Edit tour

Windows Analysis Report
SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe

Overview

General Information

Sample name:	SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe
Analysis ID:	1528442
MD5:	c70170bcedd92e90f2556c7501b1a559
SHA1:	906055b36647c5bae02e9e2db41bef9a17e2f3b1
SHA256:	1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd
Tags:	exe
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Injects a PE file into a foreign processes

LummaC encrypted strings found

Machine Learning detection for sample

Sample uses string decryption to hide its real strings

Sigma detected: Silenttrinity Stager Msbuild Activity

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Checks if the current process is being debugged

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe (PID: 6036 cmdline: "C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe" MD5: C70170BCEDD92E90F2556C7501B1A559)

MSBuild.exe (PID: 6420 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

WerFault.exe (PID: 3380 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6036 -s 272 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["isoplethui.sbs", "exemplarou.sbs", "exilepolsiy.sbs", "laddyirekyi.sbs", "frizzettei.sbs", "bemuzzeki.sbs", "invinjurhey.sbs", "wickedneatr.sbs"], "Build id": "H8NgCl--"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000001.00000002.2176103954.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmp	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Unpacked PEs

Source	Rule	Description	Author
1.2.MSBuild.exe.400000.0.unpack	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
1.2.MSBuild.exe.400000.0.raw.unpack	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
0.2.SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe.ef0000.0.unpack	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security

Sigma Signatures

System Summary

Sigma detected: Silenttrinity Stager Msbuild Activity

Source: Network Connection

Author: Kiran kumar s, oscd.community: Data: DestinationIp: 104.102.49.254, DestinationIsIpv6: false, DestinationPort: 443, EventID: 3, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, Initiated: true, ProcessId: 6420, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49723

Suricata Signatures

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T22:45:15.836455+0200	2054653	1	A Network Trojan was detected	192.168.2.5	49726	104.21.53.8	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T22:45:15.836455+0200	2049836	1	A Network Trojan was detected	192.168.2.5	49726	104.21.53.8	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe

Avira: detected

Antivirus detection for URL or domain

Source: https://steamcommunity.com/profiles/76561199724331900	URL Reputation: Label: malware
Source: https://steamcommunity.com/profiles/76561199724331900/inventory/	URL Reputation: Label: malware

Found malware configuration

Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe.ef0000.0.unpack

Malware Configuration Extractor: LummaC {"C2 url": ["isoplethui.sbs", "exemplarou.sbs", "exilepolsiy.sbs", "laddyirekyi.sbs", "frizzettei.sbs", "bemuzzeki.sbs", "invinjurhey.sbs", "wickedneatr.sbs"], "Build id": "H8NgCl--"}

Multi AV Scanner detection for submitted file

Source: SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe

ReversingLabs: Detection: 36%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmp	String decryptor: wickedneatr.sbs
Source: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmp	String decryptor: invinjurhey.sbs
Source: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmp	String decryptor: laddyirekyi.sbs
Source: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmp	String decryptor: exilepolsiy.sbs
Source: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmp	String decryptor: bemuzzeki.sbs
Source: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmp	String decryptor: exemplarou.sbs
Source: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmp	String decryptor: isoplethui.sbs
Source: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmp	String decryptor: frizzettei.sbs
Source: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmp	String decryptor: exemplarou.sbs
Source: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmp	String decryptor: - Screen Resoluton:
Source: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmp	String decryptor: Workgroup: -
Source: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmp	String decryptor: H8NgCl--

Source: SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.5:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.5:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:49815 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:49852 version: TLS 1.2

Source: SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe

Code function: 0_2_00F09ABF FindFirstFileExW,

0_2_00F09ABF

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: 4x nop then mov eax, dword ptr [esp+0Ch]	0_2_00F4A0B9
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: 4x nop then movzx ebx, word ptr [ecx]	0_2_00F48051
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: 4x nop then mov dword ptr [esp], 00000000h	0_2_00F382E8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 7789B0CBh	0_2_00F643F8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_00F3A3BF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: 4x nop then movzx eax, word ptr [esi+ecx]	0_2_00F5E318
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: 4x nop then movzx ecx, word ptr [edi+eax]	0_2_00F645E8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	0_2_00F58528
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	0_2_00F4A687
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_00F4665F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: 4x nop then mov eax, ebx	0_2_00F3264D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00F62601
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 62429966h	0_2_00F607F8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 53F09CFAh	0_2_00F668A8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F8FD61B8h	0_2_00F3C89C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: 4x nop then cmp word ptr [ecx+eax+02h], 0000h	0_2_00F3A86A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: 4x nop then jmp dword ptr [0044FDB4h]	0_2_00F32849
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: 4x nop then mov byte ptr [edi], al	0_2_00F50813
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: 4x nop then jmp eax	0_2_00F2E9A5
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	0_2_00F5093D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: 4x nop then movzx edx, byte ptr [esi+ebx]	0_2_00F22928
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: 4x nop then jmp eax	0_2_00F2E914
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: 4x nop then cmp word ptr [ebp+edi+02h], 0000h	0_2_00F44AD8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: 4x nop then mov eax, dword ptr [esp+40h]	0_2_00F2EAC6
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: 4x nop then mov eax, dword ptr [esp+000006B8h]	0_2_00F3AA47
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 53F09CFAh	0_2_00F66A38
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00F66BB8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: 4x nop then cmp dword ptr [ebp+edx*8+00h], 9ECF05EBh	0_2_00F66BB8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: 4x nop then mov eax, dword ptr [esp+04h]	0_2_00F2CB78
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: 4x nop then mov byte ptr [edi], al	0_2_00F50B43
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], A70A987Fh	0_2_00F5CB36
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: 4x nop then mov byte ptr [edi], al	0_2_00F50B22
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	0_2_00F4AC81
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: 4x nop then movzx ecx, word ptr [ebp+00h]	0_2_00F28D88
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: 4x nop then mov eax, dword ptr [esp+40h]	0_2_00F2ED6B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00F42D48
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_00F44D38
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: 4x nop then jmp eax	0_2_00F46EC4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: 4x nop then mov word ptr [edx], 0000h	0_2_00F3CEB7
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: 4x nop then jmp ecx	0_2_00F62EAE
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], F3285E74h	0_2_00F64E98
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00F64E98
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00F5CE48
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: 4x nop then jmp ecx	0_2_00F62F6C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: 4x nop then mov eax, dword ptr [esi+04h]	0_2_00F30F6F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: 4x nop then mov dword ptr [esp+1Ch], 5E46585Eh	0_2_00F4CF30
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	0_2_00F50F18
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: 4x nop then mov eax, dword ptr [esi+14h]	0_2_00F50F18
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F3285E74h	0_2_00F60F18
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: 4x nop then mov ebp, eax	0_2_00F271D8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: 4x nop then mov word ptr [eax], dx	0_2_00F3F138
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: 4x nop then mov word ptr [esi], ax	0_2_00F3F138
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	0_2_00F4F2B8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], C274D4CAh	0_2_00F63290
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: 4x nop then mov eax, dword ptr [esp+0Ch]	0_2_00F493AF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], C274D4CAh	0_2_00F63390
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: 4x nop then movzx ebx, byte ptr [ecx+esi+25h]	0_2_00F25468
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: 4x nop then mov eax, dword ptr [esi+04h]	0_2_00F3340E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	0_2_00F4B56A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: 4x nop then mov word ptr [eax], dx	0_2_00F3F540
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: 4x nop then mov eax, dword ptr [esp+08h]	0_2_00F636C7
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: 4x nop then movzx edx, byte ptr [esi+edi]	0_2_00F21878
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 27BAF212h	0_2_00F63833
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], F3285E74h	0_2_00F45824
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F3285E74h	0_2_00F61918
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	0_2_00F4DA58
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], C85F7986h	0_2_00F49BA8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00F49BA8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], C85F7986h	0_2_00F49BA8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: 4x nop then mov word ptr [edx], ax	0_2_00F47B69
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: 4x nop then jmp eax	0_2_00F47B48
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: 4x nop then cmp word ptr [eax+esi+02h], 0000h	0_2_00F4BB20
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: 4x nop then cmp byte ptr [ebx], 00000000h	0_2_00F33CBA
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00F65C62
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: 4x nop then jmp eax	0_2_00F45C1B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: 4x nop then mov eax, dword ptr [ebp-10h]	0_2_00F2DDC4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: 4x nop then movzx edi, byte ptr [ecx+esi]	0_2_00F23D78
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: 4x nop then mov edi, ecx	0_2_00F31D02
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: 4x nop then mov ecx, dword ptr [edx]	0_2_00F1DED8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: 4x nop then mov eax, dword ptr [esi+20h]	0_2_00F33E69
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00F29FE8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00F29FE8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	0_2_00F4FFD5
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: 4x nop then jmp ecx	0_2_00F25FB0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	0_2_00F4FF74
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: 4x nop then dec ebx	0_2_00F5BF08
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp]	1_2_0040D110
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp]	1_2_0040D110
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], C274D4CAh	1_2_004463B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp]	1_2_00445700
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 27BAF212h	1_2_0044695B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp+04h]	1_2_0040FCA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [ebp-10h]	1_2_00410EEC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F3285E74h	1_2_00444040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov ecx, dword ptr [edx]	1_2_00401000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esi+20h]	1_2_00416F91
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then dec ebx	1_2_0043F030
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp ecx	1_2_00446094
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp+0Ch]	1_2_0042D1E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov word ptr [eax], dx	1_2_00422260
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov word ptr [esi], ax	1_2_00422260
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esi+04h]	1_2_004142FC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov ebp, eax	1_2_0040A300
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	1_2_004323E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	1_2_004323E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	1_2_004323E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov byte ptr [edi], al	1_2_004323E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	1_2_004323E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esi+14h]	1_2_004323E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx eax, word ptr [esi+ecx]	1_2_00441440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov word ptr [eax], cx	1_2_0041D457
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp+0Ch]	1_2_0042C470
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	1_2_0042E40C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov dword ptr [esp], 00000000h	1_2_0041B410
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], C274D4CAh	1_2_004464B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov word ptr [eax], cx	1_2_00429510
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 7789B0CBh	1_2_00447520
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esi+04h]	1_2_00416536
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx ebx, byte ptr [ecx+esi+25h]	1_2_00408590
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	1_2_0043B650
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	1_2_0042E66A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx ecx, word ptr [edi+eax]	1_2_00447710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp+08h]	1_2_004467EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	1_2_0042D7AF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov word ptr [eax], dx	1_2_004228E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp word ptr [ecx+eax+02h], 0000h	1_2_0041D961
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 62429966h	1_2_00443920
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 53F09CFAh	1_2_004499D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx edx, byte ptr [esi+edi]	1_2_004049A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F3285E74h	1_2_00444A40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx edx, byte ptr [esi+ebx]	1_2_00405A50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp eax	1_2_00411A3C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp eax	1_2_00411ACD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 53F09CFAh	1_2_00449B60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp+000006B8h]	1_2_0041DB6F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F8FD61B8h	1_2_0041DB6F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esi+04h]	1_2_00413BE2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp+40h]	1_2_00411BEE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	1_2_00430B80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp word ptr [eax+esi+02h], 0000h	1_2_0042EC48
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp word ptr [ebp+edi+02h], 0000h	1_2_00427C00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], A70A987Fh	1_2_0043FC20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], C85F7986h	1_2_0042CCD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp]	1_2_0042CCD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], C85F7986h	1_2_0042CCD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp]	1_2_00449CE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [ebp+edx*8+00h], 9ECF05EBh	1_2_00449CE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp eax	1_2_0042AC91
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov word ptr [edx], ax	1_2_0042AC91
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov dword ptr [esp+1Ch], 5E46585Eh	1_2_0042FD10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	1_2_0042DD29
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp]	1_2_00448D8A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx ebx, word ptr [ecx]	1_2_0042AE57
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov word ptr [eax], cx	1_2_00427E60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp]	1_2_00425E70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov edi, ecx	1_2_00414E2A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp+40h]	1_2_00411E93
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx edi, byte ptr [ecx+esi]	1_2_00406EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx ecx, word ptr [ebp+00h]	1_2_0040BEB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp byte ptr [ebx], 00000000h	1_2_00416EBF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp eax	1_2_00429F62
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp]	1_2_0043FF70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], F3285E74h	1_2_00447FC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp]	1_2_00447FC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp ecx	1_2_00408FD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp ecx	1_2_00445FD6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov word ptr [edx], 0000h	1_2_0041FFDF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esi+20h]	1_2_00416F91

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:49726 -> 104.21.53.8:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49726 -> 104.21.53.8:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: isoplethui.sbs
Source: Malware configuration extractor	URLs: exemplarou.sbs
Source: Malware configuration extractor	URLs: exilepolsiy.sbs
Source: Malware configuration extractor	URLs: laddyirekyi.sbs
Source: Malware configuration extractor	URLs: frizzettei.sbs
Source: Malware configuration extractor	URLs: bemuzzeki.sbs
Source: Malware configuration extractor	URLs: invinjurhey.sbs
Source: Malware configuration extractor	URLs: wickedneatr.sbs

Source: Joe Sandbox View	IP Address: 104.21.53.8 104.21.53.8
Source: Joe Sandbox View	IP Address: 104.102.49.254 104.102.49.254

Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View	ASN Name: AKAMAI-ASUS AKAMAI-ASUS

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: sergei-esenin.com

Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.75
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.75
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.75
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.75
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.75
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.75
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.75
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.75
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.75
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.75
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.75
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.75
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.75
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.75
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.75
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.75
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.108.226
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.108.226
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com

Source: global traffic	DNS traffic detected: DNS query: exemplarou.sbs
Source: global traffic	DNS traffic detected: DNS query: frizzettei.sbs
Source: global traffic	DNS traffic detected: DNS query: isoplethui.sbs
Source: global traffic	DNS traffic detected: DNS query: bemuzzeki.sbs
Source: global traffic	DNS traffic detected: DNS query: exilepolsiy.sbs
Source: global traffic	DNS traffic detected: DNS query: laddyirekyi.sbs
Source: global traffic	DNS traffic detected: DNS query: invinjurhey.sbs
Source: global traffic	DNS traffic detected: DNS query: wickedneatr.sbs
Source: global traffic	DNS traffic detected: DNS query: steamcommunity.com
Source: global traffic	DNS traffic detected: DNS query: sergei-esenin.com

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: sergei-esenin.com

Source: Amcache.hve.5.dr	String found in binary or memory: http://upx.sf.net
Source: MSBuild.exe, 00000001.00000002.2176525629.000000000127E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://avatars.akamai.steamstatic
Source: MSBuild.exe, 00000001.00000002.2176525629.000000000127E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akam
Source: MSBuild.exe, 00000001.00000002.2176525629.000000000127E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamsta
Source: MSBuild.exe, 00000001.00000002.2176525629.000000000127E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.co
Source: MSBuild.exe, 00000001.00000002.2176581819.00000000012BA000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2176525629.000000000127E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/globalv2.css?v=PAcV2zMBzzSV&l=english
Source: MSBuild.exe, 00000001.00000002.2176581819.00000000012BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/promo/summer2017/stickers.css?v=HA2Yr5oy3FFG&amp
Source: MSBuild.exe, 00000001.00000002.2176581819.00000000012BA000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2176525629.000000000127E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/header.css?v=NFoCa4OkAxRb&l=english
Source: MSBuild.exe, 00000001.00000002.2176581819.00000000012BA000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2176525629.000000000127E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/modalContent.css?v=.VpiwkLAYt9r1
Source: MSBuild.exe, 00000001.00000002.2176581819.00000000012BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/profilev2.css?v=M_qL4gO2sKII&l=englis
Source: MSBuild.exe, 00000001.00000002.2176525629.000000000127E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/profilevl
Source: MSBuild.exe, 00000001.00000002.2176581819.00000000012BA000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2176525629.000000000127E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/global.js?v=9OzcxMXbaV84&l=english
Source: MSBuild.exe, 00000001.00000002.2176581819.00000000012BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC
Source: MSBuild.exe, 00000001.00000002.2176525629.000000000127E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/modalContent.js?v=f2hMA1v9Zkc8&l=engl
Source: MSBuild.exe, 00000001.00000002.2176525629.000000000127E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=english
Source: MSBuild.exe, 00000001.00000002.2176525629.000000000127E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/profile.js?v=f3vq
Source: MSBuild.exe, 00000001.00000002.2176525629.000000000127E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/promo/stickers.js?v=upl9NJ5D2xkP&l=en
Source: MSBuild.exe, 00000001.00000002.2176581819.00000000012BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw
Source: MSBuild.exe, 00000001.00000002.2176581819.00000000012BA000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2176525629.000000000127E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpEF8tL
Source: MSBuild.exe, 00000001.00000002.2176525629.000000000127E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/webui/clientcom.js?v=qu5K
Source: MSBuild.exe, 00000001.00000002.2176581819.00000000012BA000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2176525629.000000000127E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/buttons.css?v=PUJIfhtcQn7W&l=english
Source: MSBuild.exe, 00000001.00000002.2176525629.000000000127E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/motiva_sans.css?v=-DH0xTYpnVe2&l=engl
Source: MSBuild.exe, 00000001.00000002.2176581819.00000000012BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/shared_global.css?v=ezWS9te9Zwm9&l=en
Source: MSBuild.exe, 00000001.00000002.2176525629.000000000127E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/shared_resp&
Source: MSBuild.exe, 00000001.00000002.2176581819.00000000012BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/shared_responsive.css?v=sHIIcMzCffX6&
Source: MSBuild.exe, 00000001.00000002.2176581819.00000000012BA000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2176525629.000000000127E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/shared_global.js?v=REEGJU1hwkYl&am
Source: MSBuild.exe, 00000001.00000002.2176525629.000000000127E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=pSv
Source: MSBuild.exe, 00000001.00000002.2176581819.00000000012BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0
Source: MSBuild.exe, 00000001.00000002.2176402654.000000000124F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/
Source: MSBuild.exe, 00000001.00000002.2176402654.000000000124F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/=#
Source: MSBuild.exe, 00000001.00000002.2176402654.000000000124F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/E
Source: MSBuild.exe, 00000001.00000002.2176525629.000000000127E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/GG
Source: MSBuild.exe, 00000001.00000002.2176525629.000000000127E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/api
Source: MSBuild.exe, 00000001.00000002.2176525629.000000000127E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/apih
Source: MSBuild.exe, 00000001.00000002.2176402654.000000000124F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/
Source: MSBuild.exe, 00000001.00000002.2176402654.000000000124F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900
Source: MSBuild.exe, 00000001.00000002.2176525629.000000000127E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/inventory/
Source: MSBuild.exe, 00000001.00000002.2176345443.000000000122A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com:443/profiles/76561199724331900
Source: MSBuild.exe, 00000001.00000002.2176402654.0000000001245000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wickedneatr.sbs/api

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49947 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49992 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49969 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49994 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49942
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49940
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49939
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49938
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49937
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49936
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49935
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49934
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49933
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49932
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49931
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49930
Source: unknown	Network traffic detected: HTTP traffic on port 49925 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49971 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49936 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49960 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49929
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49928
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49927
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49926
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49925
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49924
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49923
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49922

Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.5:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.5:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:49815 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:49852 version: TLS 1.2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 1_2_00438720 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

1_2_00438720

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 1_2_00438720 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

1_2_00438720

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 1_2_004390EE GetDC,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetCurrentObject,GetObjectW,DeleteObject,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,

1_2_004390EE

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: 0_2_00EF2021	0_2_00EF2021
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: 0_2_00F240C8	0_2_00F240C8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: 0_2_00F22088	0_2_00F22088
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: 0_2_00F1E1CF	0_2_00F1E1CF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: 0_2_00F4E1A8	0_2_00F4E1A8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: 0_2_00F4E132	0_2_00F4E132
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: 0_2_00F22123	0_2_00F22123
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: 0_2_00F1E272	0_2_00F1E272
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: 0_2_00F28278	0_2_00F28278
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: 0_2_00F1E27B	0_2_00F1E27B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: 0_2_00F20488	0_2_00F20488
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: 0_2_00F1E455	0_2_00F1E455
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: 0_2_00F1E527	0_2_00F1E527
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: 0_2_00F58798	0_2_00F58798
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: 0_2_00F4E738	0_2_00F4E738
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: 0_2_00F64988	0_2_00F64988
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: 0_2_00EFCAF2	0_2_00EFCAF2
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: 0_2_00F24AC8	0_2_00F24AC8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: 0_2_00F3AA47	0_2_00F3AA47
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: 0_2_00F4AD84	0_2_00F4AD84
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: 0_2_00F28D88	0_2_00F28D88
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: 0_2_00F26D40	0_2_00F26D40
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: 0_2_00F64E98	0_2_00F64E98
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: 0_2_00F66FA8	0_2_00F66FA8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: 0_2_00F60F18	0_2_00F60F18
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: 0_2_00F2EF08	0_2_00F2EF08
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: 0_2_00F2B078	0_2_00F2B078
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: 0_2_00F271D8	0_2_00F271D8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: 0_2_00F551A8	0_2_00F551A8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: 0_2_00EF729C	0_2_00EF729C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: 0_2_00F533C8	0_2_00F533C8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: 0_2_00F0D39B	0_2_00F0D39B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: 0_2_00F394C8	0_2_00F394C8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: 0_2_00F25468	0_2_00F25468
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: 0_2_00F5B778	0_2_00F5B778
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: 0_2_00F27728	0_2_00F27728
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: 0_2_00F0572C	0_2_00F0572C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: 0_2_00F61918	0_2_00F61918
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: 0_2_00F49BA8	0_2_00F49BA8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: 0_2_00F0BB36	0_2_00F0BB36
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: 0_2_00F03C92	0_2_00F03C92
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: 0_2_00F27DE8	0_2_00F27DE8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: 0_2_00EF1D79	0_2_00EF1D79
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: 0_2_00EFFEF0	0_2_00EFFEF0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: 0_2_00F1DED8	0_2_00F1DED8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00410228	1_2_00410228
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00444040	1_2_00444040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00401000	1_2_00401000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00412030	1_2_00412030
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0044A0D0	1_2_0044A0D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00405160	1_2_00405160
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_004071F0	1_2_004071F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0040E1A0	1_2_0040E1A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_004382D0	1_2_004382D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_004312D0	1_2_004312D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_004012F7	1_2_004012F7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0040A300	1_2_0040A300
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_004323E0	1_2_004323E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0040B3A0	1_2_0040B3A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_004013A3	1_2_004013A3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0042C470	1_2_0042C470
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_004364F0	1_2_004364F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00414487	1_2_00414487
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0041049B	1_2_0041049B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0041C5F0	1_2_0041C5F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00408590	1_2_00408590
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_004035B0	1_2_004035B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0040164F	1_2_0040164F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00448652	1_2_00448652
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0043F620	1_2_0043F620
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_004486F0	1_2_004486F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0040A850	1_2_0040A850
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00431860	1_2_00431860
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0043B8C0	1_2_0043B8C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0043E8A0	1_2_0043E8A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0042098B	1_2_0042098B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_004489A0	1_2_004489A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00444A40	1_2_00444A40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00448A80	1_2_00448A80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00447AB0	1_2_00447AB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0041DB6F	1_2_0041DB6F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00407BF0	1_2_00407BF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00448C02	1_2_00448C02
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0042CCD0	1_2_0042CCD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00446CBF	1_2_00446CBF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00428D62	1_2_00428D62
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0042FD10	1_2_0042FD10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0042DD29	1_2_0042DD29
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0042AE57	1_2_0042AE57
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00448E70	1_2_00448E70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00414E2A	1_2_00414E2A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0040BEB0	1_2_0040BEB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00416EBF	1_2_00416EBF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0040AF10	1_2_0040AF10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00447FC0	1_2_00447FC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00408FD0	1_2_00408FD0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 0040CAA0 appears 48 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 0041D300 appears 152 times
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: String function: 00F29978 appears 93 times
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: String function: 00EF7B80 appears 49 times
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: String function: 00F3A1D8 appears 152 times

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6036 -s 272

Source: SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe, 00000000.00000000.2147772214.0000000000F78000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameproquota.exej% vs SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe
Source: SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Binary or memory string: OriginalFilenameproquota.exej% vs SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe

Source: SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe

Static PE information: Section: .data ZLIB complexity 0.9912259615384615

Source: classification engine

Classification label: mal100.troj.evad.winEXE@4/5@10/2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 1_2_00438220 CoCreateInstance,

1_2_00438220

Source: C:\Windows\SysWOW64\WerFault.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6036

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\220ebe1b-d4bc-487c-b5bf-68153413dea8

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Command line argument: MZx	0_2_00EF2021
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Command line argument: MZx	0_2_00EF2021
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Command line argument: MZx	0_2_00EF2021

Source: SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe

ReversingLabs: Detection: 36%

Source: unknown	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6036 -s 272
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dpapi.dll	Jump to behavior

Source: SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: 0_2_00EF71AD push ecx; ret		0_2_00EF71C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0044F23B push edx; ret		1_2_0044F24B

Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe

API coverage: 4.2 %

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 6052

Thread sleep time: -60000s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe

Code function: 0_2_00F09ABF FindFirstFileExW,

0_2_00F09ABF

Source: Amcache.hve.5.dr	Binary or memory string: VMware
Source: MSBuild.exe, 00000001.00000002.2176236948.000000000121C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW8
Source: Amcache.hve.5.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.5.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.5.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.5.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.5.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.5.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.5.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: MSBuild.exe, 00000001.00000002.2176455672.000000000126B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.5.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.5.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.5.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.5.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.5.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.5.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.5.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.5.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.5.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.5.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.5.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.5.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.5.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.5.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.5.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.5.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.5.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.5.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.5.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.5.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: MSBuild.exe, 00000001.00000002.2176455672.000000000126B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW;d
Source: Amcache.hve.5.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 1_2_00445BB0 LdrInitializeThunk,

1_2_00445BB0

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe

Code function: 0_2_00EF7922 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00EF7922

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: 0_2_00EF2003 mov edi, dword ptr fs:[00000030h]	0_2_00EF2003
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: 0_2_00F0A64C mov eax, dword ptr fs:[00000030h]	0_2_00F0A64C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: 0_2_00F00F2E mov ecx, dword ptr fs:[00000030h]	0_2_00F00F2E

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe

Code function: 0_2_00F0CC4B GetProcessHeap,

0_2_00F0CC4B

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: 0_2_00EF7610 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00EF7610
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: 0_2_00EF7922 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00EF7922
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: 0_2_00EF7AAF SetUnhandledExceptionFilter,	0_2_00EF7AAF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: 0_2_00EFDA73 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00EFDA73

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 value starts with: 4D5A

Jump to behavior

LummaC encrypted strings found

Source: SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	String found in binary or memory: frizzettei.sbs
Source: SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	String found in binary or memory: isoplethui.sbs
Source: SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	String found in binary or memory: exemplarou.sbs
Source: SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	String found in binary or memory: invinjurhey.sbs
Source: SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	String found in binary or memory: wickedneatr.sbs
Source: SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	String found in binary or memory: exilepolsiy.sbs
Source: SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	String found in binary or memory: laddyirekyi.sbs
Source: SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	String found in binary or memory: bemuzzeki.sbs

Writes to foreign memory regions

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 401000	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 44B000	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 44E000	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 45E000	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: E10008	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	0_2_00F0C085
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: GetLocaleInfoW,	0_2_00F0622B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: EnumSystemLocalesW,	0_2_00F0C372
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: EnumSystemLocalesW,	0_2_00F0C327
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_00F0C498
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: EnumSystemLocalesW,	0_2_00F0C40D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: GetLocaleInfoW,	0_2_00F0C6EB
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_00F0C814
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_00F0C9E9
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: GetLocaleInfoW,	0_2_00F0C91A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Code function: EnumSystemLocalesW,	0_2_00F05D7F

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe

Code function: 0_2_00EF7815 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00EF7815

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Amcache.hve.5.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.5.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.5.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.5.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: 1.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.MSBuild.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe.ef0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.2176103954.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: 1.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.MSBuild.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe.ef0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.2176103954.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	311 Process Injection	2 Virtualization/Sandbox Evasion	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Screen Capture	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 PowerShell	Boot or Logon Initialization Scripts	1 DLL Side-Loading	311 Process Injection	LSASS Memory	41 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Deobfuscate/Decode Files or Information	Security Account Manager	2 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	2 Clipboard Data	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	3 Obfuscated Files or Information	NTDS	1 File and Directory Discovery	Distributed Component Object Model	Input Capture	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Software Packing	LSA Secrets	13 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label
SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	37%	ReversingLabs	Win32.Trojan.Generic
SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	100%	Avira	HEUR/AGEN.1310458
SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://steamcommunity.com/profiles/76561199724331900	100%	URL Reputation	malware
https://community.akamai.steamstatic.com/public/css/skin_1/header.css?v=NFoCa4OkAxRb&l=english	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=pSv	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/global.js?v=9OzcxMXbaV84&l=english	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/css/motiva_sans.css?v=-DH0xTYpnVe2&l=engl	0%	URL Reputation	safe
http://upx.sf.net	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/css/skin_1/modalContent.css?v=.VpiwkLAYt9r1	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/promo/stickers.js?v=upl9NJ5D2xkP&l=en	0%	URL Reputation	safe
https://steamcommunity.com/profiles/76561199724331900/inventory/	100%	URL Reputation	malware
https://community.akamai.steamstatic.com/public/css/promo/summer2017/stickers.css?v=HA2Yr5oy3FFG&amp	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/css/shared_global.css?v=ezWS9te9Zwm9&l=en	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/javascript/shared_global.js?v=REEGJU1hwkYl&am	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/css/shared_responsive.css?v=sHIIcMzCffX6&	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/css/buttons.css?v=PUJIfhtcQn7W&l=english	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=english	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpEF8tL	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/modalContent.js?v=f2hMA1v9Zkc8&l=engl	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false	unknown
steamcommunity.com	104.102.49.254	true	true	unknown
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false	unknown
sergei-esenin.com	104.21.53.8	true	true	unknown
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false	unknown
frizzettei.sbs	unknown	unknown	true	unknown
laddyirekyi.sbs	unknown	unknown	true	unknown
wickedneatr.sbs	unknown	unknown	true	unknown
bemuzzeki.sbs	unknown	unknown	true	unknown
invinjurhey.sbs	unknown	unknown	true	unknown
isoplethui.sbs	unknown	unknown	true	unknown
exilepolsiy.sbs	unknown	unknown	true	unknown
exemplarou.sbs	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
frizzettei.sbs	true		unknown
https://steamcommunity.com/profiles/76561199724331900	true	URL Reputation: malware	unknown
invinjurhey.sbs	true		unknown
exilepolsiy.sbs	true		unknown
laddyirekyi.sbs	true		unknown
isoplethui.sbs	true		unknown
bemuzzeki.sbs	true		unknown
exemplarou.sbs	true		unknown
wickedneatr.sbs	true		unknown
https://sergei-esenin.com/api	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://sergei-esenin.com/E	MSBuild.exe, 00000001.00000002.2176402654.000000000124F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://sergei-esenin.com/GG	MSBuild.exe, 00000001.00000002.2176525629.000000000127E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/css/skin_1/header.css?v=NFoCa4OkAxRb&l=english	MSBuild.exe, 00000001.00000002.2176581819.00000000012BA000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2176525629.000000000127E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=pSv	MSBuild.exe, 00000001.00000002.2176525629.000000000127E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/global.js?v=9OzcxMXbaV84&l=english	MSBuild.exe, 00000001.00000002.2176581819.00000000012BA000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2176525629.000000000127E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/css/motiva_sans.css?v=-DH0xTYpnVe2&l=engl	MSBuild.exe, 00000001.00000002.2176525629.000000000127E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akam	MSBuild.exe, 00000001.00000002.2176525629.000000000127E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com:443/profiles/76561199724331900	MSBuild.exe, 00000001.00000002.2176345443.000000000122A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://sergei-esenin.com/	MSBuild.exe, 00000001.00000002.2176402654.000000000124F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://sergei-esenin.com/apih	MSBuild.exe, 00000001.00000002.2176525629.000000000127E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://wickedneatr.sbs/api	MSBuild.exe, 00000001.00000002.2176402654.0000000001245000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://upx.sf.net	Amcache.hve.5.dr	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw	MSBuild.exe, 00000001.00000002.2176581819.00000000012BA000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/webui/clientcom.js?v=qu5K	MSBuild.exe, 00000001.00000002.2176525629.000000000127E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/css/skin_1/modalContent.css?v=.VpiwkLAYt9r1	MSBuild.exe, 00000001.00000002.2176581819.00000000012BA000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2176525629.000000000127E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/profile.js?v=f3vq	MSBuild.exe, 00000001.00000002.2176525629.000000000127E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/javascript/promo/stickers.js?v=upl9NJ5D2xkP&l=en	MSBuild.exe, 00000001.00000002.2176525629.000000000127E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/profiles/76561199724331900/inventory/	MSBuild.exe, 00000001.00000002.2176525629.000000000127E000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
https://community.akamai.steamstatic.com/public/css/promo/summer2017/stickers.css?v=HA2Yr5oy3FFG&amp	MSBuild.exe, 00000001.00000002.2176581819.00000000012BA000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/css/shared_global.css?v=ezWS9te9Zwm9&l=en	MSBuild.exe, 00000001.00000002.2176581819.00000000012BA000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0	MSBuild.exe, 00000001.00000002.2176581819.00000000012BA000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/css/skin_1/profilevl	MSBuild.exe, 00000001.00000002.2176525629.000000000127E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/shared/javascript/shared_global.js?v=REEGJU1hwkYl&am	MSBuild.exe, 00000001.00000002.2176581819.00000000012BA000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2176525629.000000000127E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/css/shared_responsive.css?v=sHIIcMzCffX6&	MSBuild.exe, 00000001.00000002.2176581819.00000000012BA000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/css/buttons.css?v=PUJIfhtcQn7W&l=english	MSBuild.exe, 00000001.00000002.2176581819.00000000012BA000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2176525629.000000000127E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.co	MSBuild.exe, 00000001.00000002.2176525629.000000000127E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/css/globalv2.css?v=PAcV2zMBzzSV&l=english	MSBuild.exe, 00000001.00000002.2176581819.00000000012BA000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2176525629.000000000127E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=english	MSBuild.exe, 00000001.00000002.2176525629.000000000127E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/css/shared_resp&	MSBuild.exe, 00000001.00000002.2176525629.000000000127E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpEF8tL	MSBuild.exe, 00000001.00000002.2176581819.00000000012BA000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2176525629.000000000127E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://avatars.akamai.steamstatic	MSBuild.exe, 00000001.00000002.2176525629.000000000127E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com/	MSBuild.exe, 00000001.00000002.2176402654.000000000124F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamsta	MSBuild.exe, 00000001.00000002.2176525629.000000000127E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/css/skin_1/profilev2.css?v=M_qL4gO2sKII&l=englis	MSBuild.exe, 00000001.00000002.2176581819.00000000012BA000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC	MSBuild.exe, 00000001.00000002.2176581819.00000000012BA000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/modalContent.js?v=f2hMA1v9Zkc8&l=engl	MSBuild.exe, 00000001.00000002.2176525629.000000000127E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://sergei-esenin.com/=#	MSBuild.exe, 00000001.00000002.2176402654.000000000124F000.00000004.00000020.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.21.53.8	sergei-esenin.com	United States		13335	CLOUDFLARENETUS	true
104.102.49.254	steamcommunity.com	United States		16625	AKAMAI-ASUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1528442
Start date and time:	2024-10-07 22:44:09 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 17s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@4/5@10/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 68% Number of executed functions: 11 Number of non-executed functions: 164
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 40.126.32.68, 20.190.160.22, 40.126.32.140, 40.126.32.136, 20.190.160.20, 40.126.32.72, 20.190.160.17, 40.126.32.76, 192.229.221.95, 40.115.3.253, 199.232.210.172, 40.126.32.133, 20.42.73.29, 52.149.20.212, 20.3.187.198, 4.175.87.197
Excluded domains from analysis (whitelisted): prdv4a.aadg.msidentity.com, client.wns.windows.com, ctldl.windowsupdate.com.delivery.microsoft.com, otelrules.azureedge.net, slscr.update.microsoft.com, www.tm.v4.a.prd.aadg.akadns.net, otelrules.afd.azureedge.net, ctldl.windowsupdate.com, login.msa.msidentity.com, fe3cr.delivery.mp.microsoft.com, wns.notify.trafficmanager.net, fe3.delivery.mp.microsoft.com, ocsp.digicert.com, login.live.com, ocsp.edge.digicert.com, blobcollector.events.data.trafficmanager.net, onedsblobprdeus15.eastus.cloudapp.azure.com, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, azureedge-t-prod.trafficmanager.net, umwatson.events.data.microsoft.com, wu-b-net.trafficmanager.net, www.tm.lg.prod.aadmsa.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe

Simulations

Behavior and APIs

Time	Type	Description
16:45:12	API Interceptor	2x Sleep call for process: MSBuild.exe modified
16:45:15	API Interceptor	1x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.21.53.8	lihZ6gUU7V.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	CSY6k9gpVb.exe	Get hash	malicious	LummaC	Browse
	TuQlz67byH.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	c3KH2gLNrM.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Stealc, Vidar	Browse
	Setup.exe	Get hash	malicious	LummaC	Browse
	8ObkdHP9Hq.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Stealc	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse
104.102.49.254	http://gtm-cn-j4g3qqvf603.steamproxy1.com/	Get hash	malicious	Unknown	Browse	www.valvesoftware.com/legal.htm

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s-part-0017.t-0009.t-msedge.net	https://login.stmarytx.edu/cas/logout?service=http%3A%2F%2Fgoogle.com%2Famp%2Fmatrikaengineeringworks.com/hebc/?#?m=bWVsaXNzYWdAd2Utd29ybGR3aWRlLmNvbQ==	Get hash	malicious	Unknown	Browse	13.107.246.45
	https://dsdhie.org/dsjhem	Get hash	malicious	Unknown	Browse	13.107.246.45
	SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	+18365366724753456-83736-10244688.html	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	https://s.craft.me/yB5midhwwaHUPW	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	https://t.dripemail3.com/c/eyJhbGciOiJIUzI1NiJ9.eyJhdWQiOiJkZXRvdXIiLCJpc3MiOiJtb25vbGl0aCIsInN1YiI6ImRldG91cl9saW5rIiwiaWF0IjoxNzI4MzA1Mzk4LCJuYmYiOjE3MjgzMDUzOTgsImFjY291bnRfaWQiOiIyNzYyNjA5IiwiZGVsaXZlcnlfaWQiOiJpeHI5d3pqeGcwZnI2NGJjbGwycyIsInRva2VuIjoiaXhyOXd6anhnMGZyNjRiY2xsMnMiLCJzZW5kX2F0IjoxNzI4MzA0MzU0LCJlbWFpbF9pZCI6OTk2Mzg3MCwiZW1haWxhYmxlX3R5cGUiOiJCcm9hZGNhc3QiLCJlbWFpbGFibGVfaWQiOjM5NTM4MjUsInVybCI6Imh0dHBzOi8vZGFpbHlhbGFza2EuY29tL25ld3M_X19zPWw5bzljOTZzbG8xZjF3aGFiODZrJnV0bV9zb3VyY2U9ZHJpcCZ1dG1fbWVkaXVtPWVtYWlsJnV0bV9jYW1wYWlnbj1TcHJpbmcraGFzK3NwcnVuZyslRjAlOUYlOEMlQjEifQ.HIDfaWGNVn-TCtUT4qZNHq7EdymoLEqvVA8XxZBU8z8	Get hash	malicious	HtmlDropper	Browse	13.107.246.45
	https://entertaininmotionre.pro/IQCm/	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	wULBz8VjH0.exe	Get hash	malicious	Vidar	Browse	13.107.246.45
	FdjDPFGTZS.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	13.107.246.45
	https://doccloudshareddrive.com/?auth=1&shareable=true&access=restricted&check_type=password&timestamp=2024-10-07T16%3A53%3A27.609Z&priority=high&include_details=true	Get hash	malicious	Unknown	Browse	13.107.246.45
sergei-esenin.com	lihZ6gUU7V.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.21.53.8
	Bn7LPdQA1s.exe	Get hash	malicious	LummaC, Vidar	Browse	172.67.206.204
	SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	file.exe	Get hash	malicious	LummaC	Browse	104.21.53.8
	CSY6k9gpVb.exe	Get hash	malicious	LummaC	Browse	104.21.53.8
	TuQlz67byH.exe	Get hash	malicious	LummaC	Browse	104.21.53.8
	file.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	CatalogApp.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	file.exe	Get hash	malicious	LummaC	Browse	104.21.53.8
	file.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
bg.microsoft.map.fastly.net	https://login.stmarytx.edu/cas/logout?service=http%3A%2F%2Fgoogle.com%2Famp%2Fmatrikaengineeringworks.com/hebc/?#?m=bWVsaXNzYWdAd2Utd29ybGR3aWRlLmNvbQ==	Get hash	malicious	Unknown	Browse	199.232.214.172
	WiTqtf1aiE.exe	Get hash	malicious	LummaC, Vidar	Browse	199.232.214.172
	https://s.craft.me/yB5midhwwaHUPW	Get hash	malicious	HTMLPhisher	Browse	199.232.214.172
	https://entertaininmotionre.pro/IQCm/	Get hash	malicious	HTMLPhisher	Browse	199.232.210.172
	https://dsdhie.org/dsjhem	Get hash	malicious	Unknown	Browse	199.232.214.172
	FdjDPFGTZS.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	199.232.214.172
	Aew8SXjXEb.exe	Get hash	malicious	Stealc	Browse	199.232.214.172
	Adobe-Setup.msi	Get hash	malicious	Korplug	Browse	199.232.210.172
	https://dsdhie.org/dsjhem	Get hash	malicious	Unknown	Browse	199.232.214.172
	TuQlz67byH.exe	Get hash	malicious	LummaC	Browse	199.232.210.172
steamcommunity.com	utmggBCMML.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	lihZ6gUU7V.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.102.49.254
	Bn7LPdQA1s.exe	Get hash	malicious	LummaC, Vidar	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Get hash	malicious	LummaC	Browse	92.122.104.90
	WiTqtf1aiE.exe	Get hash	malicious	LummaC, Vidar	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	out.exe	Get hash	malicious	Vidar	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	FdjDPFGTZS.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.102.49.254

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	lihZ6gUU7V.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.21.53.8
	Bn7LPdQA1s.exe	Get hash	malicious	LummaC, Vidar	Browse	172.67.206.204
	https://www.dropbox.com/scl/fi/qo6796ed7hlrt0v8k9nr6/Patagonia-Health-Barcode-Scanner-Setup-2024.exe?rlkey=5bmndvx8124ztopqewiogbnlt&st=yvxpokhf&dl=0	Get hash	malicious	Unknown	Browse	1.1.1.1
	https://dsdhie.org/dsjhem	Get hash	malicious	Unknown	Browse	188.114.96.3
	L-tron_Payroll.docx	Get hash	malicious	Unknown	Browse	104.17.25.14
	SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	https://communications-chamber-confidentiality-limitation.trycloudflare.com/spec/#bWNhcnR3cmlnaHRAY2hlbXVuZ2NhbmFsLmNvbQ==	Get hash	malicious	Unknown	Browse	104.16.231.132
	+18365366724753456-83736-10244688.html	Get hash	malicious	HTMLPhisher	Browse	188.114.96.3
	https://url.avanan.click/v2/r01/___https://www.tiktok.com/qnspdA7?fni=6cbb&qfsl=js&xhjsj=gnt_zwq&yfwljy=myyux:ddBBB.lttlqj.hfdzwq?v=frudxdkniljyAkC.sEd.frl___.YXAzOnNvdXRoZXJua2l0Y2hlbmFuZGdyaWxsOmE6bzo2MGY0ZmI3MTkzODQ4OWRiOGFlZjY2ODI4ODlkMDk3NDo3OmRlYjY6NjI5YzkxZjFmNmQ3ZjI1NWIxN2UwYTI5ZTNmZjcyMTQyNTg3NmZhMDQyOWZlMDI4MDhmODRlNWVhYWU3MjJhZDpoOlQ6VA#ZHN5aHJlQG9sZ29vbmlrLmNvbQ==	Get hash	malicious	Unknown	Browse	172.66.0.235
	https://url.avanan.click/v2/r01/___https://www.tiktok.com/qnspdA7?fni=6cbb&qfsl=js&xhjsj=gnt_zwq&yfwljy=myyux:ddBBB.lttlqj.hfdzwq?v=frudxdkniljyAkC.sEd.frl___.YXAzOnNvdXRoZXJua2l0Y2hlbmFuZGdyaWxsOmE6bzo2MGY0ZmI3MTkzODQ4OWRiOGFlZjY2ODI4ODlkMDk3NDo3OmRlYjY6NjI5YzkxZjFmNmQ3ZjI1NWIxN2UwYTI5ZTNmZjcyMTQyNTg3NmZhMDQyOWZlMDI4MDhmODRlNWVhYWU3MjJhZDpoOlQ6VA#ZHN5aHJlQG9sZ29vbmlrLmNvbQ==	Get hash	malicious	Unknown	Browse	162.159.140.237
AKAMAI-ASUS	utmggBCMML.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	lihZ6gUU7V.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.102.49.254
	Bn7LPdQA1s.exe	Get hash	malicious	LummaC, Vidar	Browse	104.102.49.254
	https://www.dropbox.com/scl/fi/qo6796ed7hlrt0v8k9nr6/Patagonia-Health-Barcode-Scanner-Setup-2024.exe?rlkey=5bmndvx8124ztopqewiogbnlt&st=yvxpokhf&dl=0	Get hash	malicious	Unknown	Browse	184.28.90.27
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	https://dsdhie.org/dsjhem	Get hash	malicious	Unknown	Browse	88.221.169.152
	SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Get hash	malicious	LummaC	Browse	92.122.104.90
	https://statics.teams.cdn.office.net/evergreen-assets/safelinks/1/atp-safelinks.html?url=https%3A%2F%2Fphpstack-1335745-4931432.cloudwaysapps.com%2F%23%26%26%2B~XanJlZEBwcm9hZy5jb20=&locale=en-us&dest=https%3A%2F%2Fteams.microsoft.com%2Fapi%2Fmt%2Fpart%2Famer-03%2Fbeta%2Fatpsafelinks%2Fgeturlreputationsitev2%2F&pc=dqIG3sYngZE8N2eRBkF7CAkOWKg5g3tGjnQGJGQlc61U8QGlKCs5AzH6JKtW7FyetS1g5oEXSNBKJVlJbTCgrea0O041dBSjafsPfOc5KxbMkQRnpwalZQdhHfcjoeWL7rzuDGG%252fj2e7scaAUTCy2PY0WmBb87rgNNPdmEQne%252f00jq9aOpwCvhJrGkNK5f8MP5jaUwccFhr9IIoVaCOrXUhSnuRv%252fw%252bxhUGpneOsAgBs7CjJQbmepBIHfEqwCkqvDbYbxYB4Hm9sLVAOFaz9VFMFSXPJt4MqeWAChikWLAZATmvniptR3h97WVF%252fZtjtm3RxdNyPROzhUvL92w9fdWmSw%252bHBxn5rMHOUpaQU16ZpcfATiVaU51fqKaYO2v4ZnK7axAavLgOpgAJivuE6JO2sqksPH41Z6PVam5c4J%252bwwz5Z2pqrOSxPxEcPGeDff%252bxp9PApNxpvURRLl98WzRw%252ftZEOu%252foKPhjN0OiTGAQDLRWTF%252bMCzSQg37tk7ZYUYYc0Ycs4xDjchhFprJCCSfrZ8WyHq6cjqmnbgDKRQig28xGNFnSDEeWMDBQeeeVyNqDv0FAAxkSAMO%252b7t4Qu1y0h0MHJYEb5pxfOYe8Pyfcsn7pyR%252fkKEqziEQVGlIETrpjVMNyrhJrnX9S%252flWaxf0H3tD%252fqMhzPysO9QdPSJTG054WE4jq5GRqTKu8P25t4KJLY15Oz2j5iCg7Bd5lczhgv4PQevplLuCGckM%252fs5EPk2r2FkSOxHF51EB5FR2TgXQR5UAp2BbaWTm9irKwSSUK5z1MsGMDokVMEB4bQ9mpZrl1%252bDMixJ1mQyyLXpelmEyN8zw1nTsbXAvDQgIvPLPj0QUtphEMnmVEXMkQHiw2WHWUSxIxYcY%252fltyp6bnMrankPAnpChbWQmk95rKsUz8tqtLjNDclK1y1FLy%252fh7sed9duxDDFupXnhmXxGJOmUV6FG1arxXL8urm1F98thG8anfchv3DafKsyVHHgmdUFNH6Uhcu4sB8fo0kqm2y7IWS96w5BeG334JvnFDJPLDPvtK5ojeXfDXh%252boKJdBxXGC9NmPwgDp8XeOavQnNlJRfUAXkhukdjDg1EHGF%252b9luUuTH%252fEbKHniTzx4OvIWUnDvXcdpuEIAnW8mDJzMXpmxpl3nwtTqeQWMeSNzjute9yTZEU%252beQk498EMyU%252fuPUg%252fSOH5r%252fwjGCsPpm%252f%252bUA00SsNvWuDD0AbNIKYubFuNKQ3SX6N7M11wOksoUG%252fz9IheWtOawwl7F0lqN3xkTQhfiiHovdudAPiB%252fzt25Im27XxPQ9s1c%252bnOWOPh6m%252bvaCQcj6bcwkFbNl5Y1KL7XQvirYSFsNXnrYuQvTPMk1n5CRq6dxsl9FRGV9MMdrZduC%252bG4B0zxLA58d8fTW2zfEXnRcMTgQKLK%252fmeZT7K3wwAvQiA%253d%253d%3B%20expires%3DWed%2C%2009%20Oct%202024%2014%3A05%3A23%20GMT%3B%20path%3D%2F%3B%20SameSite%3DNone%3B%20secu	Get hash	malicious	HTMLPhisher	Browse	2.19.126.151
	WiTqtf1aiE.exe	Get hash	malicious	LummaC, Vidar	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	utmggBCMML.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	lihZ6gUU7V.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	13.107.246.45
	Bn7LPdQA1s.exe	Get hash	malicious	LummaC, Vidar	Browse	13.107.246.45
	https://login.stmarytx.edu/cas/logout?service=http%3A%2F%2Fgoogle.com%2Famp%2Fmatrikaengineeringworks.com/hebc/?#?m=bWVsaXNzYWdAd2Utd29ybGR3aWRlLmNvbQ==	Get hash	malicious	Unknown	Browse	13.107.246.45
	file.exe	Get hash	malicious	Credential Flusher	Browse	13.107.246.45
	L-tron_Payroll.docx	Get hash	malicious	Unknown	Browse	13.107.246.45
	SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	https://communications-chamber-confidentiality-limitation.trycloudflare.com/spec/#bWNhcnR3cmlnaHRAY2hlbXVuZ2NhbmFsLmNvbQ==	Get hash	malicious	Unknown	Browse	13.107.246.45
	+18365366724753456-83736-10244688.html	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	https://mailstat.us/tr/t/5w8u1qwlwl61e4h/1/https:/krediti.ca/#Y2FyYS5jJGNiZmxvb3JzaW5jLmNvbQ==	Get hash	malicious	Outlook Phishing, HTMLPhisher	Browse	13.107.246.45
a0e9f5d64349fb13191bc781f81f42e1	utmggBCMML.exe	Get hash	malicious	LummaC	Browse	104.21.53.8 104.102.49.254
	lihZ6gUU7V.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.21.53.8 104.102.49.254
	Bn7LPdQA1s.exe	Get hash	malicious	LummaC, Vidar	Browse	104.21.53.8 104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.21.53.8 104.102.49.254
	SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Get hash	malicious	LummaC	Browse	104.21.53.8 104.102.49.254
	WiTqtf1aiE.exe	Get hash	malicious	LummaC, Vidar	Browse	104.21.53.8 104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.21.53.8 104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.21.53.8 104.102.49.254
	FdjDPFGTZS.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.21.53.8 104.102.49.254
	CSY6k9gpVb.exe	Get hash	malicious	LummaC	Browse	104.21.53.8 104.102.49.254

