018 CEST	54512	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:50.108726025 CEST	443	54512	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:50.118735075 CEST	443	54514	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:50.119074106 CEST	54514	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:50.119081974 CEST	443	54514	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:50.119435072 CEST	54514	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:50.119440079 CEST	443	54514	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:50.172810078 CEST	443	54516	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:50.173621893 CEST	54516	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:50.173659086 CEST	443	54516	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:50.173849106 CEST	54516	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:50.173858881 CEST	443	54516	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:50.189985991 CEST	443	54513	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:50.190011978 CEST	443	54513	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:50.190207005 CEST	54513	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:50.190220118 CEST	443	54513	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:50.190264940 CEST	54513	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:50.190335035 CEST	443	54513	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:50.190387011 CEST	443	54513	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:50.190460920 CEST	54513	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:50.190486908 CEST	54513	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:50.190486908 CEST	54513	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:50.190505028 CEST	443	54513	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:50.190511942 CEST	443	54513	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:50.193203926 CEST	54517	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:50.193254948 CEST	443	54517	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:50.193336964 CEST	54517	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:50.193499088 CEST	54517	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:50.193511009 CEST	443	54517	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:50.201231956 CEST	443	54515	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:50.201291084 CEST	443	54515	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:50.201343060 CEST	54515	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:50.201356888 CEST	443	54515	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:50.201415062 CEST	443	54515	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:50.201469898 CEST	54515	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:50.201488972 CEST	54515	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:50.201497078 CEST	443	54515	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:50.201509953 CEST	54515	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:50.201514959 CEST	443	54515	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:50.203644991 CEST	54518	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:50.203659058 CEST	443	54518	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:50.203732014 CEST	54518	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:50.203866005 CEST	54518	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:50.203879118 CEST	443	54518	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:50.215373993 CEST	443	54512	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:50.215406895 CEST	443	54512	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:50.215471983 CEST	54512	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:50.215481043 CEST	443	54512	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:50.215660095 CEST	54512	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:50.215666056 CEST	443	54512	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:50.215687037 CEST	54512	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:50.215727091 CEST	443	54512	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:50.215761900 CEST	443	54512	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:50.215805054 CEST	54512	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:50.217684031 CEST	54519	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:50.217699051 CEST	443	54519	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:50.217763901 CEST	54519	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:50.217880964 CEST	54519	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:50.217894077 CEST	443	54519	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:50.221728086 CEST	443	54514	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:50.221760035 CEST	443	54514	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:50.221780062 CEST	443	54514	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:50.221815109 CEST	54514	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:50.221826077 CEST	443	54514	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:50.221853971 CEST	54514	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:50.221877098 CEST	54514	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:50.289885998 CEST	443	54516	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:50.289912939 CEST	443	54516	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:50.289937973 CEST	443	54516	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:50.290098906 CEST	54516	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:50.290121078 CEST	443	54516	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:50.290293932 CEST	54516	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:50.309185028 CEST	443	54514	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:50.309283018 CEST	443	54514	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:50.309286118 CEST	54514	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:50.309331894 CEST	54514	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:50.309370995 CEST	54514	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:50.309379101 CEST	443	54514	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:50.309389114 CEST	54514	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:50.309393883 CEST	443	54514	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:50.311373949 CEST	54520	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:50.311423063 CEST	443	54520	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:50.311489105 CEST	54520	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:50.311594009 CEST	54520	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:50.311603069 CEST	443	54520	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:50.372088909 CEST	443	54516	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:50.372117996 CEST	443	54516	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:50.372180939 CEST	443	54516	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:50.372180939 CEST	54516	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:50.372231960 CEST	54516	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:50.372395039 CEST	54516	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:50.372416019 CEST	443	54516	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:50.372428894 CEST	54516	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:50.372436047 CEST	443	54516	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:50.375308990 CEST	54521	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:50.375411987 CEST	443	54521	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:50.375504971 CEST	54521	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:50.375691891 CEST	54521	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:50.375727892 CEST	443	54521	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:50.804347038 CEST	443	54517	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:50.804876089 CEST	54517	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:50.804900885 CEST	443	54517	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:50.805309057 CEST	54517	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:50.805316925 CEST	443	54517	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:50.846409082 CEST	443	54518	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:50.846926928 CEST	54518	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:50.846937895 CEST	443	54518	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:50.847461939 CEST	54518	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:50.847492933 CEST	443	54518	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:50.898159027 CEST	443	54519	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:50.898662090 CEST	54519	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:50.898672104 CEST	443	54519	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:50.899050951 CEST	54519	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:50.899055958 CEST	443	54519	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:50.927036047 CEST	443	54517	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:50.927058935 CEST	443	54517	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:50.927114010 CEST	443	54517	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:50.927153111 CEST	54517	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:50.927206039 CEST	54517	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:50.927445889 CEST	54517	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:50.927445889 CEST	54517	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:50.927484035 CEST	443	54517	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:50.927505970 CEST	443	54517	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:50.929949999 CEST	54522	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:50.930025101 CEST	443	54522	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:50.930119038 CEST	54522	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:50.930248022 CEST	54522	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:50.930277109 CEST	443	54522	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:50.945902109 CEST	443	54518	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:50.945957899 CEST	443	54518	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:50.946013927 CEST	54518	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:50.946027040 CEST	443	54518	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:50.946094990 CEST	443	54518	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:50.946141958 CEST	54518	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:50.946202993 CEST	54518	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:50.946211100 CEST	443	54518	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:50.946223021 CEST	54518	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:50.946228981 CEST	443	54518	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:50.948435068 CEST	54523	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:50.948478937 CEST	443	54523	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:50.948566914 CEST	54523	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:50.948951006 CEST	54523	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:50.948964119 CEST	443	54523	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:50.978379011 CEST	443	54520	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:50.978735924 CEST	54520	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:50.978749037 CEST	443	54520	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:50.979123116 CEST	54520	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:50.979127884 CEST	443	54520	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:51.000976086 CEST	443	54519	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:51.001125097 CEST	443	54519	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:51.001197100 CEST	54519	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:51.001235008 CEST	54519	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:51.001241922 CEST	443	54519	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:51.001255035 CEST	54519	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:51.001260996 CEST	443	54519	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:51.002535105 CEST	443	54521	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:51.002844095 CEST	54521	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:51.002877951 CEST	443	54521	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:51.003227949 CEST	54521	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:51.003241062 CEST	443	54521	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:51.004215002 CEST	54524	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:51.004245043 CEST	443	54524	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:51.004301071 CEST	54524	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:51.004406929 CEST	54524	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:51.004414082 CEST	443	54524	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:51.077500105 CEST	443	54520	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:51.077578068 CEST	443	54520	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:51.077698946 CEST	54520	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:51.077841997 CEST	54520	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:51.077841997 CEST	54520	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:51.077861071 CEST	443	54520	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:51.077869892 CEST	443	54520	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:51.080730915 CEST	54525	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:51.080811977 CEST	443	54525	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:51.080895901 CEST	54525	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:51.081037045 CEST	54525	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:51.081057072 CEST	443	54525	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:51.100351095 CEST	443	54521	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:51.100909948 CEST	443	54521	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:51.100977898 CEST	54521	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:51.101042032 CEST	54521	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:51.101042032 CEST	54521	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:51.101073027 CEST	443	54521	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:51.101098061 CEST	443	54521	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:51.103425980 CEST	54526	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:51.103449106 CEST	443	54526	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:51.103524923 CEST	54526	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:51.103625059 CEST	54526	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:51.103652954 CEST	443	54526	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:51.890024900 CEST	443	54526	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:51.890676022 CEST	54526	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:51.890728951 CEST	443	54526	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:51.891068935 CEST	54526	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:51.891083002 CEST	443	54526	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:51.896821976 CEST	443	54523	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:51.896996975 CEST	443	54524	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:51.897104025 CEST	54523	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:51.897126913 CEST	443	54523	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:51.897272110 CEST	54524	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:51.897301912 CEST	443	54524	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:51.897519112 CEST	54523	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:51.897524118 CEST	443	54523	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:51.897727966 CEST	54524	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:51.897735119 CEST	443	54524	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:51.898271084 CEST	443	54522	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:51.898528099 CEST	54522	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:51.898591042 CEST	443	54522	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:51.898854017 CEST	54522	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:51.898870945 CEST	443	54522	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:51.899589062 CEST	443	54525	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:51.899821043 CEST	54525	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:51.899835110 CEST	443	54525	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:51.900137901 CEST	54525	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:51.900147915 CEST	443	54525	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:52.066526890 CEST	443	54526	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:52.066606045 CEST	443	54526	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:52.066668987 CEST	54526	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:52.066845894 CEST	54526	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:52.066884041 CEST	443	54526	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:52.066911936 CEST	54526	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:52.066926956 CEST	443	54526	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:52.069598913 CEST	54527	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:52.069638968 CEST	443	54527	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:52.069720030 CEST	54527	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:52.069854021 CEST	54527	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:52.069861889 CEST	443	54527	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:52.072947979 CEST	443	54524	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:52.073095083 CEST	443	54524	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:52.073313951 CEST	54524	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:52.073365927 CEST	54524	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:52.073380947 CEST	443	54524	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:52.073394060 CEST	54524	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:52.073400974 CEST	443	54524	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:52.074311972 CEST	443	54523	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:52.074345112 CEST	443	54523	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:52.074384928 CEST	54523	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:52.074393988 CEST	443	54523	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:52.074434042 CEST	54523	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:52.074553967 CEST	54523	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:52.074573994 CEST	443	54523	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:52.074593067 CEST	54523	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:52.074598074 CEST	443	54523	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:52.076407909 CEST	443	54525	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:52.076436996 CEST	443	54522	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:52.076575994 CEST	443	54525	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:52.076581955 CEST	443	54522	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:52.076638937 CEST	54525	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:52.076674938 CEST	54522	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:52.076684952 CEST	54525	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:52.076697111 CEST	443	54525	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:52.076734066 CEST	54522	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:52.076734066 CEST	54522	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:52.076764107 CEST	443	54522	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:52.076786995 CEST	443	54522	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:52.726887941 CEST	443	54527	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:52.750647068 CEST	54527	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:52.750670910 CEST	443	54527	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:52.751111984 CEST	54527	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:52.751118898 CEST	443	54527	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:52.863214970 CEST	443	54527	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:52.863297939 CEST	443	54527	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:52.863363028 CEST	54527	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:52.863547087 CEST	54527	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:52.863568068 CEST	443	54527	13.107.246.45	192.168.2.7
Oct 7, 2024 21:53:52.863580942 CEST	54527	443	192.168.2.7	13.107.246.45
Oct 7, 2024 21:53:52.863589048 CEST	443	54527	13.107.246.45	192.168.2.7
Oct 7, 2024 21:54:04.198586941 CEST	443	49775	104.98.116.138	192.168.2.7
Oct 7, 2024 21:54:04.198805094 CEST	49775	443	192.168.2.7	104.98.116.138

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 7, 2024 21:53:04.269710064 CEST	60689	53	192.168.2.7	1.1.1.1
Oct 7, 2024 21:53:04.279467106 CEST	53	60689	1.1.1.1	192.168.2.7
Oct 7, 2024 21:53:04.288317919 CEST	53173	53	192.168.2.7	1.1.1.1
Oct 7, 2024 21:53:04.297385931 CEST	53	53173	1.1.1.1	192.168.2.7
Oct 7, 2024 21:53:04.299088001 CEST	63929	53	192.168.2.7	1.1.1.1
Oct 7, 2024 21:53:04.307898998 CEST	53	63929	1.1.1.1	192.168.2.7
Oct 7, 2024 21:53:04.312870026 CEST	51224	53	192.168.2.7	1.1.1.1
Oct 7, 2024 21:53:04.326160908 CEST	53	51224	1.1.1.1	192.168.2.7
Oct 7, 2024 21:53:04.328948021 CEST	56311	53	192.168.2.7	1.1.1.1
Oct 7, 2024 21:53:04.338453054 CEST	53	56311	1.1.1.1	192.168.2.7
Oct 7, 2024 21:53:04.341885090 CEST	58712	53	192.168.2.7	1.1.1.1
Oct 7, 2024 21:53:04.351947069 CEST	53	58712	1.1.1.1	192.168.2.7
Oct 7, 2024 21:53:04.353775978 CEST	58714	53	192.168.2.7	1.1.1.1
Oct 7, 2024 21:53:04.384876966 CEST	53	58714	1.1.1.1	192.168.2.7
Oct 7, 2024 21:53:04.401735067 CEST	54063	53	192.168.2.7	1.1.1.1
Oct 7, 2024 21:53:04.414249897 CEST	53	54063	1.1.1.1	192.168.2.7
Oct 7, 2024 21:53:04.415699005 CEST	49167	53	192.168.2.7	1.1.1.1
Oct 7, 2024 21:53:04.426071882 CEST	53	49167	1.1.1.1	192.168.2.7
Oct 7, 2024 21:53:05.990632057 CEST	52439	53	192.168.2.7	1.1.1.1
Oct 7, 2024 21:53:06.000948906 CEST	53	52439	1.1.1.1	192.168.2.7
Oct 7, 2024 21:53:11.219289064 CEST	56209	53	192.168.2.7	1.1.1.1
Oct 7, 2024 21:53:22.805561066 CEST	53	62394	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 7, 2024 21:53:04.269710064 CEST	192.168.2.7	1.1.1.1	0x484c	Standard query (0)	exemplarou.sbs	A (IP address)	IN (0x0001)	false
Oct 7, 2024 21:53:04.288317919 CEST	192.168.2.7	1.1.1.1	0x811f	Standard query (0)	frizzettei.sbs	A (IP address)	IN (0x0001)	false
Oct 7, 2024 21:53:04.299088001 CEST	192.168.2.7	1.1.1.1	0x28a6	Standard query (0)	isoplethui.sbs	A (IP address)	IN (0x0001)	false
Oct 7, 2024 21:53:04.312870026 CEST	192.168.2.7	1.1.1.1	0x4949	Standard query (0)	bemuzzeki.sbs	A (IP address)	IN (0x0001)	false
Oct 7, 2024 21:53:04.328948021 CEST	192.168.2.7	1.1.1.1	0xd83	Standard query (0)	exilepolsiy.sbs	A (IP address)	IN (0x0001)	false
Oct 7, 2024 21:53:04.341885090 CEST	192.168.2.7	1.1.1.1	0x515f	Standard query (0)	laddyirekyi.sbs	A (IP address)	IN (0x0001)	false
Oct 7, 2024 21:53:04.353775978 CEST	192.168.2.7	1.1.1.1	0xc2a0	Standard query (0)	invinjurhey.sbs	A (IP address)	IN (0x0001)	false
Oct 7, 2024 21:53:04.401735067 CEST	192.168.2.7	1.1.1.1	0x2ded	Standard query (0)	wickedneatr.sbs	A (IP address)	IN (0x0001)	false
Oct 7, 2024 21:53:04.415699005 CEST	192.168.2.7	1.1.1.1	0xfa28	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false
Oct 7, 2024 21:53:05.990632057 CEST	192.168.2.7	1.1.1.1	0x2d4e	Standard query (0)	sergei-esenin.com	A (IP address)	IN (0x0001)	false
Oct 7, 2024 21:53:11.219289064 CEST	192.168.2.7	1.1.1.1	0x13ff	Standard query (0)	time.windows.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 7, 2024 21:53:04.279467106 CEST	1.1.1.1	192.168.2.7	0x484c	Name error (3)	exemplarou.sbs	none	none	A (IP address)	IN (0x0001)	false
Oct 7, 2024 21:53:04.297385931 CEST	1.1.1.1	192.168.2.7	0x811f	Name error (3)	frizzettei.sbs	none	none	A (IP address)	IN (0x0001)	false
Oct 7, 2024 21:53:04.307898998 CEST	1.1.1.1	192.168.2.7	0x28a6	Name error (3)	isoplethui.sbs	none	none	A (IP address)	IN (0x0001)	false
Oct 7, 2024 21:53:04.326160908 CEST	1.1.1.1	192.168.2.7	0x4949	Name error (3)	bemuzzeki.sbs	none	none	A (IP address)	IN (0x0001)	false
Oct 7, 2024 21:53:04.338453054 CEST	1.1.1.1	192.168.2.7	0xd83	Name error (3)	exilepolsiy.sbs	none	none	A (IP address)	IN (0x0001)	false
Oct 7, 2024 21:53:04.351947069 CEST	1.1.1.1	192.168.2.7	0x515f	Name error (3)	laddyirekyi.sbs	none	none	A (IP address)	IN (0x0001)	false
Oct 7, 2024 21:53:04.384876966 CEST	1.1.1.1	192.168.2.7	0xc2a0	Name error (3)	invinjurhey.sbs	none	none	A (IP address)	IN (0x0001)	false
Oct 7, 2024 21:53:04.414249897 CEST	1.1.1.1	192.168.2.7	0x2ded	Name error (3)	wickedneatr.sbs	none	none	A (IP address)	IN (0x0001)	false
Oct 7, 2024 21:53:04.426071882 CEST	1.1.1.1	192.168.2.7	0xfa28	No error (0)	steamcommunity.com		92.122.104.90	A (IP address)	IN (0x0001)	false
Oct 7, 2024 21:53:06.000948906 CEST	1.1.1.1	192.168.2.7	0x2d4e	No error (0)	sergei-esenin.com		172.67.206.204	A (IP address)	IN (0x0001)	false
Oct 7, 2024 21:53:06.000948906 CEST	1.1.1.1	192.168.2.7	0x2d4e	No error (0)	sergei-esenin.com		104.21.53.8	A (IP address)	IN (0x0001)	false
Oct 7, 2024 21:53:10.463164091 CEST	1.1.1.1	192.168.2.7	0xe718	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 7, 2024 21:53:10.463164091 CEST	1.1.1.1	192.168.2.7	0xe718	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Oct 7, 2024 21:53:11.227197886 CEST	1.1.1.1	192.168.2.7	0x13ff	No error (0)	time.windows.com	twc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

steamcommunity.com

sergei-esenin.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49699	92.122.104.90	443	6700	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 19:53:05 UTC	219	OUT	GET /profiles/76561199724331900 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: steamcommunity.com
2024-10-07 19:53:05 UTC	1870	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.akamai.steamstatic.com/ https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq. [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Mon, 07 Oct 2024 19:53:05 GMT Content-Length: 34837 Connection: close Set-Cookie: sessionid=abe7b40212c2884caceeff6a; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7Cd7fb65801182a5f50a3169fe2a0b7ef0; Path=/; Secure; HttpOnly; SameSite=None
2024-10-07 19:53:05 UTC	14514	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0d 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0d 0a 09 09 3c Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><
2024-10-07 19:53:05 UTC	10062	IN	Data Raw: 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0d 0a 09 09 6a 51 75 65 72 79 28 66 75 6e 63 74 69 6f 6e 28 24 29 20 7b 0d 0a 09 09 09 24 28 27 23 67 6c 6f 62 61 6c 5f 68 65 61 64 65 72 20 2e 73 75 70 65 72 6e 61 76 27 29 2e 76 5f 74 6f 6f 6c 74 69 70 28 7b 27 6c 6f 63 61 74 69 6f 6e 27 3a 27 62 6f 74 74 6f 6d 27 2c 20 27 64 65 73 74 72 6f 79 57 68 65 6e 44 6f 6e 65 27 3a 20 66 61 6c 73 65 2c 20 27 74 6f 6f 6c 74 69 70 43 6c 61 73 73 27 3a 20 27 73 75 70 65 72 6e 61 76 5f 63 6f 6e 74 65 6e 74 27 2c 20 27 6f 66 66 73 65 74 59 27 3a 2d 36 2c 20 27 6f 66 66 73 65 74 58 27 3a 20 31 2c 20 27 68 6f 72 69 7a 6f 6e 74 61 6c 53 6e 61 70 27 3a 20 34 2c 20 27 74 6f 6f 6c 74 69 70 50 61 72 65 6e 74 27 3a 20 27 23 67 6c 6f Data Ascii: <script type="text/javascript">jQuery(function($) {$('#global_header .supernav').v_tooltip({'location':'bottom', 'destroyWhenDone': false, 'tooltipClass': 'supernav_content', 'offsetY':-6, 'offsetX': 1, 'horizontalSnap': 4, 'tooltipParent': '#glo
2024-10-07 19:53:05 UTC	10261	IN	Data Raw: 74 3b 56 49 44 45 4f 5f 43 44 4e 5f 55 52 4c 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 68 74 74 70 73 3a 5c 2f 5c 2f 76 69 64 65 6f 2e 61 6b 61 6d 61 69 2e 73 74 65 61 6d 73 74 61 74 69 63 2e 63 6f 6d 5c 2f 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 43 4f 4d 4d 55 4e 49 54 59 5f 43 44 4e 5f 55 52 4c 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 68 74 74 70 73 3a 5c 2f 5c 2f 63 6f 6d 6d 75 6e 69 74 79 2e 61 6b 61 6d 61 69 2e 73 74 65 61 6d 73 74 61 74 69 63 2e 63 6f 6d 5c 2f 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 43 4f 4d 4d 55 4e 49 54 59 5f 43 44 4e 5f 41 53 53 45 54 5f 55 52 4c 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 68 74 74 70 73 3a 5c 2f 5c 2f 63 64 6e 2e 61 6b 61 6d 61 69 2e 73 74 65 61 6d 73 74 61 74 69 63 2e 63 6f 6d 5c 2f 73 74 65 61 6d 63 6f 6d 6d 75 6e 69 74 Data Ascii: t;VIDEO_CDN_URL":"https:\/\/video.akamai.steamstatic.com\/","COMMUNITY_CDN_URL":"https:\/\/community.akamai.steamstatic.com\/","COMMUNITY_CDN_ASSET_URL":"https:\/\/cdn.akamai.steamstatic.com\/steamcommunit

