Edit tour

Windows Analysis Report
9Y6R8fs0wd.exe

Overview

General Information

Sample name:	9Y6R8fs0wd.exe renamed because original name is a hash value
Original sample name:	d4819198f83d952086f5fdacd752c40b.exe
Analysis ID:	1528491
MD5:	d4819198f83d952086f5fdacd752c40b
SHA1:	5c9531c3ab6cdbf87687dc9a216b9ca92a693f0b
SHA256:	d4c6cfd25d667b7371d702fddfb961a15bddaef0974b7bc75bc061bd6e7de0c1
Tags:	32exetrojan
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Injects a PE file into a foreign processes

LummaC encrypted strings found

Machine Learning detection for sample

Sample uses string decryption to hide its real strings

Sigma detected: Silenttrinity Stager Msbuild Activity

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Checks if the current process is being debugged

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

9Y6R8fs0wd.exe (PID: 1560 cmdline: "C:\Users\user\Desktop\9Y6R8fs0wd.exe" MD5: D4819198F83D952086F5FDACD752C40B)

MSBuild.exe (PID: 6352 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

WerFault.exe (PID: 5168 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 1560 -s 268 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["dissapoiznw.stor", "bathdoomgaz.stor", "eaglepawnoy.stor", "mobbipenju.stor", "studennotediw.stor", "spirittunek.stor", "clearancek.site", "licendfilteo.site", "trustterwowqm.shop"], "Build id": "tLYMe5--deli333"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Sigma Signatures

System Summary

Sigma detected: Silenttrinity Stager Msbuild Activity

Source: Network Connection

Author: Kiran kumar s, oscd.community: Data: DestinationIp: 104.102.49.254, DestinationIsIpv6: false, DestinationPort: 443, EventID: 3, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, Initiated: true, ProcessId: 6352, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49704

Suricata Signatures

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T00:16:55.369508+0200	2054653	1	A Network Trojan was detected	192.168.2.5	49706	172.67.206.204	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T00:16:55.369508+0200	2049836	1	A Network Trojan was detected	192.168.2.5	49706	172.67.206.204	443	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T00:16:52.396137+0200	2056477	1	Domain Observed Used for C2 Detected	192.168.2.5	60085	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T00:16:52.521696+0200	2056471	1	Domain Observed Used for C2 Detected	192.168.2.5	54943	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T00:16:52.368127+0200	2056481	1	Domain Observed Used for C2 Detected	192.168.2.5	53891	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T00:16:52.355399+0200	2056483	1	Domain Observed Used for C2 Detected	192.168.2.5	61742	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T00:16:52.509295+0200	2056473	1	Domain Observed Used for C2 Detected	192.168.2.5	57528	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T00:16:52.333187+0200	2056485	1	Domain Observed Used for C2 Detected	192.168.2.5	58219	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T00:16:52.417701+0200	2056475	1	Domain Observed Used for C2 Detected	192.168.2.5	63337	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T00:16:52.382380+0200	2056479	1	Domain Observed Used for C2 Detected	192.168.2.5	52368	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (trustterwowqm .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T00:16:52.311943+0200	2056174	1	Domain Observed Used for C2 Detected	192.168.2.5	51645	1.1.1.1	53	UDP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: 9Y6R8fs0wd.exe

Avira: detected

Antivirus detection for URL or domain

Source: https://steamcommunity.com/profiles/76561199724331900	URL Reputation: Label: malware
Source: https://steamcommunity.com/profiles/76561199724331900/inventory/	URL Reputation: Label: malware
Source: https://steamcommunity.com/profiles/76561199724331900/badges	URL Reputation: Label: malware

Found malware configuration

Source: 0.2.9Y6R8fs0wd.exe.700000.0.unpack

Malware Configuration Extractor: LummaC {"C2 url": ["dissapoiznw.stor", "bathdoomgaz.stor", "eaglepawnoy.stor", "mobbipenju.stor", "studennotediw.stor", "spirittunek.stor", "clearancek.site", "licendfilteo.site", "trustterwowqm.shop"], "Build id": "tLYMe5--deli333"}

Multi AV Scanner detection for submitted file

Source: 9Y6R8fs0wd.exe

ReversingLabs: Detection: 34%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: 9Y6R8fs0wd.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000001.00000002.2095756245.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: clearancek.site
Source: 00000001.00000002.2095756245.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: licendfilteo.site
Source: 00000001.00000002.2095756245.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: spirittunek.stor
Source: 00000001.00000002.2095756245.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: bathdoomgaz.stor
Source: 00000001.00000002.2095756245.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: studennotediw.stor
Source: 00000001.00000002.2095756245.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: dissapoiznw.stor
Source: 00000001.00000002.2095756245.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: eaglepawnoy.stor
Source: 00000001.00000002.2095756245.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: mobbipenju.stor
Source: 00000001.00000002.2095756245.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: trustterwowqm.shop
Source: 00000001.00000002.2095756245.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000001.00000002.2095756245.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000001.00000002.2095756245.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: - Screen Resoluton:
Source: 00000001.00000002.2095756245.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000001.00000002.2095756245.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: Workgroup: -
Source: 00000001.00000002.2095756245.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: tLYMe5--deli333