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_SecuriteInfo.com_335a9b229b3b25918e3672cc8075151943f39_433d2070_d8b19c67-20a4-4e5a-8f2c-6bed9af31788\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.6917787674828239
Encrypted:	false
SSDEEP:	96:KDFHSEPy0KBxos9OyK90AffuQXIDcQvc6QcEVcw3cE/+po+HbHg/5hZAX/d5FMTD:s4Sy7oX0BU/wjhzuiFxZ24IO8PD
MD5:	644E3D4E8079E892796AF392CFAB4393
SHA1:	0C64F4A622A854027295E6BFDFD2868D24A858DF
SHA-256:	53660EA106A33BDE85CD7CBB2E22B7CF306C239CB6E4A6AD209B2CD85B3578DE
SHA-512:	68798C6D33674B5E7937FA196E43DD74D0600E9A70393E4E19737CBA446550CB159AF675EB8EC423F131F97CB355D4441BD201CC2BE0B021F71C5469CBCE7C73
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.2.8.0.7.5.1.2.8.7.5.9.2.7.2.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.2.8.0.7.5.1.3.2.0.4.0.4.7.8.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.d.8.b.1.9.c.6.7.-.2.0.a.4.-.4.e.5.a.-.8.f.2.c.-.6.b.e.d.9.a.f.3.1.7.8.8.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.9.d.b.6.5.1.3.5.-.0.d.e.5.-.4.a.b.b.-.8.7.5.9.-.2.9.d.9.f.f.2.e.0.b.9.0.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.S.e.c.u.r.i.t.e.I.n.f.o...c.o.m...W.i.n.3.2...P.W.S.X.-.g.e.n...2.7.8.4.6...2.3.9.5.4...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.p.r.o.q.u.o.t.a...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.7.9.4.-.0.0.0.1.-.0.0.1.4.-.f.8.0.5.-.3.8.c.e.f.9.1.8.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.9.7.d.0.3.f.6.a.1.a.a.4.5.0.5.0.f.7.b.e.5.5.f.8.7.6.f.e.a.2.d.c.0.0.0.0.0.9.0.4.!.0.0.0.0.9.0.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1F4E.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Mon Oct 7 20:45:12 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	33966
Entropy (8bit):	1.7281183312452595
Encrypted:	false
SSDEEP:	96:5y8k7RdhbbRKWm8dji77B7vperUlIT/yQaTlEAMNqHqwqsqwRcWw3g7LWIkWI9AU:L3Wm8pODef/yQF4KfLD3Kc4YZBYh
MD5:	89E83571D3659FA28A6B5C42373F6E12
SHA1:	C9EFB474E43697AE33DEA398E6E72CD34E4EBBC3
SHA-256:	A97AC4A41C32F859A85B00D66860F723E723172620642EFF2433CE48F8638709
SHA-512:	A783DD4D58841970EC9AA3DF581075F052800ED624AD1589ADFD43EA5947B7FA5861C31F5504902F97C08973D949E457175467514489CB5CA4FA4DE2D9DD000F
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... .......XH.g........................d...........................T.......8...........T................y......................................................................................................eJ..............GenuineIntel............T...........XH.g.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1F9D.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	3.699857252854346
Encrypted:	false
SSDEEP:	192:R6l7wVeJzO6D6YEIUSU9PHZcDgmf8ktqprj89bQtsf6wm:R6lXJa6D6YEbSU9PHiDgmf8ktLQmfM
MD5:	0EB30367247532D8ED3398EE6D790BFD
SHA1:	DFF49AF8935E1BB98CD4553251FABD222F7DFD7C
SHA-256:	4AAACFAA24F2D0034F0BAF9960D35AD3AF5EF1BE94AA05A6BD3725F5F292F824
SHA-512:	EFA93222E9F2017D1D1498D58D5C5D134EAEE815EDF71BEA781E1E4CFCBC42534B637B2196E6C15E4F33A9F24ACA59EEAF3D8F00ABE55D23244A67C5E4A32703
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.0.3.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1FCD.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4909
Entropy (8bit):	4.590623921786392
Encrypted:	false
SSDEEP:	48:cvIwWl8zsTJg77aI9/0WpW8VYWYm8M4JEYsZXF++q81mHhDakdrSSrhsd:uIjftI7pt7VOJvDDaoSuhsd
MD5:	BF20093229830F2505D560544242520B
SHA1:	01447A6A2EE7D8511654ADF25B2861386DDC7CF6
SHA-256:	60A3B81AF6FA305CAB710931D6B2C694DE72BC0DCCFD843033391FABBF12350D
SHA-512:	E1C81BE6D9B75FA8001889390E6C024755CF4A1F5F970E0DF94592D511605CCD5D689709B220BEFA9CC54E8D12B1909DCF45B1457BC8E62442057D5A6E889ACE
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="533507" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.422357772856902
Encrypted:	false
SSDEEP:	6144:hSvfpi6ceLP/9skLmb0OT6WSPHaJG8nAgeMZMMhA2fX4WABlEnNY0uhiTw:4vloT6W+EZMM6DFyG03w
MD5:	42A8D794DB9302E7139D175116014752
SHA1:	A91032D101BAA6FA156FD55FB524BBE67A1CC9EA
SHA-256:	841475FBB349B138A5886EC558601A17B43EF93C76ACBE2CEC753C20526E9283
SHA-512:	83165B19D9E599F4A5274F644B9CA662036B1AFF277D625FE791E060EC0AA61E151E73DDB116CF8D74BD23210FAF7C9F2B677CA5094222BD338B5E61D129F68A
Malicious:	false
Reputation:	low
Preview:	regf>...>....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm.w..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.723216535127891
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe
File size:	551'424 bytes
MD5:	c70170bcedd92e90f2556c7501b1a559
SHA1:	906055b36647c5bae02e9e2db41bef9a17e2f3b1
SHA256:	1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd
SHA512:	eed90b78a01fa2be870ea2d2f02cdc55fd6e53e63fc96dbf9e604af56846ff604dddf44894df1317fa4f3364a1ee3f4cd535892681f52ac3494c3835206246a4
SSDEEP:	12288:PMyHj9OPDUY0MYICPYpRx2LHdzW8J9DpddINVzb3FXPa1c5A4S:PB9O5CQpM9zW8/DfyNV33N5x
TLSH:	BDC4F11175C1C072D57316320BE1D7B4AA7DBCB00E159E9F63D44BBE8F34291DA22AAB
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......=.9.y.WUy.WUy.WU..TTu.WU..RT..WU..STl.WU..VTz.WUy.VU!.WUilTTm.WUilSTk.WUilRT4.WU1m^Tx.WU1m.Ux.WU1mUTx.WURichy.WU...............

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x406f52
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x67041EC4 [Mon Oct 7 17:47:48 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	d10af643340e1121562abe3e6bd5b0e1

Entrypoint Preview

Instruction
call 00007F3CC0FA5A70h
jmp 00007F3CC0FA4FDFh
push ebp
mov ebp, esp
mov eax, dword ptr [ebp+08h]
push esi
mov ecx, dword ptr [eax+3Ch]
add ecx, eax
movzx eax, word ptr [ecx+14h]
lea edx, dword ptr [ecx+18h]
add edx, eax
movzx eax, word ptr [ecx+06h]
imul esi, eax, 28h
add esi, edx
cmp edx, esi
je 00007F3CC0FA517Bh
mov ecx, dword ptr [ebp+0Ch]
cmp ecx, dword ptr [edx+0Ch]
jc 00007F3CC0FA516Ch
mov eax, dword ptr [edx+08h]
add eax, dword ptr [edx+0Ch]
cmp ecx, eax
jc 00007F3CC0FA516Eh
add edx, 28h
cmp edx, esi
jne 00007F3CC0FA514Ch
xor eax, eax
pop esi
pop ebp
ret
mov eax, edx
jmp 00007F3CC0FA515Bh
push esi
call 00007F3CC0FA5D84h
test eax, eax
je 00007F3CC0FA5182h
mov eax, dword ptr fs:[00000018h]
mov esi, 00486754h
mov edx, dword ptr [eax+04h]
jmp 00007F3CC0FA5166h
cmp edx, eax
je 00007F3CC0FA5172h
xor eax, eax
mov ecx, edx
lock cmpxchg dword ptr [esi], ecx
test eax, eax
jne 00007F3CC0FA5152h
xor al, al
pop esi
ret
mov al, 01h
pop esi
ret
push ebp
mov ebp, esp
cmp dword ptr [ebp+08h], 00000000h
jne 00007F3CC0FA5169h
mov byte ptr [00486758h], 00000001h
call 00007F3CC0FA541Ah
call 00007F3CC0FA8337h
test al, al
jne 00007F3CC0FA5166h
xor al, al
pop ebp
ret
call 00007F3CC0FB0D99h
test al, al
jne 00007F3CC0FA516Ch
push 00000000h
call 00007F3CC0FA833Eh
pop ecx
jmp 00007F3CC0FA514Bh
mov al, 01h
pop ebp
ret
push ebp
mov ebp, esp
cmp byte ptr [00486759h], 00000000h
je 00007F3CC0FA5166h
mov al, 01h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2c6c0	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x88000	0x3d8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x89000	0x1ad4	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x2abc0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x2ab00	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x23000	0x12c	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x210f0	0x21200	84837394ca7c217388963c2d9f9c0f41	False	0.5865197523584905	data	6.666561787802478	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x23000	0x9d78	0x9e00	36e85a317fe0262bb66f0b20259b4b2f	False	0.4350771360759494	data	4.954645854241676	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x2d000	0x5a380	0x59600	c19971048bfd62abbdd43c246d183095	False	0.9912259615384615	DOS executable (block device driver \377\377\377\377,32-bit sector-support)	7.992609431877337	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x88000	0x3d8	0x400	c67ba8481d4e7c92e5fe9f152983a3f3	False	0.439453125	data	3.287044161603086	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x89000	0x1ad4	0x1c00	d5034316f3193736196b1e4313c773a6	False	0.7269810267857143	data	6.389550090010284	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x88058	0x380	data	English	United States	0.46205357142857145