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49701	172.67.206.204	443	6700	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 19:53:06 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: sergei-esenin.com
2024-10-07 19:53:06 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-10-07 19:53:06 UTC	780	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 19:53:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=nrosuu5520737kk324fifh10rj; expires=Fri, 31 Jan 2025 13:39:45 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=G6dFQY51Wcb%2FHmCw%2BVIhpCZXzzPAAkXspS2ZR57GDyci8lbjHcrvyONh8DTBZ2iTYw085oXDBrB0Uq%2BU%2FN74s6cAJoN9wD6BrLYs0S%2F6oCX%2FgnpgJE3zGBexJOSg7PS3nMkkiw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cf06f77fab47c78-EWR
2024-10-07 19:53:06 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-10-07 19:53:06 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	15:53:02
Start date:	07/10/2024
Path:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe"
Imagebase:	0x380000
File size:	551'424 bytes
MD5 hash:	62748C6343849A0F64E1B8E92C871E6F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_LummaCStealer_4, Description: Yara detected LummaC Stealer, Source: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	15:53:03
Start date:	07/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Imagebase:	0xb70000
File size:	262'432 bytes
MD5 hash:	8FDF47E0FF70C40ED3A17014AEEA4232
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_LummaCStealer_4, Description: Yara detected LummaC Stealer, Source: 00000002.00000002.1269268783.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	15:53:03
Start date:	07/10/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 4716 -s 272
Imagebase:	0x4f0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	0.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	6.1%
Total number of Nodes:	229
Total number of Limit Nodes:	3

Executed Functions

Function 00382021 Relevance: 9.4, APIs: 1, Strings: 4, Instructions: 631
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(00405AD8,?,00000040,?), ref: 00382738

Strings

MZx, xrefs: 0038274B, 00382757, 0038275C
S, xrefs: 0038206A
a, xrefs: 00382296
', xrefs: 00382718

Memory Dump Source

Source File: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID: '$MZx$S$a
API String ID: 544645111-3057195942
Opcode ID: cf051d181c15c8091d8ab7295330e44f6f8a6f896edb110a776ff0ce3f4be4c2
Instruction ID: 3b1e56072312709689aed6e5618971652dabdc8c360e1f938409dfceab4b5f88
Opcode Fuzzy Hash: cf051d181c15c8091d8ab7295330e44f6f8a6f896edb110a776ff0ce3f4be4c2
Instruction Fuzzy Hash: 68F1BD37934F1B06E70970398D662E7954AD7AA330F924373BE639B7F4E36909419384

Function 00396368 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LCMapStringEx.KERNELBASE(?,00398F1C,?,?,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 0039639C
LCMapStringW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,?,?,00398F1C,?,?,00000000,?,00000000), ref: 003963BA

Strings

R[8, xrefs: 00396396

Memory Dump Source

Source File: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: String
String ID: R[8
API String ID: 2568140703-3778289613
Opcode ID: 063289eada90a634fa04ac53ca5c2bdb5d5d670bbf7e8aaaee16359cc9ffbd01
Instruction ID: b4927d83ff0b3a2433c49620c9767b9189ae03a30738dc33974890189f725ac7
Opcode Fuzzy Hash: 063289eada90a634fa04ac53ca5c2bdb5d5d670bbf7e8aaaee16359cc9ffbd01
Instruction Fuzzy Hash: D3F0643610115ABBCF136F90DC0AADE3E2AAB493A0F058010FA1969030CB36D972AB90

Function 00398E2E Relevance: 4.7, APIs: 3, Instructions: 202
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__freea.LIBCMT ref: 00398FDD

Part of subcall function 00393A83: HeapAlloc.KERNEL32(00000000,0039A1AA,?,?,0039A1AA,00000220,?,?,?), ref: 00393AB5

__freea.LIBCMT ref: 00398FF2
__freea.LIBCMT ref: 00399002

Memory Dump Source

Source File: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: __freea$AllocHeap
String ID:
API String ID: 85559729-0
Opcode ID: abae5b8d4009723db748fec35ffb0331b7f41a0bc18b253a32dec4050927ce62
Instruction ID: 98bb786fa87683963eefb887ce9276af12fd28e0858936f0f5d9835dedc2de13
Opcode Fuzzy Hash: abae5b8d4009723db748fec35ffb0331b7f41a0bc18b253a32dec4050927ce62
Instruction Fuzzy Hash: A351C672600216AFEF23AF64DC82EBB36AAEF86750B160569FD05DA150EF31CC508760

Function 0039A3A6 Relevance: 3.2, APIs: 2, Instructions: 177
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00399ED6: GetOEMCP.KERNEL32(00000000,?,?,?,?), ref: 00399F01

IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,?,?,?,?,0039A1ED,?,00000000,?,?,?), ref: 0039A407
GetCPInfo.KERNEL32(00000000,?,?,?,?,?,?,?,?,0039A1ED,?,00000000,?,?,?), ref: 0039A449

Memory Dump Source

Source File: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: CodeInfoPageValid
String ID:
API String ID: 546120528-0
Opcode ID: 52139910196f807d30fde98a6c19ebb30a4ddcc3b1cef07ab3a076c8eef15cf1
Instruction ID: da11f91e82905c30648986e9f30307797ea088ffaaf7ac2262f36a497045719f
Opcode Fuzzy Hash: 52139910196f807d30fde98a6c19ebb30a4ddcc3b1cef07ab3a076c8eef15cf1
Instruction Fuzzy Hash: 0A513A71A00B458FDF23CF36C8456AABBF9EF81304F16426ED0868B651E7B49945CB92

Function 00399FAA Relevance: 1.6, APIs: 1, Instructions: 147
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCPInfo.KERNEL32(E8458D00,?,0039A1F9,0039A1ED,00000000), ref: 00399FDC

Memory Dump Source

Source File: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Info
String ID:
API String ID: 1807457897-0
Opcode ID: ecdb0fe0291a5e69f259f4b3e1523e86f8a31e9ad78ca7da4fc8e9aa120c2208
Instruction ID: fbc43309191e02aed0ab23f2dad0cb7404bbbfb19cd2b664b2e8136e7b3925d4
Opcode Fuzzy Hash: ecdb0fe0291a5e69f259f4b3e1523e86f8a31e9ad78ca7da4fc8e9aa120c2208
Instruction Fuzzy Hash: A7516B719042589ADF238B28CC80BE67BBCEB45304F2406EDE59AC7142C375AD46DF61

Non-executed Functions

Function 003CAA47 Relevance: 31.9, Strings: 24, Instructions: 1933COMMON

Download Yara Rule

Strings

89>?, xrefs: 003CB8CE
tsrq, xrefs: 003CB5D4
<=2, xrefs: 003CB8D9
<=:;, xrefs: 003CB808
tuJK, xrefs: 003CB83F
LKJI, xrefs: 003CB5BE
D, xrefs: 003CB71E
89&', xrefs: 003CB813
()./, xrefs: 003CB8A2
AR, xrefs: 003CABE8
:WUE, xrefs: 003CC58F, 003CC59E
DCBA, xrefs: 003CB75F, 003CB76E
%*+(, xrefs: 003CAD0F, 003CAD1E
QNOL, xrefs: 003CB64D
WP, xrefs: 003CABC7
lkji, xrefs: 003CB616
mjkh, xrefs: 003CB6B0
`Y^_, xrefs: 003CB876
`onm, xrefs: 003CB60B
dcba, xrefs: 003CB600
@ONM, xrefs: 003CB5B3
xgfe, xrefs: 003CB5F5
T, xrefs: 003CC02F
|, xrefs: 003CBB89

Memory Dump Source

Source File: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID: %*+($()./$89&'$89>?$:WUE$<=2$<=:;$@ONM$AR$D$DCBA$LKJI$QNOL$T$WP$`Y^_$`onm$dcba$lkji$mjkh$tsrq$tuJK$xgfe$|
API String ID: 0-1418943773
Opcode ID: a9f1e68edfaf0ae1e626f109336ed9d19a6b5191b739eb3bbf20b7e6025201f9
Instruction ID: 535506d672f7ce25c687906dffa27f706f87c9ea156002c7f13c1e1bfc0cb542
Opcode Fuzzy Hash: a9f1e68edfaf0ae1e626f109336ed9d19a6b5191b739eb3bbf20b7e6025201f9
Instruction Fuzzy Hash: 4DF276B15083819FD776CF14C885BAFBBE6AFD5300F54882CE4C99B252DB359885CB92

Function 003D6EC4 Relevance: 21.7, Strings: 17, Instructions: 438COMMON

Download Yara Rule

Strings

JG, xrefs: 003D78FF
sm, xrefs: 003D7708
%e6g, xrefs: 003D702A
kW, xrefs: 003D7258
WQ, xrefs: 003D7503
=], xrefs: 003D7242
/), xrefs: 003D7545
]{, xrefs: 003D70BF, 003D70CB
(a*c, xrefs: 003D701F
_Y, xrefs: 003D7519
hi, xrefs: 003D7A75
Gt, xrefs: 003D6ED0
CG, xrefs: 003D790A
S], xrefs: 003D750E
WH, xrefs: 003D78F4
?m,o, xrefs: 003D7014
N[, xrefs: 003D724D

Memory Dump Source

Source File: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID: %e6g$(a*c$=]$?m,o$CG$Gt$JG$N[$WH$]{$hi$kW$/)$S]$WQ$_Y$sm
API String ID: 0-1131134755
Opcode ID: 7fe6c7d6d9efdaf882a2b9df3b8a54a15053ee68894a73401dbca1371ba866d9
Instruction ID: 4f39d1e9fbda216a528593a8f0e8f171c5866089790a553cff9db145525da557
Opcode Fuzzy Hash: 7fe6c7d6d9efdaf882a2b9df3b8a54a15053ee68894a73401dbca1371ba866d9
Instruction Fuzzy Hash: 7042B6B404D3858AE271CF26D581B8EBAF1BB92740F608E1EE1ED5B255DB708049CF93

Function 003D665F Relevance: 11.4, Strings: 9, Instructions: 103COMMON

Download Yara Rule

Strings

;IJK, xrefs: 003D6716
W5W7, xrefs: 003D66EE
!E4G, xrefs: 003D670E
I)C+, xrefs: 003D66D6
|1]3, xrefs: 003D66E6
z=Q?, xrefs: 003D66FE
W!Q#, xrefs: 003D66C6
,A&C, xrefs: 003D6706
@-r/, xrefs: 003D66DE

Memory Dump Source

Source File: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID: !E4G$,A&C$;IJK$@-r/$I)C+$W!Q#$W5W7$z=Q?$|1]3
API String ID: 0-2124749398
Opcode ID: f2cd62d45247a4721067a6d54a2199a1ff98fbe07b7bed4634b5cc81127c74ee
Instruction ID: 0968aba42cae03439b8815dc5910777a1e32c259f823113984c04ff956ef1d44
Opcode Fuzzy Hash: f2cd62d45247a4721067a6d54a2199a1ff98fbe07b7bed4634b5cc81127c74ee
Instruction Fuzzy Hash: E4315FB11083849BC7109F95E89262BBBF0EF82789F40592DF8E58B321E334D844CB46

Function 0039C9E9 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 183COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00394EB1: GetLastError.KERNEL32(?,00000008,00399482), ref: 00394EB5
Part of subcall function 00394EB1: SetLastError.KERNEL32(00000000,003AC480,00000024,00390419), ref: 00394F57

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 0039CAF5
IsValidCodePage.KERNEL32(00000000), ref: 0039CB3E
IsValidLocale.KERNEL32(?,00000001), ref: 0039CB4D
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 0039CB95
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 0039CBB4

Strings

||:, xrefs: 0039CA4E

Memory Dump Source

Source File: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID: ||:
API String ID: 415426439-3878463342
Opcode ID: 2f18fc76bfde808c3ee111bca1d2a003e2ac5ca0eabe2735c1971365992f2588
Instruction ID: 62780698e199bbd9d929c21aaeabd390b581251309c6ea71079b434725385b47
Opcode Fuzzy Hash: 2f18fc76bfde808c3ee111bca1d2a003e2ac5ca0eabe2735c1971365992f2588
Instruction Fuzzy Hash: 5E518F72A10209ABDF12DFA5CC86EBEB7B8FF09700F155469E915EB190E7709A04CB61

Function 0039D39B Relevance: 10.2, APIs: 1, Strings: 4, Instructions: 1436COMMONLIBRARYCODE

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 0039D57F

Strings

1#IND, xrefs: 0039D4A0
1#QNAN, xrefs: 0039D4AE
1#INF, xrefs: 0039D4D1
1#SNAN, xrefs: 0039D4A7

Memory Dump Source

Source File: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: d73d3bd8da0853cbfb9d96b3cf762ff317bb4694d1b5eb2dad59820a6a79086a
Instruction ID: 864f4e4342b2d7c0416582a4d978b3d0feb1848df4d1fefd841b7ce8d5bba098
Opcode Fuzzy Hash: d73d3bd8da0853cbfb9d96b3cf762ff317bb4694d1b5eb2dad59820a6a79086a
Instruction Fuzzy Hash: C3D21972E082298FDF66CE28DD417EAB7B9EB45305F1541EAD40EE7240E774AE818F41

Function 003DF2B8 Relevance: 9.1, Strings: 7, Instructions: 359COMMON

Download Yara Rule

Strings

mlc@, xrefs: 003DF634
{l`~, xrefs: 003DF564
ggxz, xrefs: 003DF55D
`tii, xrefs: 003DF56B
aenQ, xrefs: 003DF642
fedc, xrefs: 003DF65A
f@~!, xrefs: 003DF4D7

Memory Dump Source

Source File: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID: `tii$aenQ$f@~!$fedc$ggxz$mlc@${l`~
API String ID: 0-3056062858
Opcode ID: 81e2fee55be0e0ed83158224188c4395161ee7ac948e32e04c625285de5dfabf
Instruction ID: 187caaf8a748ba2aebce95c21146f980fc3b15ce846c30fd26f9bd397a2f9132
Opcode Fuzzy Hash: 81e2fee55be0e0ed83158224188c4395161ee7ac948e32e04c625285de5dfabf
Instruction Fuzzy Hash: 25D13BB4800B409FD361AF399646797BFF0BB06300F844A5EE4EB5B786D731A419CB92

Function 0039C085 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 251COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00394EB1: GetLastError.KERNEL32(?,00000008,00399482), ref: 00394EB5
Part of subcall function 00394EB1: SetLastError.KERNEL32(00000000,003AC480,00000024,00390419), ref: 00394F57

GetACP.KERNEL32(?,?,?,?,?,?,00391848,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 0039C146
IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,00391848,?,?,?,00000055,?,-00000050,?,?), ref: 0039C171
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 0039C2D4

Strings

utf8, xrefs: 0039C243
||:, xrefs: 0039C0C7

Memory Dump Source

Source File: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ErrorLast$CodeInfoLocalePageValid
String ID: utf8$||:
API String ID: 607553120-3782536624
Opcode ID: ae25f5edf3676bf328363be18643de23ceea1af93ac7e011b74a98f1963501e3
Instruction ID: 2a7fc981b5129dc2397dd7e6a5c972fc25b8091329114ed0639fa55f79d6f43c
Opcode Fuzzy Hash: ae25f5edf3676bf328363be18643de23ceea1af93ac7e011b74a98f1963501e3
Instruction Fuzzy Hash: 70714931A10302AADF27BB75DC46FAB73ACEF45740F15542AF546DB181EB70E94087A4

Function 0039C814 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,0039CB32,00000002,00000000,?,?,?,0039CB32,?,00000000), ref: 0039C8AD
GetLocaleInfoW.KERNEL32(?,20001004,0039CB32,00000002,00000000,?,?,?,0039CB32,?,00000000), ref: 0039C8D6
GetACP.KERNEL32(?,?,0039CB32,?,00000000), ref: 0039C8EB

Strings

ACP, xrefs: 0039C832
OCP, xrefs: 0039C868

Memory Dump Source

Source File: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 82a20dc571c8bafde707a55ef25d45d5d2d89e06cf57deaebfb29907a228ac84
Instruction ID: 596231d35ca37d5eb6c67fcb0a6789c05d19136867bf81640d039d4eb793df52
Opcode Fuzzy Hash: 82a20dc571c8bafde707a55ef25d45d5d2d89e06cf57deaebfb29907a228ac84
Instruction Fuzzy Hash: 5E21C532A28201EADF37DF55C941AA7B3AAFF54F50B579464E90AD7101EB32DE40D390

Function 003DAC81 Relevance: 7.5, Strings: 6, Instructions: 38COMMON

Download Yara Rule

Strings

iP`R, xrefs: 003DAC8A
1 G@, xrefs: 003DACA6
upH}, xrefs: 003DACAD
n\+H, xrefs: 003DAC98
%AUU, xrefs: 003DAC91
hX]N, xrefs: 003DAC9F

Memory Dump Source

Source File: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID: %AUU$1 G@$hX]N$iP`R$n\+H$upH}
API String ID: 0-3520097955
Opcode ID: 6209497fda56ba42c0ca55be78a875de8b250e6332eb0d406aaca2855171a349
Instruction ID: 6abd06f2a4ee20a600550ea1cf508e3986bfb2589a94233bf2a2c5d683d544e9
Opcode Fuzzy Hash: 6209497fda56ba42c0ca55be78a875de8b250e6332eb0d406aaca2855171a349
Instruction Fuzzy Hash: 740129B1801B45CFCB21CF95D65066FFBF1EF06741F14480DD482AB651C334AA44CBA6