Source: 9Y6R8fs0wd.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.5:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:49979 version: TLS 1.2

Source: 9Y6R8fs0wd.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe

Code function: 0_2_00719ABF FindFirstFileExW,

0_2_00719ABF

Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Code function: 4x nop then jmp ecx	0_2_0077604C
Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00776140
Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Code function: 4x nop then mov eax, dword ptr [esp+08h]	0_2_0075C198
Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Code function: 4x nop then mov word ptr [esi], ax	0_2_00758278
Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_0073A268
Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Code function: 4x nop then mov eax, dword ptr [esp+08h]	0_2_0075C224
Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	0_2_0075E2E8
Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F3285E74h	0_2_007722A8
Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Code function: 4x nop then jmp eax	0_2_00776343
Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Code function: 4x nop then mov eax, dword ptr [ebp-10h]	0_2_0073E3F3
Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Code function: 4x nop then mov edx, dword ptr [esp]	0_2_0072E3F7
Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Code function: 4x nop then cmp word ptr [eax+esi+02h], 0000h	0_2_0075C3AC
Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Code function: 4x nop then mov eax, dword ptr [esp+40h]	0_2_0075E388
Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], C85F7986h	0_2_0075A438
Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], C85F7986h	0_2_0075A438
Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Code function: 4x nop then cmp byte ptr [esi], 00000000h	0_2_00756410
Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Code function: 4x nop then mov word ptr [ebx], ax	0_2_0075C568
Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Code function: 4x nop then push 00000000h	0_2_007305B8
Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Code function: 4x nop then mov eax, edi	0_2_007566E6
Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Code function: 4x nop then mov eax, dword ptr [esi+0Ch]	0_2_0076074E
Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Code function: 4x nop then cmp byte ptr [edi], 00000000h	0_2_00742702
Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 7789B0CBh	0_2_007747F8
Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Code function: 4x nop then cmp byte ptr [esi+01h], 00000000h	0_2_0073C81B
Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Code function: 4x nop then mov dword ptr [esp], 00000000h	0_2_00748948
Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Code function: 4x nop then movzx edx, byte ptr [ecx+eax]	0_2_0073C938
Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Code function: 4x nop then movzx ecx, word ptr [edi+eax]	0_2_007749F8
Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Code function: 4x nop then mov byte ptr [ecx], al	0_2_00760AD4
Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Code function: 4x nop then mov byte ptr [ebx], al	0_2_00760AD4
Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Code function: 4x nop then mov byte ptr [ebx], al	0_2_00760AD4
Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	0_2_00768B78
Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Code function: 4x nop then movzx edx, byte ptr [esi+ebx]	0_2_00732B08
Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Code function: 4x nop then lea eax, dword ptr [edi+04h]	0_2_0075ABBB
Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Code function: 4x nop then mov byte ptr [ebx], al	0_2_0074CB98
Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Code function: 4x nop then mov eax, dword ptr [esp+0Ch]	0_2_00776B98
Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 53F09CFAh	0_2_00776B98
Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Code function: 4x nop then movzx eax, word ptr [esi+ecx]	0_2_0076EC08
Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00770C08
Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Code function: 4x nop then push ebx	0_2_00742D4B
Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Code function: 4x nop then mov eax, dword ptr [esp+0Ch]	0_2_00776D28
Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 53F09CFAh	0_2_00776D28
Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Code function: 4x nop then cmp word ptr [ecx+edx+02h], 0000h	0_2_00776EA8
Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Code function: 4x nop then cmp dword ptr [ebp+edx*8+00h], 9ECF05EBh	0_2_00776EA8
Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Code function: 4x nop then mov word ptr [ebx], ax	0_2_0074EF70
Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Code function: 4x nop then mov word ptr [eax], dx	0_2_0074AF2D
Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00776FD8
Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 62429966h	0_2_00771048
Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_0075B175
Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Code function: 4x nop then cmp word ptr [ebp+edi+02h], 0000h	0_2_00755108
Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], F3285E74h	0_2_00775288
Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_00755368
Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Code function: 4x nop then mov byte ptr [ecx], al	0_2_00761327
Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Code function: 4x nop then mov byte ptr [ebx], al	0_2_00761327
Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Code function: 4x nop then mov byte ptr [ebx], al	0_2_00761327
Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Code function: 4x nop then jmp ecx	0_2_0074338E
Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Code function: 4x nop then mov eax, dword ptr [esi+0Ch]	0_2_0076143A
Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Code function: 4x nop then mov byte ptr [ecx], al	0_2_0076143A
Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_007774F8
Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Code function: 4x nop then inc edi	0_2_007434A4
Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Code function: 4x nop then jmp eax	0_2_0074165F
Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 27BAF212h	0_2_00773642
Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 27BAF212h	0_2_007736EE
Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Code function: 4x nop then push esi	0_2_0075D75B
Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F3285E74h	0_2_00771798
Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], C274D4CAh	0_2_007738E2
Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Code function: 4x nop then mov byte ptr [edi], al	0_2_007618D8
Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Code function: 4x nop then mov eax, dword ptr [esi+40h]	0_2_00741920
Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Code function: 4x nop then movzx edx, byte ptr [esi+edi]	0_2_00731A58
Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Code function: 4x nop then mov eax, dword ptr [esp+000000C0h]	0_2_0073FA44
Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00773A08
Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Code function: 4x nop then mov word ptr [eax], dx	0_2_0074FAE2
Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Code function: 4x nop then movzx ebx, byte ptr [ecx+esi]	0_2_00739AE8
Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Code function: 4x nop then mov eax, dword ptr [ebp-18h]	0_2_0073BB58
Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Code function: 4x nop then mov byte ptr [esi+edx], bl	0_2_00739BF8
Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Code function: 4x nop then mov eax, dword ptr [esp+000001C0h]	0_2_0073FCD4
Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	0_2_0073BCB9
Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Code function: 4x nop then mov dword ptr [esp+2Ch], ebp	0_2_00775EE8
Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Code function: 4x nop then cmp byte ptr [eax+01h], 00000000h	0_2_00755EC3
Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Code function: 4x nop then movzx ebx, byte ptr [eax+esi]	0_2_00773F68
Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Code function: 4x nop then mov eax, dword ptr [esi+0Ch]	0_2_00761FF9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp]	1_2_0040D390
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 27BAF212h	1_2_0044676A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], C274D4CAh	1_2_00446A0A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx ebx, byte ptr [eax+esi]	1_2_00447082
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 62429966h	1_2_00444170
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp]	1_2_0044A100
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esi+0Ch]	1_2_00435121
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp]	1_2_004491F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp eax	1_2_004491F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp word ptr [ebp+edi+02h], 0000h	1_2_00428230
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp+08h]	1_2_0042F2C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F3285E74h	1_2_004453D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov word ptr [esi], ax	1_2_0042B3A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], F3285E74h	1_2_004483B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp+08h]	1_2_0042F46A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	1_2_00431410
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp word ptr [eax+esi+02h], 0000h	1_2_0042F4D4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov word ptr [eax], cx	1_2_00428490
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp+40h]	1_2_004314B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], C85F7986h	1_2_0042D560
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], C85F7986h	1_2_0042D560
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esi+0Ch]	1_2_0043456A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov byte ptr [ecx], al	1_2_0043456A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [ebp-10h]	1_2_0041151B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then inc edi	1_2_004165CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp]	1_2_0044A620
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp eax	1_2_0041463D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esi+40h]	1_2_0041463D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then push 00000000h	1_2_004036E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov word ptr [ebx], ax	1_2_0042F690
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esi+0Ch]	1_2_0043387B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 27BAF212h	1_2_00446816
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp byte ptr [edi], 00000000h	1_2_0041582B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F3285E74h	1_2_004448C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then push esi	1_2_00430883
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp byte ptr [esi+01h], 00000000h	1_2_0040F943
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 7789B0CBh	1_2_00447920
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov word ptr [eax], cx	1_2_0042D9A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx edx, byte ptr [ecx+eax]	1_2_0040FA60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov dword ptr [esp], 00000000h	1_2_0041BA70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov byte ptr [edi], al	1_2_00434A00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then lea eax, dword ptr [edi+04h]	1_2_0042DB64
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp+000000C0h]	1_2_00412B6C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov word ptr [ebx], ax	1_2_00421B20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx ecx, word ptr [edi+eax]	1_2_00447B20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp]	1_2_00446B30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov byte ptr [ecx], al	1_2_00433BD3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov byte ptr [ebx], al	1_2_00433BD3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov byte ptr [ebx], al	1_2_00433BD3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov word ptr [eax], dx	1_2_00422BEF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx edx, byte ptr [esi+edi]	1_2_00404B80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx ebx, byte ptr [ecx+esi]	1_2_0040CC10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx edx, byte ptr [esi+ebx]	1_2_00405C30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov byte ptr [ebx], al	1_2_0041FCC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp+0Ch]	1_2_00449CC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 53F09CFAh	1_2_00449CC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [ebp-18h]	1_2_0040EC80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov byte ptr [ebx], al	1_2_00434C90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov byte ptr [ebx], al	1_2_00434C90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	1_2_0043BCA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov byte ptr [esi+edx], bl	1_2_0040CD20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp]	1_2_00443D30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx eax, word ptr [esi+ecx]	1_2_00441D30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	1_2_0040EDE1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp ecx	1_2_00448DE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp]	1_2_00448DE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp eax	1_2_00448DE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp+000001C0h]	1_2_00412DFC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov word ptr [eax], dx	1_2_0041DD90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp+0Ch]	1_2_00449E50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 53F09CFAh	1_2_00449E50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov dword ptr [esp+2Ch], ebp	1_2_00448ED0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp ecx	1_2_00448ED0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp]	1_2_00448ED0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp eax	1_2_00448ED0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp word ptr [ecx+edx+02h], 0000h	1_2_00449FD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [ebp+edx*8+00h], 9ECF05EBh	1_2_00449FD0