Imports

DLL

Import

KERNEL32.dll

AttachConsole, MultiByteToWideChar, GetStringTypeW, WideCharToMultiByte, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionEx, DeleteCriticalSection, EncodePointer, DecodePointer, LCMapStringEx, GetCPInfo, IsProcessorFeaturePresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, GetStartupInfoW, GetModuleHandleW, CreateFileW, RaiseException, RtlUnwind, GetLastError, SetLastError, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, GetProcAddress, LoadLibraryExW, GetStdHandle, WriteFile, GetModuleFileNameW, ExitProcess, GetModuleHandleExW, HeapAlloc, HeapFree, GetFileType, LCMapStringW, GetLocaleInfoW, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, GetFileSizeEx, SetFilePointerEx, CloseHandle, FlushFileBuffers, GetConsoleOutputCP, GetConsoleMode, ReadFile, HeapReAlloc, FindClose, FindFirstFileExW, FindNextFileW, IsValidCodePage, GetACP, GetOEMCP, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetStdHandle, GetProcessHeap, ReadConsoleW, HeapSize, WriteConsoleW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-07T22:45:15.836455+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.5	49726	104.21.53.8	443	TCP
2024-10-07T22:45:15.836455+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49726	104.21.53.8	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 7, 2024 22:45:08.127630949 CEST	443	49715	20.190.159.75	192.168.2.5
Oct 7, 2024 22:45:08.127657890 CEST	443	49715	20.190.159.75	192.168.2.5
Oct 7, 2024 22:45:08.127690077 CEST	443	49715	20.190.159.75	192.168.2.5
Oct 7, 2024 22:45:08.127747059 CEST	443	49715	20.190.159.75	192.168.2.5
Oct 7, 2024 22:45:08.127774000 CEST	49715	443	192.168.2.5	20.190.159.75
Oct 7, 2024 22:45:08.127810001 CEST	49715	443	192.168.2.5	20.190.159.75
Oct 7, 2024 22:45:08.128153086 CEST	49715	443	192.168.2.5	20.190.159.75
Oct 7, 2024 22:45:08.128173113 CEST	443	49715	20.190.159.75	192.168.2.5
Oct 7, 2024 22:45:08.128182888 CEST	49715	443	192.168.2.5	20.190.159.75
Oct 7, 2024 22:45:08.128187895 CEST	443	49715	20.190.159.75	192.168.2.5
Oct 7, 2024 22:45:08.145641088 CEST	49716	443	192.168.2.5	20.190.159.75
Oct 7, 2024 22:45:08.145689011 CEST	443	49716	20.190.159.75	192.168.2.5
Oct 7, 2024 22:45:08.145791054 CEST	49716	443	192.168.2.5	20.190.159.75
Oct 7, 2024 22:45:08.145920992 CEST	49716	443	192.168.2.5	20.190.159.75
Oct 7, 2024 22:45:08.145934105 CEST	443	49716	20.190.159.75	192.168.2.5
Oct 7, 2024 22:45:08.906940937 CEST	443	49716	20.190.159.75	192.168.2.5
Oct 7, 2024 22:45:08.953933954 CEST	49716	443	192.168.2.5	20.190.159.75
Oct 7, 2024 22:45:08.956073999 CEST	49716	443	192.168.2.5	20.190.159.75
Oct 7, 2024 22:45:08.956087112 CEST	443	49716	20.190.159.75	192.168.2.5
Oct 7, 2024 22:45:08.956621885 CEST	49716	443	192.168.2.5	20.190.159.75
Oct 7, 2024 22:45:08.956626892 CEST	443	49716	20.190.159.75	192.168.2.5
Oct 7, 2024 22:45:08.956669092 CEST	49716	443	192.168.2.5	20.190.159.75
Oct 7, 2024 22:45:08.956677914 CEST	443	49716	20.190.159.75	192.168.2.5
Oct 7, 2024 22:45:09.343173027 CEST	443	49716	20.190.159.75	192.168.2.5
Oct 7, 2024 22:45:09.343204021 CEST	443	49716	20.190.159.75	192.168.2.5
Oct 7, 2024 22:45:09.343211889 CEST	443	49716	20.190.159.75	192.168.2.5
Oct 7, 2024 22:45:09.343245983 CEST	443	49716	20.190.159.75	192.168.2.5
Oct 7, 2024 22:45:09.343274117 CEST	49716	443	192.168.2.5	20.190.159.75
Oct 7, 2024 22:45:09.343292952 CEST	443	49716	20.190.159.75	192.168.2.5
Oct 7, 2024 22:45:09.343311071 CEST	49716	443	192.168.2.5	20.190.159.75
Oct 7, 2024 22:45:09.343319893 CEST	443	49716	20.190.159.75	192.168.2.5
Oct 7, 2024 22:45:09.343364000 CEST	49716	443	192.168.2.5	20.190.159.75
Oct 7, 2024 22:45:09.373663902 CEST	49716	443	192.168.2.5	20.190.159.75
Oct 7, 2024 22:45:09.373692989 CEST	443	49716	20.190.159.75	192.168.2.5
Oct 7, 2024 22:45:09.373703957 CEST	49716	443	192.168.2.5	20.190.159.75
Oct 7, 2024 22:45:09.373711109 CEST	443	49716	20.190.159.75	192.168.2.5
Oct 7, 2024 22:45:10.907063007 CEST	49675	443	192.168.2.5	23.1.237.91
Oct 7, 2024 22:45:10.907067060 CEST	49674	443	192.168.2.5	23.1.237.91
Oct 7, 2024 22:45:11.032083035 CEST	49673	443	192.168.2.5	23.1.237.91
Oct 7, 2024 22:45:13.335725069 CEST	49723	443	192.168.2.5	104.102.49.254
Oct 7, 2024 22:45:13.335778952 CEST	443	49723	104.102.49.254	192.168.2.5
Oct 7, 2024 22:45:13.335850000 CEST	49723	443	192.168.2.5	104.102.49.254
Oct 7, 2024 22:45:13.336971045 CEST	49723	443	192.168.2.5	104.102.49.254
Oct 7, 2024 22:45:13.337002039 CEST	443	49723	104.102.49.254	192.168.2.5
Oct 7, 2024 22:45:13.981168032 CEST	443	49723	104.102.49.254	192.168.2.5
Oct 7, 2024 22:45:13.981236935 CEST	49723	443	192.168.2.5	104.102.49.254
Oct 7, 2024 22:45:13.985797882 CEST	49723	443	192.168.2.5	104.102.49.254
Oct 7, 2024 22:45:13.985810041 CEST	443	49723	104.102.49.254	192.168.2.5
Oct 7, 2024 22:45:13.986110926 CEST	443	49723	104.102.49.254	192.168.2.5
Oct 7, 2024 22:45:14.034877062 CEST	49723	443	192.168.2.5	104.102.49.254
Oct 7, 2024 22:45:14.049272060 CEST	49723	443	192.168.2.5	104.102.49.254
Oct 7, 2024 22:45:14.091402054 CEST	443	49723	104.102.49.254	192.168.2.5
Oct 7, 2024 22:45:14.508001089 CEST	443	49723	104.102.49.254	192.168.2.5
Oct 7, 2024 22:45:14.508021116 CEST	443	49723	104.102.49.254	192.168.2.5
Oct 7, 2024 22:45:14.508047104 CEST	443	49723	104.102.49.254	192.168.2.5
Oct 7, 2024 22:45:14.508064985 CEST	443	49723	104.102.49.254	192.168.2.5
Oct 7, 2024 22:45:14.508069992 CEST	49723	443	192.168.2.5	104.102.49.254
Oct 7, 2024 22:45:14.508090973 CEST	443	49723	104.102.49.254	192.168.2.5
Oct 7, 2024 22:45:14.508105993 CEST	443	49723	104.102.49.254	192.168.2.5
Oct 7, 2024 22:45:14.508125067 CEST	49723	443	192.168.2.5	104.102.49.254
Oct 7, 2024 22:45:14.508148909 CEST	49723	443	192.168.2.5	104.102.49.254
Oct 7, 2024 22:45:14.599378109 CEST	443	49723	104.102.49.254	192.168.2.5
Oct 7, 2024 22:45:14.599519968 CEST	49723	443	192.168.2.5	104.102.49.254
Oct 7, 2024 22:45:14.599600077 CEST	443	49723	104.102.49.254	192.168.2.5
Oct 7, 2024 22:45:14.599659920 CEST	49723	443	192.168.2.5	104.102.49.254
Oct 7, 2024 22:45:14.604274988 CEST	443	49723	104.102.49.254	192.168.2.5
Oct 7, 2024 22:45:14.604361057 CEST	49723	443	192.168.2.5	104.102.49.254
Oct 7, 2024 22:45:14.604371071 CEST	443	49723	104.102.49.254	192.168.2.5
Oct 7, 2024 22:45:14.604384899 CEST	443	49723	104.102.49.254	192.168.2.5
Oct 7, 2024 22:45:14.604422092 CEST	49723	443	192.168.2.5	104.102.49.254
Oct 7, 2024 22:45:14.604459047 CEST	49723	443	192.168.2.5	104.102.49.254
Oct 7, 2024 22:45:14.604995012 CEST	49723	443	192.168.2.5	104.102.49.254
Oct 7, 2024 22:45:14.605010986 CEST	443	49723	104.102.49.254	192.168.2.5
Oct 7, 2024 22:45:14.605042934 CEST	49723	443	192.168.2.5	104.102.49.254
Oct 7, 2024 22:45:14.605050087 CEST	443	49723	104.102.49.254	192.168.2.5
Oct 7, 2024 22:45:14.789732933 CEST	49726	443	192.168.2.5	104.21.53.8
Oct 7, 2024 22:45:14.789767981 CEST	443	49726	104.21.53.8	192.168.2.5
Oct 7, 2024 22:45:14.789876938 CEST	49726	443	192.168.2.5	104.21.53.8
Oct 7, 2024 22:45:14.820055962 CEST	49726	443	192.168.2.5	104.21.53.8
Oct 7, 2024 22:45:14.820072889 CEST	443	49726	104.21.53.8	192.168.2.5
Oct 7, 2024 22:45:15.264888048 CEST	443	49726	104.21.53.8	192.168.2.5
Oct 7, 2024 22:45:15.264978886 CEST	49726	443	192.168.2.5	104.21.53.8
Oct 7, 2024 22:45:15.266784906 CEST	49726	443	192.168.2.5	104.21.53.8
Oct 7, 2024 22:45:15.266797066 CEST	443	49726	104.21.53.8	192.168.2.5
Oct 7, 2024 22:45:15.267055035 CEST	443	49726	104.21.53.8	192.168.2.5
Oct 7, 2024 22:45:15.268508911 CEST	49726	443	192.168.2.5	104.21.53.8
Oct 7, 2024 22:45:15.268508911 CEST	49726	443	192.168.2.5	104.21.53.8
Oct 7, 2024 22:45:15.268587112 CEST	443	49726	104.21.53.8	192.168.2.5
Oct 7, 2024 22:45:15.836438894 CEST	443	49726	104.21.53.8	192.168.2.5
Oct 7, 2024 22:45:15.836848021 CEST	443	49726	104.21.53.8	192.168.2.5
Oct 7, 2024 22:45:15.836906910 CEST	49726	443	192.168.2.5	104.21.53.8
Oct 7, 2024 22:45:15.837193966 CEST	49726	443	192.168.2.5	104.21.53.8
Oct 7, 2024 22:45:15.837204933 CEST	443	49726	104.21.53.8	192.168.2.5
Oct 7, 2024 22:45:15.837223053 CEST	49726	443	192.168.2.5	104.21.53.8
Oct 7, 2024 22:45:15.837227106 CEST	443	49726	104.21.53.8	192.168.2.5
Oct 7, 2024 22:45:20.516464949 CEST	49674	443	192.168.2.5	23.1.237.91
Oct 7, 2024 22:45:20.516480923 CEST	49675	443	192.168.2.5	23.1.237.91
Oct 7, 2024 22:45:20.532278061 CEST	49729	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:20.532315016 CEST	443	49729	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:20.532387018 CEST	49729	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:20.532717943 CEST	49729	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:20.532732964 CEST	443	49729	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:20.641427040 CEST	49673	443	192.168.2.5	23.1.237.91
Oct 7, 2024 22:45:21.177407026 CEST	443	49729	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:21.177537918 CEST	49729	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:21.179251909 CEST	49729	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:21.179265976 CEST	443	49729	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:21.179626942 CEST	443	49729	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:21.188451052 CEST	49729	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:21.231400967 CEST	443	49729	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:21.285501957 CEST	443	49729	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:21.285526991 CEST	443	49729	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:21.285542011 CEST	443	49729	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:21.285595894 CEST	49729	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:21.285615921 CEST	443	49729	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:21.285687923 CEST	49729	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:21.370904922 CEST	443	49729	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:21.370935917 CEST	443	49729	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:21.371083021 CEST	49729	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:21.371104956 CEST	443	49729	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:21.371162891 CEST	49729	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:21.372184992 CEST	443	49729	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:21.372215986 CEST	443	49729	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:21.372279882 CEST	49729	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:21.372297049 CEST	443	49729	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:21.372349024 CEST	49729	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:21.456896067 CEST	443	49729	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:21.456916094 CEST	443	49729	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:21.457056046 CEST	49729	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:21.457086086 CEST	443	49729	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:21.457140923 CEST	49729	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:21.457804918 CEST	443	49729	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:21.457823992 CEST	443	49729	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:21.457870960 CEST	49729	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:21.457878113 CEST	443	49729	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:21.457911968 CEST	49729	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:21.458925962 CEST	443	49729	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:21.458944082 CEST	443	49729	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:21.458986044 CEST	49729	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:21.458992004 CEST	443	49729	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:21.459024906 CEST	49729	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:21.459564924 CEST	443	49729	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:21.459589958 CEST	443	49729	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:21.459636927 CEST	49729	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:21.459642887 CEST	443	49729	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:21.459675074 CEST	49729	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:21.543683052 CEST	443	49729	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:21.543706894 CEST	443	49729	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:21.543802977 CEST	49729	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:21.543816090 CEST	443	49729	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:21.543852091 CEST	49729	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:21.544842958 CEST	443	49729	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:21.544859886 CEST	443	49729	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:21.544909954 CEST	49729	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:21.544909954 CEST	443	49729	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:21.544926882 CEST	443	49729	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:21.544946909 CEST	49729	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:21.544954062 CEST	443	49729	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:21.544980049 CEST	49729	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:21.544987917 CEST	443	49729	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:21.545006990 CEST	49729	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:21.545027971 CEST	49729	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:21.545428038 CEST	443	49729	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:21.545444965 CEST	443	49729	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:21.545485020 CEST	49729	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:21.545491934 CEST	443	49729	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:21.545521975 CEST	49729	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:21.548871040 CEST	443	49729	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:21.548888922 CEST	443	49729	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:21.548952103 CEST	49729	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:21.548958063 CEST	443	49729	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:21.548998117 CEST	49729	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:21.549393892 CEST	443	49729	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:21.549411058 CEST	443	49729	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:21.549455881 CEST	49729	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:21.549462080 CEST	443	49729	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:21.549479008 CEST	49729	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:21.549495935 CEST	49729	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:21.549748898 CEST	443	49729	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:21.549806118 CEST	49729	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:21.549812078 CEST	443	49729	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:21.549825907 CEST	443	49729	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:21.549860001 CEST	49729	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:21.549925089 CEST	49729	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:21.549937010 CEST	443	49729	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:21.549951077 CEST	49729	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:21.549956083 CEST	443	49729	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:21.588877916 CEST	49730	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:21.588898897 CEST	443	49730	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:21.588980913 CEST	49730	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:21.589216948 CEST	49730	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:21.589231014 CEST	443	49730	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:21.590887070 CEST	49731	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:21.590940952 CEST	443	49731	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:21.590998888 CEST	49731	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:21.591439962 CEST	49731	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:21.591451883 CEST	443	49731	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:21.592185974 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:21.592220068 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:21.592262030 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:21.593125105 CEST	49733	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:21.593154907 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:21.593159914 CEST	443	49733	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:21.593169928 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:21.593213081 CEST	49733	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:21.593503952 CEST	49733	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:21.593519926 CEST	443	49733	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:21.593740940 CEST	49734	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:21.593750954 CEST	443	49734	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:21.593796968 CEST	49734	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:21.593898058 CEST	49734	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:21.593910933 CEST	443	49734	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:22.204745054 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:22.205121040 CEST	443	49733	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:22.205450058 CEST	443	49730	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:22.205486059 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:22.205516100 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:22.205784082 CEST	49733	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:22.205810070 CEST	443	49733	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:22.206011057 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:22.206017017 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:22.206296921 CEST	49733	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:22.206301928 CEST	443	49733	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:22.206362009 CEST	49730	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:22.206387043 CEST	443	49730	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:22.206737041 CEST	49730	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:22.206743002 CEST	443	49730	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:22.211555958 CEST	443	49731	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:22.211958885 CEST	49731	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:22.211990118 CEST	443	49731	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:22.212377071 CEST	49731	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:22.212383032 CEST	443	49731	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:22.250334978 CEST	443	49734	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:22.251032114 CEST	49734	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:22.251049042 CEST	443	49734	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:22.251507044 CEST	49734	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:22.251512051 CEST	443	49734	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:22.284151077 CEST	443	49713	23.1.237.91	192.168.2.5
Oct 7, 2024 22:45:22.284411907 CEST	49713	443	192.168.2.5	23.1.237.91
Oct 7, 2024 22:45:22.300059080 CEST	443	49733	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:22.300071955 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:22.300074100 CEST	443	49733	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:22.300139904 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:22.300153971 CEST	49733	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:22.300175905 CEST	443	49733	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:22.300210953 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:22.300298929 CEST	443	49733	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:22.300451994 CEST	49733	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:22.300471067 CEST	49733	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:22.300479889 CEST	443	49733	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:22.300491095 CEST	49733	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:22.300494909 CEST	443	49733	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:22.301208019 CEST	443	49730	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:22.301234961 CEST	443	49730	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:22.301290989 CEST	49730	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:22.301316023 CEST	443	49730	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:22.301359892 CEST	49730	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:22.301403999 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:22.301429987 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:22.301443100 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:22.301449060 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:22.301454067 CEST	443	49730	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:22.301511049 CEST	443	49730	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:22.301554918 CEST	49730	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:22.301693916 CEST	49730	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:22.301704884 CEST	443	49730	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:22.301716089 CEST	49730	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:22.301721096 CEST	443	49730	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:22.304091930 CEST	49735	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:22.304116011 CEST	443	49735	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:22.304199934 CEST	49735	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:22.304364920 CEST	49735	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:22.304375887 CEST	443	49735	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:22.304647923 CEST	49736	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:22.304676056 CEST	443	49736	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:22.304743052 CEST	49736	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:22.304866076 CEST	49736	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:22.304887056 CEST	443	49736	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:22.305233002 CEST	49737	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:22.305262089 CEST	443	49737	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:22.305340052 CEST	49737	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:22.305447102 CEST	49737	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:22.305460930 CEST	443	49737	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:22.403341055 CEST	443	49731	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:22.403371096 CEST	443	49731	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:22.403512001 CEST	49731	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:22.403537989 CEST	443	49731	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:22.403584003 CEST	49731	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:22.403649092 CEST	443	49731	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:22.403708935 CEST	443	49731	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:22.403745890 CEST	49731	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:22.403767109 CEST	443	49731	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:22.403779030 CEST	49731	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:22.403779030 CEST	49731	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:22.403785944 CEST	443	49731	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:22.403793097 CEST	443	49731	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:22.407001972 CEST	49738	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:22.407032967 CEST	443	49738	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:22.407429934 CEST	49738	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:22.408160925 CEST	49738	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:22.408173084 CEST	443	49738	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:22.433630943 CEST	443	49734	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:22.433794022 CEST	443	49734	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:22.433854103 CEST	49734	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:22.433886051 CEST	49734	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:22.433902979 CEST	443	49734	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:22.433907986 CEST	49734	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:22.433912992 CEST	443	49734	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:22.436410904 CEST	49739	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:22.436446905 CEST	443	49739	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:22.436656952 CEST	49739	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:22.436656952 CEST	49739	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:22.436685085 CEST	443	49739	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:22.963208914 CEST	443	49736	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:22.963963985 CEST	49736	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:22.963975906 CEST	443	49736	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:22.964427948 CEST	49736	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:22.964431047 CEST	443	49736	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:22.966938972 CEST	443	49735	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:22.967219114 CEST	49735	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:22.967257977 CEST	443	49735	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:22.967551947 CEST	49735	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:22.967572927 CEST	443	49735	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:24.017693043 CEST	443	49737	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:24.018295050 CEST	443	49738	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:24.018374920 CEST	49737	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:24.018414974 CEST	443	49737	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:24.018843889 CEST	49738	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:24.018843889 CEST	49737	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:24.018853903 CEST	443	49738	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:24.018868923 CEST	443	49737	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:24.019402981 CEST	49738	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:24.019406080 CEST	443	49738	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:24.022711039 CEST	443	49739	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:24.023050070 CEST	49739	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:24.023070097 CEST	443	49739	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:24.023402929 CEST	49739	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:24.023410082 CEST	443	49739	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:24.109261990 CEST	443	49736	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:24.109431028 CEST	443	49736	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:24.109561920 CEST	49736	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:24.109713078 CEST	49736	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:24.109713078 CEST	49736	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:24.109735966 CEST	443	49736	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:24.109749079 CEST	443	49736	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:24.110435009 CEST	443	49735	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:24.110498905 CEST	443	49735	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:24.110549927 CEST	49735	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:24.111167908 CEST	49735	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:24.111186981 CEST	443	49735	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:24.111192942 CEST	49735	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:24.111198902 CEST	443	49735	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:24.112730026 CEST	49740	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:24.112806082 CEST	443	49740	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:24.112888098 CEST	49740	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:24.113360882 CEST	49740	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:24.113389015 CEST	443	49740	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:24.114547014 CEST	49741	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:24.114581108 CEST	443	49741	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:24.114654064 CEST	49741	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:24.114749908 CEST	49741	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:24.114763021 CEST	443	49741	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:24.119024038 CEST	443	49739	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:24.119149923 CEST	443	49739	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:24.119234085 CEST	49739	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:24.119292021 CEST	49739	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:24.119292021 CEST	49739	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:24.119302988 CEST	443	49739	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:24.119313955 CEST	443	49739	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:24.120726109 CEST	443	49738	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:24.120795965 CEST	443	49738	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:24.120845079 CEST	49738	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:24.121025085 CEST	49742	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:24.121035099 CEST	443	49742	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:24.121088028 CEST	49742	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:24.121186972 CEST	49738	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:24.121186972 CEST	49738	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:24.121203899 CEST	443	49738	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:24.121216059 CEST	443	49738	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:24.121236086 CEST	49742	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:24.121243954 CEST	443	49742	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:24.122873068 CEST	49743	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:24.122898102 CEST	443	49743	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:24.122986078 CEST	49743	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:24.123081923 CEST	49743	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:24.123106956 CEST	443	49743	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:24.123826027 CEST	443	49737	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:24.123881102 CEST	443	49737	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:24.123925924 CEST	49737	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:24.124042034 CEST	49737	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:24.124042034 CEST	49737	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:24.124047995 CEST	443	49737	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:24.124058962 CEST	443	49737	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:24.125515938 CEST	49744	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:24.125545025 CEST	443	49744	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:24.125608921 CEST	49744	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:24.125699043 CEST	49744	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:24.125714064 CEST	443	49744	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:24.723844051 CEST	443	49741	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:24.724538088 CEST	49741	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:24.724570036 CEST	443	49741	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:24.725092888 CEST	49741	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:24.725099087 CEST	443	49741	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:24.751049995 CEST	443	49743	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:24.751621008 CEST	49743	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:24.751647949 CEST	443	49743	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:24.752504110 CEST	49743	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:24.752509117 CEST	443	49743	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:24.789966106 CEST	443	49744	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:24.790374041 CEST	443	49742	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:24.790424109 CEST	49744	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:24.790457964 CEST	443	49744	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:24.790808916 CEST	49742	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:24.790827990 CEST	49744	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:24.790836096 CEST	443	49742	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:24.790836096 CEST	443	49744	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:24.791204929 CEST	49742	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:24.791213036 CEST	443	49742	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:24.819679976 CEST	443	49741	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:24.819869041 CEST	443	49741	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:24.819930077 CEST	49741	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:24.820097923 CEST	49741	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:24.820122957 CEST	443	49741	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:24.820137978 CEST	49741	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:24.820144892 CEST	443	49741	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:24.823239088 CEST	49746	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:24.823276043 CEST	443	49746	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:24.823338985 CEST	49746	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:24.823489904 CEST	49746	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:24.823498964 CEST	443	49746	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:24.846829891 CEST	443	49743	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:24.846982956 CEST	443	49743	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:24.847057104 CEST	49743	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:24.847140074 CEST	49743	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:24.847140074 CEST	49743	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:24.847187042 CEST	443	49743	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:24.847215891 CEST	443	49743	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:24.849484921 CEST	49747	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:24.849534035 CEST	443	49747	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:24.849594116 CEST	49747	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:24.849747896 CEST	49747	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:24.849766970 CEST	443	49747	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:24.889554977 CEST	443	49742	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:24.889642954 CEST	443	49742	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:24.889693975 CEST	49742	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:24.889827967 CEST	49742	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:24.889847994 CEST	443	49742	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:24.889858961 CEST	49742	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:24.889864922 CEST	443	49742	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:24.891891956 CEST	443	49744	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:24.891954899 CEST	443	49744	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:24.892005920 CEST	49744	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:24.892522097 CEST	49744	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:24.892544031 CEST	443	49744	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:24.892565966 CEST	49744	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:24.892574072 CEST	443	49744	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:24.894685030 CEST	49748	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:24.894720078 CEST	443	49748	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:24.894853115 CEST	49748	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:24.895227909 CEST	49748	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:24.895246029 CEST	443	49748	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:24.896220922 CEST	49749	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:24.896250963 CEST	443	49749	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:24.896346092 CEST	49749	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:24.896826029 CEST	49749	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:24.896836042 CEST	443	49749	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:25.132854939 CEST	443	49740	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:25.133454084 CEST	49740	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:25.133497953 CEST	443	49740	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:25.133924961 CEST	49740	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:25.133938074 CEST	443	49740	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:25.240726948 CEST	443	49740	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:25.240803957 CEST	443	49740	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:25.240888119 CEST	49740	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:25.241096020 CEST	49740	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:25.241116047 CEST	443	49740	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:25.241130114 CEST	49740	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:25.241136074 CEST	443	49740	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:25.244148016 CEST	49750	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:25.244205952 CEST	443	49750	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:25.244292021 CEST	49750	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:25.244460106 CEST	49750	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:25.244472980 CEST	443	49750	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:25.462071896 CEST	443	49746	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:25.462517023 CEST	49746	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:25.462542057 CEST	443	49746	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:25.462954998 CEST	49746	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:25.462959051 CEST	443	49746	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:25.487734079 CEST	443	49747	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:25.488253117 CEST	49747	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:25.488284111 CEST	443	49747	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:25.488795042 CEST	49747	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:25.488801956 CEST	443	49747	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:25.503158092 CEST	443	49749	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:25.503952980 CEST	49749	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:25.503968954 CEST	443	49749	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:25.504370928 CEST	49749	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:25.504376888 CEST	443	49749	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:25.520090103 CEST	443	49748	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:25.520548105 CEST	49748	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:25.520613909 CEST	443	49748	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:25.520901918 CEST	49748	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:25.520915985 CEST	443	49748	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:25.564112902 CEST	443	49746	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:25.564182997 CEST	443	49746	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:25.564263105 CEST	49746	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:25.564452887 CEST	49746	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:25.564481020 CEST	443	49746	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:25.564493895 CEST	49746	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:25.564501047 CEST	443	49746	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:25.567451000 CEST	49751	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:25.567537069 CEST	443	49751	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:25.567643881 CEST	49751	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:25.567812920 CEST	49751	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:25.567842007 CEST	443	49751	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:25.586613894 CEST	443	49747	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:25.586677074 CEST	443	49747	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:25.586757898 CEST	49747	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:25.586937904 CEST	49747	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:25.586961031 CEST	443	49747	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:25.586976051 CEST	49747	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:25.586985111 CEST	443	49747	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:25.589781046 CEST	49752	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:25.589834929 CEST	443	49752	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:25.589893103 CEST	49752	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:25.590146065 CEST	49752	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:25.590166092 CEST	443	49752	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:25.600195885 CEST	443	49749	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:25.600284100 CEST	443	49749	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:25.600351095 CEST	49749	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:25.600591898 CEST	49749	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:25.600606918 CEST	443	49749	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:25.600617886 CEST	49749	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:25.600622892 CEST	443	49749	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:25.603653908 CEST	49753	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:25.603693008 CEST	443	49753	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:25.603771925 CEST	49753	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:25.603925943 CEST	49753	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:25.603940010 CEST	443	49753	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:25.626096010 CEST	443	49748	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:25.626158953 CEST	443	49748	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:25.626214981 CEST	49748	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:25.626379013 CEST	49748	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:25.626401901 CEST	443	49748	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:25.626415968 CEST	49748	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:25.626420975 CEST	443	49748	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:25.628832102 CEST	49754	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:25.628864050 CEST	443	49754	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:25.628942966 CEST	49754	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:25.629087925 CEST	49754	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:25.629102945 CEST	443	49754	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:25.892024040 CEST	443	49750	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:25.892518044 CEST	49750	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:25.892544031 CEST	443	49750	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:25.893038988 CEST	49750	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:25.893043995 CEST	443	49750	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:25.993998051 CEST	443	49750	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:25.994076014 CEST	443	49750	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:25.994169950 CEST	49750	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:25.994358063 CEST	49750	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:25.994379997 CEST	443	49750	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:25.994391918 CEST	49750	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:25.994396925 CEST	443	49750	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:25.996864080 CEST	49756	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:25.996907949 CEST	443	49756	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:25.997024059 CEST	49756	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:25.997139931 CEST	49756	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:25.997150898 CEST	443	49756	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:26.183142900 CEST	443	49751	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:26.186557055 CEST	49751	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:26.186620951 CEST	443	49751	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:26.187020063 CEST	49751	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:26.187035084 CEST	443	49751	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:26.215945005 CEST	443	49752	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:26.218516111 CEST	49752	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:26.218569994 CEST	443	49752	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:26.218969107 CEST	49752	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:26.218977928 CEST	443	49752	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:26.242327929 CEST	443	49753	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:26.244777918 CEST	49753	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:26.244805098 CEST	443	49753	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:26.245227098 CEST	49753	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:26.245235920 CEST	443	49753	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:26.248147011 CEST	443	49754	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:26.248894930 CEST	49754	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:26.248909950 CEST	443	49754	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:26.249329090 CEST	49754	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:26.249334097 CEST	443	49754	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:26.279058933 CEST	443	49751	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:26.279196978 CEST	443	49751	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:26.279315948 CEST	49751	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:26.279505014 CEST	49751	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:26.279555082 CEST	443	49751	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:26.279611111 CEST	49751	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:26.279640913 CEST	443	49751	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:26.282516956 CEST	49757	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:26.282547951 CEST	443	49757	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:26.282640934 CEST	49757	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:26.282823086 CEST	49757	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:26.282836914 CEST	443	49757	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:26.328999043 CEST	443	49752	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:26.329164982 CEST	443	49752	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:26.329332113 CEST	49752	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:26.329375029 CEST	49752	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:26.329375029 CEST	49752	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:26.329396963 CEST	443	49752	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:26.329411030 CEST	443	49752	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:26.332477093 CEST	49758	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:26.332509041 CEST	443	49758	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:26.332592010 CEST	49758	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:26.332789898 CEST	49758	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:26.332801104 CEST	443	49758	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:26.339066029 CEST	443	49753	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:26.339137077 CEST	443	49753	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:26.339222908 CEST	49753	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:26.339318037 CEST	49753	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:26.339334011 CEST	443	49753	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:26.339361906 CEST	49753	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:26.339368105 CEST	443	49753	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:26.341458082 CEST	49759	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:26.341489077 CEST	443	49759	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:26.341587067 CEST	49759	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:26.341701031 CEST	49759	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:26.341710091 CEST	443	49759	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:26.344824076 CEST	443	49754	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:26.344890118 CEST	443	49754	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:26.345024109 CEST	49754	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:26.345146894 CEST	49754	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:26.345156908 CEST	443	49754	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:26.345171928 CEST	49754	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:26.345176935 CEST	443	49754	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:26.347100973 CEST	49760	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:26.347112894 CEST	443	49760	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:26.347184896 CEST	49760	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:26.347316027 CEST	49760	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:26.347326040 CEST	443	49760	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:26.600341082 CEST	443	49756	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:26.600816965 CEST	49756	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:26.600846052 CEST	443	49756	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:26.601516962 CEST	49756	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:26.601522923 CEST	443	49756	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:26.695883989 CEST	443	49756	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:26.695961952 CEST	443	49756	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:26.696100950 CEST	49756	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:26.696187973 CEST	49756	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:26.696187973 CEST	49756	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:26.696209908 CEST	443	49756	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:26.696218967 CEST	443	49756	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:26.705354929 CEST	49761	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:26.705394983 CEST	443	49761	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:26.705609083 CEST	49761	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:26.706250906 CEST	49761	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:26.706268072 CEST	443	49761	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:26.917021036 CEST	443	49757	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:26.917886972 CEST	49757	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:26.917915106 CEST	443	49757	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:26.918517113 CEST	49757	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:26.918524027 CEST	443	49757	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:26.953660965 CEST	443	49760	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:26.957457066 CEST	49760	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:26.957478046 CEST	443	49760	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:26.961313963 CEST	49760	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:26.961318970 CEST	443	49760	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:26.976188898 CEST	443	49759	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:26.976736069 CEST	49759	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:26.976747036 CEST	443	49759	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:26.980880976 CEST	49759	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:26.980885983 CEST	443	49759	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:27.030005932 CEST	443	49757	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:27.030086040 CEST	443	49757	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:27.030174017 CEST	49757	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:27.033071995 CEST	49757	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:27.033071995 CEST	49757	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:27.033099890 CEST	443	49757	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:27.033113003 CEST	443	49757	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:27.049076080 CEST	49762	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:27.049123049 CEST	443	49762	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:27.049207926 CEST	49762	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:27.053121090 CEST	49762	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:27.053134918 CEST	443	49762	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:27.055234909 CEST	443	49760	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:27.055310965 CEST	443	49760	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:27.055469036 CEST	49760	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:27.057018995 CEST	49760	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:27.057043076 CEST	443	49760	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:27.057081938 CEST	49760	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:27.057089090 CEST	443	49760	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:27.072640896 CEST	49763	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:27.072695017 CEST	443	49763	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:27.073146105 CEST	49763	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:27.076153994 CEST	49763	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:27.076170921 CEST	443	49763	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:27.077219963 CEST	443	49759	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:27.077282906 CEST	443	49759	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:27.077409029 CEST	49759	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:27.080415964 CEST	49759	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:27.080415964 CEST	49759	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:27.080427885 CEST	443	49759	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:27.080435991 CEST	443	49759	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:27.087407112 CEST	49764	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:27.087445974 CEST	443	49764	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:27.087538004 CEST	49764	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:27.087810993 CEST	49764	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:27.087825060 CEST	443	49764	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:27.355263948 CEST	443	49761	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:27.356095076 CEST	49761	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:27.356127024 CEST	443	49761	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:27.356276035 CEST	49761	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:27.356281996 CEST	443	49761	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:27.510905027 CEST	443	49761	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:27.510981083 CEST	443	49761	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:27.511133909 CEST	49761	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:27.511512041 CEST	49761	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:27.511512041 CEST	49761	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:27.511532068 CEST	443	49761	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:27.511544943 CEST	443	49761	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:27.513950109 CEST	49765	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:27.513994932 CEST	443	49765	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:27.514101982 CEST	49765	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:27.514235973 CEST	49765	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:27.514246941 CEST	443	49765	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:27.601037979 CEST	443	49762	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:27.602015972 CEST	49762	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:27.602045059 CEST	443	49762	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:27.602271080 CEST	49762	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:27.602276087 CEST	443	49762	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:27.696716070 CEST	443	49762	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:27.696794987 CEST	443	49762	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:27.696856976 CEST	49762	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:27.696923018 CEST	443	49763	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:27.697158098 CEST	49762	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:27.697177887 CEST	443	49762	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:27.697191954 CEST	49762	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:27.697197914 CEST	443	49762	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:27.697714090 CEST	49763	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:27.697751999 CEST	443	49763	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:27.698162079 CEST	49763	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:27.698167086 CEST	443	49763	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:27.700639963 CEST	49766	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:27.700681925 CEST	443	49766	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:27.700754881 CEST	49766	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:27.700952053 CEST	49766	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:27.700963974 CEST	443	49766	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:27.724890947 CEST	443	49764	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:27.725275040 CEST	49764	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:27.725302935 CEST	443	49764	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:27.725723982 CEST	49764	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:27.725728989 CEST	443	49764	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:27.794630051 CEST	443	49763	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:27.794703007 CEST	443	49763	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:27.794750929 CEST	49763	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:27.794915915 CEST	49763	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:27.794935942 CEST	443	49763	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:27.794949055 CEST	49763	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:27.794955015 CEST	443	49763	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:27.797796011 CEST	49767	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:27.797846079 CEST	443	49767	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:27.797960043 CEST	49767	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:27.798121929 CEST	49767	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:27.798134089 CEST	443	49767	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:27.825331926 CEST	443	49764	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:27.825407028 CEST	443	49764	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:27.825529099 CEST	49764	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:27.825838089 CEST	49764	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:27.825858116 CEST	443	49764	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:27.825891972 CEST	49764	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:27.825897932 CEST	443	49764	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:27.828466892 CEST	49768	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:27.828572989 CEST	443	49768	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:27.828687906 CEST	49768	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:27.828843117 CEST	49768	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:27.828872919 CEST	443	49768	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:28.265558958 CEST	443	49765	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:28.266285896 CEST	49765	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:28.266305923 CEST	443	49765	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:28.266858101 CEST	49765	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:28.266865015 CEST	443	49765	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:28.363039970 CEST	443	49765	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:28.363101959 CEST	443	49765	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:28.363204002 CEST	49765	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:28.363420010 CEST	49765	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:28.363432884 CEST	443	49765	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:28.363445044 CEST	49765	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:28.363450050 CEST	443	49765	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:28.366379023 CEST	49769	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:28.366425991 CEST	443	49769	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:28.366519928 CEST	49769	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:28.366673946 CEST	49769	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:28.366686106 CEST	443	49769	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:28.439481020 CEST	443	49766	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:28.440068007 CEST	49766	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:28.440083027 CEST	443	49766	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:28.440504074 CEST	49766	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:28.440507889 CEST	443	49766	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:28.450835943 CEST	443	49767	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:28.451172113 CEST	49767	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:28.451201916 CEST	443	49767	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:28.451528072 CEST	49767	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:28.451538086 CEST	443	49767	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:28.512238026 CEST	443	49768	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:28.512685061 CEST	49768	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:28.512748003 CEST	443	49768	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:28.513139009 CEST	49768	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:28.513153076 CEST	443	49768	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:28.540338993 CEST	443	49766	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:28.540426016 CEST	443	49766	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:28.540479898 CEST	49766	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:28.542558908 CEST	49766	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:28.542577028 CEST	443	49766	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:28.542593956 CEST	49766	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:28.542599916 CEST	443	49766	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:28.546662092 CEST	443	49767	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:28.546845913 CEST	443	49767	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:28.546904087 CEST	49767	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:28.558918953 CEST	49770	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:28.558984041 CEST	443	49770	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:28.559070110 CEST	49770	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:28.559237003 CEST	49767	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:28.559273005 CEST	443	49767	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:28.559286118 CEST	49767	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:28.559293032 CEST	443	49767	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:28.559675932 CEST	49770	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:28.559689999 CEST	443	49770	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:28.562172890 CEST	49771	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:28.562237024 CEST	443	49771	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:28.562304974 CEST	49771	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:28.562436104 CEST	49771	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:28.562452078 CEST	443	49771	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:28.613745928 CEST	443	49768	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:28.613821030 CEST	443	49768	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:28.613893986 CEST	49768	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:28.614061117 CEST	49768	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:28.614097118 CEST	443	49768	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:28.614125967 CEST	49768	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:28.614140034 CEST	443	49768	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:28.616575003 CEST	49772	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:28.616619110 CEST	443	49772	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:28.616733074 CEST	49772	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:28.616885900 CEST	49772	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:28.616899967 CEST	443	49772	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:29.025016069 CEST	443	49769	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:29.025465965 CEST	49769	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:29.025523901 CEST	443	49769	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:29.025930882 CEST	49769	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:29.025940895 CEST	443	49769	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:29.120110989 CEST	443	49769	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:29.120184898 CEST	443	49769	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:29.120251894 CEST	49769	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:29.121938944 CEST	49769	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:29.121964931 CEST	443	49769	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:29.121975899 CEST	49769	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:29.121982098 CEST	443	49769	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:29.124891043 CEST	49774	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:29.124933958 CEST	443	49774	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:29.124988079 CEST	49774	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:29.125129938 CEST	49774	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:29.125160933 CEST	443	49774	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:29.169819117 CEST	443	49771	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:29.170284986 CEST	49771	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:29.170325994 CEST	443	49771	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:29.170896053 CEST	49771	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:29.170912027 CEST	443	49771	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:29.180485964 CEST	443	49770	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:29.180885077 CEST	49770	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:29.180908918 CEST	443	49770	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:29.181246042 CEST	49770	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:29.181250095 CEST	443	49770	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:29.245019913 CEST	443	49772	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:29.245507002 CEST	49772	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:29.245532036 CEST	443	49772	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:29.245959997 CEST	49772	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:29.245969057 CEST	443	49772	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:29.265634060 CEST	443	49771	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:29.265806913 CEST	443	49771	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:29.265892982 CEST	49771	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:29.265980005 CEST	49771	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:29.265980005 CEST	49771	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:29.266041040 CEST	443	49771	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:29.266072035 CEST	443	49771	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:29.268623114 CEST	49775	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:29.268660069 CEST	443	49775	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:29.268738031 CEST	49775	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:29.268914938 CEST	49775	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:29.268929005 CEST	443	49775	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:29.278852940 CEST	443	49770	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:29.278922081 CEST	443	49770	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:29.278974056 CEST	49770	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:29.279093027 CEST	49770	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:29.279115915 CEST	443	49770	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:29.279126883 CEST	49770	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:29.279133081 CEST	443	49770	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:29.281503916 CEST	49776	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:29.281538963 CEST	443	49776	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:29.281616926 CEST	49776	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:29.281761885 CEST	49776	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:29.281769037 CEST	443	49776	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:29.343189955 CEST	443	49772	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:29.343255043 CEST	443	49772	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:29.343408108 CEST	49772	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:29.343642950 CEST	49772	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:29.343663931 CEST	443	49772	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:29.343676090 CEST	49772	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:29.343683958 CEST	443	49772	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:29.346524954 CEST	49777	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:29.346573114 CEST	443	49777	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:29.346652985 CEST	49777	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:29.346787930 CEST	49777	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:29.346801996 CEST	443	49777	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:29.695519924 CEST	443	49758	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:29.750859976 CEST	49758	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:29.764398098 CEST	443	49774	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:29.769336939 CEST	49758	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:29.769350052 CEST	443	49758	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:29.769856930 CEST	49758	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:29.769861937 CEST	443	49758	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:29.774014950 CEST	49774	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:29.774028063 CEST	443	49774	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:29.777627945 CEST	49774	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:29.777647972 CEST	443	49774	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:29.862951994 CEST	443	49758	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:29.863116026 CEST	443	49758	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:29.863178015 CEST	49758	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:29.870538950 CEST	443	49774	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:29.870594978 CEST	443	49774	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:29.870707035 CEST	49774	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:29.889111996 CEST	443	49776	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:29.890274048 CEST	443	49775	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:29.938332081 CEST	49776	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:29.938347101 CEST	49775	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:29.957254887 CEST	443	49777	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:30.000833035 CEST	49777	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:30.035768986 CEST	49777	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:30.035779953 CEST	443	49777	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:30.036405087 CEST	49777	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:30.036408901 CEST	443	49777	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:30.036604881 CEST	49758	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:30.036639929 CEST	443	49758	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:30.036655903 CEST	49758	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:30.036663055 CEST	443	49758	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:30.038419962 CEST	49774	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:30.038419962 CEST	49774	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:30.038439989 CEST	443	49774	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:30.038450003 CEST	443	49774	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:30.039906025 CEST	49776	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:30.039927959 CEST	443	49776	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:30.040370941 CEST	49776	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:30.040379047 CEST	443	49776	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:30.040708065 CEST	49775	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:30.040728092 CEST	443	49775	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:30.041397095 CEST	49775	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:30.041402102 CEST	443	49775	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:30.067701101 CEST	49778	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:30.067745924 CEST	443	49778	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:30.067812920 CEST	49778	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:30.084604025 CEST	49778	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:30.084619999 CEST	443	49778	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:30.085623980 CEST	49779	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:30.085664034 CEST	443	49779	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:30.085720062 CEST	49779	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:30.085815907 CEST	49779	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:30.085824966 CEST	443	49779	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:30.128082991 CEST	443	49777	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:30.128139019 CEST	443	49777	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:30.128175974 CEST	49777	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:30.128645897 CEST	49777	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:30.128655910 CEST	443	49777	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:30.128669024 CEST	49777	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:30.128674030 CEST	443	49777	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:30.130918980 CEST	443	49776	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:30.130979061 CEST	443	49776	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:30.131022930 CEST	49776	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:30.132503986 CEST	49780	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:30.132529974 CEST	443	49780	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:30.132580996 CEST	49780	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:30.132803917 CEST	49776	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:30.132831097 CEST	443	49776	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:30.132846117 CEST	49776	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:30.132852077 CEST	443	49776	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:30.133825064 CEST	49780	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:30.133835077 CEST	443	49780	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:30.134793043 CEST	443	49775	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:30.134952068 CEST	443	49775	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:30.134998083 CEST	49775	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:30.135484934 CEST	49775	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:30.135499001 CEST	443	49775	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:30.137747049 CEST	49781	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:30.137790918 CEST	443	49781	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:30.137840033 CEST	49781	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:30.137960911 CEST	49781	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:30.137975931 CEST	443	49781	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:30.139627934 CEST	49782	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:30.139635086 CEST	443	49782	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:30.139686108 CEST	49782	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:30.140666008 CEST	49782	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:30.140676022 CEST	443	49782	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:30.702079058 CEST	443	49778	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:30.705274105 CEST	49778	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:30.705307961 CEST	443	49778	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:30.705724001 CEST	49778	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:30.705729008 CEST	443	49778	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:30.732074976 CEST	443	49779	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:30.732527018 CEST	49779	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:30.732551098 CEST	443	49779	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:30.732994080 CEST	49779	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:30.733000040 CEST	443	49779	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:30.752985954 CEST	443	49782	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:30.753443956 CEST	49782	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:30.753480911 CEST	443	49782	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:30.753892899 CEST	49782	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:30.753897905 CEST	443	49782	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:30.765074968 CEST	443	49780	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:30.765455008 CEST	49780	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:30.765487909 CEST	443	49780	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:30.765866995 CEST	49780	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:30.765880108 CEST	443	49780	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:30.780841112 CEST	443	49781	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:30.781251907 CEST	49781	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:30.781272888 CEST	443	49781	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:30.781644106 CEST	49781	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:30.781649113 CEST	443	49781	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:30.800782919 CEST	443	49778	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:30.800837994 CEST	443	49778	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:30.800964117 CEST	49778	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:30.801071882 CEST	49778	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:30.801095963 CEST	443	49778	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:30.801107883 CEST	49778	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:30.801114082 CEST	443	49778	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:30.803687096 CEST	49783	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:30.803734064 CEST	443	49783	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:30.803987980 CEST	49783	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:30.804104090 CEST	49783	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:30.804115057 CEST	443	49783	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:30.834660053 CEST	443	49779	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:30.834742069 CEST	443	49779	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:30.834799051 CEST	49779	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:30.835288048 CEST	49779	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:30.835304976 CEST	443	49779	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:30.835319042 CEST	49779	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:30.835323095 CEST	443	49779	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:30.837702036 CEST	49784	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:30.837749958 CEST	443	49784	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:30.837882996 CEST	49784	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:30.838186026 CEST	49784	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:30.838202953 CEST	443	49784	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:30.848781109 CEST	443	49782	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:30.848833084 CEST	443	49782	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:30.848877907 CEST	49782	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:30.849065065 CEST	49782	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:30.849080086 CEST	443	49782	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:30.849090099 CEST	49782	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:30.849095106 CEST	443	49782	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:30.851552963 CEST	49785	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:30.851593018 CEST	443	49785	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:30.851703882 CEST	49785	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:30.851795912 CEST	49785	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:30.851810932 CEST	443	49785	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:30.863590002 CEST	443	49780	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:30.863769054 CEST	443	49780	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:30.863915920 CEST	49780	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:30.863965988 CEST	49780	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:30.863981962 CEST	443	49780	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:30.864008904 CEST	49780	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:30.864015102 CEST	443	49780	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:30.866605997 CEST	49786	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:30.866641998 CEST	443	49786	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:30.866766930 CEST	49786	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:30.866899967 CEST	49786	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:30.866914988 CEST	443	49786	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:30.879829884 CEST	443	49781	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:30.879985094 CEST	443	49781	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:30.880037069 CEST	49781	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:30.880067110 CEST	49781	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:30.880080938 CEST	443	49781	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:30.880091906 CEST	49781	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:30.880095959 CEST	443	49781	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:30.882396936 CEST	49787	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:30.882426977 CEST	443	49787	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:30.882518053 CEST	49787	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:30.882873058 CEST	49787	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:30.882888079 CEST	443	49787	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:31.424156904 CEST	443	49783	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:31.424644947 CEST	49783	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:31.424671888 CEST	443	49783	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:31.425118923 CEST	49783	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:31.425127029 CEST	443	49783	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:31.458864927 CEST	443	49785	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:31.459341049 CEST	49785	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:31.459371090 CEST	443	49785	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:31.459897041 CEST	49785	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:31.459903002 CEST	443	49785	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:31.470308065 CEST	443	49784	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:31.470774889 CEST	49784	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:31.470789909 CEST	443	49784	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:31.471447945 CEST	49784	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:31.471453905 CEST	443	49784	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:31.479882002 CEST	443	49786	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:31.482393980 CEST	49786	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:31.482424974 CEST	443	49786	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:31.482820988 CEST	49786	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:31.482826948 CEST	443	49786	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:31.512968063 CEST	443	49787	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:31.513452053 CEST	49787	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:31.513470888 CEST	443	49787	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:31.513885021 CEST	49787	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:31.513890982 CEST	443	49787	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:31.523494005 CEST	443	49783	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:31.523582935 CEST	443	49783	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:31.523670912 CEST	49783	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:31.523761034 CEST	49783	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:31.523781061 CEST	443	49783	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:31.523796082 CEST	49783	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:31.523802042 CEST	443	49783	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:31.526273012 CEST	49788	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:31.526320934 CEST	443	49788	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:31.526757002 CEST	49788	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:31.526890039 CEST	49788	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:31.526900053 CEST	443	49788	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:31.555830002 CEST	443	49785	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:31.555911064 CEST	443	49785	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:31.555991888 CEST	49785	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:31.556189060 CEST	49785	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:31.556211948 CEST	443	49785	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:31.556222916 CEST	49785	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:31.556227922 CEST	443	49785	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:31.559441090 CEST	49789	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:31.559544086 CEST	443	49789	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:31.559662104 CEST	49789	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:31.559778929 CEST	49789	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:31.559812069 CEST	443	49789	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:31.569514036 CEST	443	49784	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:31.569577932 CEST	443	49784	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:31.569658041 CEST	49784	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:31.569812059 CEST	49784	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:31.569832087 CEST	443	49784	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:31.569843054 CEST	49784	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:31.569849014 CEST	443	49784	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:31.572061062 CEST	49790	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:31.572144985 CEST	443	49790	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:31.572236061 CEST	49790	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:31.572372913 CEST	49790	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:31.572411060 CEST	443	49790	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:31.574489117 CEST	443	49786	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:31.574554920 CEST	443	49786	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:31.574615955 CEST	49786	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:31.574737072 CEST	49786	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:31.574754000 CEST	443	49786	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:31.574767113 CEST	49786	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:31.574771881 CEST	443	49786	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:31.576636076 CEST	49791	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:31.576656103 CEST	443	49791	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:31.578074932 CEST	49791	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:31.578193903 CEST	49791	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:31.578198910 CEST	443	49791	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:31.613435030 CEST	443	49787	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:31.613552094 CEST	443	49787	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:31.614084959 CEST	49787	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:31.614126921 CEST	49787	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:31.614150047 CEST	443	49787	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:31.614161015 CEST	49787	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:31.614166975 CEST	443	49787	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:31.616650105 CEST	49792	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:31.616695881 CEST	443	49792	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:31.616795063 CEST	49792	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:31.616940975 CEST	49792	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:31.616955996 CEST	443	49792	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:32.133488894 CEST	443	49788	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:32.133980989 CEST	49788	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:32.134012938 CEST	443	49788	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:32.134458065 CEST	49788	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:32.134463072 CEST	443	49788	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:32.186301947 CEST	443	49790	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:32.186489105 CEST	443	49789	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:32.186938047 CEST	49790	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:32.186966896 CEST	443	49790	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:32.186995029 CEST	49789	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:32.187001944 CEST	443	49789	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:32.187412024 CEST	49789	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:32.187422991 CEST	443	49789	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:32.187489033 CEST	49790	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:32.187494040 CEST	443	49790	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:32.198363066 CEST	443	49791	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:32.198952913 CEST	49791	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:32.198999882 CEST	443	49791	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:32.199446917 CEST	49791	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:32.199454069 CEST	443	49791	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:32.239381075 CEST	443	49788	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:32.239458084 CEST	443	49788	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:32.239512920 CEST	49788	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:32.239660025 CEST	49788	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:32.239687920 CEST	443	49788	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:32.239700079 CEST	49788	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:32.239705086 CEST	443	49788	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:32.241297960 CEST	443	49792	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:32.241683960 CEST	49792	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:32.241712093 CEST	443	49792	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:32.242110014 CEST	49792	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:32.242120981 CEST	443	49792	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:32.242161989 CEST	49793	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:32.242204905 CEST	443	49793	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:32.242278099 CEST	49793	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:32.242388964 CEST	49793	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:32.242403984 CEST	443	49793	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:32.283018112 CEST	443	49790	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:32.283102036 CEST	443	49790	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:32.283164978 CEST	49790	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:32.285167933 CEST	443	49789	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:32.285232067 CEST	443	49789	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:32.285269022 CEST	49789	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:32.287549019 CEST	49790	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:32.287573099 CEST	443	49790	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:32.287586927 CEST	49790	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:32.287592888 CEST	443	49790	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:32.287709951 CEST	49789	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:32.287714005 CEST	443	49789	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:32.303538084 CEST	49794	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:32.303590059 CEST	443	49794	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:32.303659916 CEST	49794	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:32.316708088 CEST	49795	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:32.316766024 CEST	443	49795	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:32.316840887 CEST	49795	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:32.317354918 CEST	49794	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:32.317400932 CEST	443	49794	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:32.317620993 CEST	49795	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:32.317634106 CEST	443	49795	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:32.340496063 CEST	443	49792	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:32.340568066 CEST	443	49792	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:32.340629101 CEST	49792	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:32.340955973 CEST	49792	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:32.340976000 CEST	443	49792	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:32.340987921 CEST	49792	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:32.340993881 CEST	443	49792	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:32.344038963 CEST	49796	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:32.344089031 CEST	443	49796	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:32.344161034 CEST	49796	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:32.344326973 CEST	49796	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:32.344345093 CEST	443	49796	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:32.508933067 CEST	443	49791	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:32.509026051 CEST	443	49791	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:32.509248972 CEST	49791	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:32.509318113 CEST	49791	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:32.509318113 CEST	49791	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:32.509347916 CEST	443	49791	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:32.509361982 CEST	443	49791	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:32.511842012 CEST	49797	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:32.511893988 CEST	443	49797	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:32.511977911 CEST	49797	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:32.512094975 CEST	49797	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:32.512105942 CEST	443	49797	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:32.851144075 CEST	443	49793	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:32.852089882 CEST	49793	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:32.852119923 CEST	443	49793	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:32.853095055 CEST	49793	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:32.853101015 CEST	443	49793	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:33.958950043 CEST	443	49793	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:33.959022999 CEST	443	49793	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:33.959197044 CEST	49793	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:33.959466934 CEST	49793	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:33.959486961 CEST	443	49793	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:33.959528923 CEST	49793	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:33.959534883 CEST	443	49793	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:33.962518930 CEST	443	49794	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:33.962851048 CEST	49798	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:33.962934017 CEST	443	49798	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:33.963243008 CEST	49794	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:33.963253021 CEST	443	49794	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:33.963303089 CEST	49798	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:33.963438988 CEST	49798	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:33.963459015 CEST	443	49798	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:33.963676929 CEST	49794	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:33.963682890 CEST	443	49794	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:33.971045971 CEST	443	49796	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:33.971143961 CEST	443	49795	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:33.971373081 CEST	49796	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:33.971394062 CEST	443	49796	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:33.971487999 CEST	49795	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:33.971514940 CEST	443	49795	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:33.971714973 CEST	49796	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:33.971720934 CEST	443	49796	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:33.971925020 CEST	49795	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:33.971935987 CEST	443	49795	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:34.059704065 CEST	443	49794	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:34.059773922 CEST	443	49794	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:34.059865952 CEST	49794	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:34.060072899 CEST	49794	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:34.060091972 CEST	443	49794	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:34.060107946 CEST	49794	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:34.060112953 CEST	443	49794	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:34.062891006 CEST	49799	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:34.062932014 CEST	443	49799	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:34.063040018 CEST	49799	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:34.063204050 CEST	49799	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:34.063214064 CEST	443	49799	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:34.066528082 CEST	443	49796	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:34.066615105 CEST	443	49796	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:34.066699028 CEST	49796	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:34.066876888 CEST	49796	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:34.066891909 CEST	443	49796	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:34.066905975 CEST	49796	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:34.066911936 CEST	443	49796	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:34.068363905 CEST	443	49795	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:34.068541050 CEST	443	49795	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:34.068619013 CEST	49795	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:34.068744898 CEST	49795	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:34.068763971 CEST	443	49795	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:34.068774939 CEST	49795	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:34.068780899 CEST	443	49795	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:34.069482088 CEST	49800	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:34.069577932 CEST	443	49800	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:34.069669962 CEST	49800	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:34.069849014 CEST	49800	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:34.069879055 CEST	443	49800	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:34.070554018 CEST	49801	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:34.070595026 CEST	443	49801	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:34.070662975 CEST	49801	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:34.070785046 CEST	49801	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:34.070796013 CEST	443	49801	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:34.148397923 CEST	443	49797	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:34.148896933 CEST	49797	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:34.148931980 CEST	443	49797	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:34.149416924 CEST	49797	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:34.149421930 CEST	443	49797	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:34.246875048 CEST	443	49797	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:34.246943951 CEST	443	49797	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:34.247055054 CEST	49797	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:34.247150898 CEST	49797	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:34.247168064 CEST	443	49797	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:34.247195005 CEST	49797	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:34.247200966 CEST	443	49797	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:34.249598980 CEST	49802	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:34.249651909 CEST	443	49802	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:34.249903917 CEST	49802	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:34.250051975 CEST	49802	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:34.250065088 CEST	443	49802	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:34.619604111 CEST	443	49798	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:34.620336056 CEST	49798	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:34.620379925 CEST	443	49798	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:34.620778084 CEST	49798	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:34.620784044 CEST	443	49798	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:34.673320055 CEST	443	49799	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:34.673993111 CEST	49799	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:34.674032927 CEST	443	49799	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:34.674397945 CEST	49799	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:34.674402952 CEST	443	49799	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:34.677908897 CEST	443	49801	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:34.678350925 CEST	49801	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:34.678375006 CEST	443	49801	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:34.678639889 CEST	49801	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:34.678644896 CEST	443	49801	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:34.720688105 CEST	443	49800	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:34.721007109 CEST	443	49798	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:34.721098900 CEST	443	49798	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:34.721187115 CEST	49798	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:34.721283913 CEST	49798	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:34.721306086 CEST	443	49798	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:34.721321106 CEST	49798	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:34.721328020 CEST	443	49798	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:34.721412897 CEST	49800	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:34.721474886 CEST	443	49800	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:34.721807003 CEST	49800	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:34.721822023 CEST	443	49800	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:34.723793983 CEST	49803	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:34.723854065 CEST	443	49803	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:34.723989010 CEST	49803	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:34.724127054 CEST	49803	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:34.724155903 CEST	443	49803	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:34.769103050 CEST	443	49799	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:34.769186974 CEST	443	49799	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:34.769238949 CEST	49799	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:34.769571066 CEST	49799	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:34.769593000 CEST	443	49799	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:34.769623041 CEST	49799	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:34.769629955 CEST	443	49799	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:34.772984982 CEST	49804	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:34.773025990 CEST	443	49804	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:34.773104906 CEST	49804	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:34.773243904 CEST	49804	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:34.773257971 CEST	443	49804	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:34.773287058 CEST	443	49801	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:34.773344040 CEST	443	49801	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:34.773399115 CEST	49801	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:34.773488045 CEST	49801	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:34.773507118 CEST	443	49801	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:34.773538113 CEST	49801	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:34.773544073 CEST	443	49801	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:34.775878906 CEST	49805	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:34.775913954 CEST	443	49805	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:34.775979042 CEST	49805	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:34.776217937 CEST	49805	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:34.776231050 CEST	443	49805	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:34.820905924 CEST	443	49800	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:34.820982933 CEST	443	49800	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:34.821058989 CEST	49800	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:34.821278095 CEST	49800	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:34.821279049 CEST	49800	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:34.821329117 CEST	443	49800	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:34.821360111 CEST	443	49800	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:34.840905905 CEST	49806	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:34.840959072 CEST	443	49806	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:34.841016054 CEST	49806	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:34.841407061 CEST	49806	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:34.841418028 CEST	443	49806	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:34.875787020 CEST	443	49802	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:34.876303911 CEST	49802	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:34.876334906 CEST	443	49802	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:34.876811028 CEST	49802	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:34.876816988 CEST	443	49802	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:34.972866058 CEST	443	49802	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:34.973056078 CEST	443	49802	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:34.973140001 CEST	49802	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:34.973325968 CEST	49802	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:34.973351955 CEST	443	49802	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:34.973365068 CEST	49802	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:34.973371029 CEST	443	49802	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:34.976756096 CEST	49807	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:34.976809978 CEST	443	49807	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:34.976902962 CEST	49807	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:34.977127075 CEST	49807	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:34.977140903 CEST	443	49807	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:35.386672020 CEST	443	49803	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:35.388197899 CEST	49803	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:35.388226032 CEST	443	49803	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:35.391801119 CEST	49803	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:35.391819954 CEST	443	49803	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:35.431977034 CEST	443	49805	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:35.434334040 CEST	49805	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:35.434354067 CEST	443	49805	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:35.438105106 CEST	49805	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:35.438114882 CEST	443	49805	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:35.463457108 CEST	443	49806	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:35.483818054 CEST	49806	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:35.483841896 CEST	443	49806	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:35.487535000 CEST	49806	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:35.487543106 CEST	443	49806	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:35.489051104 CEST	443	49803	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:35.489136934 CEST	443	49803	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:35.489188910 CEST	49803	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:35.490978956 CEST	49803	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:35.490998030 CEST	443	49803	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:35.491013050 CEST	49803	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:35.491018057 CEST	443	49803	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:35.514763117 CEST	49808	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:35.514805079 CEST	443	49808	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:35.514883995 CEST	49808	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:35.518670082 CEST	49808	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:35.518683910 CEST	443	49808	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:35.534830093 CEST	443	49805	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:35.534915924 CEST	443	49805	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:35.534984112 CEST	49805	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:35.575114965 CEST	49805	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:35.575151920 CEST	443	49805	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:35.575167894 CEST	49805	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:35.575177908 CEST	443	49805	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:35.580607891 CEST	443	49806	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:35.580676079 CEST	443	49806	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:35.580727100 CEST	49806	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:35.586321115 CEST	49806	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:35.586338997 CEST	443	49806	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:35.586349964 CEST	49806	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:35.586354971 CEST	443	49806	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:35.618849039 CEST	49809	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:35.618896961 CEST	443	49809	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:35.618958950 CEST	49809	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:35.619259119 CEST	49809	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:35.619275093 CEST	443	49809	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:35.621082067 CEST	49810	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:35.621104956 CEST	443	49810	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:35.621165037 CEST	49810	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:35.621284008 CEST	49810	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:35.621295929 CEST	443	49810	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:35.629106045 CEST	443	49807	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:35.631249905 CEST	49807	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:35.631278038 CEST	443	49807	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:35.631603003 CEST	49807	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:35.631611109 CEST	443	49807	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:35.732331991 CEST	443	49807	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:35.732404947 CEST	443	49807	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:35.732480049 CEST	49807	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:35.733167887 CEST	49807	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:35.733195066 CEST	443	49807	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:35.733211040 CEST	49807	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:35.733217955 CEST	443	49807	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:35.736335993 CEST	49811	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:35.736367941 CEST	443	49811	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:35.736450911 CEST	49811	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:35.736569881 CEST	49811	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:35.736581087 CEST	443	49811	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:36.160325050 CEST	443	49808	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:36.161070108 CEST	49808	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:36.161139011 CEST	443	49808	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:36.161539078 CEST	49808	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:36.161552906 CEST	443	49808	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:36.241905928 CEST	443	49810	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:36.243020058 CEST	443	49809	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:36.246007919 CEST	49810	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:36.246042013 CEST	443	49810	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:36.246982098 CEST	49810	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:36.246989965 CEST	443	49810	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:36.248750925 CEST	49809	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:36.248766899 CEST	443	49809	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:36.249661922 CEST	49809	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:36.249670029 CEST	443	49809	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:36.259434938 CEST	443	49808	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:36.259459972 CEST	443	49808	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:36.259510040 CEST	443	49808	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:36.259524107 CEST	49808	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:36.259568930 CEST	49808	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:36.262727976 CEST	49808	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:36.262746096 CEST	443	49808	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:36.262758017 CEST	49808	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:36.262763977 CEST	443	49808	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:36.266078949 CEST	49812	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:36.266119957 CEST	443	49812	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:36.266211987 CEST	49812	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:36.266359091 CEST	49812	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:36.266375065 CEST	443	49812	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:36.342108011 CEST	443	49810	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:36.342186928 CEST	443	49810	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:36.342302084 CEST	443	49809	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:36.342375040 CEST	49810	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:36.342381001 CEST	443	49809	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:36.342428923 CEST	49809	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:36.342459917 CEST	49810	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:36.342483044 CEST	443	49810	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:36.342499018 CEST	49810	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:36.342504978 CEST	443	49810	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:36.342520952 CEST	49809	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:36.342525005 CEST	443	49809	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:36.342536926 CEST	49809	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:36.342540026 CEST	443	49809	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:36.345268965 CEST	49813	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:36.345319033 CEST	443	49813	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:36.345331907 CEST	49814	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:36.345340014 CEST	443	49814	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:36.345401049 CEST	49813	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:36.345530987 CEST	49814	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:36.345530987 CEST	49814	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:36.345546007 CEST	443	49814	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:36.345594883 CEST	49813	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:36.345604897 CEST	443	49813	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:36.349127054 CEST	443	49811	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:36.349500895 CEST	49811	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:36.349539995 CEST	443	49811	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:36.349888086 CEST	49811	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:36.349893093 CEST	443	49811	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:36.360121012 CEST	443	49804	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:36.360889912 CEST	49804	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:36.360915899 CEST	443	49804	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:36.361308098 CEST	49804	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:36.361314058 CEST	443	49804	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:36.446806908 CEST	443	49811	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:36.446835995 CEST	443	49811	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:36.446888924 CEST	443	49811	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:36.446969032 CEST	49811	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:36.447004080 CEST	49811	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:36.447124004 CEST	49811	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:36.447140932 CEST	443	49811	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:36.447155952 CEST	49811	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:36.447161913 CEST	443	49811	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:36.449769974 CEST	49815	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:36.449815989 CEST	443	49815	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:36.449887991 CEST	49815	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:36.450287104 CEST	49815	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:36.450299025 CEST	443	49815	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:36.458977938 CEST	443	49804	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:36.459041119 CEST	443	49804	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:36.459095955 CEST	49804	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:36.459233999 CEST	49804	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:36.459254026 CEST	443	49804	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:36.459266901 CEST	49804	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:36.459275007 CEST	443	49804	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:36.461415052 CEST	49816	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:36.461464882 CEST	443	49816	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:36.461539030 CEST	49816	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:36.461770058 CEST	49816	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:36.461780071 CEST	443	49816	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:36.889624119 CEST	443	49812	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:36.890471935 CEST	49812	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:36.890516043 CEST	443	49812	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:36.890933037 CEST	49812	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:36.890939951 CEST	443	49812	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:36.965670109 CEST	443	49814	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:36.966564894 CEST	49814	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:36.966600895 CEST	443	49814	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:36.967139959 CEST	49814	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:36.967148066 CEST	443	49814	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:36.980879068 CEST	443	49813	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:36.981519938 CEST	49813	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:36.981544971 CEST	443	49813	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:36.981884003 CEST	49813	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:36.981889009 CEST	443	49813	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:36.985536098 CEST	443	49812	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:36.985558033 CEST	443	49812	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:36.985635996 CEST	49812	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:36.985657930 CEST	443	49812	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:36.985697985 CEST	49812	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:36.985706091 CEST	443	49812	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:36.985738993 CEST	443	49812	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:36.985775948 CEST	49812	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:36.985938072 CEST	49812	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:36.985953093 CEST	443	49812	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:36.985963106 CEST	49812	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:36.985968113 CEST	443	49812	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:36.988787889 CEST	49817	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:36.988825083 CEST	443	49817	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:36.988919020 CEST	49817	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:36.989078045 CEST	49817	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:36.989089012 CEST	443	49817	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:37.066689968 CEST	443	49815	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:37.067608118 CEST	49815	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:37.067646027 CEST	443	49815	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:37.068141937 CEST	49815	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:37.068150043 CEST	443	49815	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:37.078553915 CEST	443	49816	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:37.079099894 CEST	49816	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:37.079118013 CEST	443	49816	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:37.079411030 CEST	49816	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:37.079416990 CEST	443	49816	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:37.083522081 CEST	443	49813	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:37.083584070 CEST	443	49813	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:37.083663940 CEST	49813	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:37.083683968 CEST	443	49813	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:37.083717108 CEST	443	49813	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:37.083865881 CEST	49813	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:37.083978891 CEST	49813	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:37.083997011 CEST	443	49813	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:37.084005117 CEST	49813	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:37.084012985 CEST	443	49813	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:37.086924076 CEST	49818	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:37.086988926 CEST	443	49818	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:37.087086916 CEST	49818	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:37.087253094 CEST	49818	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:37.087270021 CEST	443	49818	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:37.096106052 CEST	443	49814	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:37.096606016 CEST	443	49814	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:37.096663952 CEST	49814	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:37.096721888 CEST	49814	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:37.096735954 CEST	443	49814	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:37.096748114 CEST	49814	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:37.096752882 CEST	443	49814	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:37.099113941 CEST	49819	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:37.099148989 CEST	443	49819	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:37.099240065 CEST	49819	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:37.099374056 CEST	49819	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:37.099390030 CEST	443	49819	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:37.163191080 CEST	443	49815	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:37.163629055 CEST	443	49815	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:37.163723946 CEST	49815	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:37.163765907 CEST	49815	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:37.163765907 CEST	49815	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:37.163785934 CEST	443	49815	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:37.163796902 CEST	443	49815	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:37.166517973 CEST	49820	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:37.166568995 CEST	443	49820	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:37.166663885 CEST	49820	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:37.166821957 CEST	49820	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:37.166831017 CEST	443	49820	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:37.175879002 CEST	443	49816	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:37.175960064 CEST	443	49816	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:37.176004887 CEST	49816	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:37.176178932 CEST	49816	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:37.176199913 CEST	443	49816	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:37.176211119 CEST	49816	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:37.176217079 CEST	443	49816	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:37.178682089 CEST	49821	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:37.178791046 CEST	443	49821	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:37.178885937 CEST	49821	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:37.179032087 CEST	49821	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:37.179064035 CEST	443	49821	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:37.610444069 CEST	443	49817	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:37.611216068 CEST	49817	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:37.611241102 CEST	443	49817	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:37.611685991 CEST	49817	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:37.611691952 CEST	443	49817	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:37.697547913 CEST	443	49818	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:37.698105097 CEST	49818	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:37.698122025 CEST	443	49818	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:37.698719978 CEST	49818	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:37.698724985 CEST	443	49818	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:37.711378098 CEST	443	49817	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:37.711765051 CEST	443	49817	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:37.711848021 CEST	49817	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:37.711886883 CEST	49817	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:37.711903095 CEST	443	49817	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:37.711914062 CEST	49817	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:37.711920023 CEST	443	49817	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:37.714386940 CEST	49822	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:37.714427948 CEST	443	49822	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:37.714512110 CEST	49822	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:37.714652061 CEST	49822	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:37.714663982 CEST	443	49822	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:37.723803997 CEST	443	49819	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:37.724236965 CEST	49819	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:37.724271059 CEST	443	49819	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:37.724689007 CEST	49819	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:37.724695921 CEST	443	49819	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:37.774988890 CEST	443	49820	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:37.775579929 CEST	49820	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:37.775625944 CEST	443	49820	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:37.776034117 CEST	49820	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:37.776043892 CEST	443	49820	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:37.794351101 CEST	443	49818	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:37.794677019 CEST	443	49818	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:37.794744015 CEST	49818	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:37.794809103 CEST	49818	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:37.794823885 CEST	443	49818	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:37.794837952 CEST	49818	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:37.794842958 CEST	443	49818	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:37.797616959 CEST	49823	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:37.797667027 CEST	443	49823	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:37.797744989 CEST	49823	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:37.797904968 CEST	49823	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:37.797916889 CEST	443	49823	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:37.798645973 CEST	443	49821	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:37.798999071 CEST	49821	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:37.799025059 CEST	443	49821	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:37.799422026 CEST	49821	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:37.799429893 CEST	443	49821	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:37.821098089 CEST	443	49819	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:37.821155071 CEST	443	49819	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:37.821207047 CEST	49819	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:37.821403027 CEST	49819	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:37.821419001 CEST	443	49819	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:37.821430922 CEST	49819	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:37.821438074 CEST	443	49819	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:37.824263096 CEST	49824	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:37.824307919 CEST	443	49824	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:37.824369907 CEST	49824	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:37.824567080 CEST	49824	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:37.824580908 CEST	443	49824	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:37.870656967 CEST	443	49820	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:37.870728016 CEST	443	49820	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:37.870785952 CEST	49820	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:37.871253014 CEST	49820	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:37.871284962 CEST	443	49820	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:37.871296883 CEST	49820	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:37.871304989 CEST	443	49820	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:37.876555920 CEST	49825	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:37.876601934 CEST	443	49825	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:37.876683950 CEST	49825	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:37.876838923 CEST	49825	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:37.876851082 CEST	443	49825	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:37.895339966 CEST	443	49821	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:37.895539045 CEST	443	49821	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:37.895596027 CEST	49821	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:37.895637989 CEST	49821	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:37.895646095 CEST	443	49821	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:37.895659924 CEST	49821	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:37.895663977 CEST	443	49821	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:37.898365974 CEST	49826	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:37.898375034 CEST	443	49826	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:37.898438931 CEST	49826	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:37.898607969 CEST	49826	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:37.898617983 CEST	443	49826	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:38.329646111 CEST	443	49822	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:38.330914021 CEST	49822	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:38.330955982 CEST	443	49822	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:38.331377983 CEST	49822	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:38.331409931 CEST	443	49822	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:38.421844006 CEST	443	49823	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:38.422540903 CEST	49823	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:38.422595978 CEST	443	49823	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:38.423185110 CEST	49823	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:38.423191071 CEST	443	49823	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:38.430845022 CEST	443	49822	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:38.432115078 CEST	443	49822	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:38.432214022 CEST	49822	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:38.432296038 CEST	49822	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:38.432296038 CEST	49822	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:38.432337999 CEST	443	49822	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:38.432363033 CEST	443	49822	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:38.435277939 CEST	49827	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:38.435332060 CEST	443	49827	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:38.435631037 CEST	49827	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:38.435631037 CEST	49827	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:38.435664892 CEST	443	49827	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:38.445144892 CEST	443	49824	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:38.445611000 CEST	49824	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:38.445628881 CEST	443	49824	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:38.446033001 CEST	49824	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:38.446039915 CEST	443	49824	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:38.524919987 CEST	443	49823	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:38.525131941 CEST	443	49823	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:38.525228024 CEST	49823	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:38.525352955 CEST	49823	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:38.525374889 CEST	443	49823	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:38.525386095 CEST	49823	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:38.525392056 CEST	443	49823	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:38.528379917 CEST	49828	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:38.528426886 CEST	443	49828	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:38.528520107 CEST	49828	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:38.528681993 CEST	49828	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:38.528696060 CEST	443	49828	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:38.529289007 CEST	443	49825	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:38.529671907 CEST	49825	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:38.529747009 CEST	443	49825	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:38.530097961 CEST	49825	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:38.530112982 CEST	443	49825	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:38.539844036 CEST	443	49826	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:38.540220022 CEST	49826	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:38.540235996 CEST	443	49826	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:38.540574074 CEST	49826	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:38.540585041 CEST	443	49826	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:38.560197115 CEST	443	49824	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:38.560235023 CEST	443	49824	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:38.560281992 CEST	443	49824	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:38.560296059 CEST	49824	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:38.560337067 CEST	49824	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:38.560575008 CEST	49824	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:38.560595989 CEST	443	49824	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:38.560607910 CEST	49824	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:38.560614109 CEST	443	49824	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:38.563783884 CEST	49829	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:38.563827038 CEST	443	49829	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:38.563893080 CEST	49829	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:38.564028978 CEST	49829	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:38.564034939 CEST	443	49829	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:38.631716967 CEST	443	49825	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:38.631788969 CEST	443	49825	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:38.631843090 CEST	49825	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:38.634016037 CEST	49825	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:38.634043932 CEST	443	49825	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:38.634057999 CEST	49825	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:38.634064913 CEST	443	49825	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:38.638030052 CEST	49830	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:38.638067961 CEST	443	49830	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:38.638144016 CEST	49830	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:38.641632080 CEST	443	49826	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:38.641848087 CEST	49830	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:38.641863108 CEST	443	49830	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:38.642041922 CEST	443	49826	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:38.642087936 CEST	49826	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:38.642098904 CEST	443	49826	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:38.642139912 CEST	49826	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:38.642292976 CEST	49826	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:38.642307997 CEST	443	49826	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:38.642323017 CEST	49826	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:38.642328978 CEST	443	49826	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:38.645991087 CEST	49831	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:38.646032095 CEST	443	49831	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:38.646094084 CEST	49831	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:38.646581888 CEST	49831	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:38.646596909 CEST	443	49831	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:39.043833017 CEST	443	49827	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:39.044542074 CEST	49827	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:39.044573069 CEST	443	49827	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:39.045020103 CEST	49827	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:39.045026064 CEST	443	49827	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:39.140053988 CEST	443	49827	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:39.140212059 CEST	443	49827	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:39.140393019 CEST	49827	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:39.140453100 CEST	49827	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:39.140476942 CEST	443	49827	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:39.140487909 CEST	49827	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:39.140495062 CEST	443	49827	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:39.143455982 CEST	49832	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:39.143511057 CEST	443	49832	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:39.143598080 CEST	49832	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:39.143734932 CEST	49832	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:39.143748999 CEST	443	49832	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:39.144052982 CEST	443	49828	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:39.144480944 CEST	49828	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:39.144501925 CEST	443	49828	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:39.144934893 CEST	49828	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:39.144941092 CEST	443	49828	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:39.180088043 CEST	443	49829	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:39.180660963 CEST	49829	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:39.180682898 CEST	443	49829	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:39.181334972 CEST	49829	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:39.181343079 CEST	443	49829	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:39.308121920 CEST	443	49830	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:39.308770895 CEST	49830	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:39.308804035 CEST	443	49830	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:39.309248924 CEST	49830	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:39.309254885 CEST	443	49830	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:39.326457024 CEST	443	49831	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:39.327012062 CEST	49831	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:39.327042103 CEST	443	49831	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:39.327435970 CEST	49831	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:39.327441931 CEST	443	49831	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:39.348614931 CEST	443	49828	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:39.348721027 CEST	443	49828	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:39.348794937 CEST	49828	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:39.349056959 CEST	49828	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:39.349085093 CEST	443	49828	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:39.349098921 CEST	49828	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:39.349104881 CEST	443	49828	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:39.350199938 CEST	443	49829	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:39.350270033 CEST	443	49829	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:39.350332022 CEST	49829	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:39.350461006 CEST	49829	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:39.350474119 CEST	443	49829	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:39.350486040 CEST	49829	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:39.350492001 CEST	443	49829	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:39.352181911 CEST	49833	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:39.352236986 CEST	443	49833	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:39.352416039 CEST	49833	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:39.352416039 CEST	49834	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:39.352477074 CEST	443	49834	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:39.352492094 CEST	49833	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:39.352504015 CEST	443	49833	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:39.352540016 CEST	49834	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:39.352641106 CEST	49834	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:39.352654934 CEST	443	49834	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:39.404301882 CEST	443	49830	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:39.405266047 CEST	443	49830	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:39.405328989 CEST	443	49830	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:39.405352116 CEST	49830	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:39.405399084 CEST	49830	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:39.405451059 CEST	49830	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:39.405469894 CEST	443	49830	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:39.405481100 CEST	49830	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:39.405486107 CEST	443	49830	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:39.408373117 CEST	49835	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:39.408416033 CEST	443	49835	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:39.408490896 CEST	49835	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:39.408636093 CEST	49835	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:39.408648014 CEST	443	49835	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:39.423657894 CEST	443	49831	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:39.424916983 CEST	443	49831	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:39.424974918 CEST	49831	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:39.425007105 CEST	49831	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:39.425023079 CEST	443	49831	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:39.425035954 CEST	49831	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:39.425040960 CEST	443	49831	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:39.427556038 CEST	49836	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:39.427602053 CEST	443	49836	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:39.427670002 CEST	49836	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:39.427798033 CEST	49836	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:39.427814960 CEST	443	49836	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:39.817059994 CEST	443	49832	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:39.818052053 CEST	49832	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:39.818133116 CEST	443	49832	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:39.818912029 CEST	49832	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:39.818917036 CEST	443	49832	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:39.918627977 CEST	443	49832	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:39.920785904 CEST	443	49832	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:39.920880079 CEST	49832	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:39.920933962 CEST	49832	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:39.920957088 CEST	443	49832	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:39.920974016 CEST	49832	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:39.920980930 CEST	443	49832	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:39.924758911 CEST	49837	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:39.924833059 CEST	443	49837	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:39.924921989 CEST	49837	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:39.925060034 CEST	49837	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:39.925088882 CEST	443	49837	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:39.973669052 CEST	443	49834	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:39.974173069 CEST	49834	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:39.974215031 CEST	443	49834	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:39.974642992 CEST	49834	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:39.974648952 CEST	443	49834	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:40.000369072 CEST	443	49833	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:40.000876904 CEST	49833	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:40.000909090 CEST	443	49833	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:40.001354933 CEST	49833	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:40.001362085 CEST	443	49833	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:40.038099051 CEST	443	49835	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:40.042165995 CEST	49835	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:40.042248011 CEST	443	49835	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:40.042972088 CEST	49835	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:40.042989016 CEST	443	49835	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:40.046320915 CEST	443	49836	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:40.046896935 CEST	49836	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:40.046931982 CEST	443	49836	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:40.047184944 CEST	49836	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:40.047200918 CEST	443	49836	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:40.069812059 CEST	443	49834	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:40.070004940 CEST	443	49834	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:40.070055962 CEST	443	49834	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:40.070070982 CEST	49834	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:40.070115089 CEST	49834	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:40.070231915 CEST	49834	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:40.070255995 CEST	443	49834	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:40.070271015 CEST	49834	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:40.070277929 CEST	443	49834	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:40.072921991 CEST	49838	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:40.072964907 CEST	443	49838	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:40.073057890 CEST	49838	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:40.073200941 CEST	49838	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:40.073216915 CEST	443	49838	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:40.136324883 CEST	443	49833	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:40.137195110 CEST	443	49833	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:40.137279034 CEST	49833	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:40.137320042 CEST	49833	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:40.137345076 CEST	443	49833	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:40.137357950 CEST	49833	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:40.137365103 CEST	443	49833	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:40.139997005 CEST	49839	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:40.140047073 CEST	443	49839	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:40.140146017 CEST	49839	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:40.140299082 CEST	49839	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:40.140311003 CEST	443	49839	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:40.145781040 CEST	443	49836	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:40.146692038 CEST	443	49836	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:40.146733999 CEST	443	49836	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:40.146738052 CEST	49836	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:40.146787882 CEST	49836	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:40.146850109 CEST	49836	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:40.146859884 CEST	443	49836	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:40.146873951 CEST	49836	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:40.146879911 CEST	443	49836	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:40.148890972 CEST	49840	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:40.148935080 CEST	443	49840	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:40.149012089 CEST	49840	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:40.149132013 CEST	49840	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:40.149142027 CEST	443	49840	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:40.150408983 CEST	443	49835	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:40.150476933 CEST	443	49835	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:40.150528908 CEST	49835	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:40.150583982 CEST	49835	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:40.150605917 CEST	443	49835	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:40.150619984 CEST	49835	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:40.150628090 CEST	443	49835	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:40.152328014 CEST	49841	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:40.152360916 CEST	443	49841	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:40.152432919 CEST	49841	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:40.152553082 CEST	49841	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:40.152564049 CEST	443	49841	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:40.666595936 CEST	443	49837	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:40.667282104 CEST	49837	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:40.667326927 CEST	443	49837	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:40.667737007 CEST	49837	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:40.667742014 CEST	443	49837	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:40.711280107 CEST	443	49838	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:40.711847067 CEST	49838	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:40.711886883 CEST	443	49838	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:40.712311029 CEST	49838	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:40.712320089 CEST	443	49838	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:40.772954941 CEST	443	49837	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:40.773042917 CEST	443	49837	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:40.773169994 CEST	49837	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:40.773416996 CEST	49837	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:40.773447990 CEST	443	49837	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:40.773463011 CEST	49837	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:40.773473978 CEST	443	49837	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:40.776571035 CEST	49842	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:40.776614904 CEST	443	49842	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:40.776684046 CEST	49842	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:40.776818991 CEST	49842	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:40.776830912 CEST	443	49842	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:40.783165932 CEST	443	49839	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:40.783457994 CEST	443	49841	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:40.783581018 CEST	49839	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:40.783607006 CEST	443	49839	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:40.783742905 CEST	49841	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:40.783751965 CEST	443	49841	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:40.784076929 CEST	49839	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:40.784085035 CEST	443	49839	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:40.784200907 CEST	49841	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:40.784205914 CEST	443	49841	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:40.785793066 CEST	443	49840	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:40.786091089 CEST	49840	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:40.786114931 CEST	443	49840	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:40.786453009 CEST	49840	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:40.786458969 CEST	443	49840	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:40.810416937 CEST	443	49838	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:40.810976982 CEST	443	49838	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:40.811048985 CEST	49838	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:40.811104059 CEST	49838	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:40.811126947 CEST	443	49838	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:40.811139107 CEST	49838	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:40.811146021 CEST	443	49838	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:40.814274073 CEST	49843	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:40.814311028 CEST	443	49843	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:40.814380884 CEST	49843	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:40.814558983 CEST	49843	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:40.814565897 CEST	443	49843	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:40.880561113 CEST	443	49839	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:40.880719900 CEST	443	49839	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:40.880809069 CEST	49839	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:40.880990028 CEST	49839	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:40.881035089 CEST	443	49839	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:40.881078959 CEST	49839	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:40.881098032 CEST	443	49839	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:40.884079933 CEST	49844	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:40.884181023 CEST	443	49844	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:40.884263039 CEST	49844	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:40.884437084 CEST	49844	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:40.884445906 CEST	443	49840	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:40.884465933 CEST	443	49844	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:40.884481907 CEST	443	49840	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:40.884525061 CEST	49840	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:40.884552956 CEST	443	49840	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:40.884572983 CEST	443	49840	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:40.884608030 CEST	49840	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:40.884666920 CEST	443	49841	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:40.884835005 CEST	443	49841	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:40.884865046 CEST	49840	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:40.884876966 CEST	443	49840	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:40.884891987 CEST	49840	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:40.884891033 CEST	49841	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:40.884896994 CEST	443	49840	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:40.884979963 CEST	49841	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:40.884999037 CEST	443	49841	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:40.885010004 CEST	49841	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:40.885015011 CEST	443	49841	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:40.888355017 CEST	49845	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:40.888401985 CEST	443	49845	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:40.888485909 CEST	49845	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:40.888634920 CEST	49845	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:40.888648987 CEST	443	49845	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:40.888935089 CEST	49846	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:40.888943911 CEST	443	49846	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:40.889034033 CEST	49846	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:40.889147997 CEST	49846	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:40.889166117 CEST	443	49846	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:41.423085928 CEST	443	49842	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:41.423644066 CEST	49842	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:41.423656940 CEST	443	49842	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:41.424104929 CEST	49842	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:41.424108982 CEST	443	49842	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:41.462281942 CEST	443	49843	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:41.462973118 CEST	49843	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:41.462989092 CEST	443	49843	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:41.463423014 CEST	49843	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:41.463428020 CEST	443	49843	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:41.527110100 CEST	443	49842	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:41.527190924 CEST	443	49842	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:41.527237892 CEST	49842	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:41.527484894 CEST	49842	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:41.527503967 CEST	443	49842	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:41.527529955 CEST	49842	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:41.527537107 CEST	443	49842	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:41.530937910 CEST	49848	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:41.530992031 CEST	443	49848	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:41.531064987 CEST	49848	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:41.531225920 CEST	49848	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:41.531239033 CEST	443	49848	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:41.535294056 CEST	443	49845	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:41.535763979 CEST	49845	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:41.535793066 CEST	443	49845	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:41.536504030 CEST	49845	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:41.536509037 CEST	443	49845	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:41.551742077 CEST	443	49844	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:41.552398920 CEST	49844	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:41.552432060 CEST	443	49844	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:41.552938938 CEST	49844	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:41.552943945 CEST	443	49844	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:41.592005968 CEST	443	49843	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:41.592091084 CEST	443	49843	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:41.592148066 CEST	49843	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:41.592344999 CEST	49843	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:41.592360020 CEST	443	49843	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:41.592370033 CEST	49843	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:41.592375994 CEST	443	49843	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:41.593674898 CEST	443	49846	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:41.594060898 CEST	49846	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:41.594094992 CEST	443	49846	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:41.594504118 CEST	49846	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:41.594508886 CEST	443	49846	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:41.595135927 CEST	49849	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:41.595179081 CEST	443	49849	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:41.595243931 CEST	49849	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:41.595364094 CEST	49849	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:41.595375061 CEST	443	49849	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:41.638377905 CEST	443	49845	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:41.638457060 CEST	443	49845	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:41.638521910 CEST	49845	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:41.638752937 CEST	49845	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:41.638770103 CEST	443	49845	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:41.638801098 CEST	49845	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:41.638807058 CEST	443	49845	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:41.641851902 CEST	49850	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:41.641887903 CEST	443	49850	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:41.641982079 CEST	49850	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:41.642153978 CEST	49850	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:41.642162085 CEST	443	49850	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:41.680804014 CEST	443	49844	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:41.683011055 CEST	443	49844	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:41.683064938 CEST	443	49844	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:41.683101892 CEST	49844	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:41.683139086 CEST	49844	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:41.683191061 CEST	49844	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:41.683207035 CEST	443	49844	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:41.683219910 CEST	49844	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:41.683226109 CEST	443	49844	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:41.686311007 CEST	49851	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:41.686367989 CEST	443	49851	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:41.686446905 CEST	49851	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:41.686614037 CEST	49851	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:41.686626911 CEST	443	49851	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:41.702234983 CEST	443	49846	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:41.702301979 CEST	443	49846	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:41.702445030 CEST	49846	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:41.702923059 CEST	49846	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:41.702940941 CEST	443	49846	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:41.702970028 CEST	49846	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:41.702975035 CEST	443	49846	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:41.705347061 CEST	49852	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:41.705388069 CEST	443	49852	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:41.705475092 CEST	49852	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:41.705571890 CEST	49852	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:41.705579042 CEST	443	49852	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:42.094249010 CEST	443	49848	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:42.097052097 CEST	49848	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:42.097079039 CEST	443	49848	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:42.097528934 CEST	49848	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:42.097537041 CEST	443	49848	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:42.194489956 CEST	443	49848	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:42.194662094 CEST	443	49848	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:42.194808006 CEST	49848	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:42.195082903 CEST	49848	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:42.195111990 CEST	443	49848	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:42.195122957 CEST	49848	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:42.195130110 CEST	443	49848	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:42.198672056 CEST	49853	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:42.198734045 CEST	443	49853	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:42.198812962 CEST	49853	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:42.202492952 CEST	49853	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:42.202516079 CEST	443	49853	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:42.217108965 CEST	443	49849	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:42.218357086 CEST	49849	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:42.218395948 CEST	443	49849	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:42.218786001 CEST	49849	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:42.218796015 CEST	443	49849	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:42.270617008 CEST	443	49850	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:42.271146059 CEST	49850	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:42.271186113 CEST	443	49850	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:42.271653891 CEST	49850	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:42.271662951 CEST	443	49850	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:42.335136890 CEST	443	49849	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:42.335176945 CEST	443	49849	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:42.335227013 CEST	443	49849	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:42.335273027 CEST	49849	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:42.335314035 CEST	49849	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:42.335509062 CEST	49849	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:42.335541010 CEST	443	49849	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:42.335558891 CEST	49849	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:42.335566998 CEST	443	49849	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:42.337178946 CEST	443	49851	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:42.338139057 CEST	49854	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:42.338195086 CEST	443	49854	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:42.338481903 CEST	49851	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:42.338516951 CEST	443	49851	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:42.338520050 CEST	49854	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:42.338638067 CEST	49854	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:42.338654995 CEST	443	49854	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:42.338911057 CEST	49851	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:42.338920116 CEST	443	49851	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:42.356458902 CEST	443	49852	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:42.360719919 CEST	49852	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:42.360748053 CEST	443	49852	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:42.361145973 CEST	49852	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:42.361150980 CEST	443	49852	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:42.368685961 CEST	443	49850	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:42.368766069 CEST	443	49850	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:42.368863106 CEST	49850	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:42.369086027 CEST	49850	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:42.369124889 CEST	443	49850	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:42.369157076 CEST	49850	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:42.369173050 CEST	443	49850	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:42.371550083 CEST	49855	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:42.371591091 CEST	443	49855	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:42.372605085 CEST	49855	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:42.372737885 CEST	49855	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:42.372754097 CEST	443	49855	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:42.444076061 CEST	443	49851	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:42.444427967 CEST	443	49851	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:42.444524050 CEST	49851	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:42.444730043 CEST	49851	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:42.444755077 CEST	443	49851	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:42.444766045 CEST	49851	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:42.444772005 CEST	443	49851	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:42.447370052 CEST	49856	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:42.447412014 CEST	443	49856	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:42.447484016 CEST	49856	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:42.447628021 CEST	49856	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:42.447638988 CEST	443	49856	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:42.458384037 CEST	443	49852	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:42.458499908 CEST	443	49852	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:42.458590031 CEST	49852	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:42.458760023 CEST	49852	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:42.458779097 CEST	443	49852	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:42.458791018 CEST	49852	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:42.458796024 CEST	443	49852	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:42.461149931 CEST	49857	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:42.461236954 CEST	443	49857	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:42.461325884 CEST	49857	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:42.461450100 CEST	49857	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:42.461484909 CEST	443	49857	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:42.874295950 CEST	443	49853	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:42.875191927 CEST	49853	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:42.875289917 CEST	443	49853	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:42.875653028 CEST	49853	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:42.875672102 CEST	443	49853	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:42.945400000 CEST	443	49854	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:42.945914984 CEST	49854	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:42.945949078 CEST	443	49854	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:42.946381092 CEST	49854	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:42.946386099 CEST	443	49854	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:42.973156929 CEST	443	49853	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:42.973186016 CEST	443	49853	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:42.973232985 CEST	443	49853	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:42.973268986 CEST	49853	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:42.973314047 CEST	49853	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:42.973478079 CEST	49853	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:42.973506927 CEST	443	49853	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:42.973524094 CEST	49853	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:42.973534107 CEST	443	49853	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:42.976151943 CEST	49858	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:42.976207018 CEST	443	49858	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:42.976285934 CEST	49858	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:42.976443052 CEST	49858	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:42.976455927 CEST	443	49858	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:43.012115002 CEST	443	49855	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:43.012854099 CEST	49855	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:43.012896061 CEST	443	49855	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:43.013230085 CEST	49855	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:43.013237953 CEST	443	49855	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:43.040086985 CEST	443	49854	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:43.040227890 CEST	443	49854	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:43.040424109 CEST	49854	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:43.040482044 CEST	49854	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:43.040505886 CEST	443	49854	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:43.040522099 CEST	49854	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:43.040529013 CEST	443	49854	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:43.043452978 CEST	49859	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:43.043504953 CEST	443	49859	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:43.043584108 CEST	49859	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:43.043759108 CEST	49859	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:43.043768883 CEST	443	49859	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:43.055269003 CEST	443	49856	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:43.055795908 CEST	49856	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:43.055821896 CEST	443	49856	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:43.056257963 CEST	49856	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:43.056269884 CEST	443	49856	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:43.067657948 CEST	443	49857	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:43.070472002 CEST	49857	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:43.070501089 CEST	443	49857	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:43.070882082 CEST	49857	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:43.070888996 CEST	443	49857	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:43.114269018 CEST	443	49855	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:43.114305973 CEST	443	49855	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:43.114362001 CEST	443	49855	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:43.114414930 CEST	49855	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:43.114474058 CEST	49855	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:43.121772051 CEST	49855	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:43.121790886 CEST	443	49855	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:43.121802092 CEST	49855	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:43.121809006 CEST	443	49855	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:43.124495029 CEST	49860	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:43.124521017 CEST	443	49860	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:43.124609947 CEST	49860	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:43.124753952 CEST	49860	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:43.124762058 CEST	443	49860	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:43.151628971 CEST	443	49856	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:43.151808977 CEST	443	49856	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:43.151922941 CEST	49856	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:43.152153015 CEST	49856	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:43.152153015 CEST	49856	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:43.152201891 CEST	443	49856	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:43.152231932 CEST	443	49856	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:43.154757977 CEST	49861	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:43.154818058 CEST	443	49861	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:43.154908895 CEST	49861	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:43.155054092 CEST	49861	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:43.155073881 CEST	443	49861	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:43.162600040 CEST	443	49857	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:43.163553953 CEST	443	49857	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:43.163598061 CEST	443	49857	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:43.163714886 CEST	49857	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:43.163714886 CEST	49857	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:43.163714886 CEST	49857	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:43.165828943 CEST	49862	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:43.165880919 CEST	443	49862	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:43.165966034 CEST	49862	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:43.166084051 CEST	49862	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:43.166105032 CEST	443	49862	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:43.469644070 CEST	49857	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:43.469681025 CEST	443	49857	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:43.614774942 CEST	443	49858	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:43.618577003 CEST	49858	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:43.618628979 CEST	443	49858	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:43.619039059 CEST	49858	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:43.619044065 CEST	443	49858	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:43.670149088 CEST	443	49859	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:43.674767017 CEST	49859	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:43.674834967 CEST	443	49859	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:43.675091982 CEST	49859	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:43.675107956 CEST	443	49859	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:43.714535952 CEST	443	49858	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:43.714705944 CEST	443	49858	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:43.714832067 CEST	49858	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:43.715058088 CEST	49858	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:43.715076923 CEST	443	49858	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:43.715089083 CEST	49858	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:43.715095043 CEST	443	49858	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:43.717789888 CEST	49863	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:43.717844009 CEST	443	49863	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:43.722151041 CEST	49863	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:43.722281933 CEST	49863	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:43.722296000 CEST	443	49863	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:43.765485048 CEST	443	49859	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:43.765723944 CEST	443	49859	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:43.765788078 CEST	443	49859	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:43.765873909 CEST	49859	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:43.766093016 CEST	49859	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:43.766113997 CEST	443	49859	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:43.766127110 CEST	49859	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:43.766133070 CEST	443	49859	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:43.769438028 CEST	49864	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:43.769488096 CEST	443	49864	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:43.769629002 CEST	49864	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:43.769814968 CEST	49864	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:43.769824982 CEST	443	49864	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:43.773983955 CEST	443	49862	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:43.774363995 CEST	49862	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:43.774398088 CEST	443	49862	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:43.774786949 CEST	49862	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:43.774796963 CEST	443	49862	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:43.780184984 CEST	443	49861	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:43.780484915 CEST	49861	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:43.780520916 CEST	443	49861	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:43.780833006 CEST	49861	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:43.780841112 CEST	443	49861	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:43.782541990 CEST	443	49860	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:43.786420107 CEST	49860	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:43.786434889 CEST	443	49860	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:43.786848068 CEST	49860	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:43.786854029 CEST	443	49860	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:43.876086950 CEST	443	49862	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:43.876179934 CEST	443	49862	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:43.876250029 CEST	49862	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:43.876569033 CEST	49862	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:43.876621008 CEST	443	49862	