Function 0038FEF0 Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 449COMMONLIBRARYCODE

Download Yara Rule

Strings

G9, xrefs: 0038FF0B, 0039008E, 003902B7, 00390250, 003900DD
G9, xrefs: 00390233, 00390211

Memory Dump Source

Source File: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID: G9$G9
API String ID: 0-2371269632
Opcode ID: b78e9bc5a25061f1abca4818c36b3245c47596756df3441acd3b4668cd2eb70a
Instruction ID: d4703a35a5ba5e55e06ace2ad16fa8f547a7771b763ce2037aa7939274f3a5dd
Opcode Fuzzy Hash: b78e9bc5a25061f1abca4818c36b3245c47596756df3441acd3b4668cd2eb70a
Instruction Fuzzy Hash: F9F15075E002199FDF19CFA8C884AADB7B5FF89314F158269E919AB381D731AD01CF90

Function 003AE1CF Relevance: 7.2, Strings: 5, Instructions: 922COMMON

Download Yara Rule

Strings

0, xrefs: 003AEC99
0, xrefs: 003AED60
@, xrefs: 003B0409
i, xrefs: 003AF7C2
0, xrefs: 003AF316

Memory Dump Source

Source File: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID: 0$0$0$@$i
API String ID: 0-3124195287
Opcode ID: 12572a0e7900ef4fab88ceb8c21c045fe7f3c85080e9f8e24115e1caf920c67f
Instruction ID: 2c5b91f8ecb82c6727c018eb1e0a853b1cbfb53933768a29a3cb2ae2c843bc03
Opcode Fuzzy Hash: 12572a0e7900ef4fab88ceb8c21c045fe7f3c85080e9f8e24115e1caf920c67f
Instruction Fuzzy Hash: B162E171A0C3818FD31ACF68C49476ABBE1EFD6308F198A2DE4D987291D774D949CB42

Function 00393C92 Relevance: 6.3, APIs: 4, Instructions: 337COMMONLIBRARYCODE

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00393D1F

Memory Dump Source

Source File: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 40f0e063838af908aa0c23a01ee66fead67f3bdac29e3056e6e3dd52480c6ad0
Instruction ID: 02af22462ff264084791b4f773b9196974c4014079ed2a5e896599963af2d4a1
Opcode Fuzzy Hash: 40f0e063838af908aa0c23a01ee66fead67f3bdac29e3056e6e3dd52480c6ad0
Instruction Fuzzy Hash: 0EB136B2E042469FDF178F68C891BFEBBB5EF55350F15816AE805AB241D2349E05CBA0

Function 00387922 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 0038792E
IsDebuggerPresent.KERNEL32 ref: 003879FA
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00387A13
UnhandledExceptionFilter.KERNEL32(?), ref: 00387A1D

Memory Dump Source

Source File: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: ad4d852a240c5db2189927741aadd680d54f3e3092a13bfe962445443549b628
Instruction ID: 84d626a4dfeb3e11b67c6619c8e98c1aa721a9242a9c26f6e6192c6b28a39257
Opcode Fuzzy Hash: ad4d852a240c5db2189927741aadd680d54f3e3092a13bfe962445443549b628
Instruction Fuzzy Hash: 1D31D7B5D053189BDB22EFA4D9497CDBBB8BF08300F1041EAE40DAB250EB759B858F55

Function 003AE455 Relevance: 5.5, Strings: 4, Instructions: 458COMMON

Download Yara Rule

Strings

-, xrefs: 003AF0C5
gfff, xrefs: 003AF1B9
gfff, xrefs: 003AF0FE
gfff, xrefs: 003AF16F

Memory Dump Source

Source File: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID: -$gfff$gfff$gfff
API String ID: 0-3742897846
Opcode ID: 7718804b42ef8cf930431149c87fdc9c6f380754b2246168860b9e7f3cc38233
Instruction ID: 892076da93366b72ba3b049477b6efaec6d45a9feeba8c6f7ca10a2ae991612e
Opcode Fuzzy Hash: 7718804b42ef8cf930431149c87fdc9c6f380754b2246168860b9e7f3cc38233
Instruction Fuzzy Hash: 36F1C571A087518FC719CE29C49036ABBE2EFD6304F19CA2DE4D98B392D674D945CB42

Function 003CF138 Relevance: 5.4, Strings: 4, Instructions: 383COMMON

Download Yara Rule

Strings

a|, xrefs: 003CF1EF
hu, xrefs: 003CF207
lc, xrefs: 003CF3DF
sj, xrefs: 003CF1FF

Memory Dump Source

Source File: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID: a|$hu$lc$sj
API String ID: 0-3748788050
Opcode ID: 2da6593b7bce017c5e70d307783f88ffe4697bf2d3fed1e3eddb71d2ace34cd3
Instruction ID: 2f4bac3f759d3f2e50204b698c3b0a8449cf23633a4c7c5d0b34e6129a95153f
Opcode Fuzzy Hash: 2da6593b7bce017c5e70d307783f88ffe4697bf2d3fed1e3eddb71d2ace34cd3
Instruction Fuzzy Hash: E5A197B54083408FC7219F18C881B2AB7F1FF96764F598A1DE8D99B291E335D901CBA6

Function 003BCB78 Relevance: 5.4, Strings: 4, Instructions: 373COMMON

Download Yara Rule

Strings

J|BJ, xrefs: 003BCEE5
V, xrefs: 003BCDB4
VY^_, xrefs: 003BCCD7
t, xrefs: 003BCB96

Memory Dump Source

Source File: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID: J|BJ$V$VY^_$t
API String ID: 0-3701112211
Opcode ID: 43469e6f44eed1a9b836f895c9410751fc96af4312bcce639396a2a91bef0c87
Instruction ID: d0f9247767c769910ee3a8af39036b976ad577f3bc479fa67cf4dcb1452ddb06
Opcode Fuzzy Hash: 43469e6f44eed1a9b836f895c9410751fc96af4312bcce639396a2a91bef0c87
Instruction Fuzzy Hash: AED1BBB051C3809BD322DF18C4806AFBBE2AF96B48F14485CF6C88B652D335CD09DB92

Function 003DA687 Relevance: 5.2, Strings: 4, Instructions: 213COMMON

Download Yara Rule

Strings

KV, xrefs: 003DA855
#', xrefs: 003DA8C2
CV, xrefs: 003DA863
T>, xrefs: 003DA85C

Memory Dump Source

Source File: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID: #'$CV$KV$T>
API String ID: 0-95592268
Opcode ID: c69b9ea6594a5c43ac04cb82c4969c9d22671953c70c58e81f226922327a0ad4
Instruction ID: 058afb95ba61adeb85bf60c48e9217b20b5df727fe364e3c9cbc8a7812c1f134
Opcode Fuzzy Hash: c69b9ea6594a5c43ac04cb82c4969c9d22671953c70c58e81f226922327a0ad4
Instruction Fuzzy Hash: 808154F4801B459BCB20DF95D28515EBFB1FF16300F604609E486ABB55C330AA55CBE3

Function 003D7B69 Relevance: 5.1, Strings: 4, Instructions: 80COMMON

Download Yara Rule

Strings

4c2a, xrefs: 003D7B81
lk, xrefs: 003D7B94
,{*y, xrefs: 003D7BDF, 003D7BEB
(g6e, xrefs: 003D7B79

Memory Dump Source

Source File: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID: (g6e$,{*y$4c2a$lk
API String ID: 0-1327526056
Opcode ID: f9dcc124c1b9a8638023c2dbdaf7777240da40c55f36b67bbdbdb3a86eb3612c
Instruction ID: 5f759c31b7f44a6885c11a50af0777e3b0020212715e6cab49123fdf579aa416
Opcode Fuzzy Hash: f9dcc124c1b9a8638023c2dbdaf7777240da40c55f36b67bbdbdb3a86eb3612c
Instruction Fuzzy Hash: 252187B54183818AC7319F20D1007ABB7F0FF82341FA4595EE8C89B360EB36C840CB86

Function 0039C498 Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 00394EB1: GetLastError.KERNEL32(?,00000008,00399482), ref: 00394EB5
Part of subcall function 00394EB1: SetLastError.KERNEL32(00000000,003AC480,00000024,00390419), ref: 00394F57

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0039C4EC
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0039C536
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0039C5FC

Memory Dump Source

Source File: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: InfoLocale$ErrorLast
String ID:
API String ID: 661929714-0
Opcode ID: a21d7c1be9fa82e7695ab0d6e8406391736120e9ddd81c20e41821d0de948078
Instruction ID: eda02bcf31cc66a79c5ad582ecdda19c82b914936680df3abc42ecda8969e6ed
Opcode Fuzzy Hash: a21d7c1be9fa82e7695ab0d6e8406391736120e9ddd81c20e41821d0de948078
Instruction Fuzzy Hash: 7A61CF729602079FDF2ADF29CC82BBA73A8EF05310F15617AE905CA585EB34ED44CB50

Function 0038DA73 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 0038DB6B
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 0038DB75
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 0038DB82

Memory Dump Source

Source File: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: e85cd27d7e2d81b50bff117f3d3b3aae27fbb7f4566eff35dd950c7803f806b1
Instruction ID: 049eb9840552e98208306312ae56f4f547c1b84faadbb4188b04bc5b83a803f2
Opcode Fuzzy Hash: e85cd27d7e2d81b50bff117f3d3b3aae27fbb7f4566eff35dd950c7803f806b1
Instruction Fuzzy Hash: 2C31A674901318ABCB22EF64DD89B8DB7B8BF08310F5045DAE41DA7290EB749B858F55

Function 003AE527 Relevance: 4.2, Strings: 3, Instructions: 472COMMON

Download Yara Rule

Strings

gfff, xrefs: 003AEE14
gfff, xrefs: 003AEE2F
+, xrefs: 003AE44B

Memory Dump Source

Source File: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID: +$gfff$gfff
API String ID: 0-3646763964
Opcode ID: 35b728ad1705faf1f3b3f1732b5860e73b9f66d7c2269a3ae04d64dfcb9b7f2b
Instruction ID: 9524edca0f2e1098bf207a968be04c5d364fdc7adc6c9411e2dd29b7f7920958
Opcode Fuzzy Hash: 35b728ad1705faf1f3b3f1732b5860e73b9f66d7c2269a3ae04d64dfcb9b7f2b
Instruction Fuzzy Hash: E4F1B13560C3818FC71ACE68C48426AFBE2EFDA304F198A6DE4D987352D374D945CB92

Function 003AE27B Relevance: 4.1, Strings: 3, Instructions: 390COMMON

Download Yara Rule

Strings

gfff, xrefs: 003AEE14
gfff, xrefs: 003AEE2F
-, xrefs: 003AEDFB

Memory Dump Source

Source File: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID: -$gfff$gfff
API String ID: 0-837351935
Opcode ID: d6ff6ad1442cbdf409bfd7bb2423588c0ae80e6daf78ca5f303bac0752b65028
Instruction ID: dd6962db0391c4e526b7e26b0482a35e7d471367d2fcf0a97ba3d5c2b142c04c
Opcode Fuzzy Hash: d6ff6ad1442cbdf409bfd7bb2423588c0ae80e6daf78ca5f303bac0752b65028
Instruction Fuzzy Hash: EED19F3160C7818FC71ACE29C48466AFBE2AFDA304F09CA6DE4D987352D734D949CB52

Function 003B5468 Relevance: 4.1, Strings: 3, Instructions: 387COMMON

Download Yara Rule

Strings

IEND, xrefs: 003B58C8
), xrefs: 003B54EE
), xrefs: 003B54E4

Memory Dump Source

Source File: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID: )$)$IEND
API String ID: 0-588110143
Opcode ID: 4c1adf4d3ddecd9b383167e0d128e5a9e29e2d1a0a5d0db94912750285bf625d
Instruction ID: b499dda972590cfd787a8bc4c242b73ea0da39fcf19279caf50c6a7a5e399174
Opcode Fuzzy Hash: 4c1adf4d3ddecd9b383167e0d128e5a9e29e2d1a0a5d0db94912750285bf625d
Instruction Fuzzy Hash: 07E103B1A087019FE311CF29C88179ABBE0FB95318F14452DF6959BB81D775E914CBC2

Function 003DFF74 Relevance: 4.0, Strings: 3, Instructions: 254COMMON

Download Yara Rule

Strings

:, xrefs: 003E01B5
3<, xrefs: 003E01AE
LTDV, xrefs: 003DFFE0

Memory Dump Source

Source File: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID: 3<$:$LTDV
API String ID: 0-2797654093
Opcode ID: 9e7e827bec4cf70078eb32fa0fd477bc959d63c8314f3fba064201532e789eb4
Instruction ID: 85557f2ac93a9e024db80a15dd4bd39659ea39b4b603e9ddf307ad5d4008f692
Opcode Fuzzy Hash: 9e7e827bec4cf70078eb32fa0fd477bc959d63c8314f3fba064201532e789eb4
Instruction Fuzzy Hash: 87719A740107918BDB668F26C590B26BBE1BF17300F98598CD8C69FB92C375F845CB65

Function 003DFFD5 Relevance: 4.0, Strings: 3, Instructions: 243COMMON

Download Yara Rule

Strings

:, xrefs: 003E01B5
3<, xrefs: 003E01AE
LTDV, xrefs: 003DFFE0

Memory Dump Source

Source File: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID: 3<$:$LTDV
API String ID: 0-2797654093
Opcode ID: 55370f4e5b9aebffe46f1c775ac834abbae90c9ef6c8401be1cb76cf2d82a942
Instruction ID: 762d0f016a54f9da106bb28e55a5f9f6e696f2f39bfcc4bd28e81ba95f2f4fc2
Opcode Fuzzy Hash: 55370f4e5b9aebffe46f1c775ac834abbae90c9ef6c8401be1cb76cf2d82a942
Instruction Fuzzy Hash: F5619C700117908BDB668F26C990B26BBE1BF17300F58598DE8C69FA93C379F855CB61

Function 003DCF30 Relevance: 3.8, Strings: 3, Instructions: 67COMMON

Download Yara Rule

Strings

^XF^, xrefs: 003DCF8B
:, xrefs: 003DCF5F
J\KR, xrefs: 003DCF50

Memory Dump Source

Source File: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID: :$J\KR$^XF^
API String ID: 0-4266130588
Opcode ID: 64bd0f38261b9b9006df79643b90736e476ce14dd74394cd61dbc2cb2afcfc2a
Instruction ID: 9b234e033afc3e19da4eff75ea056b8008c1021ae72724ec86b24455bbd20f34
Opcode Fuzzy Hash: 64bd0f38261b9b9006df79643b90736e476ce14dd74394cd61dbc2cb2afcfc2a
Instruction Fuzzy Hash: FF21907202C3818BC312DF15E09076AFBEAAF86704F195D5EE4E05B351C336D91ACB52

Function 0039622B Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,?,?,003923AE,?,20001004,00000000,00000002,?,?,003919B0), ref: 0039625F

Strings

R[8, xrefs: 0039624A

Memory Dump Source

Source File: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: R[8
API String ID: 2299586839-3778289613
Opcode ID: 3d33be8b8e6005b30456b35dca3735c9cdbe82a91803d3855ce1903ffae1b3ff
Instruction ID: 274d3a92fa7af2b8e4201049850332982cabe66d63a4ab462b15f13ca128133f
Opcode Fuzzy Hash: 3d33be8b8e6005b30456b35dca3735c9cdbe82a91803d3855ce1903ffae1b3ff
Instruction Fuzzy Hash: 27E04F32505228BBCF136F60DC09AAE7F2AEF45760F018411FD4565121CB728E21AB91

Function 003F0F18 Relevance: 3.1, Strings: 2, Instructions: 577COMMON

Download Yara Rule

Strings

%*+(, xrefs: 003F0F7C, 003F0F85
f, xrefs: 003F10E4

Memory Dump Source

Source File: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID: %*+($f
API String ID: 0-2038831151
Opcode ID: 89d37b99ddcec098b1c0d00c9a8877e78529c77cf73c3d1d79a6a6d3dd0eea3c
Instruction ID: 5694289127047189b94f5887cb1064b883e8fa53e4dd232b7e3eb78e44b023df
Opcode Fuzzy Hash: 89d37b99ddcec098b1c0d00c9a8877e78529c77cf73c3d1d79a6a6d3dd0eea3c
Instruction Fuzzy Hash: 7A12CD71608385DFC716CF19D880B2EBBE5BBC9314F188A2DF6959B291C731E805CB92

Function 003CCEB7 Relevance: 2.7, Strings: 2, Instructions: 185COMMON

Download Yara Rule

Strings

BaBc, xrefs: 003CD06F
Ye[g, xrefs: 003CCFCE

Memory Dump Source

Source File: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID: BaBc$Ye[g
API String ID: 0-286865133
Opcode ID: f1f7f391700c1d153706023ea2e533e08aec07d0302d054125fe460e923244f9
Instruction ID: 59ab4765b72a4802c28ceffcaddc2526de243012ccb181a45a5220415d764918
Opcode Fuzzy Hash: f1f7f391700c1d153706023ea2e533e08aec07d0302d054125fe460e923244f9
Instruction Fuzzy Hash: 6851BDB16183818BD732CF18C481BABB7E1FF96310F19592DE499DB690E3749844CB57

Function 003E0F18 Relevance: 2.6, Strings: 2, Instructions: 128COMMON

Download Yara Rule

Strings

40F9, xrefs: 003E0F21
%*+(, xrefs: 003E0FC7

Memory Dump Source

Source File: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID: %*+($40F9
API String ID: 0-4141425864
Opcode ID: e36d9df26ce8d8e7db79f00bc2036a7f7c8980a0d99b81a382e9f2e5388ff683
Instruction ID: 9d6a853987645b84902df36214af705ead48c0db78868d7947ab1ffd32c74d3b
Opcode Fuzzy Hash: e36d9df26ce8d8e7db79f00bc2036a7f7c8980a0d99b81a382e9f2e5388ff683
Instruction Fuzzy Hash: F8418C70111B918BDB368F26C590B26BBF1FF12305F54564DE4C25BA92C372F856CB24

Function 003ADED8 Relevance: 2.5, Strings: 1, Instructions: 1295COMMON

Download Yara Rule

Strings

@, xrefs: 003AFB18

Memory Dump Source

Source File: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: b9ab761e06cb60054b554ba1fd181e1af7336824aa7e9b9d9034564fed5e9b5a
Instruction ID: 4da00ec0d4b59d3d58d8ded64f0cd035534f99e6b45a1cda9ea23782fa8a91e6
Opcode Fuzzy Hash: b9ab761e06cb60054b554ba1fd181e1af7336824aa7e9b9d9034564fed5e9b5a
Instruction Fuzzy Hash: A89201316083518FC71ACE28C89476EBBE2EF86318F19862DE999CB791D734DD45CB81

Function 0039572C Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00395727,?,?,00000008,?,?,003A15F5,00000000), ref: 00395959

Memory Dump Source

Source File: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 6604a479dfe7cc8134f3aed7ee0960f8a042c04f8b36038ec001c6e2cbdc9ebf
Instruction ID: fcdf555c19d1da38233ca912c0867a254fa45338b35b5b5d4ab487e43f4546db
Opcode Fuzzy Hash: 6604a479dfe7cc8134f3aed7ee0960f8a042c04f8b36038ec001c6e2cbdc9ebf
Instruction Fuzzy Hash: 33B11E31610A09DFDB16CF2CC486B657BE0FF45365F268658E899CF2A1C335E992CB40

Function 0038729C Relevance: 1.7, APIs: 1, Instructions: 242COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 003872B2