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2056483 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store) : 192.168.2.5:61742 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056475 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store) : 192.168.2.5:63337 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056473 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site) : 192.168.2.5:57528 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056477 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store) : 192.168.2.5:60085 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056481 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store) : 192.168.2.5:53891 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056174 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (trustterwowqm .shop) : 192.168.2.5:51645 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056479 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store) : 192.168.2.5:52368 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056471 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site) : 192.168.2.5:54943 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056485 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store) : 192.168.2.5:58219 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:49706 -> 172.67.206.204:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49706 -> 172.67.206.204:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: dissapoiznw.stor
Source: Malware configuration extractor	URLs: bathdoomgaz.stor
Source: Malware configuration extractor	URLs: eaglepawnoy.stor
Source: Malware configuration extractor	URLs: mobbipenju.stor
Source: Malware configuration extractor	URLs: studennotediw.stor
Source: Malware configuration extractor	URLs: spirittunek.stor
Source: Malware configuration extractor	URLs: clearancek.site
Source: Malware configuration extractor	URLs: licendfilteo.site
Source: Malware configuration extractor	URLs: trustterwowqm.shop

Source: Joe Sandbox View	IP Address: 104.102.49.254 104.102.49.254
Source: Joe Sandbox View	IP Address: 172.67.206.204 172.67.206.204

Source: Joe Sandbox View	ASN Name: AKAMAI-ASUS AKAMAI-ASUS
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: sergei-esenin.com

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com

Source: MSBuild.exe, 00000001.00000002.2096055558.00000000012E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: :27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://www.youtube.com https://www.google.com https://sk equals www.youtube.com (Youtube)
Source: MSBuild.exe, 00000001.00000002.2096055558.00000000012E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ww.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.comT+ equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: trustterwowqm.shop
Source: global traffic	DNS traffic detected: DNS query: mobbipenju.store
Source: global traffic	DNS traffic detected: DNS query: eaglepawnoy.store
Source: global traffic	DNS traffic detected: DNS query: dissapoiznw.store
Source: global traffic	DNS traffic detected: DNS query: studennotediw.store
Source: global traffic	DNS traffic detected: DNS query: bathdoomgaz.store
Source: global traffic	DNS traffic detected: DNS query: spirittunek.store
Source: global traffic	DNS traffic detected: DNS query: licendfilteo.site
Source: global traffic	DNS traffic detected: DNS query: clearancek.site
Source: global traffic	DNS traffic detected: DNS query: steamcommunity.com
Source: global traffic	DNS traffic detected: DNS query: sergei-esenin.com