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:43.876657009 CEST	49862	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:43.876673937 CEST	443	49862	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:43.880980015 CEST	49865	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:43.881027937 CEST	443	49865	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:43.881162882 CEST	49865	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:43.881531954 CEST	49865	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:43.881542921 CEST	443	49865	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:43.888303995 CEST	443	49860	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:43.888384104 CEST	443	49860	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:43.888437986 CEST	49860	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:43.888626099 CEST	49860	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:43.888647079 CEST	443	49860	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:43.888658047 CEST	49860	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:43.888664007 CEST	443	49860	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:43.889446974 CEST	443	49861	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:43.889513969 CEST	443	49861	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:43.889561892 CEST	443	49861	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:43.889571905 CEST	49861	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:43.889606953 CEST	49861	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:43.889880896 CEST	49861	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:43.889898062 CEST	443	49861	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:43.889911890 CEST	49861	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:43.889918089 CEST	443	49861	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:43.891701937 CEST	49866	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:43.891719103 CEST	443	49866	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:43.891877890 CEST	49866	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:43.892050028 CEST	49866	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:43.892060995 CEST	443	49866	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:43.892421007 CEST	49867	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:43.892472982 CEST	443	49867	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:43.892713070 CEST	49867	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:43.892829895 CEST	49867	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:43.892838955 CEST	443	49867	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:44.330153942 CEST	443	49863	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:44.330599070 CEST	49863	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:44.330626011 CEST	443	49863	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:44.331294060 CEST	49863	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:44.331300020 CEST	443	49863	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:44.422772884 CEST	443	49864	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:44.425746918 CEST	443	49863	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:44.425975084 CEST	443	49863	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:44.426068068 CEST	49863	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:44.426431894 CEST	49864	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:44.426465034 CEST	443	49864	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:44.430387974 CEST	49864	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:44.430399895 CEST	443	49864	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:44.430546045 CEST	49863	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:44.430571079 CEST	443	49863	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:44.430584908 CEST	49863	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:44.430592060 CEST	443	49863	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:44.447127104 CEST	49868	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:44.447176933 CEST	443	49868	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:44.447266102 CEST	49868	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:44.450649977 CEST	49868	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:44.450664997 CEST	443	49868	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:44.502861023 CEST	443	49866	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:44.506536007 CEST	49866	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:44.506561995 CEST	443	49866	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:44.506967068 CEST	49866	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:44.506973028 CEST	443	49866	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:44.525871038 CEST	443	49864	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:44.526108980 CEST	443	49864	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:44.526201963 CEST	49864	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:44.534168959 CEST	443	49867	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:44.555893898 CEST	49864	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:44.555921078 CEST	443	49864	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:44.555936098 CEST	49864	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:44.555943966 CEST	443	49864	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:44.565063000 CEST	443	49865	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:44.566575050 CEST	49865	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:44.566592932 CEST	443	49865	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:44.567039013 CEST	49865	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:44.567043066 CEST	443	49865	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:44.581600904 CEST	49867	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:44.599795103 CEST	443	49866	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:44.599877119 CEST	443	49866	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:44.599987030 CEST	49866	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:44.610112906 CEST	49867	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:44.610136986 CEST	443	49867	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:44.610670090 CEST	49867	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:44.610677004 CEST	443	49867	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:44.615669012 CEST	49866	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:44.615696907 CEST	443	49866	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:44.615710020 CEST	49866	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:44.615716934 CEST	443	49866	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:44.619014025 CEST	49869	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:44.619055033 CEST	443	49869	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:44.619117975 CEST	49869	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:44.619956017 CEST	49870	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:44.619962931 CEST	443	49870	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:44.620011091 CEST	49870	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:44.620685101 CEST	49869	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:44.620695114 CEST	443	49869	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:44.620805025 CEST	49870	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:44.620811939 CEST	443	49870	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:44.663831949 CEST	443	49865	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:44.665183067 CEST	443	49865	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:44.665246964 CEST	443	49865	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:44.665311098 CEST	49865	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:44.666038036 CEST	49865	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:44.666058064 CEST	443	49865	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:44.666069984 CEST	49865	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:44.666075945 CEST	443	49865	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:44.672291040 CEST	49871	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:44.672342062 CEST	443	49871	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:44.672487020 CEST	49871	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:44.672729015 CEST	49871	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:44.672740936 CEST	443	49871	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:44.707842112 CEST	443	49867	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:44.707952023 CEST	443	49867	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:44.708003044 CEST	443	49867	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:44.708005905 CEST	49867	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:44.708046913 CEST	49867	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:44.710858107 CEST	49867	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:44.710886955 CEST	443	49867	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:44.710901976 CEST	49867	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:44.710910082 CEST	443	49867	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:44.713556051 CEST	49872	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:44.713609934 CEST	443	49872	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:44.713673115 CEST	49872	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:44.714286089 CEST	49872	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:44.714314938 CEST	443	49872	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:45.086040974 CEST	443	49868	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:45.086688995 CEST	49868	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:45.086738110 CEST	443	49868	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:45.087136984 CEST	49868	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:45.087142944 CEST	443	49868	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:45.187376022 CEST	443	49868	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:45.187693119 CEST	443	49868	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:45.187792063 CEST	49868	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:45.190138102 CEST	49868	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:45.190138102 CEST	49868	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:45.190165997 CEST	443	49868	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:45.190176964 CEST	443	49868	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:45.190295935 CEST	49874	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:45.190320969 CEST	443	49874	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:45.190399885 CEST	49874	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:45.190514088 CEST	49874	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:45.190524101 CEST	443	49874	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:45.244549990 CEST	443	49869	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:45.245022058 CEST	443	49870	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:45.245147943 CEST	49869	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:45.245172024 CEST	443	49869	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:45.245321035 CEST	49870	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:45.245332956 CEST	443	49870	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:45.245593071 CEST	49869	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:45.245596886 CEST	443	49869	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:45.245783091 CEST	49870	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:45.245785952 CEST	443	49870	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:45.294691086 CEST	443	49871	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:45.295196056 CEST	49871	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:45.295223951 CEST	443	49871	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:45.295656919 CEST	49871	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:45.295663118 CEST	443	49871	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:45.345694065 CEST	443	49870	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:45.345858097 CEST	443	49870	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:45.345917940 CEST	49870	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:45.346038103 CEST	49870	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:45.346059084 CEST	443	49870	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:45.346069098 CEST	49870	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:45.346075058 CEST	443	49870	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:45.348731995 CEST	49875	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:45.348794937 CEST	443	49875	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:45.348855972 CEST	49875	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:45.349041939 CEST	49875	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:45.349062920 CEST	443	49875	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:45.356256962 CEST	443	49872	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:45.356662035 CEST	49872	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:45.356698036 CEST	443	49872	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:45.357372999 CEST	49872	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:45.357383966 CEST	443	49872	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:45.377001047 CEST	443	49869	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:45.377389908 CEST	443	49869	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:45.377458096 CEST	49869	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:45.377511978 CEST	49869	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:45.377531052 CEST	443	49869	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:45.377541065 CEST	49869	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:45.377547026 CEST	443	49869	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:45.380213976 CEST	49876	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:45.380327940 CEST	443	49876	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:45.380423069 CEST	49876	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:45.380559921 CEST	49876	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:45.380592108 CEST	443	49876	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:45.391830921 CEST	443	49871	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:45.391860008 CEST	443	49871	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:45.391902924 CEST	443	49871	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:45.391952038 CEST	49871	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:45.391992092 CEST	49871	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:45.392178059 CEST	49871	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:45.392198086 CEST	443	49871	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:45.392210007 CEST	49871	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:45.392215967 CEST	443	49871	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:45.394764900 CEST	49877	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:45.394810915 CEST	443	49877	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:45.395052910 CEST	49877	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:45.395052910 CEST	49877	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:45.395092964 CEST	443	49877	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:45.454384089 CEST	443	49872	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:45.454891920 CEST	443	49872	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:45.454962969 CEST	49872	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:45.455015898 CEST	49872	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:45.455044985 CEST	443	49872	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:45.455060005 CEST	49872	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:45.455066919 CEST	443	49872	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:45.457906008 CEST	49878	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:45.457964897 CEST	443	49878	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:45.458050013 CEST	49878	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:45.458213091 CEST	49878	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:45.458229065 CEST	443	49878	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:45.815876007 CEST	443	49874	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:45.816395044 CEST	49874	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:45.816411972 CEST	443	49874	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:45.816817999 CEST	49874	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:45.816822052 CEST	443	49874	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:45.916634083 CEST	443	49874	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:45.916867018 CEST	443	49874	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:45.916918993 CEST	49874	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:45.916922092 CEST	443	49874	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:45.916965961 CEST	49874	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:45.935461044 CEST	49874	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:45.935501099 CEST	443	49874	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:45.935519934 CEST	49874	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:45.935528040 CEST	443	49874	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:45.939798117 CEST	49879	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:45.939882040 CEST	443	49879	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:45.939954042 CEST	49879	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:45.940185070 CEST	49879	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:45.940207958 CEST	443	49879	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:45.990494967 CEST	443	49875	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:45.990984917 CEST	443	49876	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:45.991278887 CEST	49875	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:45.991316080 CEST	443	49875	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:45.992100000 CEST	49875	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:45.992109060 CEST	443	49875	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:45.992413998 CEST	49876	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:45.992427111 CEST	443	49876	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:45.992943048 CEST	49876	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:45.992949009 CEST	443	49876	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:46.030384064 CEST	443	49877	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:46.030838013 CEST	49877	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:46.030917883 CEST	443	49877	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:46.031291008 CEST	49877	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:46.031315088 CEST	443	49877	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:46.112494946 CEST	443	49875	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:46.112660885 CEST	443	49875	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:46.112732887 CEST	49875	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:46.112835884 CEST	49875	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:46.112869978 CEST	443	49875	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:46.112888098 CEST	49875	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:46.112895966 CEST	443	49875	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:46.115415096 CEST	49880	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:46.115470886 CEST	443	49880	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:46.115549088 CEST	49880	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:46.115695000 CEST	49880	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:46.115706921 CEST	443	49880	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:46.129379988 CEST	443	49876	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:46.129512072 CEST	443	49876	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:46.129591942 CEST	49876	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:46.129638910 CEST	49876	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:46.129664898 CEST	443	49876	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:46.129678011 CEST	49876	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:46.129684925 CEST	443	49876	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:46.131910086 CEST	49881	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:46.131954908 CEST	443	49881	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:46.132035971 CEST	49881	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:46.132174969 CEST	49881	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:46.132188082 CEST	443	49881	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:46.149167061 CEST	443	49877	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:46.149226904 CEST	443	49877	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:46.149287939 CEST	49877	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:46.149410009 CEST	49877	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:46.149429083 CEST	443	49877	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:46.149439096 CEST	49877	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:46.149445057 CEST	443	49877	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:46.151712894 CEST	49882	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:46.151748896 CEST	443	49882	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:46.151824951 CEST	49882	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:46.151952028 CEST	49882	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:46.151963949 CEST	443	49882	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:46.177653074 CEST	443	49878	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:46.178162098 CEST	49878	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:46.178184032 CEST	443	49878	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:46.178674936 CEST	49878	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:46.178682089 CEST	443	49878	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:46.278290987 CEST	443	49878	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:46.278403044 CEST	443	49878	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:46.278486967 CEST	49878	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:46.278708935 CEST	49878	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:46.278728962 CEST	443	49878	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:46.278739929 CEST	49878	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:46.278747082 CEST	443	49878	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:46.281486988 CEST	49883	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:46.281543016 CEST	443	49883	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:46.281636000 CEST	49883	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:46.281799078 CEST	49883	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:46.281816006 CEST	443	49883	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:46.589543104 CEST	443	49879	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:46.590341091 CEST	49879	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:46.590377092 CEST	443	49879	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:46.590735912 CEST	49879	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:46.590751886 CEST	443	49879	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:46.685221910 CEST	443	49879	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:46.686151028 CEST	443	49879	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:46.686434031 CEST	49879	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:46.686434031 CEST	49879	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:46.686434031 CEST	49879	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:46.689009905 CEST	49884	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:46.689059973 CEST	443	49884	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:46.689166069 CEST	49884	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:46.689352989 CEST	49884	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:46.689366102 CEST	443	49884	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:46.736943960 CEST	443	49880	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:46.737688065 CEST	49880	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:46.737720013 CEST	443	49880	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:46.738056898 CEST	49880	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:46.738065004 CEST	443	49880	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:46.790355921 CEST	443	49881	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:46.794617891 CEST	49881	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:46.794652939 CEST	443	49881	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:46.795064926 CEST	49881	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:46.795072079 CEST	443	49881	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:46.856138945 CEST	443	49882	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:46.856677055 CEST	49882	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:46.856712103 CEST	443	49882	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:46.857139111 CEST	49882	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:46.857146978 CEST	443	49882	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:46.936810017 CEST	443	49883	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:46.942140102 CEST	49883	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:46.942173004 CEST	443	49883	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:46.943408966 CEST	49883	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:46.943418980 CEST	443	49883	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:46.958868027 CEST	443	49880	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:46.958931923 CEST	443	49880	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:46.959067106 CEST	49880	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:46.959465981 CEST	49880	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:46.959485054 CEST	443	49880	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:46.959496975 CEST	49880	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:46.959502935 CEST	443	49880	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:46.962625980 CEST	49885	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:46.962677002 CEST	443	49885	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:46.962760925 CEST	49885	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:46.963015079 CEST	49885	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:46.963032961 CEST	443	49885	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:46.977406979 CEST	443	49881	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:46.977497101 CEST	443	49881	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:46.977699995 CEST	49881	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:46.978064060 CEST	49881	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:46.978082895 CEST	443	49881	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:46.982518911 CEST	49886	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:46.982615948 CEST	443	49886	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:46.982721090 CEST	49886	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:46.982974052 CEST	49886	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:46.983014107 CEST	443	49886	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:46.987771034 CEST	443	49882	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:46.988548994 CEST	443	49882	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:46.988595963 CEST	443	49882	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:46.988605022 CEST	49882	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:46.988653898 CEST	49882	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:46.988749981 CEST	49882	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:46.988768101 CEST	443	49882	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:46.988779068 CEST	49882	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:46.988785028 CEST	443	49882	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:46.991913080 CEST	49887	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:46.991950989 CEST	443	49887	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:46.992185116 CEST	49887	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:46.992356062 CEST	49887	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:46.992367983 CEST	443	49887	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:47.000948906 CEST	49879	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:47.000977039 CEST	443	49879	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:47.112873077 CEST	443	49883	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:47.114310026 CEST	443	49883	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:47.118189096 CEST	49883	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:47.147429943 CEST	49883	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:47.147464991 CEST	443	49883	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:47.147474051 CEST	49883	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:47.147480965 CEST	443	49883	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:47.180049896 CEST	49888	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:47.180099010 CEST	443	49888	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:47.180190086 CEST	49888	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:47.180401087 CEST	49888	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:47.180413008 CEST	443	49888	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:47.469845057 CEST	443	49884	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:47.480950117 CEST	49884	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:47.480967999 CEST	443	49884	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:47.481892109 CEST	49884	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:47.481899023 CEST	443	49884	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:47.573509932 CEST	443	49884	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:47.573590994 CEST	443	49884	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:47.573652983 CEST	49884	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:47.573992014 CEST	49884	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:47.574017048 CEST	443	49884	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:47.574028969 CEST	49884	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:47.574035883 CEST	443	49884	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:47.577347040 CEST	49889	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:47.577400923 CEST	443	49889	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:47.577467918 CEST	49889	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:47.577626944 CEST	49889	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:47.577640057 CEST	443	49889	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:47.628506899 CEST	443	49885	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:47.636356115 CEST	443	49886	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:47.638164043 CEST	49885	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:47.638184071 CEST	443	49885	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:47.638628960 CEST	49885	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:47.638637066 CEST	443	49885	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:47.638910055 CEST	49886	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:47.638923883 CEST	443	49886	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:47.639343977 CEST	49886	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:47.639352083 CEST	443	49886	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:47.644855022 CEST	443	49887	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:47.645345926 CEST	49887	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:47.645359993 CEST	443	49887	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:47.645751953 CEST	49887	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:47.645756960 CEST	443	49887	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:47.730078936 CEST	443	49885	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:47.730405092 CEST	443	49885	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:47.730557919 CEST	49885	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:47.730597973 CEST	49885	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:47.730618954 CEST	443	49885	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:47.730629921 CEST	49885	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:47.730635881 CEST	443	49885	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:47.730818033 CEST	443	49886	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:47.730839014 CEST	443	49886	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:47.730890989 CEST	49886	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:47.730901003 CEST	443	49886	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:47.731040955 CEST	49886	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:47.731048107 CEST	443	49886	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:47.731064081 CEST	49886	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:47.731189966 CEST	443	49886	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:47.731220961 CEST	443	49886	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:47.731364965 CEST	49886	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:47.734252930 CEST	49890	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:47.734253883 CEST	49891	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:47.734287024 CEST	443	49890	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:47.734291077 CEST	443	49891	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:47.734358072 CEST	49890	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:47.734447956 CEST	49891	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:47.734491110 CEST	49891	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:47.734502077 CEST	443	49891	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:47.734563112 CEST	49890	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:47.734574080 CEST	443	49890	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:47.741775990 CEST	443	49887	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:47.741992950 CEST	443	49887	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:47.742033005 CEST	443	49887	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:47.742058992 CEST	49887	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:47.742094994 CEST	49887	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:47.742145061 CEST	49887	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:47.742156982 CEST	443	49887	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:47.742166996 CEST	49887	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:47.742172003 CEST	443	49887	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:47.744476080 CEST	49892	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:47.744510889 CEST	443	49892	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:47.744610071 CEST	49892	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:47.744718075 CEST	49892	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:47.744726896 CEST	443	49892	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:47.790622950 CEST	443	49888	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:47.791070938 CEST	49888	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:47.791085958 CEST	443	49888	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:47.791512012 CEST	49888	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:47.791516066 CEST	443	49888	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:47.890696049 CEST	443	49888	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:47.890734911 CEST	443	49888	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:47.890780926 CEST	443	49888	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:47.890796900 CEST	49888	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:47.890841961 CEST	49888	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:47.891071081 CEST	49888	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:47.891093016 CEST	443	49888	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:47.891103983 CEST	49888	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:47.891109943 CEST	443	49888	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:47.894690037 CEST	49893	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:47.894742012 CEST	443	49893	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:47.894833088 CEST	49893	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:47.894982100 CEST	49893	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:47.894995928 CEST	443	49893	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:48.216655970 CEST	443	49889	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:48.217240095 CEST	49889	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:48.217279911 CEST	443	49889	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:48.217706919 CEST	49889	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:48.217719078 CEST	443	49889	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:48.331285000 CEST	443	49889	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:48.331677914 CEST	443	49889	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:48.331739902 CEST	49889	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:48.331815004 CEST	49889	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:48.331815004 CEST	49889	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:48.331835985 CEST	443	49889	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:48.331845999 CEST	443	49889	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:48.334373951 CEST	49894	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:48.334407091 CEST	443	49894	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:48.334517002 CEST	49894	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:48.334671974 CEST	49894	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:48.334688902 CEST	443	49894	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:48.347121000 CEST	443	49891	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:48.347564936 CEST	49891	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:48.347579956 CEST	443	49891	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:48.348074913 CEST	49891	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:48.348079920 CEST	443	49891	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:48.351890087 CEST	443	49890	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:48.352196932 CEST	49890	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:48.352231979 CEST	443	49890	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:48.352600098 CEST	49890	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:48.352611065 CEST	443	49890	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:48.352777958 CEST	443	49892	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:48.353612900 CEST	49892	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:48.353637934 CEST	443	49892	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:48.353967905 CEST	49892	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:48.353976965 CEST	443	49892	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:48.443229914 CEST	443	49891	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:48.443748951 CEST	443	49891	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:48.443806887 CEST	49891	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:48.443866968 CEST	49891	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:48.443886042 CEST	443	49891	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:48.443895102 CEST	49891	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:48.443901062 CEST	443	49891	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:48.446849108 CEST	49895	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:48.446891069 CEST	443	49895	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:48.446954012 CEST	49895	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:48.447094917 CEST	49895	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:48.447108984 CEST	443	49895	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:48.448487043 CEST	443	49890	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:48.448487997 CEST	443	49892	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:48.448512077 CEST	443	49892	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:48.448568106 CEST	49892	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:48.448585033 CEST	443	49892	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:48.448643923 CEST	443	49892	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:48.448688030 CEST	49892	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:48.448797941 CEST	49892	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:48.448808908 CEST	443	49892	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:48.449363947 CEST	443	49890	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:48.449423075 CEST	443	49890	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:48.449429035 CEST	49890	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:48.449553967 CEST	49890	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:48.449649096 CEST	49890	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:48.449667931 CEST	443	49890	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:48.449731112 CEST	49890	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:48.449737072 CEST	443	49890	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:48.451524019 CEST	49896	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:48.451569080 CEST	443	49896	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:48.451728106 CEST	49896	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:48.451981068 CEST	49896	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:48.451997995 CEST	443	49896	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:48.452207088 CEST	49897	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:48.452240944 CEST	443	49897	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:48.452306986 CEST	49897	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:48.452461958 CEST	49897	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:48.452474117 CEST	443	49897	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:48.526007891 CEST	443	49893	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:48.526716948 CEST	49893	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:48.526750088 CEST	443	49893	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:48.527192116 CEST	49893	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:48.527201891 CEST	443	49893	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:48.623464108 CEST	443	49893	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:48.623517036 CEST	443	49893	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:48.623574972 CEST	443	49893	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:48.623632908 CEST	49893	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:48.623811960 CEST	49893	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:48.623832941 CEST	443	49893	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:48.623869896 CEST	49893	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:48.623878002 CEST	443	49893	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:48.627454996 CEST	49898	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:48.627531052 CEST	443	49898	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:48.627712965 CEST	49898	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:48.628213882 CEST	49898	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:48.628240108 CEST	443	49898	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:48.939249992 CEST	443	49894	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:48.939831018 CEST	49894	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:48.939862013 CEST	443	49894	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:48.940450907 CEST	49894	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:48.940465927 CEST	443	49894	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:49.034949064 CEST	443	49894	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:49.034981966 CEST	443	49894	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:49.035023928 CEST	443	49894	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:49.035047054 CEST	49894	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:49.035089016 CEST	49894	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:49.035315037 CEST	49894	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:49.035336018 CEST	443	49894	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:49.035350084 CEST	49894	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:49.035355091 CEST	443	49894	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:49.038120031 CEST	49899	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:49.038218975 CEST	443	49899	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:49.038337946 CEST	49899	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:49.038489103 CEST	49899	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:49.038528919 CEST	443	49899	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:49.057493925 CEST	443	49897	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:49.057955980 CEST	49897	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:49.058032990 CEST	443	49897	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:49.058562994 CEST	49897	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:49.058577061 CEST	443	49897	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:49.063009977 CEST	443	49895	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:49.063616991 CEST	49895	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:49.063646078 CEST	443	49895	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:49.064174891 CEST	49895	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:49.064179897 CEST	443	49895	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:49.084196091 CEST	443	49896	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:49.084765911 CEST	49896	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:49.084800005 CEST	443	49896	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:49.085086107 CEST	49896	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:49.085093021 CEST	443	49896	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:49.152708054 CEST	443	49897	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:49.152791023 CEST	443	49897	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:49.152884960 CEST	49897	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:49.153166056 CEST	49897	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:49.153183937 CEST	443	49897	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:49.158250093 CEST	49900	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:49.158291101 CEST	443	49900	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:49.158632994 CEST	49900	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:49.158659935 CEST	443	49895	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:49.158854008 CEST	49900	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:49.158866882 CEST	443	49900	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:49.159049034 CEST	443	49895	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:49.159116983 CEST	49895	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:49.159190893 CEST	49895	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:49.159207106 CEST	443	49895	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:49.159221888 CEST	49895	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:49.159228086 CEST	443	49895	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:49.162646055 CEST	49901	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:49.162674904 CEST	443	49901	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:49.162734985 CEST	49901	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:49.162925005 CEST	49901	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:49.162934065 CEST	443	49901	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:49.183362007 CEST	443	49896	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:49.183509111 CEST	443	49896	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:49.183569908 CEST	49896	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:49.183773041 CEST	49896	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:49.183788061 CEST	443	49896	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:49.183804035 CEST	49896	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:49.183809042 CEST	443	49896	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:49.187685966 CEST	49902	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:49.187714100 CEST	443	49902	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:49.187855959 CEST	49902	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:49.188080072 CEST	49902	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:49.188088894 CEST	443	49902	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:49.244602919 CEST	443	49898	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:49.245089054 CEST	49898	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:49.245168924 CEST	443	49898	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:49.245533943 CEST	49898	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:49.245553017 CEST	443	49898	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:49.341438055 CEST	443	49898	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:49.342097044 CEST	443	49898	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:49.342156887 CEST	443	49898	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:49.342186928 CEST	49898	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:49.342225075 CEST	49898	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:49.343754053 CEST	49898	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:49.343779087 CEST	443	49898	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:49.343791008 CEST	49898	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:49.343797922 CEST	443	49898	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:49.347666025 CEST	49903	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:49.347718000 CEST	443	49903	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:49.347788095 CEST	49903	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:49.347935915 CEST	49903	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:49.347949982 CEST	443	49903	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:49.873097897 CEST	443	49899	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:49.873574972 CEST	49899	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:49.873601913 CEST	443	49899	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:49.874133110 CEST	49899	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:49.874139071 CEST	443	49899	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:49.877217054 CEST	443	49901	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:49.877398968 CEST	443	49902	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:49.877698898 CEST	49901	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:49.877724886 CEST	443	49901	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:49.877795935 CEST	443	49900	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:49.878375053 CEST	49901	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:49.878380060 CEST	443	49901	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:49.892642021 CEST	49902	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:49.892663956 CEST	443	49902	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:49.893049002 CEST	49902	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:49.893055916 CEST	443	49902	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:49.896365881 CEST	49900	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:49.896398067 CEST	443	49900	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:49.896754980 CEST	49900	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:49.896764994 CEST	443	49900	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:49.971610069 CEST	443	49899	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:49.971687078 CEST	443	49899	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:49.972299099 CEST	49899	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:49.974808931 CEST	49899	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:49.974852085 CEST	443	49899	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:49.974893093 CEST	49899	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:49.974910021 CEST	443	49899	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:49.980315924 CEST	443	49901	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:49.980484962 CEST	443	49901	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:49.980655909 CEST	49901	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:49.983724117 CEST	443	49902	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:49.983772993 CEST	443	49902	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:49.983829021 CEST	49902	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:49.983831882 CEST	443	49902	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:49.984699965 CEST	49902	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:49.986146927 CEST	49901	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:49.986172915 CEST	443	49901	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:49.986186981 CEST	49901	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:49.986193895 CEST	443	49901	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:49.988127947 CEST	443	49900	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:49.988167048 CEST	443	49900	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:49.988228083 CEST	443	49900	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:49.988229990 CEST	49900	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:49.988265991 CEST	49900	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:49.993298054 CEST	49902	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:49.993318081 CEST	443	49902	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:49.993330002 CEST	49902	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:49.993335009 CEST	443	49902	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:50.003048897 CEST	49900	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:50.003084898 CEST	443	49900	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:50.003112078 CEST	49900	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:50.003122091 CEST	443	49900	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:50.032056093 CEST	49904	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:50.032111883 CEST	443	49904	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:50.032176971 CEST	49904	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:50.035065889 CEST	49905	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:50.035124063 CEST	443	49905	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:50.035248995 CEST	49905	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:50.038403988 CEST	49904	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:50.038424969 CEST	443	49904	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:50.039025068 CEST	49906	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:50.039052010 CEST	443	49906	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:50.039117098 CEST	49906	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:50.039202929 CEST	49906	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:50.039217949 CEST	443	49906	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:50.050817013 CEST	443	49903	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:50.079248905 CEST	49907	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:50.079324007 CEST	443	49907	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:50.079426050 CEST	49907	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:50.079516888 CEST	49905	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:50.079587936 CEST	443	49905	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:50.079813957 CEST	49903	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:50.079837084 CEST	443	49903	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:50.096849918 CEST	49903	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:50.096857071 CEST	443	49903	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:50.106277943 CEST	49907	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:50.106293917 CEST	443	49907	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:50.187541962 CEST	443	49903	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:50.188472033 CEST	443	49903	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:50.188632011 CEST	49903	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:50.189714909 CEST	49903	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:50.189743996 CEST	443	49903	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:50.189766884 CEST	49903	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:50.189774990 CEST	443	49903	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:50.202527046 CEST	49908	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:50.202590942 CEST	443	49908	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:50.202687025 CEST	49908	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:50.202909946 CEST	49908	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:50.202927113 CEST	443	49908	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:50.652169943 CEST	443	49906	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:50.652764082 CEST	49906	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:50.652793884 CEST	443	49906	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:50.653211117 CEST	49906	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:50.653218031 CEST	443	49906	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:50.699419022 CEST	443	49904	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:50.700051069 CEST	49904	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:50.700110912 CEST	443	49904	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:50.700499058 CEST	49904	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:50.700510979 CEST	443	49904	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:50.714617968 CEST	443	49905	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:50.715420961 CEST	49905	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:50.715481043 CEST	443	49905	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:50.715869904 CEST	49905	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:50.715877056 CEST	443	49905	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:50.717763901 CEST	443	49907	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:50.718147993 CEST	49907	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:50.718198061 CEST	443	49907	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:50.718477011 CEST	49907	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:50.718485117 CEST	443	49907	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:50.748512983 CEST	443	49906	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:50.748632908 CEST	443	49906	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:50.748969078 CEST	49906	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:50.748969078 CEST	49906	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:50.749011040 CEST	49906	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:50.749030113 CEST	443	49906	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:50.752470016 CEST	49909	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:50.752507925 CEST	443	49909	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:50.752578020 CEST	49909	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:50.752717972 CEST	49909	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:50.752728939 CEST	443	49909	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:50.802253962 CEST	443	49904	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:50.802309990 CEST	443	49904	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:50.802362919 CEST	49904	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:50.802506924 CEST	49904	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:50.802531958 CEST	443	49904	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:50.802546024 CEST	49904	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:50.802551985 CEST	443	49904	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:50.804857016 CEST	49910	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:50.804877996 CEST	443	49910	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:50.804949045 CEST	49910	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:50.805151939 CEST	49910	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:50.805160999 CEST	443	49910	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:50.813646078 CEST	443	49905	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:50.813715935 CEST	443	49905	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:50.813760996 CEST	49905	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:50.813898087 CEST	49905	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:50.813918114 CEST	443	49905	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:50.813927889 CEST	49905	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:50.813934088 CEST	443	49905	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:50.814625978 CEST	443	49907	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:50.814625978 CEST	443	49908	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:50.814788103 CEST	443	49907	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:50.814841032 CEST	49907	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:50.815069914 CEST	49907	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:50.815084934 CEST	443	49907	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:50.815099001 CEST	49907	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:50.815104008 CEST	443	49907	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:50.815439939 CEST	49908	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:50.815464973 CEST	443	49908	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:50.815872908 CEST	49908	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:50.815876961 CEST	443	49908	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:50.818264008 CEST	49911	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:50.818300009 CEST	443	49911	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:50.818403006 CEST	49911	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:50.818517923 CEST	49912	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:50.818558931 CEST	443	49912	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:50.818603039 CEST	49912	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:50.818746090 CEST	49911	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:50.818763018 CEST	49912	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:50.818764925 CEST	443	49911	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:50.818778992 CEST	443	49912	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:50.908493996 CEST	443	49908	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:50.910008907 CEST	443	49908	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:50.910058022 CEST	49908	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:50.910073042 CEST	443	49908	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:50.910137892 CEST	49908	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:50.910193920 CEST	49908	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:50.910216093 CEST	443	49908	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:50.910229921 CEST	49908	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:50.910237074 CEST	443	49908	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:50.913019896 CEST	49913	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:50.913064957 CEST	443	49913	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:50.913124084 CEST	49913	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:50.913327932 CEST	49913	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:50.913341045 CEST	443	49913	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:51.369668007 CEST	443	49909	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:51.370098114 CEST	49909	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:51.370114088 CEST	443	49909	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:51.370523930 CEST	49909	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:51.370527983 CEST	443	49909	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:51.436604023 CEST	443	49911	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:51.437167883 CEST	49911	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:51.437212944 CEST	443	49911	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:51.437793016 CEST	49911	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:51.437797070 CEST	443	49911	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:51.449835062 CEST	443	49910	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:51.450342894 CEST	49910	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:51.450356007 CEST	443	49910	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:51.450721979 CEST	49910	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:51.450726032 CEST	443	49910	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:51.451306105 CEST	443	49912	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:51.451746941 CEST	49912	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:51.451772928 CEST	443	49912	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:51.452105999 CEST	49912	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:51.452114105 CEST	443	49912	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:51.466804028 CEST	443	49909	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:51.466887951 CEST	443	49909	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:51.467200994 CEST	49909	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:51.467426062 CEST	49909	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:51.467437983 CEST	443	49909	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:51.467461109 CEST	49909	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:51.467467070 CEST	443	49909	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:51.470032930 CEST	49914	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:51.470077038 CEST	443	49914	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:51.470155954 CEST	49914	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:51.470302105 CEST	49914	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:51.470314026 CEST	443	49914	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:51.533962011 CEST	443	49911	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:51.534027100 CEST	443	49911	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:51.534075975 CEST	49911	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:51.534081936 CEST	443	49911	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:51.534118891 CEST	49911	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:51.534260035 CEST	49911	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:51.534281969 CEST	443	49911	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:51.534293890 CEST	49911	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:51.534300089 CEST	443	49911	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:51.536768913 CEST	49915	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:51.536807060 CEST	443	49915	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:51.536875963 CEST	49915	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:51.537013054 CEST	49915	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:51.537028074 CEST	443	49915	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:51.550405025 CEST	443	49912	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:51.550559998 CEST	443	49912	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:51.550612926 CEST	49912	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:51.550633907 CEST	49912	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:51.550646067 CEST	443	49912	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:51.550663948 CEST	49912	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:51.550669909 CEST	443	49912	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:51.551579952 CEST	443	49910	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:51.551668882 CEST	443	49910	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:51.551712036 CEST	49910	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:51.551728964 CEST	443	49910	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:51.551798105 CEST	443	49910	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:51.551831961 CEST	49910	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:51.551848888 CEST	443	49910	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:51.551858902 CEST	49910	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:51.551858902 CEST	49910	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:51.551866055 CEST	443	49910	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:51.551872015 CEST	443	49910	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:51.552700996 CEST	49916	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:51.552787066 CEST	443	49916	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:51.552858114 CEST	49916	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:51.552972078 CEST	49916	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:51.553006887 CEST	443	49916	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:51.553678989 CEST	49917	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:51.553721905 CEST	443	49917	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:51.553780079 CEST	49917	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:51.553884983 CEST	49917	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:51.553904057 CEST	443	49917	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:51.563240051 CEST	443	49913	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:51.563597918 CEST	49913	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:51.563621998 CEST	443	49913	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:51.564114094 CEST	49913	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:51.564117908 CEST	443	49913	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:51.665946960 CEST	443	49913	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:51.666013002 CEST	443	49913	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:51.666059971 CEST	49913	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:51.666321039 CEST	49913	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:51.666321039 CEST	49913	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:51.666340113 CEST	443	49913	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:51.666351080 CEST	443	49913	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:51.668701887 CEST	49918	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:51.668747902 CEST	443	49918	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:51.668821096 CEST	49918	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:51.668973923 CEST	49918	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:51.668987036 CEST	443	49918	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:52.080008030 CEST	443	49914	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:52.082611084 CEST	49914	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:52.082698107 CEST	443	49914	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:52.083065033 CEST	49914	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:52.083081007 CEST	443	49914	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:52.152779102 CEST	443	49915	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:52.154742956 CEST	49915	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:52.154781103 CEST	443	49915	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:52.155067921 CEST	49915	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:52.155073881 CEST	443	49915	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:52.177426100 CEST	443	49914	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:52.178592920 CEST	443	49914	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:52.178656101 CEST	443	49914	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:52.178756952 CEST	49914	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:52.178802967 CEST	49914	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:52.178824902 CEST	443	49914	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:52.178837061 CEST	49914	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:52.178843021 CEST	443	49914	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:52.181453943 CEST	49919	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:52.181509018 CEST	443	49919	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:52.181596994 CEST	49919	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:52.181736946 CEST	49919	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:52.181752920 CEST	443	49919	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:52.203150988 CEST	443	49917	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:52.206615925 CEST	49917	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:52.206666946 CEST	443	49917	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:52.207052946 CEST	49917	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:52.207058907 CEST	443	49917	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:52.215045929 CEST	443	49916	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:52.218487978 CEST	49916	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:52.218533039 CEST	443	49916	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:52.218847036 CEST	49916	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:52.218858004 CEST	443	49916	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:52.247275114 CEST	443	49915	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:52.247780085 CEST	443	49915	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:52.248033047 CEST	49915	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:52.248126030 CEST	49915	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:52.248156071 CEST	443	49915	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:52.248172045 CEST	49915	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:52.248179913 CEST	443	49915	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:52.251254082 CEST	49920	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:52.251317978 CEST	443	49920	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:52.251432896 CEST	49920	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:52.251605034 CEST	49920	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:52.251619101 CEST	443	49920	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:52.298732042 CEST	443	49917	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:52.298755884 CEST	443	49917	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:52.298922062 CEST	443	49917	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:52.298938036 CEST	49917	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:52.298979998 CEST	49917	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:52.299124002 CEST	49917	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:52.299154043 CEST	443	49917	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:52.299171925 CEST	49917	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:52.299179077 CEST	443	49917	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:52.302328110 CEST	49921	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:52.302391052 CEST	443	49921	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:52.302494049 CEST	49921	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:52.302669048 CEST	49921	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:52.302685976 CEST	443	49921	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:52.330003023 CEST	443	49918	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:52.330589056 CEST	49918	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:52.330617905 CEST	443	49918	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:52.330826998 CEST	443	49916	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:52.330852032 CEST	443	49916	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:52.331013918 CEST	443	49916	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:52.331053019 CEST	49918	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:52.331053019 CEST	49916	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:52.331064939 CEST	443	49918	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:52.331074953 CEST	49916	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:52.331177950 CEST	49916	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:52.331197023 CEST	443	49916	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:52.331208944 CEST	49916	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:52.331216097 CEST	443	49916	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:52.333930969 CEST	49922	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:52.333981037 CEST	443	49922	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:52.334070921 CEST	49922	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:52.334212065 CEST	49922	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:52.334228039 CEST	443	49922	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:52.424853086 CEST	443	49918	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:52.425208092 CEST	443	49918	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:52.425323009 CEST	443	49918	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:52.425334930 CEST	49918	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:52.425385952 CEST	49918	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:52.425734043 CEST	49918	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:52.425755024 CEST	443	49918	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:52.425767899 CEST	49918	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:52.425772905 CEST	443	49918	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:52.428658009 CEST	49923	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:52.428700924 CEST	443	49923	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:52.428797960 CEST	49923	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:52.428972960 CEST	49923	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:52.428987980 CEST	443	49923	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:52.785604954 CEST	443	49920	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:52.786382914 CEST	49920	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:52.786439896 CEST	443	49920	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:52.786844015 CEST	49920	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:52.786853075 CEST	443	49920	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:52.799928904 CEST	443	49919	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:52.800373077 CEST	49919	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:52.800456047 CEST	443	49919	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:52.800728083 CEST	49919	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:52.800738096 CEST	443	49919	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:52.881628990 CEST	443	49920	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:52.881930113 CEST	443	49920	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:52.881973982 CEST	443	49920	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:52.881987095 CEST	49920	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:52.882029057 CEST	49920	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:52.882126093 CEST	49920	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:52.882149935 CEST	443	49920	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:52.882164001 CEST	49920	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:52.882169962 CEST	443	49920	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:52.885427952 CEST	49924	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:52.885534048 CEST	443	49924	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:52.885620117 CEST	49924	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:52.885946035 CEST	49924	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:52.885982037 CEST	443	49924	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:52.895862103 CEST	443	49919	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:52.896069050 CEST	443	49919	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:52.896147966 CEST	49919	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:52.896231890 CEST	49919	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:52.896282911 CEST	443	49919	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:52.896312952 CEST	49919	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:52.896331072 CEST	443	49919	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:52.899244070 CEST	49925	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:52.899297953 CEST	443	49925	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:52.899404049 CEST	49925	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:52.899564028 CEST	49925	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:52.899597883 CEST	443	49925	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:52.947926998 CEST	443	49921	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:52.948472977 CEST	49921	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:52.948501110 CEST	443	49921	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:52.948962927 CEST	49921	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:52.948967934 CEST	443	49921	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:52.959667921 CEST	443	49922	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:52.960151911 CEST	49922	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:52.960161924 CEST	443	49922	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:52.960583925 CEST	49922	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:52.960587978 CEST	443	49922	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:53.054465055 CEST	443	49921	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:53.054708958 CEST	443	49921	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:53.054764032 CEST	49921	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:53.054832935 CEST	49921	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:53.054848909 CEST	443	49921	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:53.054861069 CEST	49921	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:53.054866076 CEST	443	49921	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:53.057169914 CEST	443	49922	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:53.057246923 CEST	443	49922	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:53.057292938 CEST	49922	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:53.057301044 CEST	443	49922	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:53.057312965 CEST	443	49922	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:53.057359934 CEST	49922	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:53.057796955 CEST	49926	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:53.057892084 CEST	443	49926	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:53.057904959 CEST	49922	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:53.057909966 CEST	443	49922	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:53.057919025 CEST	49922	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:53.057921886 CEST	443	49922	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:53.057971001 CEST	49926	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:53.059016943 CEST	49926	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:53.059051037 CEST	443	49926	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:53.060157061 CEST	49927	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:53.060265064 CEST	443	49927	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:53.060344934 CEST	49927	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:53.060466051 CEST	49927	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:53.060513020 CEST	443	49927	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:53.061233044 CEST	443	49923	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:53.061646938 CEST	49923	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:53.061675072 CEST	443	49923	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:53.062092066 CEST	49923	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:53.062098026 CEST	443	49923	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:53.158442020 CEST	443	49923	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:53.158735037 CEST	443	49923	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:53.158909082 CEST	49923	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:53.158909082 CEST	49923	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:53.158910036 CEST	49923	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:53.170193911 CEST	49928	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:53.170253038 CEST	443	49928	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:53.170331001 CEST	49928	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:53.170491934 CEST	49928	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:53.170506954 CEST	443	49928	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:53.469724894 CEST	49923	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:53.469772100 CEST	443	49923	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:53.517708063 CEST	443	49925	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:53.518281937 CEST	49925	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:53.518369913 CEST	443	49925	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:53.518742085 CEST	49925	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:53.518757105 CEST	443	49925	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:53.519685030 CEST	443	49924	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:53.519965887 CEST	49924	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:53.520032883 CEST	443	49924	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:53.520298004 CEST	49924	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:53.520313025 CEST	443	49924	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:53.614866018 CEST	443	49925	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:53.614952087 CEST	443	49925	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:53.615159035 CEST	49925	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:53.615288019 CEST	49925	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:53.615288019 CEST	49925	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:53.615336895 CEST	443	49925	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:53.615370035 CEST	443	49925	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:53.618432045 CEST	49929	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:53.618493080 CEST	443	49929	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:53.618583918 CEST	49929	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:53.618762016 CEST	49929	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:53.618777037 CEST	443	49929	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:53.619533062 CEST	443	49924	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:53.619699955 CEST	443	49924	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:53.619751930 CEST	443	49924	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:53.619774103 CEST	49924	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:53.619862080 CEST	49924	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:53.619862080 CEST	49924	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:53.619862080 CEST	49924	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:53.621961117 CEST	49930	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:53.621990919 CEST	443	49930	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:53.622077942 CEST	49930	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:53.622220039 CEST	49930	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:53.622236013 CEST	443	49930	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:53.678462029 CEST	443	49926	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:53.678924084 CEST	49926	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:53.678972006 CEST	443	49926	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:53.679395914 CEST	49926	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:53.679409027 CEST	443	49926	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:53.687793016 CEST	443	49927	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:53.688303947 CEST	49927	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:53.688359976 CEST	443	49927	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:53.688750029 CEST	49927	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:53.688766956 CEST	443	49927	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:53.776106119 CEST	443	49926	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:53.776485920 CEST	443	49926	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:53.776530027 CEST	49926	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:53.776535988 CEST	443	49926	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:53.776596069 CEST	49926	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:53.776655912 CEST	49926	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:53.776669025 CEST	443	49926	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:53.776681900 CEST	49926	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:53.776688099 CEST	443	49926	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:53.779475927 CEST	49931	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:53.779519081 CEST	443	49931	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:53.779587984 CEST	49931	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:53.779772997 CEST	49931	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:53.779783964 CEST	443	49931	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:53.783168077 CEST	443	49927	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:53.783236027 CEST	443	49927	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:53.783291101 CEST	49927	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:53.783402920 CEST	49927	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:53.783402920 CEST	49927	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:53.783452034 CEST	443	49927	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:53.783482075 CEST	443	49927	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:53.785732985 CEST	49932	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:53.785765886 CEST	443	49932	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:53.785820007 CEST	49932	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:53.785936117 CEST	49932	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:53.785948038 CEST	443	49932	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:53.792443991 CEST	443	49928	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:53.792820930 CEST	49928	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:53.792838097 CEST	443	49928	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:53.793342113 CEST	49928	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:53.793346882 CEST	443	49928	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:53.890108109 CEST	443	49928	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:53.890305996 CEST	443	49928	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:53.890367985 CEST	49928	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:53.890542030 CEST	49928	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:53.890564919 CEST	443	49928	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:53.890587091 CEST	49928	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:53.890594006 CEST	443	49928	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:53.894970894 CEST	49933	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:53.895023108 CEST	443	49933	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:53.895086050 CEST	49933	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:53.895237923 CEST	49933	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:53.895251036 CEST	443	49933	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:53.922796965 CEST	49924	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:53.922835112 CEST	443	49924	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:54.244399071 CEST	443	49930	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:54.244856119 CEST	49930	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:54.244888067 CEST	443	49930	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:54.244926929 CEST	443	49929	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:54.245318890 CEST	49930	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:54.245326042 CEST	443	49930	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:54.245528936 CEST	49929	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:54.245543957 CEST	443	49929	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:54.245878935 CEST	49929	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:54.245884895 CEST	443	49929	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:54.341399908 CEST	443	49930	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:54.341489077 CEST	443	49930	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:54.341598988 CEST	49930	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:54.341763020 CEST	49930	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:54.341784000 CEST	443	49930	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:54.341799021 CEST	49930	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:54.341804981 CEST	443	49930	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:54.342175007 CEST	443	49929	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:54.342206001 CEST	443	49929	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:54.342247963 CEST	49929	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:54.342257023 CEST	443	49929	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:54.342272043 CEST	443	49929	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:54.342314005 CEST	49929	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:54.342411995 CEST	49929	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:54.342417002 CEST	443	49929	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:54.342431068 CEST	49929	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:54.342434883 CEST	443	49929	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:54.344892979 CEST	49934	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:54.344934940 CEST	443	49934	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:54.344945908 CEST	49935	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:54.344991922 CEST	443	49935	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:54.345004082 CEST	49934	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:54.345046043 CEST	49935	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:54.345176935 CEST	49934	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:54.345184088 CEST	49935	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:54.345196009 CEST	443	49934	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:54.345207930 CEST	443	49935	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:54.413737059 CEST	443	49932	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:54.413778067 CEST	443	49931	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:54.414287090 CEST	49931	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:54.414314985 CEST	443	49931	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:54.414349079 CEST	49932	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:54.414370060 CEST	443	49932	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:54.414777994 CEST	49932	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:54.414784908 CEST	443	49932	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:54.414885044 CEST	49931	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:54.414892912 CEST	443	49931	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:54.521393061 CEST	443	49933	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:54.524540901 CEST	443	49931	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:54.524764061 CEST	443	49931	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:54.524863958 CEST	49931	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:54.528042078 CEST	443	49932	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:54.528151989 CEST	443	49932	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:54.528194904 CEST	443	49932	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:54.528208017 CEST	49932	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:54.528254986 CEST	49932	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:54.528533936 CEST	49933	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:54.528568029 CEST	443	49933	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:54.529284954 CEST	49931	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:54.529284954 CEST	49931	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:54.529309034 CEST	443	49931	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:54.529319048 CEST	443	49931	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:54.529331923 CEST	49933	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:54.529340029 CEST	443	49933	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:54.529553890 CEST	49932	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:54.529570103 CEST	443	49932	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:54.529584885 CEST	49932	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:54.529592991 CEST	443	49932	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:54.532712936 CEST	49936	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:54.532757044 CEST	443	49936	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:54.532773018 CEST	49937	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:54.532818079 CEST	443	49937	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:54.532823086 CEST	49936	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:54.532881975 CEST	49937	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:54.532968044 CEST	49936	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:54.532980919 CEST	443	49936	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:54.533062935 CEST	49937	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:54.533081055 CEST	443	49937	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:54.619966030 CEST	443	49933	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:54.620162964 CEST	443	49933	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:54.620251894 CEST	49933	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:54.620460033 CEST	49933	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:54.620482922 CEST	443	49933	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:54.620495081 CEST	49933	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:54.620501041 CEST	443	49933	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:54.623548031 CEST	49938	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:54.623646021 CEST	443	49938	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:54.623758078 CEST	49938	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:54.623939037 CEST	49938	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:54.623975039 CEST	443	49938	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:55.091881037 CEST	443	49934	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:55.091886997 CEST	443	49935	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:55.092561960 CEST	49934	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:55.092576981 CEST	49935	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:55.092601061 CEST	443	49934	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:55.092612028 CEST	443	49935	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:55.092921019 CEST	49934	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:55.092931032 CEST	443	49934	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:55.092972994 CEST	49935	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:55.092979908 CEST	443	49935	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:55.193909883 CEST	443	49935	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:55.193949938 CEST	443	49935	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:55.194005013 CEST	443	49935	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:55.194056988 CEST	49935	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:55.194099903 CEST	49935	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:55.194264889 CEST	49935	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:55.194284916 CEST	443	49935	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:55.194297075 CEST	49935	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:55.194303036 CEST	443	49935	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:55.196825981 CEST	49939	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:55.196901083 CEST	443	49939	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:55.197004080 CEST	49939	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:55.197124004 CEST	49939	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:55.197150946 CEST	443	49939	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:55.245661974 CEST	443	49934	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:55.245754957 CEST	443	49934	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:55.245851994 CEST	49934	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:55.246094942 CEST	49934	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:55.246094942 CEST	49934	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:55.246146917 CEST	443	49934	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:55.246175051 CEST	443	49934	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:55.248764038 CEST	49940	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:55.248806953 CEST	443	49940	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:55.248893976 CEST	49940	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:55.249042988 CEST	49940	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:55.249058008 CEST	443	49940	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:55.270998955 CEST	443	49937	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:55.274504900 CEST	443	49938	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:55.274588108 CEST	49937	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:55.274678946 CEST	443	49937	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:55.274797916 CEST	49938	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:55.274816036 CEST	443	49938	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:55.275073051 CEST	49937	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:55.275085926 CEST	443	49937	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:55.275249958 CEST	49938	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:55.275260925 CEST	443	49938	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:55.279083967 CEST	443	49936	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:55.282437086 CEST	49936	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:55.282521963 CEST	443	49936	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:55.282823086 CEST	49936	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:55.282838106 CEST	443	49936	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:55.367714882 CEST	443	49937	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:55.367785931 CEST	443	49937	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:55.367892981 CEST	443	49937	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:55.367969036 CEST	49937	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:55.368165970 CEST	49937	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:55.368191004 CEST	443	49937	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:55.368204117 CEST	49937	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:55.368210077 CEST	443	49937	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:55.371046066 CEST	49941	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:55.371098042 CEST	443	49941	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:55.371182919 CEST	49941	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:55.371342897 CEST	49941	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:55.371362925 CEST	443	49941	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:55.377779961 CEST	443	49938	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:55.377897978 CEST	443	49938	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:55.377954960 CEST	49938	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:55.378050089 CEST	49938	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:55.378060102 CEST	443	49938	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:55.378070116 CEST	49938	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:55.378073931 CEST	443	49938	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:55.380383968 CEST	49942	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:55.380409956 CEST	443	49942	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:55.380480051 CEST	49942	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:55.380604029 CEST	49942	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:55.380614042 CEST	443	49942	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:55.405637026 CEST	443	49936	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:55.405767918 CEST	443	49936	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:55.405853033 CEST	49936	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:55.405983925 CEST	49936	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:55.406018972 CEST	443	49936	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:55.406039953 CEST	49936	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:55.406048059 CEST	443	49936	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:55.415590048 CEST	49943	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:55.415632010 CEST	443	49943	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:55.415806055 CEST	49943	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:55.415985107 CEST	49943	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:55.415997982 CEST	443	49943	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:55.804253101 CEST	443	49939	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:55.804815054 CEST	49939	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:55.804883957 CEST	443	49939	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:55.805229902 CEST	49939	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:55.805248022 CEST	443	49939	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:55.855417013 CEST	443	49940	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:55.856028080 CEST	49940	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:55.856059074 CEST	443	49940	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:55.856481075 CEST	49940	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:55.856486082 CEST	443	49940	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:55.901890993 CEST	443	49939	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:55.901974916 CEST	443	49939	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:55.902117968 CEST	49939	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:55.902286053 CEST	49939	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:55.902342081 CEST	443	49939	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:55.902374029 CEST	49939	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:55.902391911 CEST	443	49939	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:55.905451059 CEST	49944	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:55.905503035 CEST	443	49944	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:55.905571938 CEST	49944	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:55.905725002 CEST	49944	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:55.905740023 CEST	443	49944	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:55.953527927 CEST	443	49940	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:55.953718901 CEST	443	49940	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:55.953768015 CEST	49940	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:55.953784943 CEST	443	49940	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:55.953799963 CEST	443	49940	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:55.953865051 CEST	49940	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:55.953989029 CEST	49940	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:55.954006910 CEST	443	49940	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:55.954016924 CEST	49940	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:55.954024076 CEST	443	49940	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:55.957112074 CEST	49945	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:55.957159042 CEST	443	49945	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:55.957226038 CEST	49945	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:55.957418919 CEST	49945	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:55.957429886 CEST	443	49945	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:56.008116007 CEST	443	49941	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:56.008625984 CEST	49941	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:56.008661985 CEST	443	49941	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:56.009171963 CEST	49941	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:56.009181023 CEST	443	49941	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:56.025557995 CEST	443	49943	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:56.026026011 CEST	49943	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:56.026050091 CEST	443	49943	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:56.026451111 CEST	49943	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:56.026454926 CEST	443	49943	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:56.029712915 CEST	443	49942	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:56.030105114 CEST	49942	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:56.030138969 CEST	443	49942	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:56.030433893 CEST	49942	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:56.030442953 CEST	443	49942	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:56.107455015 CEST	443	49941	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:56.108181953 CEST	443	49941	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:56.108282089 CEST	49941	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:56.108331919 CEST	49941	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:56.108331919 CEST	49941	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:56.108354092 CEST	443	49941	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:56.108365059 CEST	443	49941	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:56.111221075 CEST	49946	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:56.111270905 CEST	443	49946	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:56.111368895 CEST	49946	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:56.111490965 CEST	49946	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:56.111501932 CEST	443	49946	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:56.122685909 CEST	443	49943	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:56.122792006 CEST	443	49943	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:56.122843027 CEST	49943	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:56.123039007 CEST	49943	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:56.123059988 CEST	443	49943	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:56.123069048 CEST	49943	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:56.123075008 CEST	443	49943	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:56.126409054 CEST	49947	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:56.126463890 CEST	443	49947	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:56.126528025 CEST	49947	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:56.126682997 CEST	49947	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:56.126696110 CEST	443	49947	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:56.132677078 CEST	443	49942	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:56.132703066 CEST	443	49942	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:56.132745981 CEST	443	49942	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:56.132760048 CEST	49942	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:56.132791996 CEST	49942	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:56.132989883 CEST	49942	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:56.133009911 CEST	443	49942	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:56.133033991 CEST	49942	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:56.133039951 CEST	443	49942	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:56.135503054 CEST	49948	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:56.135541916 CEST	443	49948	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:56.135616064 CEST	49948	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:56.135741949 CEST	49948	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:56.135756969 CEST	443	49948	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:56.538450003 CEST	443	49944	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:56.539120913 CEST	49944	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:56.539155006 CEST	443	49944	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:56.539663076 CEST	49944	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:56.539675951 CEST	443	49944	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:56.610318899 CEST	443	49945	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:56.611068010 CEST	49945	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:56.611119986 CEST	443	49945	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:56.611433029 CEST	49945	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:56.611438990 CEST	443	49945	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:56.638276100 CEST	443	49944	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:56.638350010 CEST	443	49944	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:56.638459921 CEST	49944	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:56.638756037 CEST	49944	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:56.638775110 CEST	443	49944	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:56.638787985 CEST	49944	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:56.638792992 CEST	443	49944	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:56.641680956 CEST	49949	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:56.641729116 CEST	443	49949	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:56.641825914 CEST	49949	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:56.641946077 CEST	49949	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:56.641959906 CEST	443	49949	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:56.719481945 CEST	443	49946	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:56.720019102 CEST	49946	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:56.720031023 CEST	443	49946	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:56.720603943 CEST	49946	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:56.720609903 CEST	443	49946	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:56.740451097 CEST	443	49945	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:56.740531921 CEST	443	49945	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:56.740577936 CEST	49945	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:56.740720034 CEST	49945	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:56.740736961 CEST	443	49945	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:56.740747929 CEST	49945	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:56.740756035 CEST	443	49945	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:56.743396997 CEST	49950	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:56.743448973 CEST	443	49950	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:56.743522882 CEST	49950	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:56.743680954 CEST	49950	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:56.743689060 CEST	443	49950	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:56.771574974 CEST	443	49948	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:56.772054911 CEST	49948	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:56.772093058 CEST	443	49948	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:56.772537947 CEST	49948	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:56.772543907 CEST	443	49948	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:56.792570114 CEST	443	49947	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:56.793030977 CEST	49947	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:56.793066025 CEST	443	49947	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:56.793440104 CEST	49947	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:56.793452024 CEST	443	49947	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:56.814599037 CEST	443	49946	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:56.815048933 CEST	443	49946	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:56.815146923 CEST	49946	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:56.815159082 CEST	443	49946	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:56.815226078 CEST	49946	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:56.815272093 CEST	49946	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:56.815294027 CEST	443	49946	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:56.815304995 CEST	49946	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:56.815313101 CEST	443	49946	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:56.818289042 CEST	49951	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:56.818346024 CEST	443	49951	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:56.818450928 CEST	49951	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:56.818630934 CEST	49951	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:56.818649054 CEST	443	49951	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:56.878407001 CEST	443	49948	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:56.879214048 CEST	443	49948	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:56.879287004 CEST	443	49948	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:56.879312992 CEST	49948	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:56.879348993 CEST	49948	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:56.879411936 CEST	49948	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:56.879411936 CEST	49948	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:56.879432917 CEST	443	49948	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:56.879445076 CEST	443	49948	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:56.882205963 CEST	49952	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:56.882240057 CEST	443	49952	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:56.882339001 CEST	49952	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:56.882508993 CEST	49952	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:56.882524967 CEST	443	49952	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:56.895261049 CEST	443	49947	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:56.895322084 CEST	443	49947	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:56.895410061 CEST	49947	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:56.895558119 CEST	49947	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:56.895576000 CEST	443	49947	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:56.895586967 CEST	49947	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:56.895595074 CEST	443	49947	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:56.898313999 CEST	49953	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:56.898366928 CEST	443	49953	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:56.898452044 CEST	49953	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:56.898618937 CEST	49953	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:56.898632050 CEST	443	49953	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:57.249072075 CEST	443	49949	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:57.249682903 CEST	49949	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:57.249732971 CEST	443	49949	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:57.250150919 CEST	49949	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:57.250159025 CEST	443	49949	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:57.346182108 CEST	443	49949	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:57.346247911 CEST	443	49949	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:57.346311092 CEST	49949	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:57.346544027 CEST	49949	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:57.346565008 CEST	443	49949	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:57.346576929 CEST	49949	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:57.346582890 CEST	443	49949	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:57.349569082 CEST	49954	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:57.349595070 CEST	443	49954	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:57.349684954 CEST	49954	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:57.349873066 CEST	49954	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:57.349884987 CEST	443	49954	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:57.354562998 CEST	443	49950	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:57.354965925 CEST	49950	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:57.354974985 CEST	443	49950	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:57.355392933 CEST	49950	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:57.355396986 CEST	443	49950	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:57.441556931 CEST	443	49951	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:57.442156076 CEST	49951	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:57.442192078 CEST	443	49951	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:57.442643881 CEST	49951	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:57.442653894 CEST	443	49951	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:57.449642897 CEST	443	49950	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:57.449776888 CEST	443	49950	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:57.449824095 CEST	443	49950	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:57.449836969 CEST	49950	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:57.449877024 CEST	49950	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:57.449996948 CEST	49950	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:57.450018883 CEST	443	49950	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:57.450030088 CEST	49950	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:57.450036049 CEST	443	49950	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:57.452600956 CEST	49955	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:57.452658892 CEST	443	49955	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:57.452738047 CEST	49955	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:57.452879906 CEST	49955	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:57.452896118 CEST	443	49955	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:57.503926992 CEST	443	49952	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:57.504602909 CEST	49952	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:57.504642010 CEST	443	49952	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:57.505079985 CEST	49952	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:57.505088091 CEST	443	49952	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:57.514740944 CEST	443	49953	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:57.515125036 CEST	49953	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:57.515150070 CEST	443	49953	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:57.515547991 CEST	49953	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:57.515552998 CEST	443	49953	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:57.538877010 CEST	443	49951	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:57.539201975 CEST	443	49951	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:57.539289951 CEST	49951	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:57.539341927 CEST	49951	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:57.539341927 CEST	49951	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:57.539367914 CEST	443	49951	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:57.539381027 CEST	443	49951	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:57.541704893 CEST	49956	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:57.541754007 CEST	443	49956	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:57.541842937 CEST	49956	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:57.541964054 CEST	49956	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:57.541979074 CEST	443	49956	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:57.600219965 CEST	443	49952	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:57.600389004 CEST	443	49952	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:57.600485086 CEST	49952	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:57.600800991 CEST	49952	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:57.600821972 CEST	443	49952	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:57.600845098 CEST	49952	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:57.600852966 CEST	443	49952	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:57.603276014 CEST	49957	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:57.603323936 CEST	443	49957	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:57.603399992 CEST	49957	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:57.603517056 CEST	49957	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:57.603532076 CEST	443	49957	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:57.612761021 CEST	443	49953	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:57.612831116 CEST	443	49953	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:57.612910032 CEST	49953	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:57.613708019 CEST	49953	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:57.613728046 CEST	443	49953	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:57.613758087 CEST	49953	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:57.613764048 CEST	443	49953	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:57.623753071 CEST	49958	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:57.623801947 CEST	443	49958	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:57.623862982 CEST	49958	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:57.624002934 CEST	49958	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:57.624018908 CEST	443	49958	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:57.995006084 CEST	443	49954	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:57.995491982 CEST	49954	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:57.995528936 CEST	443	49954	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:57.996227026 CEST	49954	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:57.996233940 CEST	443	49954	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:58.063781977 CEST	443	49955	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:58.064224005 CEST	49955	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:58.064266920 CEST	443	49955	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:58.064723015 CEST	49955	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:58.064734936 CEST	443	49955	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:58.103799105 CEST	443	49954	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:58.105020046 CEST	443	49954	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:58.105130911 CEST	443	49954	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:58.105201006 CEST	49954	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:58.105238914 CEST	49954	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:58.105238914 CEST	49954	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:58.105257034 CEST	49954	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:58.105273008 CEST	443	49954	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:58.107732058 CEST	49959	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:58.107779026 CEST	443	49959	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:58.107980967 CEST	49959	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:58.107980967 CEST	49959	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:58.108012915 CEST	443	49959	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:58.165520906 CEST	443	49955	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:58.165682077 CEST	443	49955	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:58.165883064 CEST	49955	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:58.165884018 CEST	49955	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:58.165884018 CEST	49955	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:58.168399096 CEST	49960	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:58.168448925 CEST	443	49960	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:58.168514967 CEST	49960	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:58.168633938 CEST	49960	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:58.168647051 CEST	443	49960	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:58.173777103 CEST	443	49956	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:58.174140930 CEST	49956	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:58.174170971 CEST	443	49956	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:58.174551010 CEST	49956	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:58.174561024 CEST	443	49956	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:58.250124931 CEST	443	49958	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:58.250658989 CEST	49958	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:58.250684023 CEST	443	49958	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:58.251060963 CEST	49958	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:58.251068115 CEST	443	49958	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:58.253279924 CEST	443	49957	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:58.253524065 CEST	49957	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:58.253535986 CEST	443	49957	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:58.253916025 CEST	49957	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:58.253921032 CEST	443	49957	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:58.272615910 CEST	443	49956	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:58.272753954 CEST	443	49956	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:58.272878885 CEST	49956	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:58.272923946 CEST	49956	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:58.272947073 CEST	443	49956	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:58.272974968 CEST	49956	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:58.272979975 CEST	443	49956	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:58.275556087 CEST	49961	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:58.275651932 CEST	443	49961	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:58.275741100 CEST	49961	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:58.275857925 CEST	49961	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:58.275898933 CEST	443	49961	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:58.348797083 CEST	443	49958	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:58.348999977 CEST	443	49958	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:58.349098921 CEST	49958	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:58.349162102 CEST	49958	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:58.349193096 CEST	443	49958	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:58.349206924 CEST	49958	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:58.349214077 CEST	443	49958	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:58.351943016 CEST	49962	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:58.351979971 CEST	443	49962	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:58.352073908 CEST	49962	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:58.352231979 CEST	49962	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:58.352262020 CEST	443	49962	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:58.352314949 CEST	443	49957	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:58.353270054 CEST	443	49957	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:58.353315115 CEST	49957	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:58.353337049 CEST	49957	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:58.353343964 CEST	443	49957	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:58.353355885 CEST	49957	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:58.353359938 CEST	443	49957	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:58.355125904 CEST	49963	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:58.355168104 CEST	443	49963	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:58.355230093 CEST	49963	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:58.355323076 CEST	49963	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:58.355331898 CEST	443	49963	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:58.391575098 CEST	49955	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:58.391629934 CEST	443	49955	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:58.730045080 CEST	443	49959	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:58.730668068 CEST	49959	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:58.730690956 CEST	443	49959	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:58.731077909 CEST	49959	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:58.731082916 CEST	443	49959	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:58.821444988 CEST	443	49960	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:58.821980000 CEST	49960	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:58.822010994 CEST	443	49960	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:58.822393894 CEST	49960	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:58.822400093 CEST	443	49960	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:58.827558994 CEST	443	49959	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:58.828939915 CEST	443	49959	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:58.828998089 CEST	49959	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:58.829075098 CEST	49959	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:58.829093933 CEST	443	49959	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:58.829107046 CEST	49959	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:58.829113007 CEST	443	49959	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:58.832007885 CEST	49964	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:58.832101107 CEST	443	49964	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:58.832190037 CEST	49964	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:58.832302094 CEST	49964	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:58.832335949 CEST	443	49964	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:58.907941103 CEST	443	49961	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:58.908530951 CEST	49961	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:58.908576965 CEST	443	49961	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:58.908993006 CEST	49961	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:58.909007072 CEST	443	49961	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:58.923999071 CEST	443	49960	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:58.924173117 CEST	443	49960	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:58.924248934 CEST	49960	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:58.924314976 CEST	49960	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:58.924336910 CEST	443	49960	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:58.924348116 CEST	49960	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:58.924355030 CEST	443	49960	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:58.927043915 CEST	49965	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:58.927089930 CEST	443	49965	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:58.927175045 CEST	49965	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:58.927304983 CEST	49965	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:58.927319050 CEST	443	49965	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:58.957973003 CEST	443	49962	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:58.958467960 CEST	49962	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:58.958498001 CEST	443	49962	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:58.958895922 CEST	49962	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:58.958900928 CEST	443	49962	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:58.989196062 CEST	443	49963	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:58.997066021 CEST	49963	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:58.997087955 CEST	443	49963	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:58.997649908 CEST	49963	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:58.997653961 CEST	443	49963	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:59.007729053 CEST	443	49961	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:59.008443117 CEST	443	49961	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:59.008510113 CEST	49961	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:59.008552074 CEST	49961	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:59.008565903 CEST	443	49961	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:59.008579016 CEST	49961	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:59.008584976 CEST	443	49961	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:59.011326075 CEST	49966	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:59.011362076 CEST	443	49966	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:59.011523962 CEST	49966	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:59.011600971 CEST	49966	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:59.011615992 CEST	443	49966	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:59.053288937 CEST	443	49962	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:59.053817034 CEST	443	49962	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:59.053862095 CEST	443	49962	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:59.053868055 CEST	49962	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:59.053934097 CEST	49962	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:59.054047108 CEST	49962	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:59.054063082 CEST	443	49962	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:59.054076910 CEST	49962	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:59.054081917 CEST	443	49962	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:59.058322906 CEST	49967	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:59.058408022 CEST	443	49967	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:59.058481932 CEST	49967	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:59.058649063 CEST	49967	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:59.058675051 CEST	443	49967	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:59.098831892 CEST	443	49963	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:59.098973036 CEST	443	49963	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:59.099030972 CEST	49963	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:59.099193096 CEST	49963	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:59.099209070 CEST	443	49963	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:59.099219084 CEST	49963	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:59.099225044 CEST	443	49963	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:59.102318048 CEST	49968	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:59.102363110 CEST	443	49968	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:59.102432013 CEST	49968	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:59.102580070 CEST	49968	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:59.102592945 CEST	443	49968	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:59.457555056 CEST	443	49964	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:59.458172083 CEST	49964	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:59.458223104 CEST	443	49964	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:59.458606958 CEST	49964	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:59.458621979 CEST	443	49964	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:59.539705038 CEST	443	49965	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:59.540235996 CEST	49965	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:59.540251970 CEST	443	49965	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:59.540679932 CEST	49965	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:59.540683985 CEST	443	49965	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:59.555141926 CEST	443	49964	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:59.555519104 CEST	443	49964	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:59.555572033 CEST	443	49964	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:59.555599928 CEST	49964	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:59.555661917 CEST	49964	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:59.555710077 CEST	49964	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:59.555710077 CEST	49964	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:59.555749893 CEST	443	49964	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:59.555774927 CEST	443	49964	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:59.557986021 CEST	49969	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:59.558034897 CEST	443	49969	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:59.558113098 CEST	49969	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:59.558224916 CEST	49969	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:59.558240891 CEST	443	49969	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:59.634792089 CEST	443	49965	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:59.634963036 CEST	443	49965	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:59.635034084 CEST	49965	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:59.635133028 CEST	49965	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:59.635153055 CEST	443	49965	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:59.635166883 CEST	49965	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:59.635173082 CEST	443	49965	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:59.637762070 CEST	49970	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:59.637799025 CEST	443	49970	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:59.637880087 CEST	49970	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:59.638034105 CEST	49970	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:59.638046980 CEST	443	49970	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:59.682997942 CEST	443	49966	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:59.684259892 CEST	49966	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:59.684283972 CEST	443	49966	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:59.684814930 CEST	49966	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:59.684819937 CEST	443	49966	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:59.684892893 CEST	443	49967	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:59.685210943 CEST	49967	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:59.685225010 CEST	443	49967	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:59.685657024 CEST	49967	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:59.685662031 CEST	443	49967	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:59.730324984 CEST	443	49968	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:59.730698109 CEST	49968	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:59.730719090 CEST	443	49968	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:59.731249094 CEST	49968	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:59.731265068 CEST	443	49968	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:59.782406092 CEST	443	49967	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:59.782459974 CEST	443	49967	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:59.782521963 CEST	49967	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:59.782706976 CEST	49967	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:59.782725096 CEST	443	49967	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:59.782740116 CEST	49967	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:59.782746077 CEST	443	49967	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:59.785445929 CEST	49971	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:59.785490036 CEST	443	49971	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:59.785567999 CEST	49971	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:59.785687923 CEST	49971	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:59.785702944 CEST	443	49971	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:59.832732916 CEST	443	49966	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:59.832760096 CEST	443	49966	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:59.832799911 CEST	443	49966	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:59.832844973 CEST	49966	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:59.832879066 CEST	49966	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:59.833058119 CEST	49966	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:59.833072901 CEST	443	49966	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:59.833085060 CEST	49966	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:59.833090067 CEST	443	49966	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:59.835397959 CEST	49972	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:59.835432053 CEST	443	49972	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:59.835493088 CEST	49972	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:59.835653067 CEST	49972	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:59.835663080 CEST	443	49972	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:59.837186098 CEST	443	49968	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:59.837243080 CEST	443	49968	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:59.837295055 CEST	49968	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:59.837445974 CEST	49968	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:59.837470055 CEST	443	49968	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:59.837491989 CEST	49968	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:59.837500095 CEST	443	49968	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:59.839724064 CEST	49973	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:59.839765072 CEST	443	49973	13.107.246.45	192.168.2.5
Oct 7, 2024 22:45:59.839833021 CEST	49973	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:59.839968920 CEST	49973	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:45:59.839982033 CEST	443	49973	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:00.251717091 CEST	443	49969	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:00.252120972 CEST	49969	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:00.252147913 CEST	443	49969	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:00.252573967 CEST	49969	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:00.252578974 CEST	443	49969	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:00.343837023 CEST	443	49970	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:00.344536066 CEST	49970	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:00.344567060 CEST	443	49970	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:00.345125914 CEST	49970	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:00.345134020 CEST	443	49970	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:00.356096983 CEST	443	49969	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:00.356172085 CEST	443	49969	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:00.356245995 CEST	49969	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:00.356556892 CEST	49969	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:00.356575966 CEST	443	49969	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:00.356586933 CEST	49969	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:00.356591940 CEST	443	49969	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:00.359515905 CEST	49974	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:00.359555960 CEST	443	49974	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:00.359642029 CEST	49974	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:00.359827995 CEST	49974	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:00.359843016 CEST	443	49974	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:00.422308922 CEST	443	49971	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:00.422950029 CEST	49971	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:00.422970057 CEST	443	49971	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:00.423435926 CEST	49971	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:00.423446894 CEST	443	49971	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:00.446932077 CEST	443	49970	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:00.446975946 CEST	443	49970	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:00.447019100 CEST	443	49970	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:00.447048903 CEST	49970	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:00.447098970 CEST	49970	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:00.447374105 CEST	49970	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:00.447408915 CEST	443	49970	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:00.447426081 CEST	49970	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:00.447432041 CEST	443	49970	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:00.450310946 CEST	49975	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:00.450366020 CEST	443	49975	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:00.450463057 CEST	49975	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:00.450629950 CEST	49975	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:00.450640917 CEST	443	49975	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:00.510235071 CEST	443	49973	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:00.510834932 CEST	49973	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:00.510864973 CEST	443	49973	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:00.511307001 CEST	49973	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:00.511312962 CEST	443	49973	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:00.519129038 CEST	443	49971	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:00.519187927 CEST	443	49971	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:00.519234896 CEST	49971	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:00.519323111 CEST	443	49972	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:00.519488096 CEST	49971	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:00.519510984 CEST	443	49971	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:00.519526005 CEST	49971	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:00.519535065 CEST	443	49971	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:00.519721985 CEST	49972	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:00.519745111 CEST	443	49972	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:00.520123005 CEST	49972	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:00.520128012 CEST	443	49972	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:00.522059917 CEST	49976	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:00.522115946 CEST	443	49976	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:00.522201061 CEST	49976	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:00.522337914 CEST	49976	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:00.522355080 CEST	443	49976	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:00.612484932 CEST	443	49973	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:00.612509012 CEST	443	49973	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:00.612581968 CEST	49973	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:00.612607002 CEST	443	49973	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:00.612677097 CEST	443	49973	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:00.612714052 CEST	49973	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:00.612876892 CEST	49973	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:00.612890959 CEST	443	49973	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:00.612899065 CEST	49973	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:00.612904072 CEST	443	49973	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:00.615521908 CEST	49977	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:00.615571022 CEST	443	49977	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:00.615653992 CEST	49977	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:00.615940094 CEST	49977	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:00.615952015 CEST	443	49977	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:00.619877100 CEST	443	49972	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:00.619944096 CEST	443	49972	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:00.619990110 CEST	49972	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:00.620114088 CEST	49972	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:00.620134115 CEST	443	49972	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:00.620146036 CEST	49972	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:00.620151997 CEST	443	49972	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:00.622282982 CEST	49978	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:00.622308016 CEST	443	49978	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:00.622390032 CEST	49978	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:00.622526884 CEST	49978	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:00.622545958 CEST	443	49978	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:00.986866951 CEST	443	49974	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:00.987319946 CEST	49974	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:00.987339973 CEST	443	49974	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:00.987945080 CEST	49974	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:00.987948895 CEST	443	49974	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:01.057734966 CEST	443	49975	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:01.059452057 CEST	49975	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:01.059468031 CEST	443	49975	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:01.059907913 CEST	49975	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:01.059912920 CEST	443	49975	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:01.084381104 CEST	443	49974	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:01.084450960 CEST	443	49974	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:01.084526062 CEST	49974	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:01.084701061 CEST	49974	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:01.084717035 CEST	443	49974	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:01.084729910 CEST	49974	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:01.084736109 CEST	443	49974	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:01.087404966 CEST	49979	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:01.087447882 CEST	443	49979	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:01.087516069 CEST	49979	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:01.087645054 CEST	49979	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:01.087656975 CEST	443	49979	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:01.134990931 CEST	443	49976	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:01.135572910 CEST	49976	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:01.135598898 CEST	443	49976	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:01.136037111 CEST	49976	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:01.136043072 CEST	443	49976	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:01.154959917 CEST	443	49975	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:01.155018091 CEST	443	49975	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:01.155113935 CEST	49975	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:01.155157089 CEST	443	49975	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:01.155230045 CEST	49975	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:01.155495882 CEST	49975	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:01.155544043 CEST	443	49975	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:01.155572891 CEST	49975	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:01.155587912 CEST	443	49975	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:01.158884048 CEST	49980	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:01.158934116 CEST	443	49980	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:01.159009933 CEST	49980	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:01.159156084 CEST	49980	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:01.159173012 CEST	443	49980	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:01.241005898 CEST	443	49976	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:01.241030931 CEST	443	49976	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:01.241080046 CEST	443	49976	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:01.241138935 CEST	49976	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:01.241180897 CEST	49976	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:01.241353035 CEST	49976	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:01.241370916 CEST	443	49976	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:01.241383076 CEST	49976	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:01.241390944 CEST	443	49976	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:01.242784023 CEST	443	49978	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:01.243645906 CEST	49978	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:01.243659019 CEST	443	49978	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:01.244144917 CEST	49978	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:01.244148970 CEST	443	49978	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:01.244976044 CEST	49981	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:01.245018005 CEST	443	49981	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:01.245085001 CEST	49981	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:01.245203972 CEST	49981	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:01.245213985 CEST	443	49981	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:01.247880936 CEST	443	49977	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:01.248235941 CEST	49977	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:01.248248100 CEST	443	49977	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:01.248687029 CEST	49977	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:01.248691082 CEST	443	49977	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:01.359527111 CEST	443	49978	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:01.359550953 CEST	443	49978	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:01.359654903 CEST	49978	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:01.359718084 CEST	443	49978	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:01.359906912 CEST	49978	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:01.359941006 CEST	443	49978	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:01.359966040 CEST	49978	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:01.360096931 CEST	443	49978	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:01.360131025 CEST	443	49978	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:01.360172987 CEST	49978	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:01.363404036 CEST	49983	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:01.363451958 CEST	443	49983	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:01.363524914 CEST	49983	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:01.363656044 CEST	49983	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:01.363668919 CEST	443	49983	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:01.365962029 CEST	443	49977	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:01.365988016 CEST	443	49977	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:01.366045952 CEST	49977	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:01.366069078 CEST	443	49977	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:01.366250038 CEST	49977	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:01.366271973 CEST	443	49977	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:01.366292000 CEST	49977	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:01.366408110 CEST	443	49977	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:01.366439104 CEST	443	49977	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:01.366477013 CEST	49977	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:01.368419886 CEST	49984	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:01.368469954 CEST	443	49984	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:01.368549109 CEST	49984	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:01.368702888 CEST	49984	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:01.368721008 CEST	443	49984	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:01.706909895 CEST	443	49979	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:01.707429886 CEST	49979	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:01.707457066 CEST	443	49979	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:01.707887888 CEST	49979	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:01.707891941 CEST	443	49979	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:01.799971104 CEST	443	49980	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:01.800596952 CEST	49980	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:01.800667048 CEST	443	49980	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:01.801038027 CEST	49980	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:01.801052094 CEST	443	49980	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:01.809655905 CEST	443	49979	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:01.809822083 CEST	443	49979	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:01.809885025 CEST	49979	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:01.809931993 CEST	49979	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:01.809931993 CEST	49979	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:01.809951067 CEST	443	49979	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:01.809961081 CEST	443	49979	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:01.812705040 CEST	49985	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:01.812807083 CEST	443	49985	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:01.812911987 CEST	49985	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:01.813069105 CEST	49985	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:01.813093901 CEST	443	49985	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:01.870723009 CEST	443	49981	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:01.871093035 CEST	49981	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:01.871108055 CEST	443	49981	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:01.871439934 CEST	49981	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:01.871443987 CEST	443	49981	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:01.902604103 CEST	443	49980	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:01.902766943 CEST	443	49980	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:01.902898073 CEST	49980	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:01.905049086 CEST	49980	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:01.905049086 CEST	49980	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:01.905047894 CEST	49986	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:01.905101061 CEST	443	49980	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:01.905128956 CEST	443	49980	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:01.905149937 CEST	443	49986	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:01.905236006 CEST	49986	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:01.905327082 CEST	49986	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:01.905348063 CEST	443	49986	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:01.989622116 CEST	443	49981	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:01.989685059 CEST	443	49981	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:01.989736080 CEST	49981	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:01.989963055 CEST	49981	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:01.989979982 CEST	443	49981	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:01.992543936 CEST	443	49984	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:01.993120909 CEST	49984	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:01.993185043 CEST	443	49984	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:01.993726969 CEST	49984	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:01.993763924 CEST	443	49984	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:01.995093107 CEST	49987	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:01.995165110 CEST	443	49987	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:01.995254040 CEST	49987	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:01.995512009 CEST	49987	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:01.995543003 CEST	443	49987	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:02.011409044 CEST	443	49983	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:02.011921883 CEST	49983	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:02.011950016 CEST	443	49983	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:02.012757063 CEST	49983	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:02.012763977 CEST	443	49983	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:02.294289112 CEST	443	49984	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:02.294317007 CEST	443	49984	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:02.294399977 CEST	443	49984	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:02.294419050 CEST	443	49983	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:02.294461966 CEST	49984	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:02.294478893 CEST	443	49983	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:02.294500113 CEST	49984	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:02.294533014 CEST	49983	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:02.294751883 CEST	49984	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:02.294774055 CEST	443	49984	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:02.294776917 CEST	49983	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:02.294790030 CEST	49984	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:02.294794083 CEST	443	49983	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:02.294795990 CEST	443	49984	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:02.294806957 CEST	49983	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:02.294811964 CEST	443	49983	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:02.298017979 CEST	49988	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:02.298043013 CEST	443	49988	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:02.298096895 CEST	49988	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:02.298367023 CEST	49988	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:02.298382044 CEST	443	49988	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:02.299405098 CEST	49989	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:02.299437046 CEST	443	49989	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:02.299503088 CEST	49989	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:02.299633026 CEST	49989	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:02.299640894 CEST	443	49989	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:02.502562046 CEST	443	49985	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:02.503097057 CEST	49985	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:02.503160954 CEST	443	49985	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:02.503695011 CEST	49985	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:02.503709078 CEST	443	49985	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:02.531327963 CEST	443	49986	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:02.531888008 CEST	49986	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:02.531985044 CEST	443	49986	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:02.532382011 CEST	49986	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:02.532402039 CEST	443	49986	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:02.620202065 CEST	443	49985	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:02.620229006 CEST	443	49985	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:02.620296955 CEST	443	49985	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:02.620304108 CEST	49985	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:02.620363951 CEST	49985	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:02.620624065 CEST	49985	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:02.620641947 CEST	443	49985	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:02.620655060 CEST	49985	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:02.620661020 CEST	443	49985	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:02.623769045 CEST	49990	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:02.623796940 CEST	443	49990	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:02.623867989 CEST	49990	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:02.624000072 CEST	49990	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:02.624007940 CEST	443	49990	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:02.633690119 CEST	443	49986	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:02.633716106 CEST	443	49986	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:02.633730888 CEST	443	49986	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:02.633793116 CEST	49986	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:02.633824110 CEST	443	49986	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:02.633882046 CEST	49986	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:02.666774035 CEST	443	49987	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:02.667812109 CEST	49987	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:02.667879105 CEST	443	49987	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:02.668255091 CEST	49987	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:02.668270111 CEST	443	49987	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:02.711255074 CEST	443	49986	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:02.711364031 CEST	49986	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:02.711394072 CEST	443	49986	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:02.711433887 CEST	443	49986	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:02.711462021 CEST	49986	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:02.711491108 CEST	443	49986	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:02.711503029 CEST	49986	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:02.711503029 CEST	49986	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:02.711513042 CEST	443	49986	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:02.711519003 CEST	443	49986	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:02.714049101 CEST	49991	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:02.714148998 CEST	443	49991	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:02.714297056 CEST	49991	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:02.714369059 CEST	49991	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:02.714387894 CEST	443	49991	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:02.764199018 CEST	443	49987	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:02.764220953 CEST	443	49987	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:02.764272928 CEST	443	49987	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:02.764336109 CEST	49987	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:02.764399052 CEST	49987	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:02.764597893 CEST	49987	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:02.764597893 CEST	49987	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:02.764642954 CEST	443	49987	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:02.764672041 CEST	443	49987	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:02.767131090 CEST	49992	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:02.767174959 CEST	443	49992	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:02.767246008 CEST	49992	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:02.767534971 CEST	49992	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:02.767549992 CEST	443	49992	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:02.939699888 CEST	443	49988	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:02.953751087 CEST	443	49989	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:02.966065884 CEST	49988	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:02.966109037 CEST	443	49988	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:02.966525078 CEST	49988	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:02.966532946 CEST	443	49988	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:02.966897964 CEST	49989	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:02.966929913 CEST	443	49989	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:02.967236996 CEST	49989	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:02.967252016 CEST	443	49989	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:03.064140081 CEST	443	49989	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:03.064188957 CEST	443	49989	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:03.064423084 CEST	49989	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:03.064436913 CEST	443	49989	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:03.064573050 CEST	49989	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:03.065825939 CEST	49989	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:03.065830946 CEST	443	49989	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:03.065886021 CEST	49989	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:03.066205978 CEST	443	49989	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:03.066265106 CEST	443	49989	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:03.066323996 CEST	49989	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:03.067600965 CEST	443	49988	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:03.067625999 CEST	443	49988	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:03.067723036 CEST	443	49988	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:03.067774057 CEST	49988	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:03.067802906 CEST	443	49988	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:03.067838907 CEST	49988	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:03.067858934 CEST	49988	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:03.089679003 CEST	49993	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:03.089720964 CEST	443	49993	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:03.089853048 CEST	49993	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:03.093219042 CEST	49993	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:03.093235970 CEST	443	49993	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:03.149028063 CEST	443	49988	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:03.149100065 CEST	443	49988	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:03.149161100 CEST	49988	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:03.149189949 CEST	443	49988	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:03.149208069 CEST	49988	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:03.149230003 CEST	49988	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:03.149266005 CEST	443	49988	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:03.153706074 CEST	49988	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:03.245263100 CEST	49988	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:03.245263100 CEST	49988	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:03.245297909 CEST	443	49988	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:03.245311022 CEST	443	49988	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:03.251586914 CEST	49994	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:03.251625061 CEST	443	49994	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:03.251815081 CEST	49994	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:03.252381086 CEST	49994	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:03.252403975 CEST	443	49994	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:03.264399052 CEST	443	49990	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:03.264873028 CEST	49990	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:03.264889956 CEST	443	49990	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:03.265894890 CEST	49990	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:03.265899897 CEST	443	49990	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:03.362085104 CEST	443	49990	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:03.362106085 CEST	443	49990	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:03.362162113 CEST	49990	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:03.362176895 CEST	443	49990	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:03.362446070 CEST	443	49990	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:03.363377094 CEST	49990	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:03.363377094 CEST	49990	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:03.363413095 CEST	443	49990	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:03.363429070 CEST	49990	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:03.363436937 CEST	443	49990	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:03.365756035 CEST	443	49991	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:03.371443987 CEST	49991	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:03.371465921 CEST	443	49991	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:03.372082949 CEST	49991	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:03.372087955 CEST	443	49991	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:03.375591993 CEST	49995	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:03.375628948 CEST	443	49995	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:03.375797987 CEST	49995	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:03.376636982 CEST	49995	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:03.376650095 CEST	443	49995	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:03.382973909 CEST	443	49992	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:03.383719921 CEST	49992	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:03.383733988 CEST	443	49992	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:03.387732983 CEST	49992	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:03.387739897 CEST	443	49992	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:03.474095106 CEST	443	49991	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:03.474172115 CEST	443	49991	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:03.474229097 CEST	49991	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:03.474508047 CEST	49991	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:03.474508047 CEST	49991	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:03.474529028 CEST	443	49991	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:03.474539995 CEST	443	49991	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:03.477344036 CEST	49996	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:03.477394104 CEST	443	49996	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:03.477488995 CEST	49996	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:03.477628946 CEST	49996	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:03.477638960 CEST	443	49996	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:03.488374949 CEST	443	49992	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:03.488431931 CEST	443	49992	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:03.488507986 CEST	49992	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:03.488626957 CEST	49992	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:03.488641024 CEST	443	49992	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:03.488647938 CEST	49992	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:03.488653898 CEST	443	49992	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:03.491056919 CEST	49997	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:03.491091967 CEST	443	49997	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:03.491172075 CEST	49997	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:03.491333008 CEST	49997	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:03.491343975 CEST	443	49997	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:03.708993912 CEST	443	49993	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:03.709813118 CEST	49993	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:03.709841013 CEST	443	49993	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:03.710170984 CEST	49993	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:03.710176945 CEST	443	49993	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:03.805109024 CEST	443	49994	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:03.805691957 CEST	49994	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:03.805746078 CEST	443	49994	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:03.806143045 CEST	49994	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:03.806159019 CEST	443	49994	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:03.806205034 CEST	443	49993	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:03.806274891 CEST	443	49993	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:03.806329966 CEST	49993	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:03.806483030 CEST	49993	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:03.806521893 CEST	443	49993	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:03.806549072 CEST	49993	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:03.806564093 CEST	443	49993	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:03.809079885 CEST	49998	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:03.809115887 CEST	443	49998	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:03.809196949 CEST	49998	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:03.809526920 CEST	49998	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:03.809541941 CEST	443	49998	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:03.941335917 CEST	443	49994	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:03.942686081 CEST	443	49994	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:03.945797920 CEST	49999	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:03.945796967 CEST	49994	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:03.945797920 CEST	49994	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:03.945797920 CEST	49994	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:03.945895910 CEST	443	49999	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:03.945992947 CEST	49999	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:03.946127892 CEST	49999	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:03.946147919 CEST	443	49999	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:04.034820080 CEST	443	49995	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:04.035458088 CEST	49995	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:04.035471916 CEST	443	49995	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:04.036267996 CEST	49995	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:04.036273003 CEST	443	49995	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:04.125606060 CEST	443	49996	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:04.126118898 CEST	49996	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:04.126140118 CEST	443	49996	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:04.126552105 CEST	49996	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:04.126558065 CEST	443	49996	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:04.132502079 CEST	443	49997	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:04.132795095 CEST	49997	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:04.132819891 CEST	443	49997	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:04.133080006 CEST	49997	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:04.133085966 CEST	443	49997	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:04.144814014 CEST	443	49995	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:04.144900084 CEST	443	49995	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:04.144943953 CEST	443	49995	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:04.145061970 CEST	49995	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:04.145241976 CEST	49995	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:04.145848036 CEST	49995	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:04.145863056 CEST	443	49995	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:04.145872116 CEST	49995	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:04.145878077 CEST	443	49995	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:04.247687101 CEST	443	49996	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:04.247766018 CEST	443	49996	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:04.247823954 CEST	49996	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:04.248064041 CEST	49996	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:04.248086929 CEST	443	49996	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:04.248090029 CEST	443	49997	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:04.248100042 CEST	49996	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:04.248106003 CEST	443	49996	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:04.248157024 CEST	443	49997	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:04.248200893 CEST	49997	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:04.249075890 CEST	49997	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:04.249097109 CEST	443	49997	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:04.249109030 CEST	49997	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:04.249114037 CEST	443	49997	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:04.250958920 CEST	49994	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:04.250992060 CEST	443	49994	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:04.479931116 CEST	443	49998	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:04.480539083 CEST	49998	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:04.480573893 CEST	443	49998	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:04.481017113 CEST	49998	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:04.481026888 CEST	443	49998	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:04.579279900 CEST	443	49998	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:04.579514027 CEST	443	49998	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:04.579585075 CEST	49998	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:04.579627991 CEST	49998	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:04.579627991 CEST	49998	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:04.579649925 CEST	443	49998	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:04.579660892 CEST	443	49998	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:04.609610081 CEST	443	49999	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:04.610042095 CEST	49999	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:04.610068083 CEST	443	49999	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:04.610536098 CEST	49999	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:04.610542059 CEST	443	49999	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:04.713104010 CEST	443	49999	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:04.713191986 CEST	443	49999	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:04.713263035 CEST	49999	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:04.713442087 CEST	49999	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:04.713469028 CEST	443	49999	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:04.713481903 CEST	49999	443	192.168.2.5	13.107.246.45
Oct 7, 2024 22:46:04.713488102 CEST	443	49999	13.107.246.45	192.168.2.5
Oct 7, 2024 22:46:48.910666943 CEST	49709	80	192.168.2.5	173.222.108.226
Oct 7, 2024 22:46:48.918090105 CEST	80	49709	173.222.108.226	192.168.2.5
Oct 7, 2024 22:46:48.918148994 CEST	49709	80	192.168.2.5	173.222.108.226