Memory Dump Source

Source File: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 8087e586f45a7ab7a2492d1f040b733533e9310b92aa3b33519db8617d06ebe2
Instruction ID: 422aa3349898467717524c55ee53cd75c86221c8c4e639495415a968da3c442e
Opcode Fuzzy Hash: 8087e586f45a7ab7a2492d1f040b733533e9310b92aa3b33519db8617d06ebe2
Instruction Fuzzy Hash: ACA18DB1A057058FDB1ACF64D8826A9BBF5FB49314F29816AD41BEB7A0D334D841CF90

Function 003DE1A8 Relevance: 1.7, Strings: 1, Instructions: 484COMMON

Download Yara Rule

Strings

", xrefs: 003DE4A9

Memory Dump Source

Source File: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: 1e36e4a90a5bcd9904d9a2755a98640d2f51fe7f53356f7c076c40d918f289ea
Instruction ID: 3aef132296529fec582e44931906fae4c837c83b4936b4c06d9b9a68c1d4240e
Opcode Fuzzy Hash: 1e36e4a90a5bcd9904d9a2755a98640d2f51fe7f53356f7c076c40d918f289ea
Instruction Fuzzy Hash: A5F13572A083515BD726EF24D48067BBFE6AFC5300F19896EE8994F382D634DD04C792

Function 003D4D38 Relevance: 1.7, Strings: 1, Instructions: 425COMMON

Download Yara Rule

Strings

%*+(, xrefs: 003D513B, 003D5143

Memory Dump Source

Source File: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: ccee2a807569c25fde004874fc692891e8030e5aaea5b8ac7fbb6ff0169ecf93
Instruction ID: 992a656dd705a607dc2f79f4e7d887181a5eaf9f13f6355219fbed6b15912416
Opcode Fuzzy Hash: ccee2a807569c25fde004874fc692891e8030e5aaea5b8ac7fbb6ff0169ecf93
Instruction Fuzzy Hash: 46C1B0B2508300ABDB12AB14D881A6BB7F5EF96750F09891EF8C59B351E335DD14CBA2

Function 003E0813 Relevance: 1.6, Strings: 1, Instructions: 363COMMON

Download Yara Rule

Strings

Zvt~, xrefs: 003E081F

Memory Dump Source

Source File: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID: Zvt~
API String ID: 0-694600945
Opcode ID: a6c653d8a13b2bff62d9e48921e2962895175bf4283dfb7f1703a331fac975e3
Instruction ID: 19b3cd0661edcabfb58f889679c687c5caa16bde3834e1c486cd75d19d2ae9e1
Opcode Fuzzy Hash: a6c653d8a13b2bff62d9e48921e2962895175bf4283dfb7f1703a331fac975e3
Instruction Fuzzy Hash: 1EC19C701047918FD76ACF29C190B26FBE1BF16304F68899DD4DA9BB92C376E842CB50

Function 00399ABF Relevance: 1.6, APIs: 1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce7af4bb929abffaa2d2e0c0a9772d167322f04f248d401de233c8e75e0fc78a
Instruction ID: f02738096cbecbce0b68921e55088813818b481b094f005ab100114fbf528ea7
Opcode Fuzzy Hash: ce7af4bb929abffaa2d2e0c0a9772d167322f04f248d401de233c8e75e0fc78a
Instruction Fuzzy Hash: F331D772900219AFCF21EFADDC85EABB77DEB84314F15415DF90597244EA30AE408B50

Function 003D9BA8 Relevance: 1.6, Strings: 1, Instructions: 357COMMON

Download Yara Rule

Strings

%*+(, xrefs: 003D9C9B, 003D9CA3

Memory Dump Source

Source File: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: f162ee7309057f34a05e18a7188bb59e25b4a99871efe8703988e1fac2c245e9
Instruction ID: b50ef1831e7ecf66b8270d5811d37113ea18ca8c00da80c587d9c5cba7abc116
Opcode Fuzzy Hash: f162ee7309057f34a05e18a7188bb59e25b4a99871efe8703988e1fac2c245e9
Instruction Fuzzy Hash: 82B1F0B26083018BDB16EF18E880B6BB7E6EF86341F15492FE5C59B351E335D854CB92

Function 0038CAF2 Relevance: 1.6, Strings: 1, Instructions: 344COMMONLIBRARYCODE

Download Yara Rule

Strings

0, xrefs: 0038CC80

Memory Dump Source

Source File: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: c0b3847d73629dc7e1f151b0d0df3a20a3053422806b83ea5f8737dd1737240d
Instruction ID: 9d8a8ac9982a6a4cedcb2e60b558079c89a8a8af9d77b83ccaa8693e6f1451ab
Opcode Fuzzy Hash: c0b3847d73629dc7e1f151b0d0df3a20a3053422806b83ea5f8737dd1737240d
Instruction Fuzzy Hash: 95C1F470520B458FCB27FF28C481ABEBBB5BF05310F1566E9D4569B691C330AD4ACB61

Function 0039C6EB Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 00394EB1: GetLastError.KERNEL32(?,00000008,00399482), ref: 00394EB5
Part of subcall function 00394EB1: SetLastError.KERNEL32(00000000,003AC480,00000024,00390419), ref: 00394F57

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0039C73F

Memory Dump Source

Source File: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 2c8254ae786930ba12e1e07b7c1d4ab04210c657f4a6fb75ebadb59540334a74
Instruction ID: ba3ec8bee9363165e307ff812218ab3e8ec0f37339b27ae271a3b545f4a09528
Opcode Fuzzy Hash: 2c8254ae786930ba12e1e07b7c1d4ab04210c657f4a6fb75ebadb59540334a74
Instruction Fuzzy Hash: 79219572A21206AFEF1A9F65DC42E7A77ACEF45310F10107AFD05DA141EB35ED418B50

Function 003F4E98 Relevance: 1.6, Strings: 1, Instructions: 331COMMON

Download Yara Rule

Strings

P, xrefs: 003F503F

Memory Dump Source

Source File: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID: P
API String ID: 0-3110715001
Opcode ID: b4fda1ba9dc91e6581218cfb9f953b2bbd6cc257535fdb74648dd629dc9337cc
Instruction ID: 20c826395c70670c3418696df695923efacb03d31d932cacf05dfc59fc279b2e
Opcode Fuzzy Hash: b4fda1ba9dc91e6581218cfb9f953b2bbd6cc257535fdb74648dd629dc9337cc
Instruction Fuzzy Hash: 07B102715087658FC716CE18D89072EB7E1EBC5714F168A2CEAA59B380CB75EC05CBD2

Function 0039C372 Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00394EB1: GetLastError.KERNEL32(?,00000008,00399482), ref: 00394EB5
Part of subcall function 00394EB1: SetLastError.KERNEL32(00000000,003AC480,00000024,00390419), ref: 00394F57

EnumSystemLocalesW.KERNEL32(0039C498,00000001,00000000,?,-00000050,?,0039CAC9,00000000,?,?,?,00000055,?), ref: 0039C3E4

Memory Dump Source

Source File: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 3046d2c46ee868e3f159bc4ffef677affccd08008e7875842bd0cb5c20158bf0
Instruction ID: c85a4baee5bf53031f4ede455de23c77c6fb23ae17847a91d21e86c14999b8e4
Opcode Fuzzy Hash: 3046d2c46ee868e3f159bc4ffef677affccd08008e7875842bd0cb5c20158bf0
Instruction Fuzzy Hash: F011253B2103015FDF19AF39C8A15BABBA1FF80768B15842CE94787A40D375A942C740

Function 0039C91A Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 00394EB1: GetLastError.KERNEL32(?,00000008,00399482), ref: 00394EB5
Part of subcall function 00394EB1: SetLastError.KERNEL32(00000000,003AC480,00000024,00390419), ref: 00394F57

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,0039C6B4,00000000,00000000,?), ref: 0039C946

Memory Dump Source

Source File: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 163c0ac9043edb169d3742f2a063ec05602cca0087180224fa6ad30f0e696f80
Instruction ID: 1444a74cfeda02ef91b4110e719ea6f0b563875668770f844e4a364bf0afac33
Opcode Fuzzy Hash: 163c0ac9043edb169d3742f2a063ec05602cca0087180224fa6ad30f0e696f80
Instruction Fuzzy Hash: C6F0A933610111BBDF269B658805BBA7758FB40754F164428ED46A3180DB74FE41C590

Function 0039C40D Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00394EB1: GetLastError.KERNEL32(?,00000008,00399482), ref: 00394EB5
Part of subcall function 00394EB1: SetLastError.KERNEL32(00000000,003AC480,00000024,00390419), ref: 00394F57

EnumSystemLocalesW.KERNEL32(0039C6EB,00000001,?,?,-00000050,?,0039CA8D,-00000050,?,?,?,00000055,?,-00000050,?,?), ref: 0039C457

Memory Dump Source

Source File: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: ceca038e272ca8a1e3b95da261b5f41668d03c5fadddfceec529f135fca3a2e5
Instruction ID: da723417b53b7be0a171f2143b4b7eaa7754768a1311c10f611b10c9df961ac9
Opcode Fuzzy Hash: ceca038e272ca8a1e3b95da261b5f41668d03c5fadddfceec529f135fca3a2e5
Instruction Fuzzy Hash: 9AF046323003045FDF166F3ADC91A7A7B90FF80768F05802CF9068B680C2719C02C600

Function 00395D7F Relevance: 1.5, APIs: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0038DDC1: EnterCriticalSection.KERNEL32(?,?,00394B89,?,003AC2E0,00000008,00394D4D,?,0038C446,?), ref: 0038DDD0

EnumSystemLocalesW.KERNEL32(00395D72,00000001,003AC3A0,0000000C,00396127,00000000), ref: 00395DB7

Memory Dump Source

Source File: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: c8b4819e9efc518005ac1e0e09bf6a07d1e997c87b1e7d30da6e1c9d53dac8ac
Instruction ID: 6843d8c9f4a8cb13aa2ffeeae480112300bb01741217539d4770996a52f93bfb
Opcode Fuzzy Hash: c8b4819e9efc518005ac1e0e09bf6a07d1e997c87b1e7d30da6e1c9d53dac8ac
Instruction Fuzzy Hash: CDF04472A44300EFDB02EF98E846B9D7BB0FB49721F10416AF411AB2E0CB799945CB44

Function 0039C327 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00394EB1: GetLastError.KERNEL32(?,00000008,00399482), ref: 00394EB5
Part of subcall function 00394EB1: SetLastError.KERNEL32(00000000,003AC480,00000024,00390419), ref: 00394F57

EnumSystemLocalesW.KERNEL32(0039C280,00000001,?,?,?,0039CAEB,-00000050,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 0039C35E

Memory Dump Source

Source File: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 7dd3ce3c1b587c1afcb9e3683239c73693a91e883e1253c710856fad18d23599
Instruction ID: 399ebcc5f2a054c20bb2c50e320fe3e86bd79e0c9193df58f7f909ffe7c3b80f
Opcode Fuzzy Hash: 7dd3ce3c1b587c1afcb9e3683239c73693a91e883e1253c710856fad18d23599
Instruction Fuzzy Hash: CEF0E53A70020557CF16AF75D845A6ABF94FFC1B60F4B4058EA098B690C6759942C790

Function 003AE272 Relevance: 1.5, Strings: 1, Instructions: 273COMMON

Download Yara Rule

Strings

@, xrefs: 003AE78E

Memory Dump Source

Source File: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 33c5a5b9aaa3ad7d40147cb7931ce02fe19695e2396a5ce853ba19e0c001f1db
Instruction ID: 926222951aed83eea17effd6a38d1d0162c64fc3cff4ae74a0e739d7a59d887a
Opcode Fuzzy Hash: 33c5a5b9aaa3ad7d40147cb7931ce02fe19695e2396a5ce853ba19e0c001f1db
Instruction Fuzzy Hash: 4FA1A0716087418FC71ACF18C49476ABBE1EFDA308F198A6DE4D9973A1D774D908CB82

Function 003B7728 Relevance: 1.5, Strings: 1, Instructions: 271COMMON

Download Yara Rule

Strings

,, xrefs: 003B789B

Memory Dump Source

Source File: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID: ,
API String ID: 0-3772416878
Opcode ID: 6a3fef2072c4110c7e08f213014c8aa891b97c95317c3c670d38149bab24221c
Instruction ID: f6f39f0580bc8739a3c0d8acf679717d601807c414b50e1e4d008cc087d13aa9
Opcode Fuzzy Hash: 6a3fef2072c4110c7e08f213014c8aa891b97c95317c3c670d38149bab24221c
Instruction Fuzzy Hash: FBB1377010C3859FC321CF68C88065BBBE0AFA9708F444E2DF5D997782D671EA18CB96

Function 00387AAF Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00007ABB,00386DC9), ref: 00387AB4

Memory Dump Source

Source File: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 86aa27e21c219c7d7c8e8689b1a51db9297394368d87869260ca5a594b0d1255
Instruction ID: 1831e236eff0a701288afb2dbc40a11bab3aec901bb42883f5b4e7712e79bfef
Opcode Fuzzy Hash: 86aa27e21c219c7d7c8e8689b1a51db9297394368d87869260ca5a594b0d1255
Instruction Fuzzy Hash:

Function 003F1918 Relevance: 1.5, Strings: 1, Instructions: 220COMMON

Download Yara Rule

Strings

%*+(, xrefs: 003F1B0B, 003F1B13

Memory Dump Source

Source File: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: 0caa54ea1a90315641ea19c1d2cce55cd527f95500d153b2503ff0c6c28a3b73
Instruction ID: 7adc8dd521ec758b4453a31414a43a9a28b20762ec26f07cf06e2c2891d2c2e3
Opcode Fuzzy Hash: 0caa54ea1a90315641ea19c1d2cce55cd527f95500d153b2503ff0c6c28a3b73
Instruction Fuzzy Hash: A761E171609349DBDB12DF55E880B3ABBE6EF84310F19891CE6C58B291D771EC40CB91

Function 003F07F8 Relevance: 1.4, Strings: 1, Instructions: 172COMMON

Download Yara Rule

Strings

%*+(, xrefs: 003F08BB, 003F08C3

Memory Dump Source

Source File: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: 48588023ea1370a3b3f62b516369bf0138abb56be5ee286ad8c44f99da0f281a
Instruction ID: 12140cb2d74101e99e784f2d07f5789c57c7a6f522a57bba4aaf323a9f9b36ae
Opcode Fuzzy Hash: 48588023ea1370a3b3f62b516369bf0138abb56be5ee286ad8c44f99da0f281a
Instruction Fuzzy Hash: 35518F70609308DBDB2A9F19C990A3FB7E6EB89744F15882CE6C597263D771DC10CB62

Function 00381D79 Relevance: 1.4, Strings: 1, Instructions: 156COMMON

Download Yara Rule

Strings

Z81xbyuAua, xrefs: 00381E9B

Memory Dump Source

Source File: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID: Z81xbyuAua
API String ID: 0-3121583705
Opcode ID: 313fd321538252877d40fe5e3c8a5db8dc3097ef13c0725950d78f58807a9637
Instruction ID: 07c3173fed90bd13fbb0dcb360be257ba544184a13f83968e9aff7e028549b58
Opcode Fuzzy Hash: 313fd321538252877d40fe5e3c8a5db8dc3097ef13c0725950d78f58807a9637
Instruction Fuzzy Hash: 8A412B76D2062B4BCB4DFEB8C8561ABBB69E745310B01427ADD11DB3D1E2349A02C7D0

Function 003BEAC6 Relevance: 1.4, Strings: 1, Instructions: 128COMMON

Download Yara Rule

Strings

L3, xrefs: 003BEB16

Memory Dump Source

Source File: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID: L3
API String ID: 0-2730849248
Opcode ID: bf5552e4f83f3bf5aa9e4b1957c4ed33519c9f7afd665e70c400cb02b69d6293
Instruction ID: 265907ab9c5799a2696df8313bd4c8fcf8923e0249ec544379747cf46c9dbead
Opcode Fuzzy Hash: bf5552e4f83f3bf5aa9e4b1957c4ed33519c9f7afd665e70c400cb02b69d6293
Instruction Fuzzy Hash: 3D4166B410C3809BC7119F18C854AAFBBF0BF86318F04991CFAC59B291D736CA05CB5A

Function 003ECB36 Relevance: 1.4, Strings: 1, Instructions: 127COMMON

Download Yara Rule

Strings

%*+(, xrefs: 003ECB7C, 003ECB85

Memory Dump Source

Source File: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: c9c3511cf99027d5277ab4afa78953f19eeb9f45ac490c8b653ea83e395facf0
Instruction ID: 5e4a6d7f0fedf86d5a2fb080bba732c6e773e0fe864ab140fa39c91b91333ff5
Opcode Fuzzy Hash: c9c3511cf99027d5277ab4afa78953f19eeb9f45ac490c8b653ea83e395facf0
Instruction Fuzzy Hash: DC41F3B0118392ABCB15DF55DD81A2EBBE1EB89701F24892CF584A7392D331DC06CB22

Function 003ECE48 Relevance: 1.4, Strings: 1, Instructions: 124COMMON

Download Yara Rule

Strings

%*+(, xrefs: 003ECF0B, 003ECF13

Memory Dump Source

Source File: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: e1a7b55e822f4c4c0b190b196c54346a81db642f877fb84c2c593a9f1511728d
Instruction ID: c7ad9ae80674d3d3b75842600a58c24559bf637d9f6bc20aedec59f5be627672
Opcode Fuzzy Hash: e1a7b55e822f4c4c0b190b196c54346a81db642f877fb84c2c593a9f1511728d
Instruction Fuzzy Hash: B83116B1518364ABDA12AB16CC81B3FB7E9EB85744F101A28F984D7292E331DC12C762

Function 003D5824 Relevance: 1.4, Strings: 1, Instructions: 124COMMON

Download Yara Rule

Strings

%*+(, xrefs: 003D585B, 003D5863

Memory Dump Source

Source File: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: 452cdd5390474614f0ddbf0a7bb649cabe469c3da803ff3115ae04a2fb717320
Instruction ID: 84e5696eb56fed824c23dcc27b32df1ba9762e4e02682969934e9dd260e71244
Opcode Fuzzy Hash: 452cdd5390474614f0ddbf0a7bb649cabe469c3da803ff3115ae04a2fb717320
Instruction Fuzzy Hash: A841AC71219741EBD716DF18E8C0B2EBBE6FB89741F600A1DE1C08B391D331E8208B56

Function 003C3E69 Relevance: 1.4, Strings: 1, Instructions: 108COMMON

Download Yara Rule

Strings

%*+(, xrefs: 003C3F13

Memory Dump Source

Source File: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: 532d68ad360e3601756663246d56755396bef2663983efa083b5df1ddb856f39
Instruction ID: e7e3186c78c4aeec6a2eb1dc21ee9bda1d25d0b0fb1852fc42f9263ab925e15b
Opcode Fuzzy Hash: 532d68ad360e3601756663246d56755396bef2663983efa083b5df1ddb856f39
Instruction Fuzzy Hash: DD414475601B009FDB368F65C994F26BBF2FB49301F15891CE98A9BAA1E731FD108B14

Function 003F3833 Relevance: 1.4, Strings: 1, Instructions: 100COMMON

Download Yara Rule

Strings

@, xrefs: 003F389D

Memory Dump Source

Source File: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: c4c03cbc5544a13e512ffd9534df50902cc064df239456c5298f338a1898222a
Instruction ID: 55c383320a394aeda143721816a2bd5e74c3eba66427d34edd00dc674fd7f600
Opcode Fuzzy Hash: c4c03cbc5544a13e512ffd9534df50902cc064df239456c5298f338a1898222a
Instruction Fuzzy Hash: 113176B19083059BD719EF18C8A073BB7E1EF85345F44882CE6C697261E3B9DA48CB16