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: sergei-esenin.com

Source: MSBuild.exe, 00000001.00000002.2096055558.00000000012E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:27060
Source: MSBuild.exe, 00000001.00000002.2096156579.000000000133F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
Source: MSBuild.exe, 00000001.00000002.2096156579.000000000133F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/privacy_agreement/
Source: MSBuild.exe, 00000001.00000002.2096156579.000000000133F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/subscriber_agreement/
Source: Amcache.hve.5.dr	String found in binary or memory: http://upx.sf.net
Source: MSBuild.exe, 00000001.00000002.2096055558.00000000012E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.steampowered.com/
Source: MSBuild.exe, 00000001.00000002.2096055558.00000000012DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg
Source: MSBuild.exe, 00000001.00000002.2096055558.00000000012E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://broadcast.st.dl.eccdnx.com
Source: MSBuild.exe, 00000001.00000002.2096055558.00000000012E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/
Source: MSBuild.exe, 00000001.00000002.2095943216.00000000012AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://clearancek.site/api
Source: MSBuild.exe, 00000001.00000002.2096156579.000000000133F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
Source: MSBuild.exe, 00000001.00000002.2096055558.00000000012E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.comT
Source: MSBuild.exe, 00000001.00000002.2096055558.00000000012E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/
Source: MSBuild.exe, 00000001.00000002.2095943216.00000000012AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://licendfilteo.site/api
Source: MSBuild.exe, 00000001.00000002.2096055558.00000000012E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.steampowered.com/
Source: MSBuild.exe, 00000001.00000002.2096055558.00000000012E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lv.queniujq.cn
Source: MSBuild.exe, 00000001.00000002.2096055558.00000000012E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://medal.tv
Source: MSBuild.exe, 00000001.00000002.2096055558.00000000012E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://player.vimeo.com
Source: MSBuild.exe, 00000001.00000002.2096055558.00000000012E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net
Source: MSBuild.exe, 00000001.00000002.2096055558.00000000012E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net/recaptcha/;
Source: MSBuild.exe, 00000001.00000002.2096055558.00000000012E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s.ytimg.com;
Source: MSBuild.exe, 00000001.00000002.2096055558.00000000012E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/
Source: MSBuild.exe, 00000001.00000002.2096055558.00000000012E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/api
Source: MSBuild.exe, 00000001.00000002.2096055558.00000000012E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/apil
Source: MSBuild.exe, 00000001.00000002.2096055558.00000000012E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/teambr
Source: MSBuild.exe, 00000001.00000002.2095943216.00000000012AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://spirittunek.st
Source: MSBuild.exe, 00000001.00000002.2096055558.00000000012E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast-test.akamaized.net
Source: MSBuild.exe, 00000001.00000002.2096055558.00000000012E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcastchat.akamaized.net
Source: MSBuild.exe, 00000001.00000002.2095943216.00000000012AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/
Source: MSBuild.exe, 00000001.00000002.2095943216.00000000012C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/)C
Source: MSBuild.exe, 00000001.00000002.2096156579.000000000133F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
Source: MSBuild.exe, 00000001.00000002.2095943216.00000000012C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900
Source: MSBuild.exe, 00000001.00000002.2096055558.00000000012DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/badges
Source: MSBuild.exe, 00000001.00000002.2095943216.00000000012CF000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2096156579.000000000133F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/inventory/
Source: MSBuild.exe, 00000001.00000002.2096055558.00000000012E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/
Source: MSBuild.exe, 00000001.00000002.2096055558.00000000012E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;
Source: MSBuild.exe, 00000001.00000002.2096055558.00000000012E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;Persistent-Aut
Source: MSBuild.exe, 00000001.00000002.2096156579.000000000133F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/legal/
Source: MSBuild.exe, 00000001.00000002.2096055558.00000000012E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: MSBuild.exe, 00000001.00000002.2096055558.00000000012E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/recaptcha/
Source: MSBuild.exe, 00000001.00000002.2096055558.00000000012E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/recaptcha/
Source: MSBuild.exe, 00000001.00000002.2096055558.00000000012E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com
Source: MSBuild.exe, 00000001.00000002.2096055558.00000000012E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49947 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49969 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49942
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49940
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49939
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49938
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49937
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49936
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49935
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49934
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49933
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49932
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49931
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49930
Source: unknown	Network traffic detected: HTTP traffic on port 49925 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49971 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49936 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49960 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49929
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49928
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49927
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49926
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49925
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49924
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49923
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49922
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800

Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.5:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:49979 version: TLS 1.2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 1_2_004396A0 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

1_2_004396A0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 1_2_004396A0 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