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 7, 2024 22:45:13.194443941 CEST	53314	53	192.168.2.5	1.1.1.1
Oct 7, 2024 22:45:13.202898979 CEST	53	53314	1.1.1.1	192.168.2.5
Oct 7, 2024 22:45:13.214190960 CEST	52562	53	192.168.2.5	1.1.1.1
Oct 7, 2024 22:45:13.225615025 CEST	53	52562	1.1.1.1	192.168.2.5
Oct 7, 2024 22:45:13.228863001 CEST	56477	53	192.168.2.5	1.1.1.1
Oct 7, 2024 22:45:13.239494085 CEST	53	56477	1.1.1.1	192.168.2.5
Oct 7, 2024 22:45:13.244213104 CEST	61164	53	192.168.2.5	1.1.1.1
Oct 7, 2024 22:45:13.255079985 CEST	53	61164	1.1.1.1	192.168.2.5
Oct 7, 2024 22:45:13.257952929 CEST	58967	53	192.168.2.5	1.1.1.1
Oct 7, 2024 22:45:13.268130064 CEST	53	58967	1.1.1.1	192.168.2.5
Oct 7, 2024 22:45:13.272161961 CEST	64171	53	192.168.2.5	1.1.1.1
Oct 7, 2024 22:45:13.283512115 CEST	53	64171	1.1.1.1	192.168.2.5
Oct 7, 2024 22:45:13.290128946 CEST	50721	53	192.168.2.5	1.1.1.1
Oct 7, 2024 22:45:13.301956892 CEST	53	50721	1.1.1.1	192.168.2.5
Oct 7, 2024 22:45:13.303910017 CEST	50712	53	192.168.2.5	1.1.1.1
Oct 7, 2024 22:45:13.314794064 CEST	53	50712	1.1.1.1	192.168.2.5
Oct 7, 2024 22:45:13.320513964 CEST	55198	53	192.168.2.5	1.1.1.1
Oct 7, 2024 22:45:13.327325106 CEST	53	55198	1.1.1.1	192.168.2.5
Oct 7, 2024 22:45:14.607409000 CEST	57219	53	192.168.2.5	1.1.1.1
Oct 7, 2024 22:45:14.788429022 CEST	53	57219	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 7, 2024 22:45:13.194443941 CEST	192.168.2.5	1.1.1.1	0xc455	Standard query (0)	exemplarou.sbs	A (IP address)	IN (0x0001)	false
Oct 7, 2024 22:45:13.214190960 CEST	192.168.2.5	1.1.1.1	0xa7ef	Standard query (0)	frizzettei.sbs	A (IP address)	IN (0x0001)	false
Oct 7, 2024 22:45:13.228863001 CEST	192.168.2.5	1.1.1.1	0x3b64	Standard query (0)	isoplethui.sbs	A (IP address)	IN (0x0001)	false
Oct 7, 2024 22:45:13.244213104 CEST	192.168.2.5	1.1.1.1	0xf74c	Standard query (0)	bemuzzeki.sbs	A (IP address)	IN (0x0001)	false
Oct 7, 2024 22:45:13.257952929 CEST	192.168.2.5	1.1.1.1	0x53d4	Standard query (0)	exilepolsiy.sbs	A (IP address)	IN (0x0001)	false
Oct 7, 2024 22:45:13.272161961 CEST	192.168.2.5	1.1.1.1	0x4d5d	Standard query (0)	laddyirekyi.sbs	A (IP address)	IN (0x0001)	false
Oct 7, 2024 22:45:13.290128946 CEST	192.168.2.5	1.1.1.1	0x87a1	Standard query (0)	invinjurhey.sbs	A (IP address)	IN (0x0001)	false
Oct 7, 2024 22:45:13.303910017 CEST	192.168.2.5	1.1.1.1	0x3e5d	Standard query (0)	wickedneatr.sbs	A (IP address)	IN (0x0001)	false
Oct 7, 2024 22:45:13.320513964 CEST	192.168.2.5	1.1.1.1	0xbe7a	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false
Oct 7, 2024 22:45:14.607409000 CEST	192.168.2.5	1.1.1.1	0x72cc	Standard query (0)	sergei-esenin.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 7, 2024 22:45:09.392807007 CEST	1.1.1.1	192.168.2.5	0x6d71	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 7, 2024 22:45:09.392807007 CEST	1.1.1.1	192.168.2.5	0x6d71	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
Oct 7, 2024 22:45:10.582418919 CEST	1.1.1.1	192.168.2.5	0xa475	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Oct 7, 2024 22:45:10.582418919 CEST	1.1.1.1	192.168.2.5	0xa475	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Oct 7, 2024 22:45:13.202898979 CEST	1.1.1.1	192.168.2.5	0xc455	Name error (3)	exemplarou.sbs	none	none	A (IP address)	IN (0x0001)	false
Oct 7, 2024 22:45:13.225615025 CEST	1.1.1.1	192.168.2.5	0xa7ef	Name error (3)	frizzettei.sbs	none	none	A (IP address)	IN (0x0001)	false
Oct 7, 2024 22:45:13.239494085 CEST	1.1.1.1	192.168.2.5	0x3b64	Name error (3)	isoplethui.sbs	none	none	A (IP address)	IN (0x0001)	false
Oct 7, 2024 22:45:13.255079985 CEST	1.1.1.1	192.168.2.5	0xf74c	Name error (3)	bemuzzeki.sbs	none	none	A (IP address)	IN (0x0001)	false
Oct 7, 2024 22:45:13.268130064 CEST	1.1.1.1	192.168.2.5	0x53d4	Name error (3)	exilepolsiy.sbs	none	none	A (IP address)	IN (0x0001)	false
Oct 7, 2024 22:45:13.283512115 CEST	1.1.1.1	192.168.2.5	0x4d5d	Name error (3)	laddyirekyi.sbs	none	none	A (IP address)	IN (0x0001)	false
Oct 7, 2024 22:45:13.301956892 CEST	1.1.1.1	192.168.2.5	0x87a1	Name error (3)	invinjurhey.sbs	none	none	A (IP address)	IN (0x0001)	false
Oct 7, 2024 22:45:13.314794064 CEST	1.1.1.1	192.168.2.5	0x3e5d	Name error (3)	wickedneatr.sbs	none	none	A (IP address)	IN (0x0001)	false
Oct 7, 2024 22:45:13.327325106 CEST	1.1.1.1	192.168.2.5	0xbe7a	No error (0)	steamcommunity.com		104.102.49.254	A (IP address)	IN (0x0001)	false
Oct 7, 2024 22:45:14.788429022 CEST	1.1.1.1	192.168.2.5	0x72cc	No error (0)	sergei-esenin.com		104.21.53.8	A (IP address)	IN (0x0001)	false
Oct 7, 2024 22:45:14.788429022 CEST	1.1.1.1	192.168.2.5	0x72cc	No error (0)	sergei-esenin.com		172.67.206.204	A (IP address)	IN (0x0001)	false
Oct 7, 2024 22:45:20.531475067 CEST	1.1.1.1	192.168.2.5	0x46ad	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 7, 2024 22:45:20.531475067 CEST	1.1.1.1	192.168.2.5	0x46ad	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