Function 003F6BB8 Relevance: 1.3, Strings: 1, Instructions: 87COMMON

Download Yara Rule

Strings

@, xrefs: 003F6C08

Memory Dump Source

Source File: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: f17ffc2d6e27705a654a95a8f2915903712d92e1ab09fb38acfa9e2b53ebfc9f
Instruction ID: 17b854bf16d7d439bf3ead2fced375882f75a9c8f78b867d44124bf47335a7c3
Opcode Fuzzy Hash: f17ffc2d6e27705a654a95a8f2915903712d92e1ab09fb38acfa9e2b53ebfc9f
Instruction Fuzzy Hash: 623176B09093048BD715DF15D880A3EFBF9EF9A315F14892CE6C897251D332D9048BA6

Function 003CC89C Relevance: 1.3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

Strings

%*+(, xrefs: 003CC8EF

Memory Dump Source

Source File: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: 24268017a7ecd41d9c94378706e298c4005a58272b1363c3163575431a6d74e9
Instruction ID: 90f8609b73da113a3ebabec5230d32908f30f957a35a3add1ee7931f5830def0
Opcode Fuzzy Hash: 24268017a7ecd41d9c94378706e298c4005a58272b1363c3163575431a6d74e9
Instruction Fuzzy Hash: 72219A71518342CFC735CF58D894BBAB7E2FB99301F54092CE089C7682D731A950CB8A

Function 003D93AF Relevance: 1.3, Strings: 1, Instructions: 67COMMON

Download Yara Rule

Strings

~/i!, xrefs: 003D940F

Memory Dump Source

Source File: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID: ~/i!
API String ID: 0-1642318302
Opcode ID: ca5e31d4c722cdb773ff07964b58c5f5501e65a1289eb1d493cab06e26b7a2d7
Instruction ID: 0b82448c2876232b8a84efb113b5f6a3a105a25b4d866d4d2501c5c62dfe44df
Opcode Fuzzy Hash: ca5e31d4c722cdb773ff07964b58c5f5501e65a1289eb1d493cab06e26b7a2d7
Instruction Fuzzy Hash: C741C7B441E3848EE3209F519441B8FFBF1BB91320FA08E0EE2E85B251C771940A8F97

Function 003DB56A Relevance: 1.3, Strings: 1, Instructions: 46COMMON

Download Yara Rule

Strings

72?1, xrefs: 003DB57A

Memory Dump Source

Source File: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID: 72?1
API String ID: 0-1649870076
Opcode ID: 76f8ab0ed0d94e201e3e07d0fa783b670310ded641f28510d027d2591c6b76f4
Instruction ID: 3505b048e59a2197b028701e6e3100b248c026bd0affed1df8573a57177f921a
Opcode Fuzzy Hash: 76f8ab0ed0d94e201e3e07d0fa783b670310ded641f28510d027d2591c6b76f4
Instruction Fuzzy Hash: AC014BB18006459FDB21DF95E5809AFFBF6AB47305F50090DE482BB641C334AA05CB76

Function 0039CC4B Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0039CC4B

Memory Dump Source

Source File: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: c1e15951efb161b352e8a657b93e9af8edaa84f5620862bd122c04b2535eeb9f
Instruction ID: 2754291331fb32f03d7ac9d3858ec3a0f080291ed390a447e2dc68ac16b89335
Opcode Fuzzy Hash: c1e15951efb161b352e8a657b93e9af8edaa84f5620862bd122c04b2535eeb9f
Instruction Fuzzy Hash: BCA01130A002008BA3008F3AAE0A20C3AE8AA0A380B088028A800C0020EA308080AF0A

Function 003B8D88 Relevance: .9, Instructions: 895COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6de66e3364744c6f46b7430cdf404bec020986853ce93ecd62be46533fc1686f
Instruction ID: 9347d9bb954ad8c4063b4381b8876c458ea18223f00821854d15c33f42343c6f
Opcode Fuzzy Hash: 6de66e3364744c6f46b7430cdf404bec020986853ce93ecd62be46533fc1686f
Instruction Fuzzy Hash: 3D52E6319087118BC7269F1CD8803FAB3E1FFD9319F194A2EDB9697690DB34A851C786

Function 003B8278 Relevance: .7, Instructions: 670COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31e46b44ab80c96838bc845868810fc41c008ea86121d9247d5acbc9ded64e9c
Instruction ID: a2cd1a0e104491189c2a0bdc2b373a20c2afb99b1d3be24ab97feae44e630c43
Opcode Fuzzy Hash: 31e46b44ab80c96838bc845868810fc41c008ea86121d9247d5acbc9ded64e9c
Instruction Fuzzy Hash: DB52C7B0908B848FEB36CB24C4843E7BBE5AB51318F154D1EC7D646EC2CB79A986C715

Function 003B40C8 Relevance: .7, Instructions: 657COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b06f627f8f7063155f207e74ffce46a74d4b27d2ae33735865de5c38f21a1d3
Instruction ID: 7e0a29f84362ba958b7038f3ea12c7e1d90932bb4eebad009ca6661d2a8412b7
Opcode Fuzzy Hash: 6b06f627f8f7063155f207e74ffce46a74d4b27d2ae33735865de5c38f21a1d3
Instruction Fuzzy Hash: D352D3315083458FCB16CF18C0906EABBE1FF89318F5A8A6DF9995B742D734D849CB89

Function 003B4AC8 Relevance: .6, Instructions: 592COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90a9ddde86f9f0d6dcf61a8da39fda9f839fcfb56b46b398fe7e1491a94c2c2e
Instruction ID: ba130d757b6efc333121c1ed93466c9c5df786314bdd15b700df7e540361bd4a
Opcode Fuzzy Hash: 90a9ddde86f9f0d6dcf61a8da39fda9f839fcfb56b46b398fe7e1491a94c2c2e
Instruction Fuzzy Hash: B4323270615B108FC76ACF29C5806AABBF1BF85714B604A2ED6A787F91D336F845CB04

Function 003B71D8 Relevance: .5, Instructions: 459COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8dbf8a9190905fd82ba4d34b3568b61c3c587483ba5650872ac470c2db95d517
Instruction ID: 2247064cc8d295c95e5f838e5ccf2faeae9207619ad2674f16f9f8429f9b57e1
Opcode Fuzzy Hash: 8dbf8a9190905fd82ba4d34b3568b61c3c587483ba5650872ac470c2db95d517
Instruction Fuzzy Hash: 89F1AA7520C7418FC725CF29C8817AABBE6EFD9304F08882DE5D987B91E635E944CB52

Function 003B0488 Relevance: .4, Instructions: 411COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da9e90a145ef812cea4a1aec4dc33611fe657f569e89895301b885733208a132
Instruction ID: 97d29cbf9138de9fb40ebd9a3bf8693c133d247ad2fc26952163d9dc16cfa439
Opcode Fuzzy Hash: da9e90a145ef812cea4a1aec4dc33611fe657f569e89895301b885733208a132
Instruction Fuzzy Hash: 6AD11471A083019BC719CF28C98065FB7E5EBC8754F158A3EFA99977A0E770DC058B82

Function 003F4988 Relevance: .4, Instructions: 354COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab695292c8b8be27e531aa2b31291d186ec3fa8c2225d2167c1a821e12252e0c
Instruction ID: 837bb9f2f07e3c06929a0402fc3bee8651b49925ab8ca28b08f2117770d07b86
Opcode Fuzzy Hash: ab695292c8b8be27e531aa2b31291d186ec3fa8c2225d2167c1a821e12252e0c
Instruction Fuzzy Hash: 21B1F5B2A043544BE716DA28CC4177BB7E9EBC4314F09492DFAA897392E735DC048792

Function 003E0B22 Relevance: .3, Instructions: 330COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ee771dfa70001f925bfea03d664bd7776843dac40e7f18ab3edc6201f5f4258
Instruction ID: 2667afd4f64a0018520d038e683559e494184df35358a20983f130c41ca64d8e
Opcode Fuzzy Hash: 0ee771dfa70001f925bfea03d664bd7776843dac40e7f18ab3edc6201f5f4258
Instruction Fuzzy Hash: A0B1CC701047918FD76ACF2AC590B26FBE0BF16304F68859DE4DA9B792C376E842CB50

Function 0039BB36 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ErrorLastProcess$CurrentFeatureInfoLocalePresentProcessorTerminate
String ID:
API String ID: 3471368781-0
Opcode ID: efe735fba20f30406206e80527fff89f9cab1b8d46604c7181b679aaf2c516b2
Instruction ID: 47b1642aa992ac8109027c3315dfd5d341dd3717501a816bd44ae331179b5545
Opcode Fuzzy Hash: efe735fba20f30406206e80527fff89f9cab1b8d46604c7181b679aaf2c516b2
Instruction Fuzzy Hash: B8B106755007069BDF3AAF25DD92BB7F3A8EF44308F14442DEA87CA580EB75A981CB10

Function 003E0B43 Relevance: .3, Instructions: 324COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b767dea67f4a2f7cf31decc1319bcbc18fec578ba60376257e9679b3c1f41b22
Instruction ID: d91b3a29d146f1a9656f9489bab9a2d659c70d8462259a75838fdee08819d579
Opcode Fuzzy Hash: b767dea67f4a2f7cf31decc1319bcbc18fec578ba60376257e9679b3c1f41b22
Instruction Fuzzy Hash: E6B1AA701047918FD76ACF29C190B26FBE1BF16304F68899DE4DA9B792C376E842CB50

Function 003B7DE8 Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c6117061885288c1b39a5b943f8482e52345fd8b1a48c2f17ef7dcb0cf10c7c
Instruction ID: 0cb8987aec5d4284df497e2937d19959e748035456e07aa3ad8b32614f863edd
Opcode Fuzzy Hash: 9c6117061885288c1b39a5b943f8482e52345fd8b1a48c2f17ef7dcb0cf10c7c
Instruction Fuzzy Hash: 1CC17CB2A587418FC361CF68CC86BABB7E1FF85318F08492DD2D9C6642D778A155CB06

Function 003C340E Relevance: .3, Instructions: 295COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d3e80e1e551c1b5307767355c273c929f276517553dab3428ab8c78f89de879
Instruction ID: 98811177459771f65fe2202435e14527fc4e10ef819009989bf05f55b291e5c9
Opcode Fuzzy Hash: 4d3e80e1e551c1b5307767355c273c929f276517553dab3428ab8c78f89de879
Instruction Fuzzy Hash: 2DB111B4610B409FC326CF24C984B67BBF1AF46704F54885DE8AA8BB52D335F905CB61

Function 003F45E8 Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a95dd50ec095db7a27f57ad37ec87d9359705260a1e90b17de809d3445c49d2e
Instruction ID: c0b7362e84cff6abece08a79df496db0ad48d14e5775025dd0ecdaaee536f44a
Opcode Fuzzy Hash: a95dd50ec095db7a27f57ad37ec87d9359705260a1e90b17de809d3445c49d2e
Instruction Fuzzy Hash: 5B919D71608345ABDB25DB14CC80BBFBBE5EB8A350F55482CFAA497351E731E844CB92

Function 003B2123 Relevance: .3, Instructions: 284COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2bc2c964d8783c56c0facf786f96d3b5996f0704cee37f54a01b38d77fa17338
Instruction ID: 97040beb0776f95998f749c26b82228a2fa3a492f1478b5617063623a834f789
Opcode Fuzzy Hash: 2bc2c964d8783c56c0facf786f96d3b5996f0704cee37f54a01b38d77fa17338
Instruction Fuzzy Hash: ADA115B2A083418BD3278E1894503A7F7D2AFE130CF1A876DDA598BB41EBB5DC09C741

Function 003F6FA8 Relevance: .3, Instructions: 282COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a57c0111a676d4db74895e3ca6696bb045d8f27298eeec49787a9baf2036813
Instruction ID: 59583d2e076d2947eb6243730168ce29d61f2fb4dc08c020b14081f7f07a377d
Opcode Fuzzy Hash: 4a57c0111a676d4db74895e3ca6696bb045d8f27298eeec49787a9baf2036813
Instruction Fuzzy Hash: A08170342083099BD726DF28D890A3AB7E5EF89740F15892CE686CB351E731EC55CB92

Function 003E33C8 Relevance: .2, Instructions: 246COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1cd372a116d043efc028469314845027128994ef8c54f150f525e54f19af1d2
Instruction ID: 3433e3789cbc9d82e1d153f36a83bc46eb85c403c6ee8ddf60921b310d6fe965
Opcode Fuzzy Hash: c1cd372a116d043efc028469314845027128994ef8c54f150f525e54f19af1d2
Instruction Fuzzy Hash: 85712933B699E04BC316993E4C86395B9830BD7334B3EC379E9B48B3E4D62989064341

Function 003D4AD8 Relevance: .2, Instructions: 242COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5eee379ce68d8c273bbc54570b7d3637e45457eb8161fd84b21c20bb6afda90
Instruction ID: 3798f22dee966d3111388546e7910f9b8ec4375733c07d3f3f0d87cf1cb4e0c2
Opcode Fuzzy Hash: e5eee379ce68d8c273bbc54570b7d3637e45457eb8161fd84b21c20bb6afda90
Instruction Fuzzy Hash: AC51E4B2600304ABDB219B64EC86B7733B8EF96754F15855AF985CF391E375E804C721

Function 003DAD84 Relevance: .2, Instructions: 242COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 390502a7dbc55b931af77b2cd4db89728a94f04527eb6b4d510d3d8de7dda55c
Instruction ID: 36b18bce1c1e63ff718a71955d7248c9e5c4db28986dced9e2b38b796bd9901c
Opcode Fuzzy Hash: 390502a7dbc55b931af77b2cd4db89728a94f04527eb6b4d510d3d8de7dda55c
Instruction Fuzzy Hash: AA816776E009154BCB1CCF69D8525BEB7A3ABC8314B29C22ED917E73D5DF3499028B84

Function 003CF540 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d945db3ddaf58208315b5268697068eceb6d853915d256c1e8a4390fd1e69238
Instruction ID: 0311494c827ca706c93ef5ea0f23d73ef0a3edf0d585eb5295e4a1035c6176b2
Opcode Fuzzy Hash: d945db3ddaf58208315b5268697068eceb6d853915d256c1e8a4390fd1e69238
Instruction Fuzzy Hash: 835176B01183809FD712EF18C891B2ABBF2EFA6750F04491DE5C19B361E379C914CB66

Function 003B2088 Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2039f829499ba2b7c9b1141e2c1bb0237ca780102234b95d4d22809a355a138f
Instruction ID: bed3b1655a99c3cdf88a6bfeb348c509813c6a8962292645ac45d54c97c95eab
Opcode Fuzzy Hash: 2039f829499ba2b7c9b1141e2c1bb0237ca780102234b95d4d22809a355a138f
Instruction Fuzzy Hash: D171D4B65087428BE7278E18C4403A7BBD2AFE130CF1E8B6DDA594BA51E7B5CC05C741

Function 003DE738 Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d108e008403b3c92b59985e25fae4eb0cb21936506a5ffd7efe5999b9cc5533
Instruction ID: 0c9c6867c9a9c4995ef4be0e573e8524967a663c2d3ceb2584a01215ea7cc297
Opcode Fuzzy Hash: 6d108e008403b3c92b59985e25fae4eb0cb21936506a5ffd7efe5999b9cc5533
Instruction Fuzzy Hash: F861DD33A083019BE766EE68E48022EBFE2ABC5710F65C82EF4898F351D374DC459742

Function 003E51A8 Relevance: .2, Instructions: 215COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c84dc754691bb308a9dbcbaee720ee309334a0e93e615c3737e2285dce66845
Instruction ID: b6502331c919d4e3072a2dffeef1b2bc59110cce7c8f4d8fbfc007eb62fb9db5
Opcode Fuzzy Hash: 9c84dc754691bb308a9dbcbaee720ee309334a0e93e615c3737e2285dce66845
Instruction Fuzzy Hash: 3261BB2BB5AEF04BC316463E1C513AA6A874BE2338F3EC376D9B19B7E1C5A94C014341

Function 003C1D02 Relevance: .2, Instructions: 203COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef974d5467c23934b05c42b7d635b16aa9e9ab43c254c6b335f5a0cd9b41eca7
Instruction ID: 3ddfba01d9303a3fe0756cb95fe9e2541c89dc84284f602d3f0fffc900800b97
Opcode Fuzzy Hash: ef974d5467c23934b05c42b7d635b16aa9e9ab43c254c6b335f5a0cd9b41eca7
Instruction Fuzzy Hash: 3E6157B1510B408BDB36CF24C584B66B7F5AF06300F154A2DD49BCBA92E770F848CBA5

Function 003EB778 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3bfe97d3e605c19e95649c7c2302aff60e9fd4c242a0f426c4f6abc5f87afd30
Instruction ID: 2a4075b75f0d23d826d99b49a4b4dbe211f8bb6c4313acec3a0e794bfcf791be
Opcode Fuzzy Hash: 3bfe97d3e605c19e95649c7c2302aff60e9fd4c242a0f426c4f6abc5f87afd30
Instruction Fuzzy Hash: 3C516BB15087548FE715DF29D89435BFBE1BBC8314F054A2DE5E987390E379DA088B82

Function 003C0F6F Relevance: .2, Instructions: 178COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48cdc4f15658e30105a6f08c7e73f5cf13de9fa3d5a0f874ad6e22d423ce7761
Instruction ID: 8653bd27dfdeb22a664be45ee921db2bfb4cddc9d12e8c970f1f55064ee71a57
Opcode Fuzzy Hash: 48cdc4f15658e30105a6f08c7e73f5cf13de9fa3d5a0f874ad6e22d423ce7761
Instruction Fuzzy Hash: 5E61B0B4C10B40AFD361AF39D907B57BEF4AB06601F504A1DE8EA97684E7316419CBE3

Function 003F43F8 Relevance: .2, Instructions: 176COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 059aace7fb3d33d5b05fdb41d57cec956a4f2a5a1265165ba3f05433a5bfbe07
Instruction ID: f8363ad02c1953f0d80d4a9d2b038dcd254fe7ce7d3b459244a112f579bec15e
Opcode Fuzzy Hash: 059aace7fb3d33d5b05fdb41d57cec956a4f2a5a1265165ba3f05433a5bfbe07
Instruction Fuzzy Hash: 12510631608318ABC716AE19DC90B3FB7E5EB8A754F29862CF69997391C731EC108751

Function 003BB078 Relevance: .2, Instructions: 175COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fb79119c8b7e9dc55afa4138464863e5f7e156fcefff6606c592a99b47a041b
Instruction ID: dd420d9a463def7c5f18cc22f3f98e64e556e9d6c8ee5a9d9bbbc868128b4651
Opcode Fuzzy Hash: 7fb79119c8b7e9dc55afa4138464863e5f7e156fcefff6606c592a99b47a041b
Instruction Fuzzy Hash: C0514B27B195904BC32A993C5C653EABA870FD3338B3DC76AE6F58BBE0DB9548014250

Function 003B9FE8 Relevance: .2, Instructions: 164COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a584769e959b28c720a83d526e0753d41a88e74ccf0ead47e7f50f9f79b33220
Instruction ID: d16b81972576b56c1383ba882460cf3d2385a22fbb0980df0e32b2a352c567c7
Opcode Fuzzy Hash: a584769e959b28c720a83d526e0753d41a88e74ccf0ead47e7f50f9f79b33220
Instruction Fuzzy Hash: 8D41587490CB40ABD702BF68C544A6EFBF5AF92749F048C1CE6C89B652C336C8148B67