1_2_004396A0

Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Code function: 0_2_00702021	0_2_00702021
Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Code function: 0_2_00766078	0_2_00766078
Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Code function: 0_2_0075A059	0_2_0075A059
Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Code function: 0_2_0072E175	0_2_0072E175
Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Code function: 0_2_00734278	0_2_00734278
Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Code function: 0_2_00732268	0_2_00732268
Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Code function: 0_2_0072E212	0_2_0072E212
Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Code function: 0_2_0072E2D5	0_2_0072E2D5
Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Code function: 0_2_00766378	0_2_00766378
Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Code function: 0_2_00732302	0_2_00732302
Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Code function: 0_2_0075A438	0_2_0075A438
Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Code function: 0_2_00738428	0_2_00738428
Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Code function: 0_2_007305B8	0_2_007305B8
Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Code function: 0_2_0073E768	0_2_0073E768
Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Code function: 0_2_00764858	0_2_00764858
Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Code function: 0_2_0070CAF2	0_2_0070CAF2
Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Code function: 0_2_00764A88	0_2_00764A88
Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Code function: 0_2_0074CB98	0_2_0074CB98
Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Code function: 0_2_00734C78	0_2_00734C78
Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Code function: 0_2_00736C29	0_2_00736C29
Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Code function: 0_2_00774DA8	0_2_00774DA8
Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Code function: 0_2_00738F38	0_2_00738F38
Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Code function: 0_2_0073F058	0_2_0073F058
Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Code function: 0_2_0073B2D8	0_2_0073B2D8
Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Code function: 0_2_0070729C	0_2_0070729C
Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Code function: 0_2_00775288	0_2_00775288
Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Code function: 0_2_00737338	0_2_00737338
Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Code function: 0_2_0071D39B	0_2_0071D39B
Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Code function: 0_2_0076D598	0_2_0076D598
Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Code function: 0_2_00735618	0_2_00735618
Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Code function: 0_2_0071572C	0_2_0071572C
Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Code function: 0_2_00771798	0_2_00771798
Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Code function: 0_2_00737908	0_2_00737908
Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Code function: 0_2_00751908	0_2_00751908
Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Code function: 0_2_0075BADA	0_2_0075BADA
Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Code function: 0_2_0071BB36	0_2_0071BB36
Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Code function: 0_2_0076BCB8	0_2_0076BCB8
Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Code function: 0_2_00713C92	0_2_00713C92
Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Code function: 0_2_00701D79	0_2_00701D79
Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Code function: 0_2_0070FEF0	0_2_0070FEF0
Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Code function: 0_2_0072DED8	0_2_0072DED8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0040FFE0	1_2_0040FFE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0040C060	1_2_0040C060
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00447082	1_2_00447082
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00409110	1_2_00409110
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_004491F0	1_2_004491F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00412180	1_2_00412180
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0042D181	1_2_0042D181
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_004391A0	1_2_004391A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00405340	1_2_00405340
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0042D181	1_2_0042D181
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_004073A0	1_2_004073A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_004483B0	1_2_004483B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0040A460	1_2_0040A460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0040E400	1_2_0040E400
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_004394A0	1_2_004394A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0040B550	1_2_0040B550
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0042D560	1_2_0042D560
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_004305E0	1_2_004305E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_004406C0	1_2_004406C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_004036E0	1_2_004036E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0042B69D	1_2_0042B69D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00408740	1_2_00408740
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_004448C0	1_2_004448C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_004298E2	1_2_004298E2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00411890	1_2_00411890
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0042E977	1_2_0042E977
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00409903	1_2_00409903
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_004489D7	1_2_004489D7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00437980	1_2_00437980
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0042D9A0	1_2_0042D9A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0042FA20	1_2_0042FA20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0040AA30	1_2_0040AA30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00424A30	1_2_00424A30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0042CAF0	1_2_0042CAF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00406B60	1_2_00406B60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0042DB64	1_2_0042DB64
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00448B00	1_2_00448B00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00409B1C	1_2_00409B1C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00437BB0	1_2_00437BB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0042EC02	1_2_0042EC02
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0041FCC0	1_2_0041FCC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0043EDE0	1_2_0043EDE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00448DE0	1_2_00448DE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00407DA0	1_2_00407DA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00432E33	1_2_00432E33
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00448ED0	1_2_00448ED0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00447ED0	1_2_00447ED0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 0040CB10 appears 45 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 0041D970 appears 155 times
Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Code function: String function: 0074A848 appears 155 times
Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Code function: String function: 00707B80 appears 49 times
Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Code function: String function: 007399E8 appears 96 times

Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 1560 -s 268

Source: 9Y6R8fs0wd.exe, 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameproquota.exej% vs 9Y6R8fs0wd.exe
Source: 9Y6R8fs0wd.exe	Binary or memory string: OriginalFilenameproquota.exej% vs 9Y6R8fs0wd.exe

Source: 9Y6R8fs0wd.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 9Y6R8fs0wd.exe

Static PE information: Section: .data ZLIB complexity 0.9911179315476191

Source: classification engine

Classification label: mal100.troj.evad.winEXE@4/5@11/2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 1_2_00428230 CoCreateInstance,

1_2_00428230

Source: C:\Windows\SysWOW64\WerFault.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess1560

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\032b00c4-1bf4-4323-b39b-be1246883189

Jump to behavior

Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Command line argument: MZx	0_2_00702021
Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Command line argument: MZx	0_2_00702021
Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Command line argument: MZx	0_2_00702021

Source: 9Y6R8fs0wd.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 9Y6R8fs0wd.exe