steamcommunity.com

sergei-esenin.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49723	104.102.49.254	443	6420	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 20:45:14 UTC	219	OUT	GET /profiles/76561199724331900 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: steamcommunity.com
2024-10-07 20:45:14 UTC	1870	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.akamai.steamstatic.com/ https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq. [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Mon, 07 Oct 2024 20:45:14 GMT Content-Length: 34837 Connection: close Set-Cookie: sessionid=088002f5bd80e2723000937c; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7Cd7fb65801182a5f50a3169fe2a0b7ef0; Path=/; Secure; HttpOnly; SameSite=None
2024-10-07 20:45:14 UTC	14514	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0d 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0d 0a 09 09 3c Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><
2024-10-07 20:45:14 UTC	16384	IN	Data Raw: 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0d 0a 09 09 6a 51 75 65 72 79 28 66 75 6e 63 74 69 6f 6e 28 24 29 20 7b 0d 0a 09 09 09 24 28 27 23 67 6c 6f 62 61 6c 5f 68 65 61 64 65 72 20 2e 73 75 70 65 72 6e 61 76 27 29 2e 76 5f 74 6f 6f 6c 74 69 70 28 7b 27 6c 6f 63 61 74 69 6f 6e 27 3a 27 62 6f 74 74 6f 6d 27 2c 20 27 64 65 73 74 72 6f 79 57 68 65 6e 44 6f 6e 65 27 3a 20 66 61 6c 73 65 2c 20 27 74 6f 6f 6c 74 69 70 43 6c 61 73 73 27 3a 20 27 73 75 70 65 72 6e 61 76 5f 63 6f 6e 74 65 6e 74 27 2c 20 27 6f 66 66 73 65 74 59 27 3a 2d 36 2c 20 27 6f 66 66 73 65 74 58 27 3a 20 31 2c 20 27 68 6f 72 69 7a 6f 6e 74 61 6c 53 6e 61 70 27 3a 20 34 2c 20 27 74 6f 6f 6c 74 69 70 50 61 72 65 6e 74 27 3a 20 27 23 67 6c 6f Data Ascii: <script type="text/javascript">jQuery(function($) {$('#global_header .supernav').v_tooltip({'location':'bottom', 'destroyWhenDone': false, 'tooltipClass': 'supernav_content', 'offsetY':-6, 'offsetX': 1, 'horizontalSnap': 4, 'tooltipParent': '#glo
2024-10-07 20:45:14 UTC	3768	IN	Data Raw: 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 72 6f 66 69 6c 65 5f 73 75 6d 6d 61 72 79 5f 66 6f 6f 74 65 72 22 3e 0d 0a 09 09 09 09 09 09 09 3c 73 70 61 6e 20 64 61 74 61 2d 70 61 6e 65 6c 3d 22 7b 26 71 75 6f 74 3b 66 6f 63 75 73 61 62 6c 65 26 71 75 6f 74 3b 3a 74 72 75 65 2c 26 71 75 6f 74 3b 63 6c 69 63 6b 4f 6e 41 63 74 69 76 61 74 65 26 71 75 6f 74 3b 3a 74 72 75 65 7d 22 20 63 6c 61 73 73 3d 22 77 68 69 74 65 4c 69 6e 6b 22 20 63 6c 61 73 73 3d 22 77 68 69 74 65 4c 69 6e 6b 22 3e 56 69 65 77 20 6d 6f 72 65 20 69 6e 66 6f 3c 2f 73 70 61 6e 3e 0d 0a 09 09 09 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 09 09 09 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 20 24 4a 28 20 66 75 6e 63 74 69 6f 6e 28 29 Data Ascii: <div class="profile_summary_footer"><span data-panel="{"focusable":true,"clickOnActivate":true}" class="whiteLink" class="whiteLink">View more info</span></div><script type="text/javascript"> $J( function()
2024-10-07 20:45:14 UTC	171	IN	Data Raw: 09 3c 73 70 61 6e 3e 56 69 65 77 20 6d 6f 62 69 6c 65 20 77 65 62 73 69 74 65 3c 2f 73 70 61 6e 3e 0d 0a 09 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 0d 0a 09 3c 2f 64 69 76 3e 09 3c 21 2d 2d 20 72 65 73 70 6f 6e 73 69 76 65 5f 70 61 67 65 5f 63 6f 6e 74 65 6e 74 20 2d 2d 3e 0d 0a 0d 0a 3c 2f 64 69 76 3e 09 3c 21 2d 2d 20 72 65 73 70 6f 6e 73 69 76 65 5f 70 61 67 65 5f 66 72 61 6d 65 20 2d 2d 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <span>View mobile website</span></div></div></div></div>... responsive_page_content --></div>... responsive_page_frame --></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49726	104.21.53.8	443	6420	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 20:45:15 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: sergei-esenin.com
2024-10-07 20:45:15 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-10-07 20:45:15 UTC	776	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 20:45:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=m3rmbqah4mg114itn4340nrodu; expires=Fri, 31 Jan 2025 14:31:54 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4oekr8zbbF5TrlY1MM%2FRGDrH7TkpN5RvD7KgNfY%2BSvxQIzpVI24spahoNSRd1CLlUojgjAOIBdrrAwO53qwpkagba%2BhZlbxVSNpAtQ0Go3%2Fj1cmjsYeWV28m12xIPkvXgL1HYA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cf0bbdaed9e5e78-EWR
2024-10-07 20:45:15 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-10-07 20:45:15 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	16:45:12
Start date:	07/10/2024
Path:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe"
Imagebase:	0xef0000
File size:	551'424 bytes
MD5 hash:	C70170BCEDD92E90F2556C7501B1A559
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_LummaCStealer_4, Description: Yara detected LummaC Stealer, Source: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	16:45:12
Start date:	07/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Imagebase:	0xdc0000
File size:	262'432 bytes
MD5 hash:	8FDF47E0FF70C40ED3A17014AEEA4232
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_LummaCStealer_4, Description: Yara detected LummaC Stealer, Source: 00000001.00000002.2176103954.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	16:45:12
Start date:	07/10/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6036 -s 272
Imagebase:	0xbe0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	0.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	6.1%
Total number of Nodes:	229
Total number of Limit Nodes:	3

Executed Functions

Function 00EF2021 Relevance: 9.4, APIs: 1, Strings: 4, Instructions: 631
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(00F75AD8,?,00000040,?), ref: 00EF2738

Strings

S, xrefs: 00EF206A
MZx, xrefs: 00EF274B, 00EF2757, 00EF275C
a, xrefs: 00EF2296
', xrefs: 00EF2718

Memory Dump Source

Source File: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID: '$MZx$S$a
API String ID: 544645111-3057195942
Opcode ID: fc939ef32515b7cbef8d34178127e7c2d0e319078a11b4fa9c01b0ca0bcff8d0
Instruction ID: 0bf2736bda7369728439bf87e57100c2bebe39e5cb768f6e3beeda9ae2f3e82b
Opcode Fuzzy Hash: fc939ef32515b7cbef8d34178127e7c2d0e319078a11b4fa9c01b0ca0bcff8d0
Instruction Fuzzy Hash: 63F1CF27935E1F06E70864394C522F5994AD7EA730F92633BBF22FB3F4E36909419285

Function 00F06368 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LCMapStringEx.KERNELBASE(?,00F08F1C,?,?,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 00F0639C
LCMapStringW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,?,?,00F08F1C,?,?,00000000,?,00000000), ref: 00F063BA

Strings

R[, xrefs: 00F06396

Memory Dump Source

Source File: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: String
String ID: R[
API String ID: 2568140703-3972925902
Opcode ID: a91c20f090d73057ff49a3bdbdfebe8803fe8ecacb25498f1c662cffcced0128
Instruction ID: 0c43db81558c85d9497c3a5fa450414775b75de8d4a770c2af3f58686c684c77
Opcode Fuzzy Hash: a91c20f090d73057ff49a3bdbdfebe8803fe8ecacb25498f1c662cffcced0128
Instruction Fuzzy Hash: 9BF0763240015ABBCF126F90DC09EDE3F66EF487A0F058010FA18A5160CB36D971BB95

Function 00F08E2E Relevance: 4.7, APIs: 3, Instructions: 202
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__freea.LIBCMT ref: 00F08FDD

Part of subcall function 00F03A83: HeapAlloc.KERNEL32(00000000,00F0A1AA,?,?,00F0A1AA,00000220,?,?,?), ref: 00F03AB5

__freea.LIBCMT ref: 00F08FF2
__freea.LIBCMT ref: 00F09002

Memory Dump Source

Source File: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: __freea$AllocHeap
String ID:
API String ID: 85559729-0
Opcode ID: 5782a126601f1e5566985c0f99711a0a7f09e373d8522f5cf55b494c7ad3a89f
Instruction ID: e91d022da88b082c43945510d86e130cd18839622ef1e2047b4603f9a2116b85
Opcode Fuzzy Hash: 5782a126601f1e5566985c0f99711a0a7f09e373d8522f5cf55b494c7ad3a89f
Instruction Fuzzy Hash: D551C272A00206AFEF219FA4CC41EBB76AAEF447A1B150128FD44D6191EF75CC12B760

Function 00F0A3A6 Relevance: 3.2, APIs: 2, Instructions: 177
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00F09ED6: GetOEMCP.KERNEL32(00000000,?,?,?,?), ref: 00F09F01

IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,?,?,?,?,00F0A1ED,?,00000000,?,?,?), ref: 00F0A407
GetCPInfo.KERNEL32(00000000,?,?,?,?,?,?,?,?,00F0A1ED,?,00000000,?,?,?), ref: 00F0A449

Memory Dump Source

Source File: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: CodeInfoPageValid
String ID:
API String ID: 546120528-0
Opcode ID: 88c9f2af29323c448c098489dff5ac730669fefa1094b7e21cd8c3524b7309af
Instruction ID: 9a9d4ee0d4823c44cf601b5bc5df837420b2e1dca8fe0a934ce48a67b833b3c9
Opcode Fuzzy Hash: 88c9f2af29323c448c098489dff5ac730669fefa1094b7e21cd8c3524b7309af
Instruction Fuzzy Hash: 31512575E003458FDB21CF35C8456BABBF5FF85314F18806ED0828B2A2E6B49945FB52

Function 00F09FAA Relevance: 1.6, APIs: 1, Instructions: 147
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCPInfo.KERNEL32(E8458D00,?,00F0A1F9,00F0A1ED,00000000), ref: 00F09FDC

Memory Dump Source

Source File: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Info
String ID:
API String ID: 1807457897-0
Opcode ID: 38272b46506d7831aee27bc1dabfcb7374090d60d32570b7fec0148acb13b483
Instruction ID: c6fa314df797682b5463aed366b651d9a5aaf3de856167f51f2e0263aed86eae
Opcode Fuzzy Hash: 38272b46506d7831aee27bc1dabfcb7374090d60d32570b7fec0148acb13b483
Instruction Fuzzy Hash: DE514B7290835C9ADB218B28CD80BE67BB8EB59304F2405EDD19AC71C2D3759D46FF21

Non-executed Functions

Function 00F3AA47 Relevance: 31.9, Strings: 24, Instructions: 1933COMMON

Download Yara Rule

Strings

mjkh, xrefs: 00F3B6B0
WP, xrefs: 00F3ABC7
LKJI, xrefs: 00F3B5BE
`Y^_, xrefs: 00F3B876
tsrq, xrefs: 00F3B5D4
T, xrefs: 00F3C02F
xgfe, xrefs: 00F3B5F5
%*+(, xrefs: 00F3AD0F, 00F3AD1E
89>?, xrefs: 00F3B8CE
dcba, xrefs: 00F3B600
<=2, xrefs: 00F3B8D9
89&', xrefs: 00F3B813
<=:;, xrefs: 00F3B808
DCBA, xrefs: 00F3B75F, 00F3B76E
|, xrefs: 00F3BB89
tuJK, xrefs: 00F3B83F
()./, xrefs: 00F3B8A2
@ONM, xrefs: 00F3B5B3
:WUE, xrefs: 00F3C58F, 00F3C59E
QNOL, xrefs: 00F3B64D
`onm, xrefs: 00F3B60B
AR, xrefs: 00F3ABE8
lkji, xrefs: 00F3B616
D, xrefs: 00F3B71E

Memory Dump Source

Source File: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID: %*+($()./$89&'$89>?$:WUE$<=2$<=:;$@ONM$AR$D$DCBA$LKJI$QNOL$T$WP$`Y^_$`onm$dcba$lkji$mjkh$tsrq$tuJK$xgfe$|
API String ID: 0-1418943773
Opcode ID: a9f1e68edfaf0ae1e626f109336ed9d19a6b5191b739eb3bbf20b7e6025201f9
Instruction ID: 1ce831702830c2d9ec01f1bd4175d0d554cacbbe1075950bd24ec65282986f36
Opcode Fuzzy Hash: a9f1e68edfaf0ae1e626f109336ed9d19a6b5191b739eb3bbf20b7e6025201f9
Instruction Fuzzy Hash: EDF286B19083819BD770CF14C894BAFBBE1BFD5320F54482CE5C99B291DB759884EB92

Function 00F46EC4 Relevance: 21.7, Strings: 17, Instructions: 438COMMON

Download Yara Rule

Strings

N[, xrefs: 00F4724D
WQ, xrefs: 00F47503
]{, xrefs: 00F470BF, 00F470CB
/), xrefs: 00F47545
sm, xrefs: 00F47708
JG, xrefs: 00F478FF
Gt, xrefs: 00F46ED0
(a*c, xrefs: 00F4701F
%e6g, xrefs: 00F4702A
kW, xrefs: 00F47258
_Y, xrefs: 00F47519
hi, xrefs: 00F47A75
S], xrefs: 00F4750E
=], xrefs: 00F47242
?m,o, xrefs: 00F47014
WH, xrefs: 00F478F4
CG, xrefs: 00F4790A

Memory Dump Source

Source File: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID: %e6g$(a*c$=]$?m,o$CG$Gt$JG$N[$WH$]{$hi$kW$/)$S]$WQ$_Y$sm
API String ID: 0-1131134755
Opcode ID: 7fe6c7d6d9efdaf882a2b9df3b8a54a15053ee68894a73401dbca1371ba866d9
Instruction ID: 48b72ef706e2dbf13c756af42dae8b19ca5654d851f80fbc3e276a5a1dfac2e5
Opcode Fuzzy Hash: 7fe6c7d6d9efdaf882a2b9df3b8a54a15053ee68894a73401dbca1371ba866d9
Instruction Fuzzy Hash: 5142B5B414D3858AE270CF26D581B8EBAF1BB92740F608E1DE5ED5B255DBB08049CF93

Function 00F4665F Relevance: 11.4, Strings: 9, Instructions: 103COMMON

Download Yara Rule

Strings

|1]3, xrefs: 00F466E6
@-r/, xrefs: 00F466DE
,A&C, xrefs: 00F46706
z=Q?, xrefs: 00F466FE
!E4G, xrefs: 00F4670E
W5W7, xrefs: 00F466EE
;IJK, xrefs: 00F46716
W!Q#, xrefs: 00F466C6
I)C+, xrefs: 00F466D6

Memory Dump Source

Source File: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID: !E4G$,A&C$;IJK$@-r/$I)C+$W!Q#$W5W7$z=Q?$|1]3
API String ID: 0-2124749398
Opcode ID: f2cd62d45247a4721067a6d54a2199a1ff98fbe07b7bed4634b5cc81127c74ee
Instruction ID: 2482c2bc3d2ab831f717947977f2bf60eab3663e1c5e2872c030ad96b056ecec
Opcode Fuzzy Hash: f2cd62d45247a4721067a6d54a2199a1ff98fbe07b7bed4634b5cc81127c74ee
Instruction Fuzzy Hash: 863140B05083819BCB109F95D8A062BBBF0EF86799F40591CF8D68B221E738D944EB46

Function 00F0D39B Relevance: 10.2, APIs: 1, Strings: 4, Instructions: 1436COMMONLIBRARYCODE

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 00F0D57F

Strings

1#SNAN, xrefs: 00F0D4A7
1#QNAN, xrefs: 00F0D4AE
1#IND, xrefs: 00F0D4A0
1#INF, xrefs: 00F0D4D1

Memory Dump Source

Source File: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 37108115962d1a09aed1f964b348e36d88fb4964616a5b926ae6f98a7473c9ef
Instruction ID: b09061be346cafe4cd4a1865e951f74c994d93805066afd3f5efb49246e9864d
Opcode Fuzzy Hash: 37108115962d1a09aed1f964b348e36d88fb4964616a5b926ae6f98a7473c9ef
Instruction Fuzzy Hash: DCD24E72E082298FDB65CF68DD407E9B7B5EB44314F1445EAD40DE7280DB78AE81AF41

Function 00F4F2B8 Relevance: 9.1, Strings: 7, Instructions: 359COMMON

Download Yara Rule

Strings

`tii, xrefs: 00F4F56B
ggxz, xrefs: 00F4F55D
aenQ, xrefs: 00F4F642
fedc, xrefs: 00F4F65A
{l`~, xrefs: 00F4F564
mlc@, xrefs: 00F4F634
f@~!, xrefs: 00F4F4D7

Memory Dump Source

Source File: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID: `tii$aenQ$f@~!$fedc$ggxz$mlc@${l`~
API String ID: 0-3056062858
Opcode ID: 81e2fee55be0e0ed83158224188c4395161ee7ac948e32e04c625285de5dfabf
Instruction ID: b50fcb6122ffd985b577a7946e80ae873961b9284988ffbac76a8ff851521ee0
Opcode Fuzzy Hash: 81e2fee55be0e0ed83158224188c4395161ee7ac948e32e04c625285de5dfabf
Instruction Fuzzy Hash: 79D13CB4801B409FD360AF398646797BFF0BB06300F444A5DE8EB5B696D735A41ACBD2

Function 00F0C814 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,00F0CB32,00000002,00000000,?,?,?,00F0CB32,?,00000000), ref: 00F0C8AD
GetLocaleInfoW.KERNEL32(?,20001004,00F0CB32,00000002,00000000,?,?,?,00F0CB32,?,00000000), ref: 00F0C8D6
GetACP.KERNEL32(?,?,00F0CB32,?,00000000), ref: 00F0C8EB

Strings

OCP, xrefs: 00F0C868
ACP, xrefs: 00F0C832

Memory Dump Source

Source File: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: f270bcc9e132ef0f2824f0296104930b8215586924d0030b9ed43ff244f551f2
Instruction ID: d2a8fead09ba9d91d673c74c2772237cc1c3f97e9ca5fa2664536b58f5cab074
Opcode Fuzzy Hash: f270bcc9e132ef0f2824f0296104930b8215586924d0030b9ed43ff244f551f2
Instruction Fuzzy Hash: 7921B032E00201EADB248F55C940B9B73E6EF54B60B56C624E90AD7181EB32DE41F3D8

Function 00F0C9E9 Relevance: 7.7, APIs: 5, Instructions: 183COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00F04EB1: GetLastError.KERNEL32(?,00000008,00F09482), ref: 00F04EB5
Part of subcall function 00F04EB1: SetLastError.KERNEL32(00000000,00F1C480,00000024,00F00419), ref: 00F04F57

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 00F0CAF5
IsValidCodePage.KERNEL32(00000000), ref: 00F0CB3E
IsValidLocale.KERNEL32(?,00000001), ref: 00F0CB4D
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 00F0CB95
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 00F0CBB4

Memory Dump Source

Source File: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID:
API String ID: 415426439-0
Opcode ID: e2c6d6ad226b1c402f69244a2008db438e1efbe97c83403ef765a1190bdafe01
Instruction ID: 9d9c02bb327589f1328314e39b5fe10b876f40fee72098c88bcd4d257e1e2ed6
Opcode Fuzzy Hash: e2c6d6ad226b1c402f69244a2008db438e1efbe97c83403ef765a1190bdafe01
Instruction Fuzzy Hash: 98516EB2E00209ABDB10DFA5CC42AAE77B8FF48710F154669E911E71D0E7749A44FBA1

Function 00F4AC81 Relevance: 7.5, Strings: 6, Instructions: 38COMMON

Download Yara Rule

Strings

hX]N, xrefs: 00F4AC9F
1 G@, xrefs: 00F4ACA6
n\+H, xrefs: 00F4AC98
upH}, xrefs: 00F4ACAD
iP`R, xrefs: 00F4AC8A
%AUU, xrefs: 00F4AC91

Memory Dump Source

Source File: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID: %AUU$1 G@$hX]N$iP`R$n\+H$upH}
API String ID: 0-3520097955
Opcode ID: 6209497fda56ba42c0ca55be78a875de8b250e6332eb0d406aaca2855171a349
Instruction ID: fc1515b0655c5ea0f29abf955ad028758662a7a9110a00703d90f75903c16d45
Opcode Fuzzy Hash: 6209497fda56ba42c0ca55be78a875de8b250e6332eb0d406aaca2855171a349
Instruction Fuzzy Hash: EE0129B0901745CBCB20CF95C690A6FFBF1EF06741F14480DD882A7651C334AA44DBA6

Function 00F0C085 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 251COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00F04EB1: GetLastError.KERNEL32(?,00000008,00F09482), ref: 00F04EB5
Part of subcall function 00F04EB1: SetLastError.KERNEL32(00000000,00F1C480,00000024,00F00419), ref: 00F04F57

GetACP.KERNEL32(?,?,?,?,?,?,00F01848,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 00F0C146
IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,00F01848,?,?,?,00000055,?,-00000050,?,?), ref: 00F0C171
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 00F0C2D4

Strings

utf8, xrefs: 00F0C243

Memory Dump Source

Source File: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ErrorLast$CodeInfoLocalePageValid
String ID: utf8
API String ID: 607553120-905460609
Opcode ID: 0847998e7a599e7e973ef7d51c780c07fef2a5c3541a604e56f2c33292be273c
Instruction ID: 3d43add1be88b4108325d652ea9dc5a78a8bfbb7564c73b9f60437c9c4f37bf3
Opcode Fuzzy Hash: 0847998e7a599e7e973ef7d51c780c07fef2a5c3541a604e56f2c33292be273c
Instruction Fuzzy Hash: EC71F672A04306AADB24BB75CC42BAB73A8EF44710F144629FA45D75C1EB74E941B7E0

Function 00F1E1CF Relevance: 7.2, Strings: 5, Instructions: 922COMMON

Download Yara Rule

Strings

0, xrefs: 00F1ED60
@, xrefs: 00F20409
0, xrefs: 00F1F316
0, xrefs: 00F1EC99
i, xrefs: 00F1F7C2

Memory Dump Source

Source File: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID: 0$0$0$@$i
API String ID: 0-3124195287
Opcode ID: 12572a0e7900ef4fab88ceb8c21c045fe7f3c85080e9f8e24115e1caf920c67f
Instruction ID: 5138dd18e9b7b2142503738e7dda3b3a9ba24943b1a23fdfbf6e8400d61cdba4
Opcode Fuzzy Hash: 12572a0e7900ef4fab88ceb8c21c045fe7f3c85080e9f8e24115e1caf920c67f
Instruction Fuzzy Hash: 0862E471A0C3818FD318CF28C4907AAFBE1AFD5314F188A2DE8D997291D774D989DB42

Function 00F03C92 Relevance: 6.3, APIs: 4, Instructions: 337COMMONLIBRARYCODE

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00F03D1F

Memory Dump Source

Source File: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 40f0e063838af908aa0c23a01ee66fead67f3bdac29e3056e6e3dd52480c6ad0
Instruction ID: b517498cbeef1da6f42ee9a03c6b0c1a0202e6b8f1c2dd674c84b4a4fd6cf707
Opcode Fuzzy Hash: 40f0e063838af908aa0c23a01ee66fead67f3bdac29e3056e6e3dd52480c6ad0
Instruction Fuzzy Hash: 69B15A72E042569FDB158F68C8817FEBBB9EF55310F14816AE904AB2C1D234DE05F7A1

Function 00EF7922 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 00EF792E
IsDebuggerPresent.KERNEL32 ref: 00EF79FA
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00EF7A13
UnhandledExceptionFilter.KERNEL32(?), ref: 00EF7A1D

Memory Dump Source

Source File: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 95b8247f62dce209d6d8d2ce2aed62d96b6ece0b1e09904cd7d57e763aba8706
Instruction ID: 150bb197cae506c19b588161e78456fd5b7a2ba3d6d69980b68023a60aa76171
Opcode Fuzzy Hash: 95b8247f62dce209d6d8d2ce2aed62d96b6ece0b1e09904cd7d57e763aba8706
Instruction Fuzzy Hash: 723103B5D0521C9ADB60EFA4D949BCDBBF8AF08304F1051AAE50CAB250EB719B848F44

Function 00F1E455 Relevance: 5.5, Strings: 4, Instructions: 458COMMON

Download Yara Rule

Strings

gfff, xrefs: 00F1F1B9
gfff, xrefs: 00F1F16F
gfff, xrefs: 00F1F0FE
-, xrefs: 00F1F0C5

Memory Dump Source

Source File: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID: -$gfff$gfff$gfff
API String ID: 0-3742897846
Opcode ID: 7718804b42ef8cf930431149c87fdc9c6f380754b2246168860b9e7f3cc38233
Instruction ID: a2c9d29202f3f862451cdd809bc02680da89f04c362f30a8d186b5ea8fb328b7
Opcode Fuzzy Hash: 7718804b42ef8cf930431149c87fdc9c6f380754b2246168860b9e7f3cc38233
Instruction Fuzzy Hash: ECF1D871A0C7518FC718CE29C4903AABBE2AFD9314F18CA3DE4D987392D634D949DB42

Function 00F3F138 Relevance: 5.4, Strings: 4, Instructions: 383COMMON

Download Yara Rule

Strings

lc, xrefs: 00F3F3DF
hu, xrefs: 00F3F207
sj, xrefs: 00F3F1FF
a|, xrefs: 00F3F1EF

Memory Dump Source

Source File: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID: a|$hu$lc$sj
API String ID: 0-3748788050
Opcode ID: 2da6593b7bce017c5e70d307783f88ffe4697bf2d3fed1e3eddb71d2ace34cd3
Instruction ID: c79b23231f711bcc0d34303c39490bafe855eebd297785eceb5c12e543ba3164
Opcode Fuzzy Hash: 2da6593b7bce017c5e70d307783f88ffe4697bf2d3fed1e3eddb71d2ace34cd3
Instruction Fuzzy Hash: 12A19DB4808341CBC720DF18C881A2BB7F0FF96764F548A1CE8D59B291E379D949DB96

Function 00F2CB78 Relevance: 5.4, Strings: 4, Instructions: 373COMMON

Download Yara Rule

Strings

V, xrefs: 00F2CDB4
t, xrefs: 00F2CB96
J|BJ, xrefs: 00F2CEE5
VY^_, xrefs: 00F2CCD7

Memory Dump Source

Source File: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID: J|BJ$V$VY^_$t
API String ID: 0-3701112211
Opcode ID: 43469e6f44eed1a9b836f895c9410751fc96af4312bcce639396a2a91bef0c87
Instruction ID: cc3c05bc668062ef2b9584a3a3e7c051ba5906217296ca6eae0d9d13cbb3a71a
Opcode Fuzzy Hash: 43469e6f44eed1a9b836f895c9410751fc96af4312bcce639396a2a91bef0c87
Instruction Fuzzy Hash: 7FD17AB190C3A09BD310DF15E59061FBBE1AF96B44F14882CF4D99B262D336CD49EB92

Function 00F4A687 Relevance: 5.2, Strings: 4, Instructions: 213COMMON

Download Yara Rule

Strings

#', xrefs: 00F4A8C2
KV, xrefs: 00F4A855
T>, xrefs: 00F4A85C
CV, xrefs: 00F4A863

Memory Dump Source

Source File: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID: #'$CV$KV$T>
API String ID: 0-95592268
Opcode ID: c69b9ea6594a5c43ac04cb82c4969c9d22671953c70c58e81f226922327a0ad4
Instruction ID: 0b4eb99a3da07e904d937c96c1344167214a547302cc812ee29825b687a508ac
Opcode Fuzzy Hash: c69b9ea6594a5c43ac04cb82c4969c9d22671953c70c58e81f226922327a0ad4
Instruction Fuzzy Hash: C18154F4801B459BDB20DFA5C68516EBFB1FF12300F604608E886AB655C334AA56CFE3

Function 00F47B69 Relevance: 5.1, Strings: 4, Instructions: 80COMMON

Download Yara Rule

Strings

,{*y, xrefs: 00F47BDF, 00F47BEB
lk, xrefs: 00F47B94
4c2a, xrefs: 00F47B81
(g6e, xrefs: 00F47B79

Memory Dump Source

Source File: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID: (g6e$,{*y$4c2a$lk
API String ID: 0-1327526056
Opcode ID: f9dcc124c1b9a8638023c2dbdaf7777240da40c55f36b67bbdbdb3a86eb3612c
Instruction ID: 76c072bf5bce020cc47a88ddda88ef2c9c34b88fac8669b36e14f334ebfb203d
Opcode Fuzzy Hash: f9dcc124c1b9a8638023c2dbdaf7777240da40c55f36b67bbdbdb3a86eb3612c
Instruction Fuzzy Hash: 152168B480D3818AC730AF20C5407ABBBF0FF82741F64595DE9D89B264DB7AC840DB96

Function 00F0C498 Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 00F04EB1: GetLastError.KERNEL32(?,00000008,00F09482), ref: 00F04EB5
Part of subcall function 00F04EB1: SetLastError.KERNEL32(00000000,00F1C480,00000024,00F00419), ref: 00F04F57

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00F0C4EC
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00F0C536
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00F0C5FC

Memory Dump Source

Source File: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: InfoLocale$ErrorLast
String ID:
API String ID: 661929714-0
Opcode ID: 29c1488cf2ce9c048d771dfa936d59fe69ece6ed308a32c9fb16bee30e910e79
Instruction ID: 8bab098b8b16c981e176e85c0332759219f1cfa66a891c8b1f8e03651d2d5032
Opcode Fuzzy Hash: 29c1488cf2ce9c048d771dfa936d59fe69ece6ed308a32c9fb16bee30e910e79
Instruction Fuzzy Hash: 166181769001079FDB28DF24CC82BBA77A9EF04320F14427AE909C65C5EB79E945FB90

Function 00EFDA73 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 00EFDB6B
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 00EFDB75
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 00EFDB82

Memory Dump Source

Source File: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: cae0fb53775dcf4c3cb76cb4ea811fbd35bf39284490103609566f2baf815c2a
Instruction ID: ab5413f0a3523e89412503d1ec7aadfd2bc747fe44d13f050e992468eb8ebb09
Opcode Fuzzy Hash: cae0fb53775dcf4c3cb76cb4ea811fbd35bf39284490103609566f2baf815c2a
Instruction Fuzzy Hash: 2B31C27490122CABCB21DF24DD89BDCBBF8AF08310F5051DAE50CA6250EB709F858F45

Function 00F1E527 Relevance: 4.2, Strings: 3, Instructions: 472COMMON

Download Yara Rule

Strings

gfff, xrefs: 00F1EE2F
+, xrefs: 00F1E44B
gfff, xrefs: 00F1EE14

Memory Dump Source

Source File: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID: +$gfff$gfff
API String ID: 0-3646763964
Opcode ID: 35b728ad1705faf1f3b3f1732b5860e73b9f66d7c2269a3ae04d64dfcb9b7f2b
Instruction ID: 08aaade6b3151799fc8e0857c84e9d8abe5c2080fa00f6a51e1bd955dd85beef
Opcode Fuzzy Hash: 35b728ad1705faf1f3b3f1732b5860e73b9f66d7c2269a3ae04d64dfcb9b7f2b
Instruction Fuzzy Hash: 3DF1B531A0C3918FC715CE28C4843AAFBE2AFD5314F188A6DE8D987352D734D989DB52

Function 00F1E27B Relevance: 4.1, Strings: 3, Instructions: 390COMMON

Download Yara Rule

Strings

gfff, xrefs: 00F1EE2F
gfff, xrefs: 00F1EE14
-, xrefs: 00F1EDFB

Memory Dump Source

Source File: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID: -$gfff$gfff
API String ID: 0-837351935
Opcode ID: d6ff6ad1442cbdf409bfd7bb2423588c0ae80e6daf78ca5f303bac0752b65028
Instruction ID: a529a678c21afb363bc05306e6946317159bc5115056d670fc8161432e77929f
Opcode Fuzzy Hash: d6ff6ad1442cbdf409bfd7bb2423588c0ae80e6daf78ca5f303bac0752b65028
Instruction Fuzzy Hash: FFD1913160C7818FC715CE29C4846AAFFE2AFD9314F08CA6DE8D987352D634D989DB52

Function 00F25468 Relevance: 4.1, Strings: 3, Instructions: 387COMMON

Download Yara Rule

Strings

), xrefs: 00F254EE
IEND, xrefs: 00F258C8
), xrefs: 00F254E4

Memory Dump Source

Source File: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID: )$)$IEND
API String ID: 0-588110143
Opcode ID: 4c1adf4d3ddecd9b383167e0d128e5a9e29e2d1a0a5d0db94912750285bf625d
Instruction ID: 2ad38120c72fb5b22a7cc0cf1b1e9bd3c9b2beca58a9e177808c8460698bd98d
Opcode Fuzzy Hash: 4c1adf4d3ddecd9b383167e0d128e5a9e29e2d1a0a5d0db94912750285bf625d
Instruction Fuzzy Hash: 64E102B1A08B119FD310CF29D88175ABBE0FB94724F14452DF5989B381D7B9E854DBC2

Function 00F4FF74 Relevance: 4.0, Strings: 3, Instructions: 254COMMON

Download Yara Rule

Strings

:, xrefs: 00F501B5
LTDV, xrefs: 00F4FFE0
3<, xrefs: 00F501AE

Memory Dump Source

Source File: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID: 3<$:$LTDV
API String ID: 0-2797654093
Opcode ID: 9e7e827bec4cf70078eb32fa0fd477bc959d63c8314f3fba064201532e789eb4
Instruction ID: f370a9f1da47b5f8dcb60d89e25867f57179bf6dd1cdfb829abbb1cf03fb81cc
Opcode Fuzzy Hash: 9e7e827bec4cf70078eb32fa0fd477bc959d63c8314f3fba064201532e789eb4
Instruction Fuzzy Hash: 73718A70400B818BDB618F24C590B26BBF1BF16301F98598CD8C69BA93C739F809DB65

Function 00F4FFD5 Relevance: 4.0, Strings: 3, Instructions: 243COMMON

Download Yara Rule

Strings

:, xrefs: 00F501B5
LTDV, xrefs: 00F4FFE0
3<, xrefs: 00F501AE

Memory Dump Source

Source File: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID: 3<$:$LTDV
API String ID: 0-2797654093
Opcode ID: 55370f4e5b9aebffe46f1c775ac834abbae90c9ef6c8401be1cb76cf2d82a942
Instruction ID: 79d8a0ed9a488568abfd9e4884abcc60d3b76ea0cc545e77b9d9297b99a6860c
Opcode Fuzzy Hash: 55370f4e5b9aebffe46f1c775ac834abbae90c9ef6c8401be1cb76cf2d82a942
Instruction Fuzzy Hash: F1618D704117818BDB618F25C990726BFE1BF17301F58588DD8C69FA93C739E809DB65

Function 00F4CF30 Relevance: 3.8, Strings: 3, Instructions: 67COMMON

Download Yara Rule

Strings

J\KR, xrefs: 00F4CF50
:, xrefs: 00F4CF5F
^XF^, xrefs: 00F4CF8B

Memory Dump Source

Source File: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID: :$J\KR$^XF^
API String ID: 0-4266130588
Opcode ID: 64bd0f38261b9b9006df79643b90736e476ce14dd74394cd61dbc2cb2afcfc2a
Instruction ID: 79fb456ebcf28c518309b9f9d679b010ddd75b8ed1966e50f370656e4b476780
Opcode Fuzzy Hash: 64bd0f38261b9b9006df79643b90736e476ce14dd74394cd61dbc2cb2afcfc2a
Instruction Fuzzy Hash: B321AF7140C3808BD312DF29D05072AFFE2AF86360F585D5CE8E45B251C33AD90AABA2

Function 00F0622B Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,?,?,00F023AE,?,20001004,00000000,00000002,?,?,00F019B0), ref: 00F0625F

Strings

R[, xrefs: 00F0624A

Memory Dump Source

Source File: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: R[
API String ID: 2299586839-3972925902
Opcode ID: a854b1cd41447693d5f44b52673e644db1b09d43aff21b2f00f53f6b4c54019e
Instruction ID: e8421f0c17b6b16f83ad9b1b3249d02ac5d2a8ffd325e1046f7755b5750b9f07
Opcode Fuzzy Hash: a854b1cd41447693d5f44b52673e644db1b09d43aff21b2f00f53f6b4c54019e
Instruction Fuzzy Hash: 6FE04F3650022CBBCF122F60DC08AAE7F6AEF44760F118014FD05A52A1CB758E30BBD1

Function 00EFFEF0 Relevance: 3.4, APIs: 2, Instructions: 449COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b78e9bc5a25061f1abca4818c36b3245c47596756df3441acd3b4668cd2eb70a
Instruction ID: f94d1e2be2c3eef6bda2ee07bdd707ec4b1e35bd7638029c03bdeeadd36ff1f7
Opcode Fuzzy Hash: b78e9bc5a25061f1abca4818c36b3245c47596756df3441acd3b4668cd2eb70a
Instruction Fuzzy Hash: A6F13171E002199FDF14CFA8D884BADB7B1FF89324F158269E919A7381DB309E45DB90