Function 003B2928 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c510111869ba92912451a7b0d7d7782332ddc64f2b9d570885866b3e77a8514
Instruction ID: 68eea7ed82b535be1eeee2ba3974c127152b9a5816f9340a42f4f05391c88425
Opcode Fuzzy Hash: 5c510111869ba92912451a7b0d7d7782332ddc64f2b9d570885866b3e77a8514
Instruction Fuzzy Hash: 0951C3B1A042119FC716DF18C88096BB7A5FF85328F15466CF9999B752DB30EC41CB92

Function 003F68A8 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d30d4e8a50d40c0e8e6fee20bdc4211b6d278f2fd574d11acf0e5d5d24d8c046
Instruction ID: 90d7b645e50744194cd6067665ee87092caa0838f84179d9cdb689ddee75a0c2
Opcode Fuzzy Hash: d30d4e8a50d40c0e8e6fee20bdc4211b6d278f2fd574d11acf0e5d5d24d8c046
Instruction Fuzzy Hash: A2419E70208348ABDB16DB14D992B3FB7E5EB85754F15882CF6CAA7251D371EC10CB62

Function 003F6A38 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d5a67f3ffa23472cfb88f51fe90dd05ce35a88d56981a423dec3974e78b2c01
Instruction ID: 0ad54b301ad9517767aa475fe43b44884f82074c2e5826b888665d7b0cb915f3
Opcode Fuzzy Hash: 4d5a67f3ffa23472cfb88f51fe90dd05ce35a88d56981a423dec3974e78b2c01
Instruction Fuzzy Hash: 06418D70208344ABEB16DF15D991B3EBBE5EF85710F65882CF6899B252D331EC11CB62

Function 003BEF08 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a677d001378452f9222ddafdd89244ca075fbfc8bcdccc55e17e3a0b6c405d97
Instruction ID: a5abc1a408bc7a5c8737b513384c056c60022b0aadd155f288e7e330bba2dee3
Opcode Fuzzy Hash: a677d001378452f9222ddafdd89244ca075fbfc8bcdccc55e17e3a0b6c405d97
Instruction Fuzzy Hash: 88410772A083614FD35DCF2A849027ABBD2AFC5300F0AC62EE5D6876D1DA748955DB81

Function 003DBB20 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10c2414fe1792f3da68675f1142f4c0fe16de70f006865abae02691a7f7a35df
Instruction ID: 2092e003a6914067afbc83669ad6a3d4d9890850fb4c166f65ab8acdd58fb092
Opcode Fuzzy Hash: 10c2414fe1792f3da68675f1142f4c0fe16de70f006865abae02691a7f7a35df
Instruction Fuzzy Hash: 02416DB8910725DBDF218F54EC80BADB7B0FF06300F45414AE945AB3A0DB38A951CB65

Function 003CA3BF Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e23e85b138a55b5785af51337ab17c150877dc4adb199558c55d9d3bc3a9249
Instruction ID: 9a9342c0978ae8027cf696d3d25fc75b1a6265c9b2849757b6f3058d4b30c458
Opcode Fuzzy Hash: 5e23e85b138a55b5785af51337ab17c150877dc4adb199558c55d9d3bc3a9249
Instruction Fuzzy Hash: 1221E162804718CBC7269F15C856B72B3B1FFA5358F1A511CE886DB391F3B4AD01C362

Function 003BED6B Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ba195b4828959f65e00ce52dd80ddb8fbff997edeacb4fd00185acfab274216
Instruction ID: d7180ab25c499ceb938574886a5c51dca39565fd0a793cf4052a3aa218c1ee7d
Opcode Fuzzy Hash: 1ba195b4828959f65e00ce52dd80ddb8fbff997edeacb4fd00185acfab274216
Instruction Fuzzy Hash: A34100745083809FD321AB18C884B5EFBF5FB8A749F14492CF6C497692C376D8148B6A

Function 003F5C62 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a49b99cf3d7157d0ed907d3dfc7e1b3386e027d0657bcc432d1dbf0f3fdc52c
Instruction ID: 6c4f42ded74e1116cf68a723131d919d23c534ee8268b6cf05e26bfa8619c138
Opcode Fuzzy Hash: 9a49b99cf3d7157d0ed907d3dfc7e1b3386e027d0657bcc432d1dbf0f3fdc52c
Instruction Fuzzy Hash: FC41CE3160C7948FC7059F68C49053EFBE6AF9A300F1A8A2DE6DA9B251C775DD058B82

Function 003EBF08 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5be6113664422e96713363ec41851647c31506b086c17a8b3ff98e201e465e1
Instruction ID: ef9e2637e62563d9a25d0e962b5b6702456e28276a159dd5c7409087a559906c
Opcode Fuzzy Hash: c5be6113664422e96713363ec41851647c31506b086c17a8b3ff98e201e465e1
Instruction Fuzzy Hash: ED210A329082744BC7279B5A888153BF7E4EB9A705F46872EE8C4A72D4D335DC158BD1

Function 003CA86A Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 442e2041b7d4f0044f3b33030fef62c39f21b01d4b2ce6fbad3c99d345b53e03
Instruction ID: f073ac7b55efc7b070a52c8d57e73472cb3288e8132a51c36f96cb614b671331
Opcode Fuzzy Hash: 442e2041b7d4f0044f3b33030fef62c39f21b01d4b2ce6fbad3c99d345b53e03
Instruction Fuzzy Hash: F13167B16487898BD7319F14C485BAEB7B0FFA6364F05491DE4899BB90D3748841CB53

Function 003F36C7 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22bb0a0a16351f1bf1c6c1539f0de18b004dbbca40553b19ee82d601e5bf0c89
Instruction ID: 961973a5f0c2378321741b0a72098f1540d96be67af53535abccd628ae4c063b
Opcode Fuzzy Hash: 22bb0a0a16351f1bf1c6c1539f0de18b004dbbca40553b19ee82d601e5bf0c89
Instruction Fuzzy Hash: 1D3137B0118382EAD715DF14C49062FFBF0AF96785F50581DF4C9AB261D338DA88CB9A

Function 003D2D48 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad53ddb2add9dc148ccbfce0f9bbc6833265dcee60d8dc427d2cea672e24ee2f
Instruction ID: c74841d350fed7d146ce52df6cac8ecbbc149ec49632e0a229e67a36c072e21a
Opcode Fuzzy Hash: ad53ddb2add9dc148ccbfce0f9bbc6833265dcee60d8dc427d2cea672e24ee2f
Instruction Fuzzy Hash: 2621DEB24083009BC722AF18D84196BB7F5EFA2761F55891DE4E59B391E338C900CBA2

Function 003F3290 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef5757cbf0b0f317ecf1d42ae58ac30bf33f4febf434d18edb842894bb03324b
Instruction ID: 10e1b06973ccd07b779818205f246881e2083ac1f1db70d1f5e335791d251ec3
Opcode Fuzzy Hash: ef5757cbf0b0f317ecf1d42ae58ac30bf33f4febf434d18edb842894bb03324b
Instruction Fuzzy Hash: 7A31F6B4648305BBDA25DB04CD82F3EB7A5EB85B51F648A1CF3815B2E1C770E910CB56

Function 003B1878 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08fc7749f87834a0ac2745ce569e5a70dd2e905a0fab7b5503f7284ac12dee09
Instruction ID: 17a85fab7489e280b1f0d4a304636bd289d9d40f8af176804d2ccfdc21fee2f0
Opcode Fuzzy Hash: 08fc7749f87834a0ac2745ce569e5a70dd2e905a0fab7b5503f7284ac12dee09
Instruction Fuzzy Hash: A931E831A04300DBC7129F58C890AAAB7E5FF8535CF99893DEA99DB651D331DC42CB42

Function 003D8051 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8e389976b406287930bf639976c9266f6cf3b476f1ef4286262bb577516eb39
Instruction ID: 79f1c951006c64500a0ca31909882b986d0157bead99b1769aca5236f1e6c344
Opcode Fuzzy Hash: b8e389976b406287930bf639976c9266f6cf3b476f1ef4286262bb577516eb39
Instruction Fuzzy Hash: 1121B131908706978321DF25C4805AEB3F2FFD8791F15CA2DE88547324EB30AA5AD781

Function 003F3390 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4be7152b6fc8e7c35516a89d2ef9863e36723042a04817cdefcf23ca02a08de
Instruction ID: 3904662c04952827cf52370094ba97f490dfcb8d07f5dadd9681118ef1afeb07
Opcode Fuzzy Hash: c4be7152b6fc8e7c35516a89d2ef9863e36723042a04817cdefcf23ca02a08de
Instruction Fuzzy Hash: 1D2169B4608344ABC706EF19D490A3EFBE5EB89741F19882DE1C597322C731E951CB66

Function 003C3CBA Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b3d95a434817f6c973c9ff02e9ec9249f9d0004a7a7719806d7aee0d8c1105b
Instruction ID: 2332ec0affb20ab8a8687a54c554839a9b07b34b0840ea1acf539aa898a99c6e
Opcode Fuzzy Hash: 6b3d95a434817f6c973c9ff02e9ec9249f9d0004a7a7719806d7aee0d8c1105b
Instruction Fuzzy Hash: 842177B0A00B00AFD7328F25D885B66B7F5AF49710F20C92DE1978BA61E770F944CB14

Function 003BDDC4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01f69c16b9c6494f60613f818dcde7c35e0fbda7122440d87ad7206b78ff61d5
Instruction ID: 0d271fdafa472a19a916d8a0b01ad211ac9f2b3df530120677b86cbafaf316d0
Opcode Fuzzy Hash: 01f69c16b9c6494f60613f818dcde7c35e0fbda7122440d87ad7206b78ff61d5
Instruction Fuzzy Hash: ED2137B4A0021A9FDF05CF94CC90BBEBBB2FF4A304F144819E511BB292C735A901CB64

Function 003B6D40 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73d1958f67b8eb9f3a7656a6591d9f0965aa8cf07a1fb854fe5963536110b1f1
Instruction ID: 319152caa0ab24131fa0c503674417ff92718d5611af283b2f5e31117f55a682
Opcode Fuzzy Hash: 73d1958f67b8eb9f3a7656a6591d9f0965aa8cf07a1fb854fe5963536110b1f1
Instruction Fuzzy Hash: A8215E1521E3C4AE8386C67D088048FBEE15EFA004F896E9EF4C4AB397C554C619C7AB

Function 003E8528 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction ID: 154cd4d3a8d91e9fa456cf874f361b5c246e1c755098a4e263058d82d1b6f9dc
Opcode Fuzzy Hash: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction Fuzzy Hash: 9311C633E051E40EC3178E3D88405A5BFA30AD3634F6983D9E4B99B2D6CE238D8A9354

Function 003DDA58 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90022ddfb32469098a8610d4b68e70bc315f5b0e8987f5b71d64abe4c0da561b
Instruction ID: b10cd23e603e8cb4f0968be9cf6c74d0459ee2cdad85ff8624f5ca286c11613a
Opcode Fuzzy Hash: 90022ddfb32469098a8610d4b68e70bc315f5b0e8987f5b71d64abe4c0da561b
Instruction Fuzzy Hash: E40175F2A0430157DB239F65A8C1B6BB2A85F51704F1A842EEA059F701DB75EC15C791

Function 003DE132 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7acb281752a9f4735269b9b1cc002f9492d4fa73a4f259361f6e86e2b95aaaf8
Instruction ID: 4f8d7cacfd48430779ccd76ed3ce0beb3ad1fcf179e65138705aa8dfa0ba8300
Opcode Fuzzy Hash: 7acb281752a9f4735269b9b1cc002f9492d4fa73a4f259361f6e86e2b95aaaf8
Instruction Fuzzy Hash: 5421493689A2808BCB4A8F3088960517BB5FE4721936DC2EFCC968D467E76E5407DB21

Function 003DA0B9 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab6512b1c667dcaa1cc604779a64c1ce391463726a027d9a9669059550eb36de
Instruction ID: 53dd43211e24c484671aec78998b7d5d3c1a6cb7d6d8a48207ee942c730cbc10
Opcode Fuzzy Hash: ab6512b1c667dcaa1cc604779a64c1ce391463726a027d9a9669059550eb36de
Instruction Fuzzy Hash: F111ECB1418380AFD3219F61D584A2FFBE1ABA6B14F548C0DF6A49B251C379E809CF46

Function 003B3D78 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 205e877a776a04d6abd7e4e09befea2a77073528980a632510507c7b4451283a
Instruction ID: 87b8502d3964d5042000687c5f6d9ba54499a53d0671b5fa4eed4bfcc0a80075
Opcode Fuzzy Hash: 205e877a776a04d6abd7e4e09befea2a77073528980a632510507c7b4451283a
Instruction Fuzzy Hash: ACF0593E7182294BA211CEBBA8C487BF3D6DBCA319B15563CEB41C3601CEB1E80291D4

Function 003E8798 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dad40b8a8b0cf0c680be38028a9801f4e1e9da1297b4f3b9e1d9df466e9bee7e
Instruction ID: 6506d07c58c905065930edc77b6421f51c28c54387ea28b09faa2761b04cb969
Opcode Fuzzy Hash: dad40b8a8b0cf0c680be38028a9801f4e1e9da1297b4f3b9e1d9df466e9bee7e
Instruction Fuzzy Hash: 1E0162B3A199610B8348CE3DDC1156BBAD15BD5770F19872DBEF5CB3E0D230C8118695

Function 003C94C8 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8ebd7708255391ffa87ed53dd5dbf97c7cff7b52fcdad9dabb06971c835301f
Instruction ID: afd6f86e1ed7dc578beff9a6215ab27dc393fb41cabbec3b70aacfa27007612f
Opcode Fuzzy Hash: d8ebd7708255391ffa87ed53dd5dbf97c7cff7b52fcdad9dabb06971c835301f
Instruction Fuzzy Hash: EB014B72A196204B8308CE3C9C1112ABEE19B86330F158B2EBCFAD73E0D664CD548696

Function 003C264D Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4320f5b54cd7c9a23a8005bed77f00b087a05b385b7ddd433214809cd8c5cbf
Instruction ID: b22375a218c53da89c2b6b9e7bed9b8f268f175a2568dccabffeb256c646347d
Opcode Fuzzy Hash: f4320f5b54cd7c9a23a8005bed77f00b087a05b385b7ddd433214809cd8c5cbf
Instruction Fuzzy Hash: 58F0C8366007069FDB21DE28CC40A67B3B6FB86304F48593CD545D7465C732F525DB40

Function 003C82E8 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 809ee23363f840c811a801533be2b64f834fb93f4c5a4ab9cc37b5a2fd812bb4
Instruction ID: 68d7dc4f01171ae141bca92eae0f00e60f4aeb1f0f935d38c94fd105b6853d7b
Opcode Fuzzy Hash: 809ee23363f840c811a801533be2b64f834fb93f4c5a4ab9cc37b5a2fd812bb4
Instruction Fuzzy Hash: BCF05CB9A04290D7DB238A489CC0F77BBDCCB87714F072429E880D7103E5616C40C3E5

Function 003F2601 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 279a4f57a637f8128bfd8be77460e1d279c07fa6b9848119afc157391d6ef02f
Instruction ID: b9d1a11b122e3583ad71f3d6ff297b49f3664b92347eef7b4e12d6f01668c955
Opcode Fuzzy Hash: 279a4f57a637f8128bfd8be77460e1d279c07fa6b9848119afc157391d6ef02f
Instruction Fuzzy Hash: DFF0327090C280ABC712AB08E844A2FFBF4EF96701F14882CF1C4DB261C236D810CB6A

Function 003E093D Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41ab932f2415c7df50655ebb21d4dd6f332960aa9c3ec918add296c67870008e
Instruction ID: bfb787c82aed50391a84f639e1eeebca274e87d3ce1107ebae765882dd8056fd
Opcode Fuzzy Hash: 41ab932f2415c7df50655ebb21d4dd6f332960aa9c3ec918add296c67870008e
Instruction Fuzzy Hash: 47F06774121B408BD3A28F24C680A16FBF1FF06300F98694CE4969BFA2D334F810CB45

Function 0039A64C Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d30a52f00f890bd01d6e84b1357bca7669443c8ff688bb46904ed1c21e63159d
Instruction ID: ea748808975243773901036b22a18401df8e382cca2156e0ab857677027ac457
Opcode Fuzzy Hash: d30a52f00f890bd01d6e84b1357bca7669443c8ff688bb46904ed1c21e63159d
Instruction Fuzzy Hash: 82E08C32922238EBCB16DB9CC94598AF3ECEB44B01B150596B501D3210C270DE00C7D0

Function 003EE318 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4b5204e339133bf84330416a5308528dd9e98d6cb7a6fcb91640552a86da4e7
Instruction ID: 3b540f061149b1ae81ae61b9b2999fafc3096b990649807ceb5cf7cceba51916
Opcode Fuzzy Hash: a4b5204e339133bf84330416a5308528dd9e98d6cb7a6fcb91640552a86da4e7
Instruction Fuzzy Hash: 06D0A53550837146AB748D1AB400877F7F0E9C7711B89555EF5C1E3184D230FC41C279

Function 003BE9A5 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cc908392028c27f7ecf30c78ebf6660cf32a01492e826555e3d9857673c97f4
Instruction ID: 54fb5d341633d4b5dbd6375f6927d50f3e7d8ee348e20c8fa91e38776716234d
Opcode Fuzzy Hash: 5cc908392028c27f7ecf30c78ebf6660cf32a01492e826555e3d9857673c97f4
Instruction Fuzzy Hash: 6CC04C38A581008BC2499F55FC96576B7BCA76720EB103039DA07FB762DF64D41A990D

Function 00382003 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e41f3a0bbe8064cbde10df4dc7d14c157057afb8668647c008b1bc4d95090ae
Instruction ID: c169d2905f6db2e0efe3234ff1fefef249d6825f2aa7ea3319016ee2f218e1f7
Opcode Fuzzy Hash: 9e41f3a0bbe8064cbde10df4dc7d14c157057afb8668647c008b1bc4d95090ae
Instruction Fuzzy Hash: C0D0923A645A109FC210CF09E440941F7B4FB996307164066ED04A3720C330FC41CAD0

Function 003BE914 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1ade6ef58d6580d8cbff1d8d081264510f391430feb37eef4a632f827e8cdbb
Instruction ID: 3ce517668b75dd8ec07bc93450fd5ed773db641c187a6516fbcec464afc1c4df
Opcode Fuzzy Hash: e1ade6ef58d6580d8cbff1d8d081264510f391430feb37eef4a632f827e8cdbb
Instruction Fuzzy Hash: B1C09B39B5C0048BC244CF45D892472B3FC571730C710703A8B43F7661CE20D41D850D

Function 00390F2E Relevance: .0, Instructions: 12COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f509db719341cefea6c6c824f556d87c4149af31b656ab04d21882e9f704e7b0
Instruction ID: 6de4d4666b273d93eed0232a0075214f33f84b638fee69044f603c7ae9409ca2
Opcode Fuzzy Hash: f509db719341cefea6c6c824f556d87c4149af31b656ab04d21882e9f704e7b0
Instruction Fuzzy Hash: 7CC08C340009008ACE3F8A1082753A433A5A3A2782F8404CCDC1B0BB42C51E9D82DA01

Function 003F2F6C Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eda25dfc225e456b4df2f38464500c90323af58adcbdfe6e488d54600b94eb62
Instruction ID: 1a5367619600861a95e3410d3013f5c3e7f5ecba95d2f39f01c41938a14050eb
Opcode Fuzzy Hash: eda25dfc225e456b4df2f38464500c90323af58adcbdfe6e488d54600b94eb62
Instruction Fuzzy Hash: 35C09B3465D204C7910CCF04D951475F37B9B97757724B02DD90623757D134F512951D