ReversingLabs: Detection: 34%

Source: unknown	Process created: C:\Users\user\Desktop\9Y6R8fs0wd.exe "C:\Users\user\Desktop\9Y6R8fs0wd.exe"
Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 1560 -s 268
Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior

Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dpapi.dll	Jump to behavior

Source: 9Y6R8fs0wd.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: 9Y6R8fs0wd.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: 9Y6R8fs0wd.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: 9Y6R8fs0wd.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: 9Y6R8fs0wd.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: 9Y6R8fs0wd.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: 9Y6R8fs0wd.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: 9Y6R8fs0wd.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: 9Y6R8fs0wd.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: 9Y6R8fs0wd.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: 9Y6R8fs0wd.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: 9Y6R8fs0wd.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: 9Y6R8fs0wd.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Code function: 0_2_00742722 push eax; retf	0_2_00742727
Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Code function: 0_2_007071AD push ecx; ret	0_2_007071C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0041584A push eax; retf	1_2_0041584F

Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe

API coverage: 4.2 %

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5572

Thread sleep time: -30000s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe

Code function: 0_2_00719ABF FindFirstFileExW,

0_2_00719ABF

Source: Amcache.hve.5.dr	Binary or memory string: VMware
Source: Amcache.hve.5.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.5.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.5.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.5.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.5.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.5.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.5.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: MSBuild.exe, 00000001.00000002.2096055558.00000000012E5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.5.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.5.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.5.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.5.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.5.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.5.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.5.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.5.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.5.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.5.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.5.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.5.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.5.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.5.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.5.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: MSBuild.exe, 00000001.00000002.2095883701.000000000129C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWH
Source: Amcache.hve.5.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.5.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.5.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.5.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.5.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.5.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 1_2_004464F0 LdrInitializeThunk,

1_2_004464F0

Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe

Code function: 0_2_00707922 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00707922

Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Code function: 0_2_00702003 mov edi, dword ptr fs:[00000030h]	0_2_00702003
Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Code function: 0_2_0071A64C mov eax, dword ptr fs:[00000030h]	0_2_0071A64C
Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Code function: 0_2_00710F2E mov ecx, dword ptr fs:[00000030h]	0_2_00710F2E

Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe

Code function: 0_2_0071CC4B GetProcessHeap,

0_2_0071CC4B

Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Code function: 0_2_00707610 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00707610
Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Code function: 0_2_00707922 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00707922
Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Code function: 0_2_0070DA73 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0070DA73
Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Code function: 0_2_00707AAF SetUnhandledExceptionFilter,	0_2_00707AAF

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 value starts with: 4D5A

Jump to behavior

LummaC encrypted strings found

Source: 9Y6R8fs0wd.exe	String found in binary or memory: spirittunek.stor
Source: 9Y6R8fs0wd.exe	String found in binary or memory: bathdoomgaz.stor
Source: 9Y6R8fs0wd.exe	String found in binary or memory: studennotediw.stor
Source: 9Y6R8fs0wd.exe	String found in binary or memory: dissapoiznw.stor
Source: 9Y6R8fs0wd.exe	String found in binary or memory: eaglepawnoy.stor
Source: 9Y6R8fs0wd.exe	String found in binary or memory: mobbipenju.stor
Source: 9Y6R8fs0wd.exe	String found in binary or memory: trustterwowqm.shop
Source: 9Y6R8fs0wd.exe	String found in binary or memory: clearancek.site
Source: 9Y6R8fs0wd.exe	String found in binary or memory: licendfilteo.site

Writes to foreign memory regions

Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 401000	Jump to behavior
Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 44C000	Jump to behavior
Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 44F000	Jump to behavior
Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 45F000	Jump to behavior
Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 11D0008	Jump to behavior

Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"

Jump to behavior

Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	0_2_0071C085
Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Code function: GetLocaleInfoW,	0_2_0071622B
Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Code function: EnumSystemLocalesW,	0_2_0071C372
Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Code function: EnumSystemLocalesW,	0_2_0071C327
Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Code function: EnumSystemLocalesW,	0_2_0071C40D
Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_0071C498
Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Code function: GetLocaleInfoW,	0_2_0071C6EB
Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_0071C814
Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Code function: GetLocaleInfoW,	0_2_0071C91A
Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_0071C9E9
Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe	Code function: EnumSystemLocalesW,	0_2_00715D7F

Source: C:\Users\user\Desktop\9Y6R8fs0wd.exe

Code function: 0_2_00707815 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00707815