Function 00F60F18 Relevance: 3.1, Strings: 2, Instructions: 577COMMON

Download Yara Rule

Strings

f, xrefs: 00F610E4
%*+(, xrefs: 00F60F7C, 00F60F85

Memory Dump Source

Source File: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID: %*+($f
API String ID: 0-2038831151
Opcode ID: 89d37b99ddcec098b1c0d00c9a8877e78529c77cf73c3d1d79a6a6d3dd0eea3c
Instruction ID: 9254061d4ffb400cfbdd2e053e2b9e478ef00f50bd40788b250d0240b4650a6c
Opcode Fuzzy Hash: 89d37b99ddcec098b1c0d00c9a8877e78529c77cf73c3d1d79a6a6d3dd0eea3c
Instruction Fuzzy Hash: 8612AD71A083419FCB15CF18C890B2EBBE5FBC9314F188A2DF4959B291D735E845EB92

Function 00F3CEB7 Relevance: 2.7, Strings: 2, Instructions: 185COMMON

Download Yara Rule

Strings

BaBc, xrefs: 00F3D06F
Ye[g, xrefs: 00F3CFCE

Memory Dump Source

Source File: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID: BaBc$Ye[g
API String ID: 0-286865133
Opcode ID: f1f7f391700c1d153706023ea2e533e08aec07d0302d054125fe460e923244f9
Instruction ID: 1b99fc788ba8328f8a41dae08ae459855c33cc147e404b3d45a19e80b0975b65
Opcode Fuzzy Hash: f1f7f391700c1d153706023ea2e533e08aec07d0302d054125fe460e923244f9
Instruction Fuzzy Hash: F151DEB2A083818BD730CF14C880BABB7E1FF96360F18491DE4D99B690E3749844DB97

Function 00F50F18 Relevance: 2.6, Strings: 2, Instructions: 128COMMON

Download Yara Rule

Strings

40F9, xrefs: 00F50F21
%*+(, xrefs: 00F50FC7

Memory Dump Source

Source File: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID: %*+($40F9
API String ID: 0-4141425864
Opcode ID: e36d9df26ce8d8e7db79f00bc2036a7f7c8980a0d99b81a382e9f2e5388ff683
Instruction ID: b6380fc4551fda62a287fe99956374e761a3713426c80fbda2a1764eed44a043
Opcode Fuzzy Hash: e36d9df26ce8d8e7db79f00bc2036a7f7c8980a0d99b81a382e9f2e5388ff683
Instruction Fuzzy Hash: CC41BD70510B418BD7758F24D590B26BBF1FF02306F54544DE9C25BA92C736F80ADB24

Function 00F1DED8 Relevance: 2.5, Strings: 1, Instructions: 1295COMMON

Download Yara Rule

Strings

@, xrefs: 00F1FB18

Memory Dump Source

Source File: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: b9ab761e06cb60054b554ba1fd181e1af7336824aa7e9b9d9034564fed5e9b5a
Instruction ID: f5c1fd610318cd7f50e7db9195d7dee667ab48e1656e7d998c214e8b7f10fdfa
Opcode Fuzzy Hash: b9ab761e06cb60054b554ba1fd181e1af7336824aa7e9b9d9034564fed5e9b5a
Instruction Fuzzy Hash: 5192F872A083518FD714CE28C8943AABBE2AFC5324F18863DE895D7391D774DD89DB81

Function 00F0572C Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00F05727,?,?,00000008,?,?,00F115F5,00000000), ref: 00F05959

Memory Dump Source

Source File: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 87364f56637c70fc7dc9758978950c48e1f79ae25bdbd43ff547aeea207b970d
Instruction ID: dc313558cb7fcf15c7854ec0edfc3f43ab5d8026cc3123efb59b2727b13457e7
Opcode Fuzzy Hash: 87364f56637c70fc7dc9758978950c48e1f79ae25bdbd43ff547aeea207b970d
Instruction Fuzzy Hash: 0CB12932A10A09CFDB15CF28C486B667BE0FB45764F258658E899CF2E1C375E991EF40

Function 00EF729C Relevance: 1.7, APIs: 1, Instructions: 242COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 00EF72B2

Memory Dump Source

Source File: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 10547ad52fa2addbea90f9f3534513c07afed663a3a054415380251165440eec
Instruction ID: 4393bad51a9d488858c8ff9b81a6b334896c56db37ef8f3f783e7ec0c34e7817
Opcode Fuzzy Hash: 10547ad52fa2addbea90f9f3534513c07afed663a3a054415380251165440eec
Instruction Fuzzy Hash: 04A1AEB1A056098FDB18CF64D8927A9BBF0FB4C318F25912AD94DE73A4C3349941DF50

Function 00F4E1A8 Relevance: 1.7, Strings: 1, Instructions: 484COMMON

Download Yara Rule

Strings

", xrefs: 00F4E4A9

Memory Dump Source

Source File: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: 1e36e4a90a5bcd9904d9a2755a98640d2f51fe7f53356f7c076c40d918f289ea
Instruction ID: a7d823b4cb25c3f53ceb39a857a737da7e0f80eef0ce6c84050813f92898204c
Opcode Fuzzy Hash: 1e36e4a90a5bcd9904d9a2755a98640d2f51fe7f53356f7c076c40d918f289ea
Instruction Fuzzy Hash: C2F12271E083514BD725CF248880A7BBFE6BBD5320F08896DEC9987382D638DD44E792

Function 00F44D38 Relevance: 1.7, Strings: 1, Instructions: 425COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00F4513B, 00F45143

Memory Dump Source

Source File: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: ccee2a807569c25fde004874fc692891e8030e5aaea5b8ac7fbb6ff0169ecf93
Instruction ID: 765771df6a65eb150d672a31964741fa8f8335d462d743a6b88bd95ae84c527e
Opcode Fuzzy Hash: ccee2a807569c25fde004874fc692891e8030e5aaea5b8ac7fbb6ff0169ecf93
Instruction Fuzzy Hash: 56C1B3B1908701ABDB10AB18C841B2BBBF4EF95760F48481CF8C597352E375ED54EBA2

Function 00F50813 Relevance: 1.6, Strings: 1, Instructions: 363COMMON

Download Yara Rule

Strings

Zvt~, xrefs: 00F5081F

Memory Dump Source

Source File: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID: Zvt~
API String ID: 0-694600945
Opcode ID: a6c653d8a13b2bff62d9e48921e2962895175bf4283dfb7f1703a331fac975e3
Instruction ID: 7b573f3e5f3f17413de5f6d329e9eb46ef997b80cb4fe0856d1bfa4f9804ca24
Opcode Fuzzy Hash: a6c653d8a13b2bff62d9e48921e2962895175bf4283dfb7f1703a331fac975e3
Instruction Fuzzy Hash: 3CC1AE705047818FD765CF28C190B26FBE1BF56305F58849DD8DA9B792C736E806DB50

Function 00F09ABF Relevance: 1.6, APIs: 1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3538f683b854fec2f08688c2642cb3d5ee39a2f1fca8c91902b408484a0fbe4
Instruction ID: 8b022038fc7c3c7af7d571c0510419a29150a94bd6bd102cce3ae687eeeb9be8
Opcode Fuzzy Hash: b3538f683b854fec2f08688c2642cb3d5ee39a2f1fca8c91902b408484a0fbe4
Instruction Fuzzy Hash: 8031F972904219AFCB20DFA8CC85DBB77BDEB84324F144158F91597285F6B4AE40AB50

Function 00F49BA8 Relevance: 1.6, Strings: 1, Instructions: 357COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00F49C9B, 00F49CA3

Memory Dump Source

Source File: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: f162ee7309057f34a05e18a7188bb59e25b4a99871efe8703988e1fac2c245e9
Instruction ID: cb92836728f06a74078ca83fb6a95a4c9bfe5113f717665fca8a34126ba70970
Opcode Fuzzy Hash: f162ee7309057f34a05e18a7188bb59e25b4a99871efe8703988e1fac2c245e9
Instruction Fuzzy Hash: 67B1E271A0C3029BDB14DF14D880B6BBBE6EF86360F14492CE9C59B351E375D845EBA2

Function 00EFCAF2 Relevance: 1.6, Strings: 1, Instructions: 344COMMONLIBRARYCODE

Download Yara Rule

Strings

0, xrefs: 00EFCC80

Memory Dump Source

Source File: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 8a570fe16fd96bdb030cc9dc799ad20f0455763497b4d837a4936d71f9c136b0
Instruction ID: 30cea4c992b2197151278c4734124e5d87832de87ac01c7e6a5a0f071148002a
Opcode Fuzzy Hash: 8a570fe16fd96bdb030cc9dc799ad20f0455763497b4d837a4936d71f9c136b0
Instruction Fuzzy Hash: 2EC1E374A0460D8FCB28CF28C6816BEFBF2AF45318F346A19D656B7291C731AD45CB91

Function 00F0C6EB Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 00F04EB1: GetLastError.KERNEL32(?,00000008,00F09482), ref: 00F04EB5
Part of subcall function 00F04EB1: SetLastError.KERNEL32(00000000,00F1C480,00000024,00F00419), ref: 00F04F57

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00F0C73F

Memory Dump Source

Source File: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 1735290ea3583e62d9d7dca12771c7d27a710cec3785ef711b58c29b4dfb269f
Instruction ID: 390626f4b1f9b94d190c031e2fb8bff3f120d435d15b5100251b0d45c057a8a3
Opcode Fuzzy Hash: 1735290ea3583e62d9d7dca12771c7d27a710cec3785ef711b58c29b4dfb269f
Instruction Fuzzy Hash: F5218372905206ABEF189B25DC41ABAB7A8EF44320F10417AFD05D71C1FB78ED41BA90

Function 00F64E98 Relevance: 1.6, Strings: 1, Instructions: 331COMMON

Download Yara Rule

Strings

P, xrefs: 00F6503F

Memory Dump Source

Source File: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID: P
API String ID: 0-3110715001
Opcode ID: b4fda1ba9dc91e6581218cfb9f953b2bbd6cc257535fdb74648dd629dc9337cc
Instruction ID: b4dcbb83fded59811193ba751d4d9b499c5f5dfbf532a2d003b78ddef45aa921
Opcode Fuzzy Hash: b4fda1ba9dc91e6581218cfb9f953b2bbd6cc257535fdb74648dd629dc9337cc
Instruction Fuzzy Hash: 53B112729087618FC725CE18D89072EB7E2EBC5B54F158A2CE8A5AB380C775DC05DBD2

Function 00F0C372 Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00F04EB1: GetLastError.KERNEL32(?,00000008,00F09482), ref: 00F04EB5
Part of subcall function 00F04EB1: SetLastError.KERNEL32(00000000,00F1C480,00000024,00F00419), ref: 00F04F57

EnumSystemLocalesW.KERNEL32(00F0C498,00000001,00000000,?,-00000050,?,00F0CAC9,00000000,?,?,?,00000055,?), ref: 00F0C3E4

Memory Dump Source

Source File: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 0b56529bf3bdad106254742b5c85a36f4cdda7d86cc5891e20388930d568164a
Instruction ID: fe62a9f661d8402461484559292ff557a679414c3aec273f1db36639aad5da45
Opcode Fuzzy Hash: 0b56529bf3bdad106254742b5c85a36f4cdda7d86cc5891e20388930d568164a
Instruction Fuzzy Hash: 5411293A6003055FDB189F38D8A15BABB91FF84368B15852CE98747A80D371B942E780

Function 00F0C91A Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 00F04EB1: GetLastError.KERNEL32(?,00000008,00F09482), ref: 00F04EB5
Part of subcall function 00F04EB1: SetLastError.KERNEL32(00000000,00F1C480,00000024,00F00419), ref: 00F04F57

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,00F0C6B4,00000000,00000000,?), ref: 00F0C946

Memory Dump Source

Source File: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 9cb6bdd4c645eb72ed0623b03d7789b39c93941f34c4d3de0c1246b911c6be5f
Instruction ID: e8acaacb9a1301b63628903e41b0a5685d3a7d0fa38c19a85c3640dfc7f2ba29
Opcode Fuzzy Hash: 9cb6bdd4c645eb72ed0623b03d7789b39c93941f34c4d3de0c1246b911c6be5f
Instruction Fuzzy Hash: E9F0F937900111BBDB249721CC05BBA7B58EF40764F054628ED42A31C0DA34FE01F5D0

Function 00F0C40D Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00F04EB1: GetLastError.KERNEL32(?,00000008,00F09482), ref: 00F04EB5
Part of subcall function 00F04EB1: SetLastError.KERNEL32(00000000,00F1C480,00000024,00F00419), ref: 00F04F57

EnumSystemLocalesW.KERNEL32(00F0C6EB,00000001,?,?,-00000050,?,00F0CA8D,-00000050,?,?,?,00000055,?,-00000050,?,?), ref: 00F0C457

Memory Dump Source

Source File: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 39a547ab160876c575aff459bd4ed0657b8cf9397c96bd3052dff5f3894bf811
Instruction ID: 273d99b55c93764c52cc9056ee2b84f1edfce0da3fddb48a96b635c64f8a5038
Opcode Fuzzy Hash: 39a547ab160876c575aff459bd4ed0657b8cf9397c96bd3052dff5f3894bf811
Instruction Fuzzy Hash: F3F0C23A6003045FDB249F79DC91A7A7B91FF80778F15852DF9468BAD0C671AC42F690

Function 00F05D7F Relevance: 1.5, APIs: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00EFDDC1: EnterCriticalSection.KERNEL32(?,?,00F04B89,?,00F1C2E0,00000008,00F04D4D,?,00EFC446,?), ref: 00EFDDD0

EnumSystemLocalesW.KERNEL32(00F05D72,00000001,00F1C3A0,0000000C,00F06127,00000000), ref: 00F05DB7

Memory Dump Source

Source File: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: 78e5d0c662181cdd83fdc756860e2fe8eb62a9d37e564db9450e928fbda8a5a6
Instruction ID: 6e9d38eee6da9d74a0b45ec09048a786dcef33b14cf3377524cae749d13a855b
Opcode Fuzzy Hash: 78e5d0c662181cdd83fdc756860e2fe8eb62a9d37e564db9450e928fbda8a5a6
Instruction Fuzzy Hash: C9F03772A44318EFD710EF98E842B997BF1EB48721F10811AF415AB2E1DBB99940EF45

Function 00F0C327 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00F04EB1: GetLastError.KERNEL32(?,00000008,00F09482), ref: 00F04EB5
Part of subcall function 00F04EB1: SetLastError.KERNEL32(00000000,00F1C480,00000024,00F00419), ref: 00F04F57

EnumSystemLocalesW.KERNEL32(00F0C280,00000001,?,?,?,00F0CAEB,-00000050,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 00F0C35E

Memory Dump Source

Source File: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: eb70a427fc8e967488e6797af126aa27128bd54d1253dc75dc243ce444d9c2d8
Instruction ID: 6b91d5ceb3342cf61a4f0bca1cb9c1f56e1fa78655c3056bd3602e8f35d28450
Opcode Fuzzy Hash: eb70a427fc8e967488e6797af126aa27128bd54d1253dc75dc243ce444d9c2d8
Instruction Fuzzy Hash: 75F0553A70020457CB049F35CC0566ABF90EFC1B30B068058EA098B6C0C2319946F7D0

Function 00F1E272 Relevance: 1.5, Strings: 1, Instructions: 273COMMON

Download Yara Rule

Strings

@, xrefs: 00F1E78E

Memory Dump Source

Source File: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 33c5a5b9aaa3ad7d40147cb7931ce02fe19695e2396a5ce853ba19e0c001f1db
Instruction ID: a895b3c4f6835915ab268fc7cda3a1af3a2b30c9e476ba3d316f76784772f96a
Opcode Fuzzy Hash: 33c5a5b9aaa3ad7d40147cb7931ce02fe19695e2396a5ce853ba19e0c001f1db
Instruction Fuzzy Hash: F1A1C131A0C7818FD714CF18C4943AABBE1AFD9318F188A6DE4D997391C738D988DB42

Function 00F27728 Relevance: 1.5, Strings: 1, Instructions: 271COMMON

Download Yara Rule

Strings

,, xrefs: 00F2789B

Memory Dump Source

Source File: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID: ,
API String ID: 0-3772416878
Opcode ID: 6a3fef2072c4110c7e08f213014c8aa891b97c95317c3c670d38149bab24221c
Instruction ID: 98d4b4fa2b7fe2bbbbe65a49efc71e99880d72af34af87dfc9b5c6f38af05103
Opcode Fuzzy Hash: 6a3fef2072c4110c7e08f213014c8aa891b97c95317c3c670d38149bab24221c
Instruction Fuzzy Hash: AEB1377150C3819FC320DF69D88065BBBE0AFA9714F444A2DF5D987382D275EA18CB97

Function 00EF7AAF Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00007ABB,00EF6DC9), ref: 00EF7AB4

Memory Dump Source

Source File: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 0500ea0d2cd3c3419db2ec4b5e3325f7f090f02ab78f3e7f059d0e656e2d4d5c
Instruction ID: a04a64d7bc37a3d6a60b2c169eea0e61c9fb4bcb1741fb1d18c4a1ae4e129175
Opcode Fuzzy Hash: 0500ea0d2cd3c3419db2ec4b5e3325f7f090f02ab78f3e7f059d0e656e2d4d5c
Instruction Fuzzy Hash:

Function 00F61918 Relevance: 1.5, Strings: 1, Instructions: 220COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00F61B0B, 00F61B13

Memory Dump Source

Source File: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: 0caa54ea1a90315641ea19c1d2cce55cd527f95500d153b2503ff0c6c28a3b73
Instruction ID: 7f82352d3f95137483e244a80038f87bee0a3bc852a080d8c4f1afb1d12d3cc2
Opcode Fuzzy Hash: 0caa54ea1a90315641ea19c1d2cce55cd527f95500d153b2503ff0c6c28a3b73
Instruction Fuzzy Hash: 7661DE71A093419BD7109FA5C880B2ABBE6FFC5360F1C8A2CE5C587292D735EC40EB52

Function 00F607F8 Relevance: 1.4, Strings: 1, Instructions: 172COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00F608BB, 00F608C3

Memory Dump Source

Source File: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: 48588023ea1370a3b3f62b516369bf0138abb56be5ee286ad8c44f99da0f281a
Instruction ID: 8b0f60c8b185836e76af729fc8db9224c47abc93ce753181b074849b86c390a4
Opcode Fuzzy Hash: 48588023ea1370a3b3f62b516369bf0138abb56be5ee286ad8c44f99da0f281a
Instruction Fuzzy Hash: 27518E71A09300ABDB28DF15C890A2BB7F6EF89755F24892CE4C597352DB35DC10EB62

Function 00EF1D79 Relevance: 1.4, Strings: 1, Instructions: 156COMMON

Download Yara Rule

Strings

Z81xbyuAua, xrefs: 00EF1E9B

Memory Dump Source

Source File: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID: Z81xbyuAua
API String ID: 0-3121583705
Opcode ID: 42a81f914e2ef5dc5d9e38ed447c2645d2ada35811a70139a4e6d560a10890eb
Instruction ID: 35af4c877773370316b1b38deb1b273f56f4fc8d654cf5898dfcca88d568d408
Opcode Fuzzy Hash: 42a81f914e2ef5dc5d9e38ed447c2645d2ada35811a70139a4e6d560a10890eb
Instruction Fuzzy Hash: BD410B76E2052F8BCB0CEEB888561BBBB65EB45354B04527ADE11EB3D1E2348A01C6D0

Function 00F2EAC6 Relevance: 1.4, Strings: 1, Instructions: 128COMMON

Download Yara Rule

Strings

L3, xrefs: 00F2EB16

Memory Dump Source

Source File: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID: L3
API String ID: 0-2730849248
Opcode ID: bf5552e4f83f3bf5aa9e4b1957c4ed33519c9f7afd665e70c400cb02b69d6293
Instruction ID: f05b346dc8edafa80a1a823b55dfc5e79c09bc3b371afe0538c6b4f0f0cf01e1
Opcode Fuzzy Hash: bf5552e4f83f3bf5aa9e4b1957c4ed33519c9f7afd665e70c400cb02b69d6293
Instruction Fuzzy Hash: 984162B44083909BCB109F14D854A2FBBF0BF86324F14892CF9C69B2A1D736CA15CB5A

Function 00F5CB36 Relevance: 1.4, Strings: 1, Instructions: 127COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00F5CB7C, 00F5CB85

Memory Dump Source

Source File: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: c9c3511cf99027d5277ab4afa78953f19eeb9f45ac490c8b653ea83e395facf0
Instruction ID: e736529a08e8ed6a388158ee1d8479d5951e407b7d7219551ce75e520cb3b5cf
Opcode Fuzzy Hash: c9c3511cf99027d5277ab4afa78953f19eeb9f45ac490c8b653ea83e395facf0
Instruction Fuzzy Hash: 9D41D6B1908341AFD714DF54DD85A2EB7E1FB89742F14482CFA85A7251D335DC08EBA2

Function 00F5CE48 Relevance: 1.4, Strings: 1, Instructions: 124COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00F5CF0B, 00F5CF13

Memory Dump Source

Source File: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: e1a7b55e822f4c4c0b190b196c54346a81db642f877fb84c2c593a9f1511728d
Instruction ID: 9a8493510389862772e3345e61b1ea1fa29b1e9a791b0bbbc1b9e0755cdae4b8
Opcode Fuzzy Hash: e1a7b55e822f4c4c0b190b196c54346a81db642f877fb84c2c593a9f1511728d
Instruction Fuzzy Hash: 5F31D8B1908300AFDA10AB14DC81B2FB7E9EB85755F144828FE86D7252E335DC18E7B2

Function 00F45824 Relevance: 1.4, Strings: 1, Instructions: 124COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00F4585B, 00F45863

Memory Dump Source

Source File: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: 452cdd5390474614f0ddbf0a7bb649cabe469c3da803ff3115ae04a2fb717320
Instruction ID: 7247a6d6edb8970c06093d5a2b6ce952067d913db33c6cf9881d74ed5279d8fc
Opcode Fuzzy Hash: 452cdd5390474614f0ddbf0a7bb649cabe469c3da803ff3115ae04a2fb717320
Instruction Fuzzy Hash: 9C41AC70609742EBD715EF18C8C0B2EBBE6EB89B51F604A1CE4C087292D735E8549B56

Function 00F33E69 Relevance: 1.4, Strings: 1, Instructions: 108COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00F33F13

Memory Dump Source

Source File: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: 532d68ad360e3601756663246d56755396bef2663983efa083b5df1ddb856f39
Instruction ID: a119db4ea99b4a1aa8f2aef481d755edfa888ca9cda7d87d845e8ffbe212b040
Opcode Fuzzy Hash: 532d68ad360e3601756663246d56755396bef2663983efa083b5df1ddb856f39
Instruction Fuzzy Hash: EA415B75A00B00DFD738CF65C894B26BBF2FB49351F54891CE58A9BAA1E335F8009B14

Function 00F63833 Relevance: 1.4, Strings: 1, Instructions: 100COMMON

Download Yara Rule

Strings

@, xrefs: 00F6389D

Memory Dump Source

Source File: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: c4c03cbc5544a13e512ffd9534df50902cc064df239456c5298f338a1898222a
Instruction ID: be1dc23a45c41617b5d40965c3f7357f1c12a8c4aa3c950ca1e8b299176be1dd
Opcode Fuzzy Hash: c4c03cbc5544a13e512ffd9534df50902cc064df239456c5298f338a1898222a
Instruction Fuzzy Hash: 3D3198B19083019FD718EF28C8A072EB7E2EF85355F48882CE5C697261E379DA44DB16

Function 00F66BB8 Relevance: 1.3, Strings: 1, Instructions: 87COMMON

Download Yara Rule

Strings

@, xrefs: 00F66C08

Memory Dump Source

Source File: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: f17ffc2d6e27705a654a95a8f2915903712d92e1ab09fb38acfa9e2b53ebfc9f
Instruction ID: e24fb8784e6db4f9f899370b3a97f1106eb3b68e2439fde08b27922f9dd7f625
Opcode Fuzzy Hash: f17ffc2d6e27705a654a95a8f2915903712d92e1ab09fb38acfa9e2b53ebfc9f
Instruction Fuzzy Hash: 4E3187B09093009BD714EF14D880A2EFBF5EFDA32AF14892CE5C897251D336D904DBA6

Function 00F3C89C Relevance: 1.3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00F3C8EF

Memory Dump Source

Source File: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: 24268017a7ecd41d9c94378706e298c4005a58272b1363c3163575431a6d74e9
Instruction ID: 22265c7e79e445220c54dd180368b8cde5bfb26624424bd152f43f5874e6406b
Opcode Fuzzy Hash: 24268017a7ecd41d9c94378706e298c4005a58272b1363c3163575431a6d74e9
Instruction Fuzzy Hash: 6A219D71908342CFC734CF58D894BBAB7E2FB99361F54082CE08993642D735A950EB86

Function 00F493AF Relevance: 1.3, Strings: 1, Instructions: 67COMMON

Download Yara Rule

Strings

~/i!, xrefs: 00F4940F

Memory Dump Source

Source File: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID: ~/i!
API String ID: 0-1642318302
Opcode ID: ca5e31d4c722cdb773ff07964b58c5f5501e65a1289eb1d493cab06e26b7a2d7
Instruction ID: 6e27a349b17e0045eb4df896d652783fcbeeff70f80e4febc3cf0a8bef6ae6f1
Opcode Fuzzy Hash: ca5e31d4c722cdb773ff07964b58c5f5501e65a1289eb1d493cab06e26b7a2d7
Instruction Fuzzy Hash: 9241B8B441D3849EE3209F518441B8FFBF1BB91324FA08E0DE6E85B251D771940A8F97

Function 00F4B56A Relevance: 1.3, Strings: 1, Instructions: 46COMMON

Download Yara Rule

Strings

72?1, xrefs: 00F4B57A

Memory Dump Source

Source File: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID: 72?1
API String ID: 0-1649870076
Opcode ID: 76f8ab0ed0d94e201e3e07d0fa783b670310ded641f28510d027d2591c6b76f4
Instruction ID: d75534b5d4b474ce558e9f43295c26e58ccfdb1702a9dd2c7a42380249630025
Opcode Fuzzy Hash: 76f8ab0ed0d94e201e3e07d0fa783b670310ded641f28510d027d2591c6b76f4
Instruction Fuzzy Hash: A1014BB18006459FDB20CF95D5849AFFBB6AB46301F54090CE482BB641C334EA05CB76

Function 00F0CC4B Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00F0CC4B

Memory Dump Source

Source File: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 122544b155afe2d75d77dba99335cfdb4285141353ca51b7ec774df0794165ec
Instruction ID: bb6424f73f14b67b547156357282964ba1d48485de189dce9c6ff32416eef8cd
Opcode Fuzzy Hash: 122544b155afe2d75d77dba99335cfdb4285141353ca51b7ec774df0794165ec
Instruction Fuzzy Hash: 67A01130A00308AB83808F3AAE0A2883AE8AA0828030AC028A808C0020EA208080BF02

Function 00F28D88 Relevance: .9, Instructions: 895COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6de66e3364744c6f46b7430cdf404bec020986853ce93ecd62be46533fc1686f
Instruction ID: 43619998a49f9d76ff210c0934b71a8e930ef9e1448432e311eb3ce83a4ef534
Opcode Fuzzy Hash: 6de66e3364744c6f46b7430cdf404bec020986853ce93ecd62be46533fc1686f
Instruction Fuzzy Hash: 9B52F932A0C7318BC725DF18E8802BAB3E1FFD5325F294A2DD9D693280D774A851D786

Function 00F28278 Relevance: .7, Instructions: 670COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31e46b44ab80c96838bc845868810fc41c008ea86121d9247d5acbc9ded64e9c
Instruction ID: 433099f034155b6cd3b7b7c70f134c90e770b94f46e7f1c4ab7b4ea68634ee8a
Opcode Fuzzy Hash: 31e46b44ab80c96838bc845868810fc41c008ea86121d9247d5acbc9ded64e9c
Instruction Fuzzy Hash: C852E970D0ABA48FEB35DB24D4843A7BBE1EB91360F144D2DC5D606AC2C779A887E711

Function 00F240C8 Relevance: .7, Instructions: 657COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b06f627f8f7063155f207e74ffce46a74d4b27d2ae33735865de5c38f21a1d3
Instruction ID: 526472565b8e10b1b6d2cac15167131a254c385e4fedac1c3f908da8121b1550
Opcode Fuzzy Hash: 6b06f627f8f7063155f207e74ffce46a74d4b27d2ae33735865de5c38f21a1d3
Instruction Fuzzy Hash: 0652E0319083658FCB15CF14D0906AABBE1FF89314F198A6DF8995B341D7B8E889DF81

Function 00F24AC8 Relevance: .6, Instructions: 592COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90a9ddde86f9f0d6dcf61a8da39fda9f839fcfb56b46b398fe7e1491a94c2c2e
Instruction ID: 48b08760c53d644e2966a17c3fe4bbdf0e21d98e060c31c41bcea9763b3c9120
Opcode Fuzzy Hash: 90a9ddde86f9f0d6dcf61a8da39fda9f839fcfb56b46b398fe7e1491a94c2c2e
Instruction Fuzzy Hash: 72322571915B218FC328CF29D59062AB7F1BF85710B604A2ED6A787F90D376F844EB10

Function 00F271D8 Relevance: .5, Instructions: 459COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8dbf8a9190905fd82ba4d34b3568b61c3c587483ba5650872ac470c2db95d517
Instruction ID: ba504566e62051198efc4422591709bc0314e3960cd2c7304dacd83d938eaac1
Opcode Fuzzy Hash: 8dbf8a9190905fd82ba4d34b3568b61c3c587483ba5650872ac470c2db95d517
Instruction Fuzzy Hash: C5F1BC7560C7418FD724DF29C881A6BFBE6AFD8300F08882DE4D987751E639E944CB56

Function 00F20488 Relevance: .4, Instructions: 411COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da9e90a145ef812cea4a1aec4dc33611fe657f569e89895301b885733208a132
Instruction ID: b23d169be95d8a61f33453e3a74521c2776fabf94212a7c426df3aea7d99b88a
Opcode Fuzzy Hash: da9e90a145ef812cea4a1aec4dc33611fe657f569e89895301b885733208a132
Instruction Fuzzy Hash: 00D1E672E083219BC704CF28D88065FBBE1EBC8750F158A3DF99997391EA75DC459B82

Function 00F64988 Relevance: .4, Instructions: 354COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab695292c8b8be27e531aa2b31291d186ec3fa8c2225d2167c1a821e12252e0c
Instruction ID: 7929d6f2abfb9e112f7c8a6a9fb5b2dac6e6e48b41b67b3f4388fc2d75f9dc55
Opcode Fuzzy Hash: ab695292c8b8be27e531aa2b31291d186ec3fa8c2225d2167c1a821e12252e0c
Instruction Fuzzy Hash: 2DB1F5B2A083504BE728EF69CC4176BB7E5EBC5314F09492DE9A897381E735EC049792

Function 00F50B22 Relevance: .3, Instructions: 330COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ee771dfa70001f925bfea03d664bd7776843dac40e7f18ab3edc6201f5f4258
Instruction ID: 3b7ae3902e5723187a3abbd62a012f78dadb43a4b49e4a49c714d53e16a7d707
Opcode Fuzzy Hash: 0ee771dfa70001f925bfea03d664bd7776843dac40e7f18ab3edc6201f5f4258
Instruction Fuzzy Hash: E4B1CD705047818FD766CF28C190B26FBE0BF56305F58849DE8DA9B792CB36E806DB50

Function 00F0BB36 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ErrorLastProcess$CurrentFeatureInfoLocalePresentProcessorTerminate
String ID:
API String ID: 3471368781-0
Opcode ID: 718d0bd811bc3fad30afcac83d110d7699d6c7c8650fff825f3d50820b6d83d8
Instruction ID: a2cf07224c4a5d121e10da687499ff35c09c0a9d07f160fbe15511bc2b3df51a
Opcode Fuzzy Hash: 718d0bd811bc3fad30afcac83d110d7699d6c7c8650fff825f3d50820b6d83d8
Instruction Fuzzy Hash: 62B108759007069BDB389B25CC92BB7B3E9EF44318F54442DEA83C66C1EB75A981FB10

Function 00F50B43 Relevance: .3, Instructions: 324COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b767dea67f4a2f7cf31decc1319bcbc18fec578ba60376257e9679b3c1f41b22
Instruction ID: 6835fc875c9932150ede1dcc176823ba307a5819796eb56de4f3e995f3ac81ba
Opcode Fuzzy Hash: b767dea67f4a2f7cf31decc1319bcbc18fec578ba60376257e9679b3c1f41b22
Instruction Fuzzy Hash: 83B19C705047818FD766CF28C190B26FBE1BF56305F58889DE8DA9B792CB36E806DB50

Function 00F27DE8 Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c6117061885288c1b39a5b943f8482e52345fd8b1a48c2f17ef7dcb0cf10c7c
Instruction ID: 806acaa526a2e22aa901d4179b264fd91fba16ba1977d04d96a449d29aee2aae
Opcode Fuzzy Hash: 9c6117061885288c1b39a5b943f8482e52345fd8b1a48c2f17ef7dcb0cf10c7c
Instruction Fuzzy Hash: D6C17BB2A487518FC320CF68DC86BABB7E1BF85318F08492DD1D9C6242E778A155CB46

Function 00F3340E Relevance: .3, Instructions: 295COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d3e80e1e551c1b5307767355c273c929f276517553dab3428ab8c78f89de879
Instruction ID: 853cfe75e57dfd9ba8cf14f0ad40923468be08067808e4ae3a8aeda07339b915
Opcode Fuzzy Hash: 4d3e80e1e551c1b5307767355c273c929f276517553dab3428ab8c78f89de879
Instruction Fuzzy Hash: 31B110B4600B409FD321CF24C981B57BBE2AF56711F14885CE8AA8BB92D379F905CB64

Function 00F645E8 Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a95dd50ec095db7a27f57ad37ec87d9359705260a1e90b17de809d3445c49d2e
Instruction ID: 27de627719524aa71cf189904cfc952a65af46a3573842f34a96674562a72aea
Opcode Fuzzy Hash: a95dd50ec095db7a27f57ad37ec87d9359705260a1e90b17de809d3445c49d2e
Instruction Fuzzy Hash: D591AF71A48341ABDB24EB14CC41BAFB7E5EB8A350F54482CF99497391E735F840EB92

Function 00F22123 Relevance: .3, Instructions: 284COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2bc2c964d8783c56c0facf786f96d3b5996f0704cee37f54a01b38d77fa17338
Instruction ID: 2744296d4710066998f4568bb9a1a35ef7d19a1a197a6534423c01d0c34842b2
Opcode Fuzzy Hash: 2bc2c964d8783c56c0facf786f96d3b5996f0704cee37f54a01b38d77fa17338
Instruction Fuzzy Hash: 7BA105B3908362ABE755CE18E890326BBE2AFE0324F1DC56DE8594B341E775DC09E741

Function 00F66FA8 Relevance: .3, Instructions: 282COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a57c0111a676d4db74895e3ca6696bb045d8f27298eeec49787a9baf2036813
Instruction ID: 772b04f851b8bb3192c172fbe0a02b91a80ad990d0c72a8e619b4cc0fa17502c
Opcode Fuzzy Hash: 4a57c0111a676d4db74895e3ca6696bb045d8f27298eeec49787a9baf2036813
Instruction Fuzzy Hash: 7C81BF346083019BDB24EF28C890A2BB7E5FF49754F15892DF986CB251E734EC50DBA2

Function 00F533C8 Relevance: .2, Instructions: 246COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1cd372a116d043efc028469314845027128994ef8c54f150f525e54f19af1d2
Instruction ID: 5bf32582ee3fe04177cf38b131afe85a0b933488cdce6ae828f004b1e992e408
Opcode Fuzzy Hash: c1cd372a116d043efc028469314845027128994ef8c54f150f525e54f19af1d2
Instruction Fuzzy Hash: D1712837B299904BC315993C4C82395BA830BD7375F3EC379EEB48B3E5D629890A6350

Function 00F44AD8 Relevance: .2, Instructions: 242COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5eee379ce68d8c273bbc54570b7d3637e45457eb8161fd84b21c20bb6afda90
Instruction ID: 5cc7f421dcdf02a25a69694ade194169a6ddfb0e482b8754b8f7a88f51769469
Opcode Fuzzy Hash: e5eee379ce68d8c273bbc54570b7d3637e45457eb8161fd84b21c20bb6afda90
Instruction Fuzzy Hash: C251D0B1A002049BDB209B24CCC6B7737B8EF86768F188558FE85DB391E375E800D722

Function 00F4AD84 Relevance: .2, Instructions: 242COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 390502a7dbc55b931af77b2cd4db89728a94f04527eb6b4d510d3d8de7dda55c
Instruction ID: 79a9df247a87eab72a1f8ba4c0aa974f533880fa455b800c5064da703877caee
Opcode Fuzzy Hash: 390502a7dbc55b931af77b2cd4db89728a94f04527eb6b4d510d3d8de7dda55c
Instruction Fuzzy Hash: 06816776E009154BDB1CCE69CC5157EBAB3ABC8324B19C22DD927E73D5DF3499028B84

Function 00F3F540 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d945db3ddaf58208315b5268697068eceb6d853915d256c1e8a4390fd1e69238
Instruction ID: dd9b828e8a1fc9b2457177d64674f36bfd2ff953434fc5d5413cf72feb42cc22
Opcode Fuzzy Hash: d945db3ddaf58208315b5268697068eceb6d853915d256c1e8a4390fd1e69238
Instruction Fuzzy Hash: 5A5178B08183808BD710EF19C891A2ABBF5FFA6760F045D1CE4C59B361E379C908DB66

Function 00F22088 Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2039f829499ba2b7c9b1141e2c1bb0237ca780102234b95d4d22809a355a138f
Instruction ID: cb204106149b6afd47814621e1a9a7c7d6d3ef3e9208ea86a06a26115b9c62f3
Opcode Fuzzy Hash: 2039f829499ba2b7c9b1141e2c1bb0237ca780102234b95d4d22809a355a138f
Instruction Fuzzy Hash: 377129B3908362ABE765CE14E84032ABBD3AFE1324F1D816DD8554B391E776CC15E742

Function 00F4E738 Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d108e008403b3c92b59985e25fae4eb0cb21936506a5ffd7efe5999b9cc5533
Instruction ID: c95121df715836d0d09d59d2a657461cb2ca2e41a996b976449c4f5d081be033
Opcode Fuzzy Hash: 6d108e008403b3c92b59985e25fae4eb0cb21936506a5ffd7efe5999b9cc5533
Instruction Fuzzy Hash: 2661BF32A083019BEB64CF69C58472EBFE2BBC5360F64C92DF8998B395D274DC45A741

Function 00F551A8 Relevance: .2, Instructions: 215COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c84dc754691bb308a9dbcbaee720ee309334a0e93e615c3737e2285dce66845
Instruction ID: 499c699e1b391a97324b18f9a9af8897a8528e1ac647c01d8586fceb8315d2f4
Opcode Fuzzy Hash: 9c84dc754691bb308a9dbcbaee720ee309334a0e93e615c3737e2285dce66845
Instruction Fuzzy Hash: EB618B27F1AE904BC314463C1C663AA6E834BD2731F3EC376DEB58B3E1C5A948096381

Function 00F31D02 Relevance: .2, Instructions: 203COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef974d5467c23934b05c42b7d635b16aa9e9ab43c254c6b335f5a0cd9b41eca7
Instruction ID: 79bffaefb4a80f06b97b1888868dc7577eb6758ef8f627a71433cc1b0dc8f799
Opcode Fuzzy Hash: ef974d5467c23934b05c42b7d635b16aa9e9ab43c254c6b335f5a0cd9b41eca7
Instruction Fuzzy Hash: 0D612AB0900B408BDB35CF24D980B26B7F5BF56320F144A2DD49B8BA91E774F848DB65

Function 00F5B778 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3bfe97d3e605c19e95649c7c2302aff60e9fd4c242a0f426c4f6abc5f87afd30
Instruction ID: 05fd4717c8937b24598165fac1492eb3e362cdaf2aae822c9ea29bba19146855
Opcode Fuzzy Hash: 3bfe97d3e605c19e95649c7c2302aff60e9fd4c242a0f426c4f6abc5f87afd30
Instruction Fuzzy Hash: 9A515CB19087548FE714DF29D89435BBBE1BBC8314F144A2DE9E987350E379DA088B82

Function 00F30F6F Relevance: .2, Instructions: 178COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48cdc4f15658e30105a6f08c7e73f5cf13de9fa3d5a0f874ad6e22d423ce7761
Instruction ID: cfe254c7fba25ac4be212404df1e6325d88069dd5c6e21e533b237fa071cd5a6
Opcode Fuzzy Hash: 48cdc4f15658e30105a6f08c7e73f5cf13de9fa3d5a0f874ad6e22d423ce7761
Instruction Fuzzy Hash: BF61BEB4C10B40AFD360AF39D907757BEF4AB06211F404A1DE8EA96684E7316419DBE3

Function 00F643F8 Relevance: .2, Instructions: 176COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 059aace7fb3d33d5b05fdb41d57cec956a4f2a5a1265165ba3f05433a5bfbe07
Instruction ID: 1debdcb6bcaa9d413f611c43ed7654d10aee3092db781623901fa14e8dcf202f
Opcode Fuzzy Hash: 059aace7fb3d33d5b05fdb41d57cec956a4f2a5a1265165ba3f05433a5bfbe07
Instruction Fuzzy Hash: 1A510871608310ABC714AE18DC91B2EB7E6EF89764F28862CF8D697391C735FC109755

Function 00F2B078 Relevance: .2, Instructions: 175COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fb79119c8b7e9dc55afa4138464863e5f7e156fcefff6606c592a99b47a041b
Instruction ID: bcef62a406ead3b03fe7f9b279395c04fa3041bd0ce6129f1e0c2793c1986a88
Opcode Fuzzy Hash: 7fb79119c8b7e9dc55afa4138464863e5f7e156fcefff6606c592a99b47a041b
Instruction Fuzzy Hash: 54513837B596A187C3298A3C6C653AA7B830FD3334B3DC76AE9B58B3E1D6154805A350

Function 00F29FE8 Relevance: .2, Instructions: 164COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a584769e959b28c720a83d526e0753d41a88e74ccf0ead47e7f50f9f79b33220
Instruction ID: a6c71b82f5118d1288345fe293737efba47233abc6af5aa841387e6d9bd1d485
Opcode Fuzzy Hash: a584769e959b28c720a83d526e0753d41a88e74ccf0ead47e7f50f9f79b33220
Instruction Fuzzy Hash: E741357090D390ABD701BB68E984A2EFBE5AF92751F148C1CE5C497252C33AD814AF67

Function 00F22928 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c510111869ba92912451a7b0d7d7782332ddc64f2b9d570885866b3e77a8514
Instruction ID: 62e1b596363086952d90608f20b26fbf1b14c477c255f6c3ade63142211f8d11
Opcode Fuzzy Hash: 5c510111869ba92912451a7b0d7d7782332ddc64f2b9d570885866b3e77a8514
Instruction Fuzzy Hash: D651C1B1E04321AFC714DF18D88092AB7A1FF85324F15466CF8959B352D735EC81EB92

Function 00F668A8 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d30d4e8a50d40c0e8e6fee20bdc4211b6d278f2fd574d11acf0e5d5d24d8c046
Instruction ID: 47f957200317a2f894530d1129277fb30f5a0601acb029d1149ec34cab9eddb7
Opcode Fuzzy Hash: d30d4e8a50d40c0e8e6fee20bdc4211b6d278f2fd574d11acf0e5d5d24d8c046
Instruction Fuzzy Hash: 50417D30608341ABE714DB54D990B2FB7E5EB85764F14882CF98AE7251D335EC10AB62

Function 00F66A38 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d5a67f3ffa23472cfb88f51fe90dd05ce35a88d56981a423dec3974e78b2c01
Instruction ID: 817bbf2fb4c4441d362e37a5080c06c9ca99fa59b77aeb1b7c6bb500a40edd5c
Opcode Fuzzy Hash: 4d5a67f3ffa23472cfb88f51fe90dd05ce35a88d56981a423dec3974e78b2c01
Instruction Fuzzy Hash: ED418E30608340ABDB14DF55D990B2EB7E5EF86764F24882CF589D7252D335E811EB62

Function 00F2EF08 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a677d001378452f9222ddafdd89244ca075fbfc8bcdccc55e17e3a0b6c405d97
Instruction ID: bfc85c556a7d5dbe7b81be4306b06728dfdd86573064131f620d93f6e623d0f8
Opcode Fuzzy Hash: a677d001378452f9222ddafdd89244ca075fbfc8bcdccc55e17e3a0b6c405d97
Instruction Fuzzy Hash: E1410872A083614FD75CCF2A949023ABBE1AFC5310F19C63EE4D6872D1DA748845EB81

Function 00F4BB20 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10c2414fe1792f3da68675f1142f4c0fe16de70f006865abae02691a7f7a35df
Instruction ID: a72f3f2f22a7b19f71d5ad93649b28a3d1be77ce8c819dfc9a8d39507aac76f0
Opcode Fuzzy Hash: 10c2414fe1792f3da68675f1142f4c0fe16de70f006865abae02691a7f7a35df
Instruction Fuzzy Hash: 54417CB8D003259BDF20CF54DC80BADBBB0FF56350F444149E985AB3A1EB38A951DB65

Function 00F3A3BF Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e23e85b138a55b5785af51337ab17c150877dc4adb199558c55d9d3bc3a9249
Instruction ID: cbc957c3c68c4a9ae52060b35fa55494d26b669808d843503709b6d4b67402b9
Opcode Fuzzy Hash: 5e23e85b138a55b5785af51337ab17c150877dc4adb199558c55d9d3bc3a9249
Instruction Fuzzy Hash: B521EF62804324CBC720DF15C892676B3B0FFA6370F195119E8D69B3A1F3B9AD01E762

Function 00F2ED6B Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ba195b4828959f65e00ce52dd80ddb8fbff997edeacb4fd00185acfab274216
Instruction ID: fb0541b0c1931bc8bb021dbffedcd1885994a3f5ceed96e988c98bf039f355ac
Opcode Fuzzy Hash: 1ba195b4828959f65e00ce52dd80ddb8fbff997edeacb4fd00185acfab274216
Instruction Fuzzy Hash: FF4113705083809BD710AF14D894B1EFBF5FB86755F240D2CF6C497292C37AD8189B6A

Function 00F65C62 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a49b99cf3d7157d0ed907d3dfc7e1b3386e027d0657bcc432d1dbf0f3fdc52c
Instruction ID: 23fa52495511e199337741033d67d17bf31841c03491674c76c876d423f5f412
Opcode Fuzzy Hash: 9a49b99cf3d7157d0ed907d3dfc7e1b3386e027d0657bcc432d1dbf0f3fdc52c
Instruction Fuzzy Hash: 5241E231A0C7908FC704DF68C49092EFBE6AF8A710F198A2DE4D9EB251C735DD058B82

Function 00F5BF08 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5be6113664422e96713363ec41851647c31506b086c17a8b3ff98e201e465e1
Instruction ID: 85713280c3233e3d2f3240ee1bb9959a3c03150cc7b28d8f592debd23e43a0f0
Opcode Fuzzy Hash: c5be6113664422e96713363ec41851647c31506b086c17a8b3ff98e201e465e1
Instruction Fuzzy Hash: F5213A329082144BC3249B99988153BF7E4EB9A716F46862EEDC4A7294E3349C189BD1

Function 00F3A86A Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 442e2041b7d4f0044f3b33030fef62c39f21b01d4b2ce6fbad3c99d345b53e03
Instruction ID: 16f5f458526895c93bf5694da070dbb08fd48b23446f0c65fd378fa7160cf000
Opcode Fuzzy Hash: 442e2041b7d4f0044f3b33030fef62c39f21b01d4b2ce6fbad3c99d345b53e03
Instruction Fuzzy Hash: CC3167B16493818AD7349F15C884BAEB7B0FFA6360F04495DE4D99BBA0D3788841EB53

Function 00F636C7 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22bb0a0a16351f1bf1c6c1539f0de18b004dbbca40553b19ee82d601e5bf0c89
Instruction ID: 8d187a36bdecb40fa87b635cf76d2f036e1c0d194f433933d8f1d8bbe1fb815d
Opcode Fuzzy Hash: 22bb0a0a16351f1bf1c6c1539f0de18b004dbbca40553b19ee82d601e5bf0c89
Instruction Fuzzy Hash: D43134B051C382AAE714CF14C49062FFBF0AF96795F54580DF4C9AB261D338DA84DB9A

Function 00F42D48 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad53ddb2add9dc148ccbfce0f9bbc6833265dcee60d8dc427d2cea672e24ee2f
Instruction ID: ce1065d1ab75d9ab3c8e5c3bc3c6b29bdaa566cd46df0f149f2417502cbf390c
Opcode Fuzzy Hash: ad53ddb2add9dc148ccbfce0f9bbc6833265dcee60d8dc427d2cea672e24ee2f
Instruction Fuzzy Hash: AB21B5B19093019BC710AF18C84596BBBF4EF92761F84492CF8D5D7251E338C940EBA7

Function 00F63290 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef5757cbf0b0f317ecf1d42ae58ac30bf33f4febf434d18edb842894bb03324b
Instruction ID: 4357a2a28ded71f723ac78f3621e5e1e032588250cd7402155f48699e6aee966
Opcode Fuzzy Hash: ef5757cbf0b0f317ecf1d42ae58ac30bf33f4febf434d18edb842894bb03324b
Instruction Fuzzy Hash: D231B4B0648301BBD624DB04CC92F3EB7A5EB85B51F64861CF1815B2E1D770F910DB55

Function 00F21878 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08fc7749f87834a0ac2745ce569e5a70dd2e905a0fab7b5503f7284ac12dee09
Instruction ID: dd40b970c687034fe6703c304e70e8601ad918a4a551964b8dccf699da6c8e61
Opcode Fuzzy Hash: 08fc7749f87834a0ac2745ce569e5a70dd2e905a0fab7b5503f7284ac12dee09
Instruction Fuzzy Hash: C431C431E083209BD7149E58E8C0AABB7E1FF95364F58893CE8999B241D335DC42EB46