Function 003F2EAE Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7e2c6ed00036b488e97d7b66a9e7c4df7905aef658a94aa0b4bf4ae83390246
Instruction ID: 5d07e073f59bc1d9ab006b13b9bdb4d2a63cac6ada5626c8abf9decc6d651ca6
Opcode Fuzzy Hash: e7e2c6ed00036b488e97d7b66a9e7c4df7905aef658a94aa0b4bf4ae83390246
Instruction Fuzzy Hash: 24C09224B682008BA24CCF18DD51935F2BB9B8BA9BB14B03DC906A3257E134E522860C

Function 003B5FB0 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2933151f0ac7f075621f0545018cb448e1da5df1c2a72fb1f6ef91afbd1dabd
Instruction ID: 90f083a07c24874d7646f44137cd52b4f4485f2d8af233f17395c09b59a772d3
Opcode Fuzzy Hash: a2933151f0ac7f075621f0545018cb448e1da5df1c2a72fb1f6ef91afbd1dabd
Instruction Fuzzy Hash: 53C04878908204CAC724CF2AC040AB9F3F5BB4F201F00A01AECA8A3240D638D800DF29

Function 003C2849 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c2b20021a969b34ebd9379bf9b485349b18f198d0552b071d404ad5cd0f597e
Instruction ID: f1c0c38a0b7feefcd14a7992d526c0f8ddc67da51ba104f186919c48afb70220
Opcode Fuzzy Hash: 8c2b20021a969b34ebd9379bf9b485349b18f198d0552b071d404ad5cd0f597e
Instruction Fuzzy Hash: CAB012B1C9C215CBC3008F10C40D1B0F335EE0B202F8071A5850527405C7328003CB0C

Function 003D7B48 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f0846c5d1b29fa8c7eb75566415611b062c9094183590c26b2b47b45be6fc4b
Instruction ID: bb9825d44238991dd192075755b19327866138ce72804a29b080075e6f376ac3
Opcode Fuzzy Hash: 1f0846c5d1b29fa8c7eb75566415611b062c9094183590c26b2b47b45be6fc4b
Instruction Fuzzy Hash: CCB012309082408BD204CF04C450530F374D747109F003418D10AB3152C220E844C60C

Function 003D5C1B Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05b00ae002dc55fb4e625dd24f5a9641755cf84b69f0189ba72e1364eef460e8
Instruction ID: 6fa0a1bee6cd81a0e7ee55e180bb11495692cb872df1a59e9b59285b5741de68
Opcode Fuzzy Hash: 05b00ae002dc55fb4e625dd24f5a9641755cf84b69f0189ba72e1364eef460e8
Instruction Fuzzy Hash: 4CA00138A883028B8209CE14E690875F3B8A74F602F103954E949B3216C620E8048A2E

Function 003853B1 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 003853B8
std::_Lockit::_Lockit.LIBCPMT ref: 003853C2
int.LIBCPMT ref: 003853D9

Part of subcall function 003816B4: std::_Lockit::_Lockit.LIBCPMT ref: 003816C5
Part of subcall function 003816B4: std::_Lockit::~_Lockit.LIBCPMT ref: 003816DF

std::_Facet_Register.LIBCPMT ref: 00385413
std::_Lockit::~_Lockit.LIBCPMT ref: 00385433
Concurrency::cancel_current_task.LIBCPMT ref: 00385440

Strings

R[8, xrefs: 00385420

Memory Dump Source

Source File: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Register
String ID: R[8
API String ID: 55977855-3778289613
Opcode ID: 1c9a211b9c92ce70ffe03790d345ce5638f822288158643fbf8c3c7cc8a40c79
Instruction ID: 374664201b25a3ab661f272c2fa1d00b2f3524b51d3ce036e1a08a09524e9ad8
Opcode Fuzzy Hash: 1c9a211b9c92ce70ffe03790d345ce5638f822288158643fbf8c3c7cc8a40c79
Instruction Fuzzy Hash: C21106759007159BCB12FB64C805BAEB7B5EF44321F61048DF801AB291DFB0EE01CB80

Function 0038A5C8 Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 0038A6E7
___TypeMatch.LIBVCRUNTIME ref: 0038A7F5
CallUnexpected.LIBVCRUNTIME ref: 0038A962

Strings

csm, xrefs: 0038A605
csm, xrefs: 0038A71E
csm, xrefs: 0038A672

Memory Dump Source

Source File: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: CallMatchTypeUnexpectedtype_info::operator==
String ID: csm$csm$csm
API String ID: 1206542248-393685449
Opcode ID: c86e6d8c5682e58c0d35502b447340b0d9839011d6ad2794c8965aefc7fd7011
Instruction ID: d1da0334a4eb1e628feac02080134e9a3a01c8a532d7979133379505539e28dd
Opcode Fuzzy Hash: c86e6d8c5682e58c0d35502b447340b0d9839011d6ad2794c8965aefc7fd7011
Instruction Fuzzy Hash: 04B17D71800B09DFEF26EFA4C8419AEBBB5BF04310B15459BF8116B212D731EA51DBA2

Function 00395F4A Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,F8250000,?,9503A385,?,00396057,0038C446,?,F8250000,00000000), ref: 0039600B

Strings

api-ms-, xrefs: 00395FA1
ext-ms-, xrefs: 00395FB5

Memory Dump Source

Source File: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: d6db8a6b1422e155375bd12525a8f8fa593ffa51e8ddf127de3bfdff24b2cc57
Instruction ID: f0d105ea065e557205cd7b5ed911c7a48f8ba971ebd2838156f0f1c6f050a788
Opcode Fuzzy Hash: d6db8a6b1422e155375bd12525a8f8fa593ffa51e8ddf127de3bfdff24b2cc57
Instruction Fuzzy Hash: 1721A572A45510EBCF239B65AD45A6E7768AB42770F260124F917BB2D0DB30EE41C7E0

Function 0038507A Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00385081
std::_Lockit::_Lockit.LIBCPMT ref: 0038508C
std::locale::_Setgloballocale.LIBCPMT ref: 003850A7
_Yarn.LIBCPMT ref: 003850BD
std::_Lockit::~_Lockit.LIBCPMT ref: 003850FA

Strings

R[8, xrefs: 003850C9, 003850ED

Memory Dump Source

Source File: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Lockitstd::_$H_prolog3Lockit::_Lockit::~_SetgloballocaleYarnstd::locale::_
String ID: R[8
API String ID: 156189095-3778289613
Opcode ID: 5604e4f71a238e9b025ac8f77189813fc3bdc17a102b7aa56a22e9edb4588f50
Instruction ID: 3aa8053743b8552f96925fa88cf821cc057e01d0fb4878bbed4c94b3ae68acb7
Opcode Fuzzy Hash: 5604e4f71a238e9b025ac8f77189813fc3bdc17a102b7aa56a22e9edb4588f50
Instruction Fuzzy Hash: 0F01BC75A046619BCB0BBB20EC55A7C7BA2BF85340B254099E8126B381CF34AE02CBC5

Function 00390F50 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,9503A385,?,?,00000000,003A1FC8,000000FF,?,00390EE0,00391010,?,00390EB4,00000000), ref: 00390F85
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00390F97
FreeLibrary.KERNEL32(00000000,?,?,00000000,003A1FC8,000000FF,?,00390EE0,00391010,?,00390EB4,00000000), ref: 00390FB9

Strings

mscoree.dll, xrefs: 00390F7E
R[8, xrefs: 00390FA8
CorExitProcess, xrefs: 00390F8F

Memory Dump Source

Source File: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$R[8$mscoree.dll
API String ID: 4061214504-1208683240
Opcode ID: 10ac8715909609cf9809cd3cd42980cc3926e3f308ecf58d08952edff3d7c83b
Instruction ID: 5539a01c143200da5d0a5f9bb8efd7089e127bdf5621ab4b87845a987b11299e
Opcode Fuzzy Hash: 10ac8715909609cf9809cd3cd42980cc3926e3f308ecf58d08952edff3d7c83b
Instruction Fuzzy Hash: 4B016272904615EFDB17DB50DC09FAEBBBCFB05B14F050529F812A26D0DB749A04CA90

Function 0039F356 Relevance: 9.3, APIs: 6, Instructions: 298COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ecd822261f812272fcfbeec51ef5caa60f83a520daa9e8ff53c1c1778f05602
Instruction ID: 88e788bf1aeabfbb22d38269abd6ae82cb8b2c631756565bb76b431a9f0e3f8d
Opcode Fuzzy Hash: 9ecd822261f812272fcfbeec51ef5caa60f83a520daa9e8ff53c1c1778f05602
Instruction Fuzzy Hash: D6B1BF70A04309AFDF13DFA9D880BAEBBB5AF45314F1541A9E511EB2A2CB71DD41CB60

Function 0038A25A Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,0038A251,00388978,00387AFF), ref: 0038A268
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0038A276
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0038A28F
SetLastError.KERNEL32(00000000,0038A251,00388978,00387AFF), ref: 0038A2E1

Memory Dump Source

Source File: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: bccbca6079498a348f12f20d548205fb92e89063119e74db034b4289ac6f1352
Instruction ID: 9d854d662e48365717eb1fa063bff8c5c948aa47875895dbd447a8c336257951
Opcode Fuzzy Hash: bccbca6079498a348f12f20d548205fb92e89063119e74db034b4289ac6f1352
Instruction Fuzzy Hash: 9C01B13224DB126EF7273775BC86A266749EB03778F2042AAF1114A8E2EF524C125346

Function 0038A371 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 0038A438
___AdjustPointer.LIBCMT ref: 0038A45B
___AdjustPointer.LIBCMT ref: 0038A4F7

Strings

R[8, xrefs: 0038A3D0

Memory Dump Source

Source File: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID: R[8
API String ID: 1740715915-3778289613
Opcode ID: 5e4acee22802e82879391296e291d5a15d0df18d6532ce251c4d11275882a489
Instruction ID: b5a5d7c3fc8ce54eb7399a8ec23fdf043adf9d7c4058d550c144ad3a8201b330
Opcode Fuzzy Hash: 5e4acee22802e82879391296e291d5a15d0df18d6532ce251c4d11275882a489
Instruction Fuzzy Hash: 0D510472605B069FFF27AF15D845B7A77A4EF04310F2540AEE8114B691E7B1EC40CB92

Function 00384436 Relevance: 7.5, APIs: 5, Instructions: 48COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00384442
int.LIBCPMT ref: 00384455

Part of subcall function 003816B4: std::_Lockit::_Lockit.LIBCPMT ref: 003816C5
Part of subcall function 003816B4: std::_Lockit::~_Lockit.LIBCPMT ref: 003816DF

std::_Facet_Register.LIBCPMT ref: 00384488
std::_Lockit::~_Lockit.LIBCPMT ref: 0038449E
Concurrency::cancel_current_task.LIBCPMT ref: 003844A9

Memory Dump Source

Source File: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 65749afd5bbeaafc92e2d90dea17c86bb6b6546ce97f8ec7e5a72d3df41de0a7
Instruction ID: 2497e13606c686eaf9f2cdf669afcf41d4f2e3a0093f8e5adda65c9acf4840d2
Opcode Fuzzy Hash: 65749afd5bbeaafc92e2d90dea17c86bb6b6546ce97f8ec7e5a72d3df41de0a7
Instruction Fuzzy Hash: 2201A772900319ABCB16FB65D8059AD776CEF80760B1505D9FC056F691DB30EE06D784

Function 00383DB1 Relevance: 7.5, APIs: 5, Instructions: 48COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00383DBD
int.LIBCPMT ref: 00383DD0

Part of subcall function 003816B4: std::_Lockit::_Lockit.LIBCPMT ref: 003816C5
Part of subcall function 003816B4: std::_Lockit::~_Lockit.LIBCPMT ref: 003816DF

std::_Facet_Register.LIBCPMT ref: 00383E03
std::_Lockit::~_Lockit.LIBCPMT ref: 00383E19
Concurrency::cancel_current_task.LIBCPMT ref: 00383E24

Memory Dump Source

Source File: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 39ac479b5c60797a6066baf373e7c6605fea09d6534ee17c78c0cfa911555660
Instruction ID: c640ef7fd6e81ec73e82ae18dafb089d2862d23b32fc187547f648f7bd8c5654
Opcode Fuzzy Hash: 39ac479b5c60797a6066baf373e7c6605fea09d6534ee17c78c0cfa911555660
Instruction Fuzzy Hash: 4E018472904214ABCB17BB64D9458AEB7689F40760B1501D9FC056B291DB34AE46D780

Function 00384308 Relevance: 7.5, APIs: 5, Instructions: 47COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00384315
int.LIBCPMT ref: 00384328

Part of subcall function 003816B4: std::_Lockit::_Lockit.LIBCPMT ref: 003816C5
Part of subcall function 003816B4: std::_Lockit::~_Lockit.LIBCPMT ref: 003816DF

std::_Facet_Register.LIBCPMT ref: 0038435B
std::_Lockit::~_Lockit.LIBCPMT ref: 00384371
Concurrency::cancel_current_task.LIBCPMT ref: 0038437C

Memory Dump Source

Source File: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: dbf391323ba2ae313bd2c13918f90c13de8c6d8b3b8609db288ee2cd8e97489d
Instruction ID: 4f3e9bae66badf0b60b193d33cde12b067153032ba249412ef202ea5b5325d12
Opcode Fuzzy Hash: dbf391323ba2ae313bd2c13918f90c13de8c6d8b3b8609db288ee2cd8e97489d
Instruction Fuzzy Hash: 7B012B36900719A7CB17FB64D9018DD77689F80310B1001D9FC056F291EF30AE06DBC4

Function 0038A060 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 0038A09F
__IsNonwritableInCurrentImage.LIBCMT ref: 0038A153

Strings

csm, xrefs: 0038A13D
R[8, xrefs: 0038A16C

Memory Dump Source

Source File: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: CurrentImageNonwritable___except_validate_context_record
String ID: R[8$csm
API String ID: 3480331319-1323013633
Opcode ID: ca033d10cd87d3900d21e3e33c8f99408ce5758f4e2b8fa8f44824c42f6a368c
Instruction ID: 1e374e361b0c3172bc1bc48f5a0c783eb9b44d947ea829b52db0eb2fd9009f72
Opcode Fuzzy Hash: ca033d10cd87d3900d21e3e33c8f99408ce5758f4e2b8fa8f44824c42f6a368c
Instruction Fuzzy Hash: B141D670A007099BDF12EF68C885A9EBBB5EF45324F1580D6E8156B392C735DE41CB92

Function 0038B3A2 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,0038B353,00000000,?,00406AE4,?,?,?,0038B4F6,00000004,InitializeCriticalSectionEx,003A4BD8,InitializeCriticalSectionEx), ref: 0038B3AF
GetLastError.KERNEL32(?,0038B353,00000000,?,00406AE4,?,?,?,0038B4F6,00000004,InitializeCriticalSectionEx,003A4BD8,InitializeCriticalSectionEx,00000000,?,0038B2AD), ref: 0038B3B9
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 0038B3E1

Strings

api-ms-, xrefs: 0038B3C6

Memory Dump Source

Source File: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: c98161056ef3be7a609313d1c013dea7d4937feb43565ddf6a3c5fe49048a6ae
Instruction ID: 3d64a9f80f67a101675c4c77224be8538a28cfb8c692edb21a2f8ade473be396
Opcode Fuzzy Hash: c98161056ef3be7a609313d1c013dea7d4937feb43565ddf6a3c5fe49048a6ae
Instruction Fuzzy Hash: 2AE04F34284305B7EF236BB1EC4AB597E58AB02B41F110061FA0DE84E1E7B1DA5087D4

Function 00397747 Relevance: 6.3, APIs: 4, Instructions: 338fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(9503A385,00000000,00000000,00000000), ref: 003977AA

Part of subcall function 0039952A: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,00398FD3,?,00000000,-00000008), ref: 003995D6

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00397A05
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00397A4D
GetLastError.KERNEL32 ref: 00397AF0

Memory Dump Source

Source File: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: ad1c3ee9c03ecda3b978dda35e758de2395382d3f4a27b4457b0981093a95af8
Instruction ID: c8c3ef8783aea4dd23946fb46ae6a1fe62634826473e2cea66af7bff40598da7
Opcode Fuzzy Hash: ad1c3ee9c03ecda3b978dda35e758de2395382d3f4a27b4457b0981093a95af8
Instruction Fuzzy Hash: 99D18A75D142589FCF06CFA8D8809EDBBB9FF09310F18416AE826EB391D730A942CB50

Function 003A06EF Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,0000000C,?,00000000,00000000,?,0039F713,00000000,00000001,00000000,00000000,?,00397B44,00000000,00000000,00000000), ref: 003A0706
GetLastError.KERNEL32(?,0039F713,00000000,00000001,00000000,00000000,?,00397B44,00000000,00000000,00000000,00000000,00000000,?,003980CB,00000000), ref: 003A0712

Part of subcall function 003A06D8: CloseHandle.KERNEL32(FFFFFFFE,003A0722,?,0039F713,00000000,00000001,00000000,00000000,?,00397B44,00000000,00000000,00000000,00000000,00000000), ref: 003A06E8

___initconout.LIBCMT ref: 003A0722

Part of subcall function 003A069A: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,003A06C9,0039F700,00000000,?,00397B44,00000000,00000000,00000000,00000000), ref: 003A06AD

WriteConsoleW.KERNEL32(00000000,0000000C,?,00000000,?,0039F713,00000000,00000001,00000000,00000000,?,00397B44,00000000,00000000,00000000,00000000), ref: 003A0737

Memory Dump Source

Source File: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 49b4c55831b3da2f11292d50c2ba4c7065316c4814e8bc2f8d2504c016ba3524
Instruction ID: 917131d9bda51867f0f1d58700be7eed37c55b5b647d1a7b58574ba1d4c656e5
Opcode Fuzzy Hash: 49b4c55831b3da2f11292d50c2ba4c7065316c4814e8bc2f8d2504c016ba3524
Instruction Fuzzy Hash: 91F03036100554BBCF272FE5DC099897FAAFB4B3A1F054010FA5A95530CA328D30DF91

Function 003A1093 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147COMMONLIBRARYCODE

Download Yara Rule

APIs

DecodePointer.KERNEL32(?,?,?,?,?,?,?,?,?,003A09EF), ref: 003A10AC

Strings

Li:, xrefs: 003A1241
R[8, xrefs: 003A1176, 003A1220, 003A1266

Memory Dump Source

Source File: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: DecodePointer
String ID: Li:$R[8
API String ID: 3527080286-3951607920
Opcode ID: 76cee2318d04bfd75ab9fa927ddd980d3b10a0fa0ba3696f998c5ef23c8392de
Instruction ID: 4cc0cd10243fad614d917a7e03eb41e71ddeda25c8d91efb629d9d02126318f1
Opcode Fuzzy Hash: 76cee2318d04bfd75ab9fa927ddd980d3b10a0fa0ba3696f998c5ef23c8392de
Instruction Fuzzy Hash: 1651007490050ACBDF129FA8E94C2BEBFB8FF0B300F164049E591A7264CB70CA29CB44

Function 00385F4D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

_Fputc.LIBCPMT ref: 00386026

Strings

R[8, xrefs: 00386005

Memory Dump Source

Source File: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Fputc
String ID: R[8
API String ID: 3078413507-3778289613
Opcode ID: 684c0f5b4f8cfedbc436df2058e01da80ddce6df419c6f6def49af3a1b2ede72
Instruction ID: 79892c67d9dbb7194356eaf9a544eaea4f980b706a9a2e196818428b1d8abb48
Opcode Fuzzy Hash: 684c0f5b4f8cfedbc436df2058e01da80ddce6df419c6f6def49af3a1b2ede72
Instruction Fuzzy Hash: 99415F7691071AEBCF16EF64C4908EDB7B9FF09354B1540A6E641A7A40EB31FD41CB90