Function 00F48051 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8e389976b406287930bf639976c9266f6cf3b476f1ef4286262bb577516eb39
Instruction ID: 7c91c39e67db800b073eb45df12dad2257446e7dcc8f3ddc4bd09b57539c3752
Opcode Fuzzy Hash: b8e389976b406287930bf639976c9266f6cf3b476f1ef4286262bb577516eb39
Instruction Fuzzy Hash: 53219131908716878324DF29C4805AEB3F2FFD8791F15CA2CD88557364EB34AA5AE785

Function 00F63390 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4be7152b6fc8e7c35516a89d2ef9863e36723042a04817cdefcf23ca02a08de
Instruction ID: cec344eda3068d7c7d1e3452846be1e534860c843a6678ecc0b4d7c0eb81c333
Opcode Fuzzy Hash: c4be7152b6fc8e7c35516a89d2ef9863e36723042a04817cdefcf23ca02a08de
Instruction Fuzzy Hash: A5218CB06083419BC704EF19D8A0A2EFBF1EB8A751F18881CE0C597322C735E951DB66

Function 00F33CBA Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b3d95a434817f6c973c9ff02e9ec9249f9d0004a7a7719806d7aee0d8c1105b
Instruction ID: b44ef9b86bdb0d3bc6c172fec9e286f522203a9a9217c078026646d8da2654bd
Opcode Fuzzy Hash: 6b3d95a434817f6c973c9ff02e9ec9249f9d0004a7a7719806d7aee0d8c1105b
Instruction Fuzzy Hash: C6216DB0A00700AFD731CF25DC81B22B7F5AF59720F24992DE0969B661E774F544DB54

Function 00F2DDC4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01f69c16b9c6494f60613f818dcde7c35e0fbda7122440d87ad7206b78ff61d5
Instruction ID: 1c3451c224c9ab52b6210c188d3d4bdd7c64baef1cccd0d8b7bc1325c2ab8e53
Opcode Fuzzy Hash: 01f69c16b9c6494f60613f818dcde7c35e0fbda7122440d87ad7206b78ff61d5
Instruction Fuzzy Hash: B62137B490022A9FDF05CF94DC90BBEBBB2FF4A301F144818E411BB292C735A905CBA4

Function 00F26D40 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73d1958f67b8eb9f3a7656a6591d9f0965aa8cf07a1fb854fe5963536110b1f1
Instruction ID: 319152caa0ab24131fa0c503674417ff92718d5611af283b2f5e31117f55a682
Opcode Fuzzy Hash: 73d1958f67b8eb9f3a7656a6591d9f0965aa8cf07a1fb854fe5963536110b1f1
Instruction Fuzzy Hash: A8215E1521E3C4AE8386C67D088048FBEE15EFA004F896E9EF4C4AB397C554C619C7AB

Function 00F58528 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction ID: 70052f0bde80c4e4fe014c37bf9ceb7c02fe23a55cf4341e008a9980720037fe
Opcode Fuzzy Hash: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction Fuzzy Hash: 5C11EC33A051D40EC3158D3C84405657F930AD3676F5D8399F8F5A71D6D922CD8F9354

Function 00F4DA58 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90022ddfb32469098a8610d4b68e70bc315f5b0e8987f5b71d64abe4c0da561b
Instruction ID: a0573edfdca98121bc31aa4d8534ef224b2a8af28a0749a4de16087a69c8f7d5
Opcode Fuzzy Hash: 90022ddfb32469098a8610d4b68e70bc315f5b0e8987f5b71d64abe4c0da561b
Instruction Fuzzy Hash: 340171F1A0430157EB20AF6598C1B7BB6A8AF92760F18442CED1597303DB7DEC09E792

Function 00F4E132 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7acb281752a9f4735269b9b1cc002f9492d4fa73a4f259361f6e86e2b95aaaf8
Instruction ID: 4f8d7cacfd48430779ccd76ed3ce0beb3ad1fcf179e65138705aa8dfa0ba8300
Opcode Fuzzy Hash: 7acb281752a9f4735269b9b1cc002f9492d4fa73a4f259361f6e86e2b95aaaf8
Instruction Fuzzy Hash: 5421493689A2808BCB4A8F3088960517BB5FE4721936DC2EFCC968D467E76E5407DB21

Function 00F4A0B9 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab6512b1c667dcaa1cc604779a64c1ce391463726a027d9a9669059550eb36de
Instruction ID: 6ee5beea3273a511f693d12ed5df544ffef1ffd90afe2f57586e0b8f5bfe832f
Opcode Fuzzy Hash: ab6512b1c667dcaa1cc604779a64c1ce391463726a027d9a9669059550eb36de
Instruction Fuzzy Hash: 1211ECB0418380AFD3209F618484A2FFBE1EBA6B14F648C0DF5A49B251C779E809DF46

Function 00F23D78 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 205e877a776a04d6abd7e4e09befea2a77073528980a632510507c7b4451283a
Instruction ID: 58d36cfa3eb5b8d7aab99a8f7a753c370af9b5be5e953746b852cc2b4110d64a
Opcode Fuzzy Hash: 205e877a776a04d6abd7e4e09befea2a77073528980a632510507c7b4451283a
Instruction Fuzzy Hash: A7F02B3FB1422D0B6210CDA6A8C4437B395D7C6325B145538DA41C3201CD71E8026194

Function 00F58798 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dad40b8a8b0cf0c680be38028a9801f4e1e9da1297b4f3b9e1d9df466e9bee7e
Instruction ID: 6506d07c58c905065930edc77b6421f51c28c54387ea28b09faa2761b04cb969
Opcode Fuzzy Hash: dad40b8a8b0cf0c680be38028a9801f4e1e9da1297b4f3b9e1d9df466e9bee7e
Instruction Fuzzy Hash: 1E0162B3A199610B8348CE3DDC1156BBAD15BD5770F19872DBEF5CB3E0D230C8118695

Function 00F394C8 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8ebd7708255391ffa87ed53dd5dbf97c7cff7b52fcdad9dabb06971c835301f
Instruction ID: afd6f86e1ed7dc578beff9a6215ab27dc393fb41cabbec3b70aacfa27007612f
Opcode Fuzzy Hash: d8ebd7708255391ffa87ed53dd5dbf97c7cff7b52fcdad9dabb06971c835301f
Instruction Fuzzy Hash: EB014B72A196204B8308CE3C9C1112ABEE19B86330F158B2EBCFAD73E0D664CD548696

Function 00F3264D Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4320f5b54cd7c9a23a8005bed77f00b087a05b385b7ddd433214809cd8c5cbf
Instruction ID: f4c2984818efcfa5267624be0900b2b005700f0f3671530007c128e0d7aaee94
Opcode Fuzzy Hash: f4320f5b54cd7c9a23a8005bed77f00b087a05b385b7ddd433214809cd8c5cbf
Instruction Fuzzy Hash: ADF0C232600706AFDB20DE28DC80A67B3B6FB8A344F48993CE58597565C736F526DB44

Function 00F382E8 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 809ee23363f840c811a801533be2b64f834fb93f4c5a4ab9cc37b5a2fd812bb4
Instruction ID: afd1db93901ba84206c1ea2941e4d19adf6f8618d4dc6ff64dcd7c8dde489ef7
Opcode Fuzzy Hash: 809ee23363f840c811a801533be2b64f834fb93f4c5a4ab9cc37b5a2fd812bb4
Instruction Fuzzy Hash: C7F027B1A04310D7DB228948DC80B77BB9CCB87770F250415F84153201E165584183E5

Function 00F62601 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 279a4f57a637f8128bfd8be77460e1d279c07fa6b9848119afc157391d6ef02f
Instruction ID: 41662b77d8a58fb8fe62ca9151ebe3f0090f717198bcd3b6f68fbae5291a66c4
Opcode Fuzzy Hash: 279a4f57a637f8128bfd8be77460e1d279c07fa6b9848119afc157391d6ef02f
Instruction Fuzzy Hash: 60F0E27190D280ABD351AB58E954A1EFBF4EF96741F14882CE0C49B261C33AD850DB6A

Function 00F5093D Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41ab932f2415c7df50655ebb21d4dd6f332960aa9c3ec918add296c67870008e
Instruction ID: 0ae8a167c1064fad53a5d6b2709c23180dcb81339f3f14247c6f9965cbfc348e
Opcode Fuzzy Hash: 41ab932f2415c7df50655ebb21d4dd6f332960aa9c3ec918add296c67870008e
Instruction Fuzzy Hash: E5F0F474521B409BD3A28F24C684A16FBF1BF06301F94695CE8969BF52D335F814CB55

Function 00F0A64C Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d30a52f00f890bd01d6e84b1357bca7669443c8ff688bb46904ed1c21e63159d
Instruction ID: 1a4067250fafc0852d8fede707fe0f641aa9b4c4ac26670394a214bcf62034be
Opcode Fuzzy Hash: d30a52f00f890bd01d6e84b1357bca7669443c8ff688bb46904ed1c21e63159d
Instruction Fuzzy Hash: E1E08C32921238EBCB24DB98C90498EF3FCEB45B10B154496B902D3250C275DE00E7D0

Function 00F5E318 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4b5204e339133bf84330416a5308528dd9e98d6cb7a6fcb91640552a86da4e7
Instruction ID: 1e7aced49131a06fc45e9b39f9cdd3e6548bdb71bf294f816b49c8910075386c
Opcode Fuzzy Hash: a4b5204e339133bf84330416a5308528dd9e98d6cb7a6fcb91640552a86da4e7
Instruction Fuzzy Hash: CAD05B2190832146AB688E19A400877F7E0EA87712B85555EF985E3154D230EC45D269

Function 00F2E9A5 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cc908392028c27f7ecf30c78ebf6660cf32a01492e826555e3d9857673c97f4
Instruction ID: c27c69557bcaf4867557a537826c6ef73f071e3a54fa5e5cbddfd5735a06ec20
Opcode Fuzzy Hash: 5cc908392028c27f7ecf30c78ebf6660cf32a01492e826555e3d9857673c97f4
Instruction Fuzzy Hash: 64C04C39A991008BC6449F55FC96536B7B8A76B20E710303ADA07FB262DE60D45A990D

Function 00EF2003 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d67d6194250ff7b28096e7c9ff046a95c56316c184b7c46a14e3d09ae8945e0a
Instruction ID: 7af3d389dc526cde1d937f95d1f860e52b57df218b0712f6394470016472bd73
Opcode Fuzzy Hash: d67d6194250ff7b28096e7c9ff046a95c56316c184b7c46a14e3d09ae8945e0a
Instruction Fuzzy Hash: 6CD0923A605A149FC210CF09E440941F7B4FB996307164066E90493720C330FC41DAD0

Function 00F2E914 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1ade6ef58d6580d8cbff1d8d081264510f391430feb37eef4a632f827e8cdbb
Instruction ID: 5f10778036f982285a6eba8d4cad1430e4f243c13a5efd8a3e4328dc499e5567
Opcode Fuzzy Hash: e1ade6ef58d6580d8cbff1d8d081264510f391430feb37eef4a632f827e8cdbb
Instruction Fuzzy Hash: 7BC09B39B5C0148BC244DF45E892532B3F8531730C710303B8A43F7261CD20D419990D

Function 00F62F6C Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eda25dfc225e456b4df2f38464500c90323af58adcbdfe6e488d54600b94eb62
Instruction ID: 9a834d4fd11a1bcc5629f543b0d2d13062003d61a34e88c5a6033e960a3acd63
Opcode Fuzzy Hash: eda25dfc225e456b4df2f38464500c90323af58adcbdfe6e488d54600b94eb62
Instruction Fuzzy Hash: 97C09B3465C20087914CCF04DA51575F3779B97757714B03DC90623257D135F512951D

Function 00F00F2E Relevance: .0, Instructions: 12COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f509db719341cefea6c6c824f556d87c4149af31b656ab04d21882e9f704e7b0
Instruction ID: 85cdf46bdb86f5c5bfeaff22b7475356bc1c63bf429796a625393780dad11059
Opcode Fuzzy Hash: f509db719341cefea6c6c824f556d87c4149af31b656ab04d21882e9f704e7b0
Instruction Fuzzy Hash: C7C08C34401A0086CF39891082713A43365E3A2793F8404CCDC1A0B7C2C91E9C82FA01

Function 00F62EAE Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7e2c6ed00036b488e97d7b66a9e7c4df7905aef658a94aa0b4bf4ae83390246
Instruction ID: 5d07e073f59bc1d9ab006b13b9bdb4d2a63cac6ada5626c8abf9decc6d651ca6
Opcode Fuzzy Hash: e7e2c6ed00036b488e97d7b66a9e7c4df7905aef658a94aa0b4bf4ae83390246
Instruction Fuzzy Hash: 24C09224B682008BA24CCF18DD51935F2BB9B8BA9BB14B03DC906A3257E134E522860C

Function 00F25FB0 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2933151f0ac7f075621f0545018cb448e1da5df1c2a72fb1f6ef91afbd1dabd
Instruction ID: 90f083a07c24874d7646f44137cd52b4f4485f2d8af233f17395c09b59a772d3
Opcode Fuzzy Hash: a2933151f0ac7f075621f0545018cb448e1da5df1c2a72fb1f6ef91afbd1dabd
Instruction Fuzzy Hash: 53C04878908204CAC724CF2AC040AB9F3F5BB4F201F00A01AECA8A3240D638D800DF29

Function 00F32849 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c2b20021a969b34ebd9379bf9b485349b18f198d0552b071d404ad5cd0f597e
Instruction ID: f1c0c38a0b7feefcd14a7992d526c0f8ddc67da51ba104f186919c48afb70220
Opcode Fuzzy Hash: 8c2b20021a969b34ebd9379bf9b485349b18f198d0552b071d404ad5cd0f597e
Instruction Fuzzy Hash: CAB012B1C9C215CBC3008F10C40D1B0F335EE0B202F8071A5850527405C7328003CB0C

Function 00F47B48 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f0846c5d1b29fa8c7eb75566415611b062c9094183590c26b2b47b45be6fc4b
Instruction ID: bb9825d44238991dd192075755b19327866138ce72804a29b080075e6f376ac3
Opcode Fuzzy Hash: 1f0846c5d1b29fa8c7eb75566415611b062c9094183590c26b2b47b45be6fc4b
Instruction Fuzzy Hash: CCB012309082408BD204CF04C450530F374D747109F003418D10AB3152C220E844C60C

Function 00F45C1B Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05b00ae002dc55fb4e625dd24f5a9641755cf84b69f0189ba72e1364eef460e8
Instruction ID: 6fa0a1bee6cd81a0e7ee55e180bb11495692cb872df1a59e9b59285b5741de68
Opcode Fuzzy Hash: 05b00ae002dc55fb4e625dd24f5a9641755cf84b69f0189ba72e1364eef460e8
Instruction Fuzzy Hash: 4CA00138A883028B8209CE14E690875F3B8A74F602F103954E949B3216C620E8048A2E

Function 00EF53B1 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00EF53B8
std::_Lockit::_Lockit.LIBCPMT ref: 00EF53C2
int.LIBCPMT ref: 00EF53D9

Part of subcall function 00EF16B4: std::_Lockit::_Lockit.LIBCPMT ref: 00EF16C5
Part of subcall function 00EF16B4: std::_Lockit::~_Lockit.LIBCPMT ref: 00EF16DF

std::_Facet_Register.LIBCPMT ref: 00EF5413
std::_Lockit::~_Lockit.LIBCPMT ref: 00EF5433
Concurrency::cancel_current_task.LIBCPMT ref: 00EF5440

Strings

R[, xrefs: 00EF5420

Memory Dump Source

Source File: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Register
String ID: R[
API String ID: 55977855-3972925902
Opcode ID: 448300d3581572934ecc3206fa54a0587c00ab0c5b5d279ab408151d88db244a
Instruction ID: 0b728889d4b7ec30894626fe236a71c2fb90ac33a59ba9ead3d79f459fc703cc
Opcode Fuzzy Hash: 448300d3581572934ecc3206fa54a0587c00ab0c5b5d279ab408151d88db244a
Instruction Fuzzy Hash: 0911E172900A1CDBCB14EB64D8016BEB7F5AF54324F54540DEB45B7291DFB0AE40DB81

Function 00EFA5C8 Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 00EFA6E7
___TypeMatch.LIBVCRUNTIME ref: 00EFA7F5
CallUnexpected.LIBVCRUNTIME ref: 00EFA962

Strings

csm, xrefs: 00EFA605
csm, xrefs: 00EFA672
csm, xrefs: 00EFA71E

Memory Dump Source

Source File: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: CallMatchTypeUnexpectedtype_info::operator==
String ID: csm$csm$csm
API String ID: 1206542248-393685449
Opcode ID: bc9e5be8526a2f942fc2e7289d53fcb2e5c07739be259c4fc17c80a71ca60924
Instruction ID: db226407eb722c0805734bd17f6c1e938bb1e3df1f922ef94cccf4e5aed94035
Opcode Fuzzy Hash: bc9e5be8526a2f942fc2e7289d53fcb2e5c07739be259c4fc17c80a71ca60924
Instruction Fuzzy Hash: 25B18BB180020DDFCF18EFA4C8809BEB7B5AF44314B19907AEA197F212D771DA51CB92

Function 00F05F4A Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,F8250000,?,75CEE1D5,?,00F06057,00EFC446,?,F8250000,00000000), ref: 00F0600B

Strings

ext-ms-, xrefs: 00F05FB5
api-ms-, xrefs: 00F05FA1

Memory Dump Source

Source File: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 9f413f4c7cc8e9055eb1a2d6865fec8001294ee6245f17b793cb7c0657174dfb
Instruction ID: a74ab22ad0a489a43b18ce7d194d13708c9fe9c50b47dcf96d2537439e8fecdd
Opcode Fuzzy Hash: 9f413f4c7cc8e9055eb1a2d6865fec8001294ee6245f17b793cb7c0657174dfb
Instruction Fuzzy Hash: 20210832E01615A7CB319B659C40A9B3768AF41BB5B250110F915E72D0D6B4ED00FBE0

Function 00EF507A Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00EF5081
std::_Lockit::_Lockit.LIBCPMT ref: 00EF508C
std::locale::_Setgloballocale.LIBCPMT ref: 00EF50A7
_Yarn.LIBCPMT ref: 00EF50BD
std::_Lockit::~_Lockit.LIBCPMT ref: 00EF50FA

Strings

R[, xrefs: 00EF50C9, 00EF50ED

Memory Dump Source

Source File: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Lockitstd::_$H_prolog3Lockit::_Lockit::~_SetgloballocaleYarnstd::locale::_
String ID: R[
API String ID: 156189095-3972925902
Opcode ID: 7c230b5e1ca8de569f1dda523a277b9bc1f4dcb53bf4b63882427314e40b7224
Instruction ID: ec3ed987062925fd7acca7df46de714289f747eabed1ce9a2bfe709e1a61b040
Opcode Fuzzy Hash: 7c230b5e1ca8de569f1dda523a277b9bc1f4dcb53bf4b63882427314e40b7224
Instruction Fuzzy Hash: 2701BC76A0095C9BDB05AF20D841ABD7BB1BF94340B295009EA4167381CF34AE41EFC2

Function 00F00F50 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,75CEE1D5,?,?,00000000,00F11FC8,000000FF,?,00F00EE0,00F01010,?,00F00EB4,00000000), ref: 00F00F85
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00F00F97
FreeLibrary.KERNEL32(00000000,?,?,00000000,00F11FC8,000000FF,?,00F00EE0,00F01010,?,00F00EB4,00000000), ref: 00F00FB9

Strings

mscoree.dll, xrefs: 00F00F7E
CorExitProcess, xrefs: 00F00F8F
R[, xrefs: 00F00FA8

Memory Dump Source

Source File: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$R[$mscoree.dll
API String ID: 4061214504-706027784
Opcode ID: 8c897d3982952e889624426a3ee4458cd341e2e94a2c469302853512f3dd7f7c
Instruction ID: 9af84a994640f4ddcbc8bb0b52d74bae9503a73d21624ce5e291968b160fe07e
Opcode Fuzzy Hash: 8c897d3982952e889624426a3ee4458cd341e2e94a2c469302853512f3dd7f7c
Instruction Fuzzy Hash: 90014F32944619EBDB118B50DC09FEEBBB8FB08B25F054529E811A22D0DB749904EA90

Function 00F0F356 Relevance: 9.3, APIs: 6, Instructions: 298COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27baeed0ec27e6dc0a1bc6a06a5fa3a66b6eab8eab3f560888004dac26025660
Instruction ID: af60b9d53354899d8d5e36e6847b4dcb26de9800d965203e77bb2bfdfda3776a
Opcode Fuzzy Hash: 27baeed0ec27e6dc0a1bc6a06a5fa3a66b6eab8eab3f560888004dac26025660
Instruction Fuzzy Hash: 27B1F174E04209AFDB21DFA8DC80BBEBBB1AF45310F144169E504AB6E2C7769D45FB60

Function 00EFA25A Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00EFA251,00EF8978,00EF7AFF), ref: 00EFA268
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00EFA276
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00EFA28F
SetLastError.KERNEL32(00000000,00EFA251,00EF8978,00EF7AFF), ref: 00EFA2E1

Memory Dump Source

Source File: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 1485b2f12a0740fb053be03eb319dba2f5d34d7c0b0a336ddda22c3b9cc22f74
Instruction ID: 11ea28eb203b7faef69ed2aa7f4e8c384b93aa4c919dca39cc374046d6741dd4
Opcode Fuzzy Hash: 1485b2f12a0740fb053be03eb319dba2f5d34d7c0b0a336ddda22c3b9cc22f74
Instruction Fuzzy Hash: 7601F17230E32D6EB6242774BC866B637D5EB0A778B255239F324790F1FF124C026242

Function 00EFA371 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00EFA438
___AdjustPointer.LIBCMT ref: 00EFA45B
___AdjustPointer.LIBCMT ref: 00EFA4F7

Strings

R[, xrefs: 00EFA3D0

Memory Dump Source

Source File: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID: R[
API String ID: 1740715915-3972925902
Opcode ID: a9dfe1b2cfc097e2181bccc4fb7d124b5375e9d811b2d17ea806526fee80e924
Instruction ID: 2bccbe9f0bdc856321f1736b6d6b53827f2bc4eb045bf659af51fa54e3a88abd
Opcode Fuzzy Hash: a9dfe1b2cfc097e2181bccc4fb7d124b5375e9d811b2d17ea806526fee80e924
Instruction Fuzzy Hash: DB5123B660120EDFDB288F54D844BBA77B4EF04314F28503DEA29AB291E771ED40D792

Function 00EF4436 Relevance: 7.5, APIs: 5, Instructions: 48COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00EF4442
int.LIBCPMT ref: 00EF4455

Part of subcall function 00EF16B4: std::_Lockit::_Lockit.LIBCPMT ref: 00EF16C5
Part of subcall function 00EF16B4: std::_Lockit::~_Lockit.LIBCPMT ref: 00EF16DF

std::_Facet_Register.LIBCPMT ref: 00EF4488
std::_Lockit::~_Lockit.LIBCPMT ref: 00EF449E
Concurrency::cancel_current_task.LIBCPMT ref: 00EF44A9

Memory Dump Source

Source File: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: f63e4a29512fac8607fe41e0c896218445273dbe38e5fe2095faa704c6ad14be
Instruction ID: a137f23bd2dd243b7e47ce1967cf9a898a0aa9e05beae6ee5f0570e9951e62c0
Opcode Fuzzy Hash: f63e4a29512fac8607fe41e0c896218445273dbe38e5fe2095faa704c6ad14be
Instruction Fuzzy Hash: 2101F2B250011CEBCB24EB64D8059BE77A8EF80760B141189FA19BB2D0EF319E01EB80

Function 00EF3DB1 Relevance: 7.5, APIs: 5, Instructions: 48COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00EF3DBD
int.LIBCPMT ref: 00EF3DD0

Part of subcall function 00EF16B4: std::_Lockit::_Lockit.LIBCPMT ref: 00EF16C5
Part of subcall function 00EF16B4: std::_Lockit::~_Lockit.LIBCPMT ref: 00EF16DF

std::_Facet_Register.LIBCPMT ref: 00EF3E03
std::_Lockit::~_Lockit.LIBCPMT ref: 00EF3E19
Concurrency::cancel_current_task.LIBCPMT ref: 00EF3E24

Memory Dump Source

Source File: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: bf7e4a5f880186898209221eb2c3b5be9851386f37136ae08f6ddef55a623e7c
Instruction ID: 4f61b21b084ab27cfa04ae6eab99f8f21342e3aaed71d2c96dd9261b494fe305
Opcode Fuzzy Hash: bf7e4a5f880186898209221eb2c3b5be9851386f37136ae08f6ddef55a623e7c
Instruction Fuzzy Hash: D701F27290021CEBCB25BB64D8058BE77E8DF80360B242189FA05B7291EF31EF41D781

Function 00EF4308 Relevance: 7.5, APIs: 5, Instructions: 47COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00EF4315
int.LIBCPMT ref: 00EF4328

Part of subcall function 00EF16B4: std::_Lockit::_Lockit.LIBCPMT ref: 00EF16C5
Part of subcall function 00EF16B4: std::_Lockit::~_Lockit.LIBCPMT ref: 00EF16DF

std::_Facet_Register.LIBCPMT ref: 00EF435B
std::_Lockit::~_Lockit.LIBCPMT ref: 00EF4371
Concurrency::cancel_current_task.LIBCPMT ref: 00EF437C

Memory Dump Source

Source File: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 6888542f6cf07b63f2fa216af77f9805a7b5d13d4f72062d8c8e1e3739aae67e
Instruction ID: 941e93d3019d07c28dfd2b8ac5deeda198455c5badc36788db3c1ca75435a294
Opcode Fuzzy Hash: 6888542f6cf07b63f2fa216af77f9805a7b5d13d4f72062d8c8e1e3739aae67e
Instruction Fuzzy Hash: DD01F2B290061CABCB14BB649801CFE77E89F90320B112159FA09B72D1EF309E41DB81

Function 00EFA060 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 00EFA09F
__IsNonwritableInCurrentImage.LIBCMT ref: 00EFA153

Strings

csm, xrefs: 00EFA13D
R[, xrefs: 00EFA16C

Memory Dump Source

Source File: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: CurrentImageNonwritable___except_validate_context_record
String ID: R[$csm
API String ID: 3480331319-1515388219
Opcode ID: dff31af16691ce630ea6e6e7dd3c9074885f5cbf5036e99c4b2f2d6e5083aedd
Instruction ID: bb619def1bbed157ef4ee6ff9a8fe380635edb52ece79a76fc20f9a11c6f35c4
Opcode Fuzzy Hash: dff31af16691ce630ea6e6e7dd3c9074885f5cbf5036e99c4b2f2d6e5083aedd
Instruction Fuzzy Hash: 6F41B6B0A0121CABCF10DF68D881ABE7BF5AF44314F199165EA187F352C735DA51CB92

Function 00EFB3A2 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,00EFB353,00000000,?,00F76AE4,?,?,?,00EFB4F6,00000004,InitializeCriticalSectionEx,00F14BD8,InitializeCriticalSectionEx), ref: 00EFB3AF
GetLastError.KERNEL32(?,00EFB353,00000000,?,00F76AE4,?,?,?,00EFB4F6,00000004,InitializeCriticalSectionEx,00F14BD8,InitializeCriticalSectionEx,00000000,?,00EFB2AD), ref: 00EFB3B9
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 00EFB3E1

Strings

api-ms-, xrefs: 00EFB3C6

Memory Dump Source

Source File: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: a89d711944181145d1d0cf56e1564ddf24e957278f40e203a173e6664a821861
Instruction ID: 8f09e773fe3b1d5ab11f1ddfb26ac7a25b63d00d50bdf952d6eeb24e77920748
Opcode Fuzzy Hash: a89d711944181145d1d0cf56e1564ddf24e957278f40e203a173e6664a821861
Instruction Fuzzy Hash: DCE0483428420CB7EF115B71EC46B693E589B14B49F114061FB0CF80E5D7B1E954A685

Function 00F07747 Relevance: 6.3, APIs: 4, Instructions: 338fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(75CEE1D5,00000000,00000000,00000000), ref: 00F077AA

Part of subcall function 00F0952A: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,00F08FD3,?,00000000,-00000008), ref: 00F095D6

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00F07A05
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00F07A4D
GetLastError.KERNEL32 ref: 00F07AF0

Memory Dump Source

Source File: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: b2ff1e30261e3c0ddfd229cdba7fdec49cd6680ef19b40315737359672b6b5b9
Instruction ID: 04420d99bd76e18da1ac684478982951e518306b060b42a1a273c74084112a82
Opcode Fuzzy Hash: b2ff1e30261e3c0ddfd229cdba7fdec49cd6680ef19b40315737359672b6b5b9
Instruction Fuzzy Hash: FAD17975E042589FCB11DFE8D8809EDBBB5FF09310F18816AE855EB391D734A941EB50

Function 00F106EF Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,0000000C,?,00000000,00000000,?,00F0F713,00000000,00000001,00000000,00000000,?,00F07B44,00000000,00000000,00000000), ref: 00F10706
GetLastError.KERNEL32(?,00F0F713,00000000,00000001,00000000,00000000,?,00F07B44,00000000,00000000,00000000,00000000,00000000,?,00F080CB,00000000), ref: 00F10712

Part of subcall function 00F106D8: CloseHandle.KERNEL32(FFFFFFFE,00F10722,?,00F0F713,00000000,00000001,00000000,00000000,?,00F07B44,00000000,00000000,00000000,00000000,00000000), ref: 00F106E8

___initconout.LIBCMT ref: 00F10722

Part of subcall function 00F1069A: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00F106C9,00F0F700,00000000,?,00F07B44,00000000,00000000,00000000,00000000), ref: 00F106AD

WriteConsoleW.KERNEL32(00000000,0000000C,?,00000000,?,00F0F713,00000000,00000001,00000000,00000000,?,00F07B44,00000000,00000000,00000000,00000000), ref: 00F10737

Memory Dump Source

Source File: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 8e1d151dc08e96ecf15ebccb8849d568d455075ca3bc87d9b61393e06d255fb1
Instruction ID: 2654f37f3f88727f6388c270eb0b3621c8c5f4f00f5c3233240e0179ce175a2c
Opcode Fuzzy Hash: 8e1d151dc08e96ecf15ebccb8849d568d455075ca3bc87d9b61393e06d255fb1
Instruction Fuzzy Hash: 27F03036441168BBCF225F95DC089C93FB6FF493A1B018010FA5DA5130CA7299A0FF90

Function 00EF5F4D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

_Fputc.LIBCPMT ref: 00EF6026

Strings

R[, xrefs: 00EF6005

Memory Dump Source

Source File: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Fputc
String ID: R[
API String ID: 3078413507-3972925902
Opcode ID: 7e2b82e201ce35d8db10c4e37eecb785605d950254597264022b272810d2dc40
Instruction ID: a6a22871089d902f5a288eb3694760b943c93ae0bc558ffb02963c0c02c0192e
Opcode Fuzzy Hash: 7e2b82e201ce35d8db10c4e37eecb785605d950254597264022b272810d2dc40
Instruction Fuzzy Hash: 62415933A1061EABCB14DF64D4848FDB7B8FF29314B14506AE741B7650EB31EA418B90

Function 00EFA96D Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?), ref: 00EFA992

Strings

RCC, xrefs: 00EFA9AC
MOC, xrefs: 00EFA9A4

Memory Dump Source

Source File: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: e311312df9c801f2cbfd47a86834b514479c7c8e964f4738ecba816affdb3dba
Instruction ID: a506a9fb6f3011e70676a6968278ddbfe880b77a653e68300b7d127c1bd27e54
Opcode Fuzzy Hash: e311312df9c801f2cbfd47a86834b514479c7c8e964f4738ecba816affdb3dba
Instruction Fuzzy Hash: 44413AB190060DAFCF16DF98CD81ABEBBB5BF48304F199069FA187B211D3359950DB52

Function 00EF5107 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00EF5113
std::_Lockit::~_Lockit.LIBCPMT ref: 00EF516F

Strings

R[, xrefs: 00EF513A, 00EF5154

Memory Dump Source

Source File: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_
String ID: R[
API String ID: 593203224-3972925902
Opcode ID: 106d2420cdf7e44f9c88342fc89ffe3765e481b4c715067afa15185cff0c90c3
Instruction ID: a9171e8327c03830677445ae7005142502d289a126298ab54c434f20ff980bc7
Opcode Fuzzy Hash: 106d2420cdf7e44f9c88342fc89ffe3765e481b4c715067afa15185cff0c90c3
Instruction Fuzzy Hash: 5D019E71600918EFCB00DB54C885EAD7BBAEF85714B154099EA05AB3A1DF70FE00CB50

Function 00EF15DF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00EF15E6
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00EF161E

Part of subcall function 00EF5178: _Yarn.LIBCPMT ref: 00EF5197
Part of subcall function 00EF5178: _Yarn.LIBCPMT ref: 00EF51BB

Strings

bad locale name, xrefs: 00EF162C

Memory Dump Source

Source File: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Yarnstd::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 1908188788-1405518554
Opcode ID: ac71b7f1d463c8d006683211dc8df9b822df3a0dfce2fac56027a8966b7477d5
Instruction ID: a411f1c14738d157dbfa1939fc87a96315305b4840d35c973fe3aae675e4645c
Opcode Fuzzy Hash: ac71b7f1d463c8d006683211dc8df9b822df3a0dfce2fac56027a8966b7477d5
Instruction Fuzzy Hash: 46F09AB2406B849E83319F7A8480453FBE4BE283103809E6FE2CED3A11C330E004CB6A

Function 00F062A6 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 26COMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(?,?), ref: 00F062E6

Strings

InitializeCriticalSectionEx, xrefs: 00F062B6
R[, xrefs: 00F062D6

Memory Dump Source

Source File: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: CountCriticalInitializeSectionSpin
String ID: InitializeCriticalSectionEx$R[
API String ID: 2593887523-432795312
Opcode ID: b1272d6d0c0e5dcb1d34f4fe8f4de8f3bf3694fe0c21ba0d0e5e7694972ff552
Instruction ID: 9373518e573e01af05bbc02872962f09c2d7eef2f013a4a02e756bfa8acf86c7
Opcode Fuzzy Hash: b1272d6d0c0e5dcb1d34f4fe8f4de8f3bf3694fe0c21ba0d0e5e7694972ff552
Instruction Fuzzy Hash: 73E01236584218B7CF112F91EC06EDE7F16EB847A1F018025FD18A91A0D6B2D971F6D5

Function 00F0612C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22memoryCOMMON

Download Yara Rule

APIs

TlsAlloc.KERNEL32 ref: 00F06160

Strings

FlsAlloc, xrefs: 00F0613C
R[, xrefs: 00F06156

Memory Dump Source

Source File: 00000000.00000002.2177775715.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.2177752859.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177808469.0000000000F13000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177830522.0000000000F1D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177877472.0000000000F75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177896522.0000000000F76000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2177915612.0000000000F78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Alloc
String ID: FlsAlloc$R[
API String ID: 2773662609-3428055260
Opcode ID: 64c19b7006d4693e994991375e5e95804437d287829db490cd448a295e5fed5e
Instruction ID: b9d4b35671274429234aaaff7db13cfb3ec974955b9ad8b086fb1ab3666ba9c0
Opcode Fuzzy Hash: 64c19b7006d4693e994991375e5e95804437d287829db490cd448a295e5fed5e
Instruction Fuzzy Hash: 29E0CD36AC431873C61136619C05EDE7A148B88F717014020F909A51C1CAA5D950B5D6

Analysis Process: MSBuild.exePID: 6420, Parent PID: 6036COMMON

Execution Graph

Execution Coverage:	1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	2.3%
Total number of Nodes:	44
Total number of Limit Nodes:	4

Executed Functions

Function 0040D110 Relevance: 6.2, APIs: 4, Instructions: 154
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetInputState.USER32 ref: 0040D121
GetCurrentThreadId.KERNEL32 ref: 0040D136
GetCurrentProcessId.KERNEL32 ref: 0040D13C
ExitProcess.KERNEL32 ref: 0040D2F0

Memory Dump Source

Source File: 00000001.00000002.2176103954.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: CurrentProcess$ExitInputStateThread
String ID:
API String ID: 1029096631-0
Opcode ID: 08eb499608fb6ca27a79879cc2e31d82174a6a7722ca31d8a5ded37d06d49044
Instruction ID: f02d3b79713e8d81e15a0fda541fde84aa13a8de9f5ea14ec3edbee07005130c
Opcode Fuzzy Hash: 08eb499608fb6ca27a79879cc2e31d82174a6a7722ca31d8a5ded37d06d49044
Instruction Fuzzy Hash: BD41697480D340ABC301BFA5D644A1EFBF1AF56709F048C6DE5C4A7292C339D8189B6B

Function 00445700 Relevance: 1.6, APIs: 1, Instructions: 69
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlReAllocateHeap.NTDLL(?,00000000,?,?), ref: 00445784

Memory Dump Source

Source File: 00000001.00000002.2176103954.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 451ba736794f0e2f30a849843ab83a7da9f20e1e8286aac8e33d1c41455145f3
Instruction ID: c85136016a5953b7558c7414a3c459db971abdd3e4f37367334958bb3d5b1fc4
Opcode Fuzzy Hash: 451ba736794f0e2f30a849843ab83a7da9f20e1e8286aac8e33d1c41455145f3
Instruction Fuzzy Hash: DF119E7191C240EBD711AF28E840A1BBBF5AF86716F05883DE4C49B212D339D811CB9B

Function 00445BB0 Relevance: 1.5, APIs: 1, Instructions: 14
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL(0044973D,005C003F,00000006,?,?,00000018,8C8D8A8B,?,?), ref: 00445BDE

Memory Dump Source

Source File: 00000001.00000002.2176103954.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: b66ff63dfd389af1bc8afcc0025f999e8b2b47508af02e865142dda64173a8e3
Instruction ID: fb6f357373f259be8b0e83fffc5d2a3912a28e0da7d2036ce94b71e982b3a7e9
Opcode Fuzzy Hash: b66ff63dfd389af1bc8afcc0025f999e8b2b47508af02e865142dda64173a8e3
Instruction Fuzzy Hash: 76E0FE75908316AB9A09CF45C14444EFBE5BFC4714F11CC8DA4D867210D3B0AD46DF82

Function 00445DCE Relevance: 3.0, APIs: 2, Instructions: 17
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetForegroundWindow.USER32 ref: 00445DCE
GetForegroundWindow.USER32 ref: 00445DE0

Memory Dump Source

Source File: 00000001.00000002.2176103954.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: 8c61841407d1a4852bfe4b40972173754e0679736d2baf3d56bf65322f3b4ff0
Instruction ID: 1e21c31d78f88c29f1ba1c45ad2c8465459836b227478d43c99d9611323569fd
Opcode Fuzzy Hash: 8c61841407d1a4852bfe4b40972173754e0679736d2baf3d56bf65322f3b4ff0
Instruction Fuzzy Hash: 11D05EE9A023405BEA08AB22FC0E4173615A78626E7040438E80B82312E535E924C64A

Function 00443220 Relevance: 1.6, APIs: 1, Instructions: 59
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL(?,00000000), ref: 004432A6

Memory Dump Source

Source File: 00000001.00000002.2176103954.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 50965382f7edf395daec22a3aa5bcca61c8fe5508095e75f982d05b7b9ec31b6
Instruction ID: 4bd1cfedf901e7341f085caf0d3c231c399316e56ace865125bd700590354386
Opcode Fuzzy Hash: 50965382f7edf395daec22a3aa5bcca61c8fe5508095e75f982d05b7b9ec31b6
Instruction Fuzzy Hash: 4B016D3450D3409BD701EF18E845A1ABBE8EF4AB02F054D6CE5C58B362D339DD60CB96

Function 00443202 Relevance: 1.5, APIs: 1, Instructions: 6
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(?,00000000), ref: 00443208

Memory Dump Source

Source File: 00000001.00000002.2176103954.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: f4e883208b5af43432b1f7820fa52118579d54aaadfbe7b6ea97085ba09a0524
Instruction ID: d989c2ef34d315249fff67303ad5b66d5fc7957262475763486a37997b8dd8e1
Opcode Fuzzy Hash: f4e883208b5af43432b1f7820fa52118579d54aaadfbe7b6ea97085ba09a0524
Instruction Fuzzy Hash: CCB012304401005FDA141B00EC0AF003510EF00606F800070A100040B2D1619864C559

Non-executed Functions

Function 00429510 Relevance: 30.2, APIs: 1, Strings: 16, Instructions: 426COMMON

Download Yara Rule

Strings

?M0K, xrefs: 00429968
z=Q?, xrefs: 00429826
,A&C, xrefs: 0042982E
B?Q9, xrefs: 00429B0B
G'M!, xrefs: 00429ADB
T#a-, xrefs: 00429AE3
!E4G, xrefs: 00429836
2A"_, xrefs: 00429980
L3Y=, xrefs: 00429B03
O+f), xrefs: 00429634, 0042963D
B7U1, xrefs: 00429AFB
X/R), xrefs: 00429AEB
8;, xrefs: 00429B13
G+X5, xrefs: 00429AF3
pq, xrefs: 004299E0
;IJK, xrefs: 0042983E

Memory Dump Source

Source File: 00000001.00000002.2176103954.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID:
String ID: !E4G$,A&C$2A"_$8;$;IJK$?M0K$B7U1$B?Q9$G'M!$G+X5$L3Y=$O+f)$T#a-$X/R)$pq$z=Q?
API String ID: 0-655414846
Opcode ID: 821277b00644bb46f69b775215d578a60cf2f50154e1c4f07745e3abcf78f76a
Instruction ID: 614779ad590eebcf7b8fe37e51d599c86efeb38568f1612107a067b093dacd9a
Opcode Fuzzy Hash: 821277b00644bb46f69b775215d578a60cf2f50154e1c4f07745e3abcf78f76a
Instruction Fuzzy Hash: 56F130B4608380ABD310DF15E881A2BBBF4FB86748F944D1DF4D59B252D378D908CB9A

Function 00438720 Relevance: 22.9, APIs: 6, Strings: 7, Instructions: 115clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00438738
GetWindowLongW.USER32 ref: 00438763
GetClipboardData.USER32 ref: 00438773
CloseClipboard.USER32 ref: 00438880

Strings

=, xrefs: 004387CD
6, xrefs: 004387D5
?, xrefs: 004387C9
8, xrefs: 004387E5
6, xrefs: 004387D9
9, xrefs: 004387D1
9, xrefs: 004387DD

Memory Dump Source

Source File: 00000001.00000002.2176103954.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Clipboard$CloseDataLongOpenWindow
String ID: 6$6$8$9$9$=$?
API String ID: 1647500905-2499364611
Opcode ID: 7c9163cd6bc49d62cda3546406a8a3a59e414d7ee2d25f2b6b977c001a77ad7b
Instruction ID: c6cecdc6b357f73a091e8619202f080a94ed584840656985310604660298186b
Opcode Fuzzy Hash: 7c9163cd6bc49d62cda3546406a8a3a59e414d7ee2d25f2b6b977c001a77ad7b
Instruction Fuzzy Hash: F741B170C08385CFDB01AFB8D5893AEBFB0AB5A314F14092EE485A7381D7794949C76B

Function 0043F620 Relevance: 19.7, APIs: 9, Strings: 2, Instructions: 452memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32 ref: 0043F67C
SysAllocString.OLEAUT32 ref: 0043F73C
VariantInit.OLEAUT32(00000000), ref: 0043F7BB
SysStringLen.OLEAUT32(?), ref: 0043F86B

Strings

dg, xrefs: 0043F7F5
hi, xrefs: 0043F6E6

Memory Dump Source

Source File: 00000001.00000002.2176103954.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: String$Alloc$InitVariant
String ID: dg$hi
API String ID: 3520221836-2859417413
Opcode ID: a29f64484bac79c51184cc7e0d437789df3d7f91ec00fbc448bf7e6117096322
Instruction ID: 76cd35575ce81f92284fb50bd1b390108f3350da4718470232658bad10f85c67
Opcode Fuzzy Hash: a29f64484bac79c51184cc7e0d437789df3d7f91ec00fbc448bf7e6117096322
Instruction Fuzzy Hash: E9F18776608301EFE704CF24D881B2ABBF5FB8A355F14992EF485872A1C738D845CB1A

Function 004390EE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 82COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32 ref: 00439124
GetSystemMetrics.USER32 ref: 00439133

Strings

, xrefs: 004391DE

Memory Dump Source

Source File: 00000001.00000002.2176103954.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: MetricsSystem
String ID:
API String ID: 4116985748-3916222277
Opcode ID: ab5555a52b31076e5eeb6519deaae68eca3c41e93bfc72b6c9b35e59f4d21b4a
Instruction ID: 7f7dffd27c621b542e95bdab6b7ee4d7f31120e949507c5ac4fca7aa65185fb2
Opcode Fuzzy Hash: ab5555a52b31076e5eeb6519deaae68eca3c41e93bfc72b6c9b35e59f4d21b4a
Instruction Fuzzy Hash: 6C3160B49183048FDB00EF6CDA8565EBBF4BF89704F11492DE498DB360D775A948CB86

Function 00438220 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2176103954.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bdc841d7a406348b8f463a63eb878eabe2c962c804589a40256072bab34e7f2b
Instruction ID: 5feb4677dc7f436114534582e8c0716e72c97c069455e78d6c85f3d503c4cf0a
Opcode Fuzzy Hash: bdc841d7a406348b8f463a63eb878eabe2c962c804589a40256072bab34e7f2b
Instruction Fuzzy Hash: 4501E4B44107009FD360EF29C485747BBE8EB08714F008A1DE8AECB680D774A5448B82

Function 00439843 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 109COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32 ref: 00439891
GetSystemMetrics.USER32 ref: 004398A0

Strings

, xrefs: 00439974

Memory Dump Source

Source File: 00000001.00000002.2176103954.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: MetricsSystem
String ID:
API String ID: 4116985748-3916222277
Opcode ID: c81f12191cba6e53c0562e90626fcbcb1d354553d74947de8f13948612130a55
Instruction ID: eb4df33fe1d6a66542a4d5aad425eba8fef39bce69b1d50955d9d3d9aaf60553
Opcode Fuzzy Hash: c81f12191cba6e53c0562e90626fcbcb1d354553d74947de8f13948612130a55
Instruction Fuzzy Hash: 3B516DB4E142188FDB40EFACD985A9EBBF0BB48310F018529E898E7350D734A944CF96

Function 0040F1FB Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 88COMMON

Download Yara Rule

APIs

ShellExecuteW.SHELL32(00000000,57A649BB,0044D58A,832F8123,00000000,00000005), ref: 0040F32F

Strings

PQ, xrefs: 0040F2BF
8@-, xrefs: 0040F33A

Memory Dump Source

Source File: 00000001.00000002.2176103954.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: ExecuteShell
String ID: 8@-$PQ
API String ID: 587946157-876866189
Opcode ID: 1a0b4a114143d5ca3374a3cd52da601592b1729854c1c1369e379120faed14fe
Instruction ID: 32a7b61192442560c6f92bb2f4be214f77c1956f3597500a90fccf8073e86402
Opcode Fuzzy Hash: 1a0b4a114143d5ca3374a3cd52da601592b1729854c1c1369e379120faed14fe
Instruction Fuzzy Hash: 5F312878A012689FDB208F94DD45BDEBB71BF46301F1408E9E689AA281C7B54E848F56

Function 00435551 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 0043555A
VariantInit.OLEAUT32 ref: 00435566

Strings

2, xrefs: 004355B5

Memory Dump Source

Source File: 00000001.00000002.2176103954.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Variant$ClearInit
String ID: 2
API String ID: 2610073882-450215437
Opcode ID: 9656e49463a1eac2a2e27d608098374d928559fc5e9cd49b246a20351250d731
Instruction ID: 1309dba7e2d53283adf9958502b19f3f730abdb88899d5b7c892982ad23b04e6
Opcode Fuzzy Hash: 9656e49463a1eac2a2e27d608098374d928559fc5e9cd49b246a20351250d731
Instruction Fuzzy Hash: 6341D370108BC1CED722DF2CC494646BFA0AB56324F188A9CD8EA4F3DAC775E505CB62

Function 00435A84 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 81COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 00435AA6
VariantInit.OLEAUT32 ref: 00435AB2

Strings

2, xrefs: 00435B01

Memory Dump Source

Source File: 00000001.00000002.2176103954.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Variant$ClearInit
String ID: 2
API String ID: 2610073882-450215437
Opcode ID: b9a854552b158eee2be1d84dc97acde07f31a6659becb1d60da7bb16dc3eeda4
Instruction ID: 10a0ad4f487e5ee891bf26f48cdc5f2681f831964d1233476b22d4ecaaddf2d0
Opcode Fuzzy Hash: b9a854552b158eee2be1d84dc97acde07f31a6659becb1d60da7bb16dc3eeda4
Instruction Fuzzy Hash: B141C570108BC18ED725CF2CC494656BFE0AB5A324F18868DE8EA8F3D6C775D506DB62

Function 00435A99 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 00435AA6
VariantInit.OLEAUT32 ref: 00435AB2

Strings

2, xrefs: 00435B01

Memory Dump Source

Source File: 00000001.00000002.2176103954.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Variant$ClearInit
String ID: 2
API String ID: 2610073882-450215437
Opcode ID: fb5371bdd09d0e906117c41cc88a3a5b350ebddee64f3fa9cb34d119133aa536
Instruction ID: e960a9e32f486725a985871b83e160e2d060c1978967536bf2cf05e5ffba8ce9
Opcode Fuzzy Hash: fb5371bdd09d0e906117c41cc88a3a5b350ebddee64f3fa9cb34d119133aa536
Instruction Fuzzy Hash: A831C320008BC18EDB229F3C8488646BFA05F27224F1887DDD8EA4F3DBC365D506DB66

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_SecuriteInfo.com_335a9b229b3b25918e3672cc8075151943f39_433d2070_d8b19c67-20a4-4e5a-8f2c-6bed9af31788\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1F4E.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1F9D.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1FCD.tmp.xml

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Windows Analysis Report
SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe

Function 00EF2021 Relevance: 9.4, APIs: 1, Strings: 4, Instructions: 631
memoryCOMMON

Function 00F06368 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34
COMMONLIBRARYCODE

Function 00F08E2E Relevance: 4.7, APIs: 3, Instructions: 202
COMMON

Function 00F0A3A6 Relevance: 3.2, APIs: 2, Instructions: 177
COMMON

Function 00F09FAA Relevance: 1.6, APIs: 1, Instructions: 147
COMMON