Function 0038A96D Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?), ref: 0038A992

Strings

RCC, xrefs: 0038A9AC
MOC, xrefs: 0038A9A4

Memory Dump Source

Source File: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 5d700a22aef59b9cbd0b81f791fad99b3a9845b06bfcdc1704d43416e16e5fed
Instruction ID: 729bf1cebd29528ed1145019fc18b73d85598ae27cb10dddd51c57ae8066d281
Opcode Fuzzy Hash: 5d700a22aef59b9cbd0b81f791fad99b3a9845b06bfcdc1704d43416e16e5fed
Instruction Fuzzy Hash: EA417D71900609AFDF1AEF94CD81AEEBBB5FF48300F1A409AFA0467211D335D950DB52

Function 00385107 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00385113
std::_Lockit::~_Lockit.LIBCPMT ref: 0038516F

Strings

R[8, xrefs: 0038513A, 00385154

Memory Dump Source

Source File: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_
String ID: R[8
API String ID: 593203224-3778289613
Opcode ID: df33d69f1a4933082dbf933307611c4c5657454e03f6e035078abec01cda12af
Instruction ID: 0e8bd344493dcf41442ea45d4be23fa7fb5d1ac5705137c639b3fea829f6d5a4
Opcode Fuzzy Hash: df33d69f1a4933082dbf933307611c4c5657454e03f6e035078abec01cda12af
Instruction Fuzzy Hash: 99018C35600619AFCB06EF64C889E9977B9EF85710B0500E9E8019F3A1DB70EE05CB50

Function 003815DF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 003815E6
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 0038161E

Part of subcall function 00385178: _Yarn.LIBCPMT ref: 00385197
Part of subcall function 00385178: _Yarn.LIBCPMT ref: 003851BB

Strings

bad locale name, xrefs: 0038162C

Memory Dump Source

Source File: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Yarnstd::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 1908188788-1405518554
Opcode ID: c7c7e5a8d61741694037565c0fb0870042cc6917e39a6254df4a3c49e6f98eb5
Instruction ID: a15e450eb9059d7b23a46f43fe794335572232a9722429d857181b7330082849
Opcode Fuzzy Hash: c7c7e5a8d61741694037565c0fb0870042cc6917e39a6254df4a3c49e6f98eb5
Instruction Fuzzy Hash: 26F03A72505B909E8332AF7A8481447FBE4FE293103948E6FE0DEC3A12D734E404CB6A

Function 003962A6 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 26COMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(?,?), ref: 003962E6

Strings

R[8, xrefs: 003962D6
InitializeCriticalSectionEx, xrefs: 003962B6

Memory Dump Source

Source File: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: CountCriticalInitializeSectionSpin
String ID: InitializeCriticalSectionEx$R[8
API String ID: 2593887523-3266539331
Opcode ID: 8453b0de8ff4a19d0dbf1ff5fa32c69fb77e1dcfb86b8e560f4267a20eec9b3a
Instruction ID: 14c69daeb63f73b13c861dd5e934800f7f43e5a8ee3cda2a447b6bcb33afd6be
Opcode Fuzzy Hash: 8453b0de8ff4a19d0dbf1ff5fa32c69fb77e1dcfb86b8e560f4267a20eec9b3a
Instruction Fuzzy Hash: F1E09232545218BBCF132F90EC07ECE7F19DB46BA1F048020FD2819160C7B2D92196D4

Function 0039612C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22memoryCOMMON

Download Yara Rule

APIs

TlsAlloc.KERNEL32 ref: 00396160

Strings

FlsAlloc, xrefs: 0039613C
R[8, xrefs: 00396156

Memory Dump Source

Source File: 00000000.00000002.1452249127.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1452196779.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452297911.00000000003A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452318529.00000000003AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452360417.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452381469.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1452400494.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Alloc
String ID: FlsAlloc$R[8
API String ID: 2773662609-4153746590
Opcode ID: cdec64353435dbba5a99922898282bbdab47a4c9ab1c5800beedb1b6214da84e
Instruction ID: 6d017e9c4c1f182f750dbd568b96780f91da3f59902ab056a679fc0521aeb70e
Opcode Fuzzy Hash: cdec64353435dbba5a99922898282bbdab47a4c9ab1c5800beedb1b6214da84e
Instruction Fuzzy Hash: 1DE02B36B89728738A2377B0AC07EDF7F18CB47BB1F014020FE0526292CAE5990092E5

Analysis Process: MSBuild.exePID: 6700, Parent PID: 4716COMMON

Execution Graph

Execution Coverage:	1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	2.3%
Total number of Nodes:	44
Total number of Limit Nodes:	4

Executed Functions

Function 0040D110 Relevance: 6.2, APIs: 4, Instructions: 154
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetInputState.USER32 ref: 0040D121
GetCurrentThreadId.KERNEL32 ref: 0040D136
GetCurrentProcessId.KERNEL32 ref: 0040D13C
ExitProcess.KERNEL32 ref: 0040D2F0

Memory Dump Source

Source File: 00000002.00000002.1269268783.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: CurrentProcess$ExitInputStateThread
String ID:
API String ID: 1029096631-0
Opcode ID: 08eb499608fb6ca27a79879cc2e31d82174a6a7722ca31d8a5ded37d06d49044
Instruction ID: f02d3b79713e8d81e15a0fda541fde84aa13a8de9f5ea14ec3edbee07005130c
Opcode Fuzzy Hash: 08eb499608fb6ca27a79879cc2e31d82174a6a7722ca31d8a5ded37d06d49044
Instruction Fuzzy Hash: BD41697480D340ABC301BFA5D644A1EFBF1AF56709F048C6DE5C4A7292C339D8189B6B

Function 00445700 Relevance: 1.6, APIs: 1, Instructions: 69
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlReAllocateHeap.NTDLL(?,00000000,?,?), ref: 00445784

Memory Dump Source

Source File: 00000002.00000002.1269268783.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 451ba736794f0e2f30a849843ab83a7da9f20e1e8286aac8e33d1c41455145f3
Instruction ID: c85136016a5953b7558c7414a3c459db971abdd3e4f37367334958bb3d5b1fc4
Opcode Fuzzy Hash: 451ba736794f0e2f30a849843ab83a7da9f20e1e8286aac8e33d1c41455145f3
Instruction Fuzzy Hash: DF119E7191C240EBD711AF28E840A1BBBF5AF86716F05883DE4C49B212D339D811CB9B

Function 00445BB0 Relevance: 1.5, APIs: 1, Instructions: 14
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL(0044973D,005C003F,00000006,?,?,00000018,8C8D8A8B,?,?), ref: 00445BDE

Memory Dump Source

Source File: 00000002.00000002.1269268783.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: b66ff63dfd389af1bc8afcc0025f999e8b2b47508af02e865142dda64173a8e3
Instruction ID: fb6f357373f259be8b0e83fffc5d2a3912a28e0da7d2036ce94b71e982b3a7e9
Opcode Fuzzy Hash: b66ff63dfd389af1bc8afcc0025f999e8b2b47508af02e865142dda64173a8e3
Instruction Fuzzy Hash: 76E0FE75908316AB9A09CF45C14444EFBE5BFC4714F11CC8DA4D867210D3B0AD46DF82

Function 00445DCE Relevance: 3.0, APIs: 2, Instructions: 17
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetForegroundWindow.USER32 ref: 00445DCE
GetForegroundWindow.USER32 ref: 00445DE0

Memory Dump Source

Source File: 00000002.00000002.1269268783.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: 8c61841407d1a4852bfe4b40972173754e0679736d2baf3d56bf65322f3b4ff0
Instruction ID: 1e21c31d78f88c29f1ba1c45ad2c8465459836b227478d43c99d9611323569fd
Opcode Fuzzy Hash: 8c61841407d1a4852bfe4b40972173754e0679736d2baf3d56bf65322f3b4ff0
Instruction Fuzzy Hash: 11D05EE9A023405BEA08AB22FC0E4173615A78626E7040438E80B82312E535E924C64A

Function 00443220 Relevance: 1.6, APIs: 1, Instructions: 59
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL(?,00000000), ref: 004432A6

Memory Dump Source

Source File: 00000002.00000002.1269268783.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 50965382f7edf395daec22a3aa5bcca61c8fe5508095e75f982d05b7b9ec31b6
Instruction ID: 4bd1cfedf901e7341f085caf0d3c231c399316e56ace865125bd700590354386
Opcode Fuzzy Hash: 50965382f7edf395daec22a3aa5bcca61c8fe5508095e75f982d05b7b9ec31b6
Instruction Fuzzy Hash: 4B016D3450D3409BD701EF18E845A1ABBE8EF4AB02F054D6CE5C58B362D339DD60CB96

Function 00443202 Relevance: 1.5, APIs: 1, Instructions: 6
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(?,00000000), ref: 00443208

Memory Dump Source

Source File: 00000002.00000002.1269268783.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: f4e883208b5af43432b1f7820fa52118579d54aaadfbe7b6ea97085ba09a0524
Instruction ID: d989c2ef34d315249fff67303ad5b66d5fc7957262475763486a37997b8dd8e1
Opcode Fuzzy Hash: f4e883208b5af43432b1f7820fa52118579d54aaadfbe7b6ea97085ba09a0524
Instruction Fuzzy Hash: CCB012304401005FDA141B00EC0AF003510EF00606F800070A100040B2D1619864C559

Non-executed Functions

Function 00429510 Relevance: 30.2, APIs: 1, Strings: 16, Instructions: 426COMMON

Download Yara Rule

Strings

pq, xrefs: 004299E0
B?Q9, xrefs: 00429B0B
z=Q?, xrefs: 00429826
L3Y=, xrefs: 00429B03
O+f), xrefs: 00429634, 0042963D
X/R), xrefs: 00429AEB
G'M!, xrefs: 00429ADB
G+X5, xrefs: 00429AF3
8;, xrefs: 00429B13
;IJK, xrefs: 0042983E
?M0K, xrefs: 00429968
B7U1, xrefs: 00429AFB
,A&C, xrefs: 0042982E
!E4G, xrefs: 00429836
2A"_, xrefs: 00429980
T#a-, xrefs: 00429AE3

Memory Dump Source

Source File: 00000002.00000002.1269268783.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID:
String ID: !E4G$,A&C$2A"_$8;$;IJK$?M0K$B7U1$B?Q9$G'M!$G+X5$L3Y=$O+f)$T#a-$X/R)$pq$z=Q?
API String ID: 0-655414846
Opcode ID: 821277b00644bb46f69b775215d578a60cf2f50154e1c4f07745e3abcf78f76a
Instruction ID: 614779ad590eebcf7b8fe37e51d599c86efeb38568f1612107a067b093dacd9a
Opcode Fuzzy Hash: 821277b00644bb46f69b775215d578a60cf2f50154e1c4f07745e3abcf78f76a
Instruction Fuzzy Hash: 56F130B4608380ABD310DF15E881A2BBBF4FB86748F944D1DF4D59B252D378D908CB9A

Function 00438720 Relevance: 22.9, APIs: 6, Strings: 7, Instructions: 115clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00438738
GetWindowLongW.USER32 ref: 00438763
GetClipboardData.USER32 ref: 00438773
CloseClipboard.USER32 ref: 00438880

Strings

8, xrefs: 004387E5
6, xrefs: 004387D9
?, xrefs: 004387C9
9, xrefs: 004387D1
6, xrefs: 004387D5
=, xrefs: 004387CD
9, xrefs: 004387DD

Memory Dump Source

Source File: 00000002.00000002.1269268783.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Clipboard$CloseDataLongOpenWindow
String ID: 6$6$8$9$9$=$?
API String ID: 1647500905-2499364611
Opcode ID: 7c9163cd6bc49d62cda3546406a8a3a59e414d7ee2d25f2b6b977c001a77ad7b
Instruction ID: c6cecdc6b357f73a091e8619202f080a94ed584840656985310604660298186b
Opcode Fuzzy Hash: 7c9163cd6bc49d62cda3546406a8a3a59e414d7ee2d25f2b6b977c001a77ad7b
Instruction Fuzzy Hash: F741B170C08385CFDB01AFB8D5893AEBFB0AB5A314F14092EE485A7381D7794949C76B

Function 0043F620 Relevance: 19.7, APIs: 9, Strings: 2, Instructions: 452memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32 ref: 0043F67C
SysAllocString.OLEAUT32 ref: 0043F73C
VariantInit.OLEAUT32(00000000), ref: 0043F7BB
SysStringLen.OLEAUT32(?), ref: 0043F86B

Strings

hi, xrefs: 0043F6E6
dg, xrefs: 0043F7F5

Memory Dump Source

Source File: 00000002.00000002.1269268783.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: String$Alloc$InitVariant
String ID: dg$hi
API String ID: 3520221836-2859417413
Opcode ID: a29f64484bac79c51184cc7e0d437789df3d7f91ec00fbc448bf7e6117096322
Instruction ID: 76cd35575ce81f92284fb50bd1b390108f3350da4718470232658bad10f85c67
Opcode Fuzzy Hash: a29f64484bac79c51184cc7e0d437789df3d7f91ec00fbc448bf7e6117096322
Instruction Fuzzy Hash: E9F18776608301EFE704CF24D881B2ABBF5FB8A355F14992EF485872A1C738D845CB1A

Function 004390EE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 82COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32 ref: 00439124
GetSystemMetrics.USER32 ref: 00439133

Strings

, xrefs: 004391DE

Memory Dump Source

Source File: 00000002.00000002.1269268783.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: MetricsSystem
String ID:
API String ID: 4116985748-3916222277
Opcode ID: ab5555a52b31076e5eeb6519deaae68eca3c41e93bfc72b6c9b35e59f4d21b4a
Instruction ID: 7f7dffd27c621b542e95bdab6b7ee4d7f31120e949507c5ac4fca7aa65185fb2
Opcode Fuzzy Hash: ab5555a52b31076e5eeb6519deaae68eca3c41e93bfc72b6c9b35e59f4d21b4a
Instruction Fuzzy Hash: 6C3160B49183048FDB00EF6CDA8565EBBF4BF89704F11492DE498DB360D775A948CB86

Function 00438220 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1269268783.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bdc841d7a406348b8f463a63eb878eabe2c962c804589a40256072bab34e7f2b
Instruction ID: 5feb4677dc7f436114534582e8c0716e72c97c069455e78d6c85f3d503c4cf0a
Opcode Fuzzy Hash: bdc841d7a406348b8f463a63eb878eabe2c962c804589a40256072bab34e7f2b
Instruction Fuzzy Hash: 4501E4B44107009FD360EF29C485747BBE8EB08714F008A1DE8AECB680D774A5448B82

Function 00439843 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 109COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32 ref: 00439891
GetSystemMetrics.USER32 ref: 004398A0

Strings

, xrefs: 00439974

Memory Dump Source

Source File: 00000002.00000002.1269268783.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: MetricsSystem
String ID:
API String ID: 4116985748-3916222277
Opcode ID: c81f12191cba6e53c0562e90626fcbcb1d354553d74947de8f13948612130a55
Instruction ID: eb4df33fe1d6a66542a4d5aad425eba8fef39bce69b1d50955d9d3d9aaf60553
Opcode Fuzzy Hash: c81f12191cba6e53c0562e90626fcbcb1d354553d74947de8f13948612130a55
Instruction Fuzzy Hash: 3B516DB4E142188FDB40EFACD985A9EBBF0BB48310F018529E898E7350D734A944CF96

Function 0040F1FB Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 88COMMON

Download Yara Rule

APIs

ShellExecuteW.SHELL32(00000000,57A649BB,0044D58A,832F8123,00000000,00000005), ref: 0040F32F

Strings

8@-, xrefs: 0040F33A
PQ, xrefs: 0040F2BF

Memory Dump Source

Source File: 00000002.00000002.1269268783.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: ExecuteShell
String ID: 8@-$PQ
API String ID: 587946157-876866189
Opcode ID: 1a0b4a114143d5ca3374a3cd52da601592b1729854c1c1369e379120faed14fe
Instruction ID: 32a7b61192442560c6f92bb2f4be214f77c1956f3597500a90fccf8073e86402
Opcode Fuzzy Hash: 1a0b4a114143d5ca3374a3cd52da601592b1729854c1c1369e379120faed14fe
Instruction Fuzzy Hash: 5F312878A012689FDB208F94DD45BDEBB71BF46301F1408E9E689AA281C7B54E848F56

Function 00435551 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 0043555A
VariantInit.OLEAUT32 ref: 00435566

Strings

2, xrefs: 004355B5

Memory Dump Source

Source File: 00000002.00000002.1269268783.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Variant$ClearInit
String ID: 2
API String ID: 2610073882-450215437
Opcode ID: 9656e49463a1eac2a2e27d608098374d928559fc5e9cd49b246a20351250d731
Instruction ID: 1309dba7e2d53283adf9958502b19f3f730abdb88899d5b7c892982ad23b04e6
Opcode Fuzzy Hash: 9656e49463a1eac2a2e27d608098374d928559fc5e9cd49b246a20351250d731
Instruction Fuzzy Hash: 6341D370108BC1CED722DF2CC494646BFA0AB56324F188A9CD8EA4F3DAC775E505CB62

Function 00435A84 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 81COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 00435AA6
VariantInit.OLEAUT32 ref: 00435AB2

Strings

2, xrefs: 00435B01

Memory Dump Source

Source File: 00000002.00000002.1269268783.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Variant$ClearInit
String ID: 2
API String ID: 2610073882-450215437
Opcode ID: b9a854552b158eee2be1d84dc97acde07f31a6659becb1d60da7bb16dc3eeda4
Instruction ID: 10a0ad4f487e5ee891bf26f48cdc5f2681f831964d1233476b22d4ecaaddf2d0
Opcode Fuzzy Hash: b9a854552b158eee2be1d84dc97acde07f31a6659becb1d60da7bb16dc3eeda4
Instruction Fuzzy Hash: B141C570108BC18ED725CF2CC494656BFE0AB5A324F18868DE8EA8F3D6C775D506DB62

Function 00435A99 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 00435AA6
VariantInit.OLEAUT32 ref: 00435AB2

Strings

2, xrefs: 00435B01

Memory Dump Source

Source File: 00000002.00000002.1269268783.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Variant$ClearInit
String ID: 2
API String ID: 2610073882-450215437
Opcode ID: fb5371bdd09d0e906117c41cc88a3a5b350ebddee64f3fa9cb34d119133aa536
Instruction ID: e960a9e32f486725a985871b83e160e2d060c1978967536bf2cf05e5ffba8ce9
Opcode Fuzzy Hash: fb5371bdd09d0e906117c41cc88a3a5b350ebddee64f3fa9cb34d119133aa536
Instruction Fuzzy Hash: A831C320008BC18EDB229F3C8488646BFA05F27224F1887DDD8EA4F3DBC365D506DB66

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_SecuriteInfo.com_c086986ef72da566936e540c9d0207bf0492b1a_cf265dec_7a4679c3-3ada-41cb-944a-a855ef24c584\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3787.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER37C7.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER37F7.tmp.xml

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Windows Analysis Report
SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe

Function 00382021 Relevance: 9.4, APIs: 1, Strings: 4, Instructions: 631
memoryCOMMON

Function 00396368 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34
COMMONLIBRARYCODE

Function 00398E2E Relevance: 4.7, APIs: 3, Instructions: 202
COMMON

Function 0039A3A6 Relevance: 3.2, APIs: 2, Instructions: 177
COMMON

Function 00399FAA Relevance: 1.6, APIs: 1, Instructions: 147
COMMON