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Amcache.hve.5.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.5.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.5.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.5.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	311 Process Injection	2 Virtualization/Sandbox Evasion	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 PowerShell	Boot or Logon Initialization Scripts	1 DLL Side-Loading	311 Process Injection	LSASS Memory	41 Security Software Discovery	Remote Desktop Protocol	2 Clipboard Data	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Deobfuscate/Decode Files or Information	Security Account Manager	2 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	3 Obfuscated Files or Information	NTDS	1 File and Directory Discovery	Distributed Component Object Model	Input Capture	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Software Packing	LSA Secrets	13 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label
9Y6R8fs0wd.exe	34%	ReversingLabs	Win32.Trojan.Generic
9Y6R8fs0wd.exe	100%	Avira	HEUR/AGEN.1310458
9Y6R8fs0wd.exe	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://player.vimeo.com	0%	URL Reputation	safe
http://store.steampowered.com/subscriber_agreement/	0%	URL Reputation	safe
https://recaptcha.net/recaptcha/;	0%	URL Reputation	safe
https://medal.tv	0%	URL Reputation	safe
https://broadcast.st.dl.eccdnx.com	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1	0%	URL Reputation	safe
https://login.steampowered.com/	0%	URL Reputation	safe
https://store.steampowered.com/legal/	0%	URL Reputation	safe
https://steamcommunity.com/profiles/76561199724331900	100%	URL Reputation	malware
http://store.steampowered.com/privacy_agreement/	0%	URL Reputation	safe
https://recaptcha.net	0%	URL Reputation	safe
http://upx.sf.net	0%	URL Reputation	safe
https://store.steampowered.com/	0%	URL Reputation	safe
https://lv.queniujq.cn	0%	URL Reputation	safe
https://steamcommunity.com/profiles/76561199724331900/inventory/	100%	URL Reputation	malware
https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg	0%	URL Reputation	safe
https://help.steampowered.com/	0%	URL Reputation	safe
https://api.steampowered.com/	0%	URL Reputation	safe
http://store.steampowered.com/account/cookiepreferences/	0%	URL Reputation	safe
https://store.steampowered.com/;	0%	URL Reputation	safe
https://steamcommunity.com/profiles/76561199724331900/badges	100%	URL Reputation	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
steamcommunity.com	104.102.49.254	true	true	unknown
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false	unknown
sergei-esenin.com	172.67.206.204	true	true	unknown
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false	unknown
trustterwowqm.shop	unknown	unknown	true	unknown
eaglepawnoy.store	unknown	unknown	false	unknown
bathdoomgaz.store	unknown	unknown	false	unknown
spirittunek.store	unknown	unknown	false	unknown
licendfilteo.site	unknown	unknown	true	unknown
studennotediw.store	unknown	unknown	false	unknown
mobbipenju.store	unknown	unknown	false	unknown
clearancek.site	unknown	unknown	true	unknown
dissapoiznw.store	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
studennotediw.stor	true		unknown
spirittunek.stor	true		unknown
trustterwowqm.shop	true		unknown
eaglepawnoy.stor	true		unknown
clearancek.site	true		unknown
mobbipenju.stor	true		unknown
https://steamcommunity.com/profiles/76561199724331900	true	URL Reputation: malware	unknown
licendfilteo.site	true		unknown
bathdoomgaz.stor	true		unknown
dissapoiznw.stor	true		unknown
https://sergei-esenin.com/api	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://player.vimeo.com	MSBuild.exe, 00000001.00000002.2096055558.00000000012E5000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://sergei-esenin.com/apil	MSBuild.exe, 00000001.00000002.2096055558.00000000012E5000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/	MSBuild.exe, 00000001.00000002.2096055558.00000000012E5000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://sergei-esenin.com/	MSBuild.exe, 00000001.00000002.2096055558.00000000012E5000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/;Persistent-Aut	MSBuild.exe, 00000001.00000002.2096055558.00000000012E5000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://store.steampowered.com/subscriber_agreement/	MSBuild.exe, 00000001.00000002.2096156579.000000000133F000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org	MSBuild.exe, 00000001.00000002.2096156579.000000000133F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://recaptcha.net/recaptcha/;	MSBuild.exe, 00000001.00000002.2096055558.00000000012E5000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://sergei-esenin.com/teambr	MSBuild.exe, 00000001.00000002.2096055558.00000000012E5000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.youtube.com	MSBuild.exe, 00000001.00000002.2096055558.00000000012E5000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.google.com	MSBuild.exe, 00000001.00000002.2096055558.00000000012E5000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://medal.tv	MSBuild.exe, 00000001.00000002.2096055558.00000000012E5000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://spirittunek.st	MSBuild.exe, 00000001.00000002.2095943216.00000000012AE000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://broadcast.st.dl.eccdnx.com	MSBuild.exe, 00000001.00000002.2096055558.00000000012E5000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1	MSBuild.exe, 00000001.00000002.2096156579.000000000133F000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://s.ytimg.com;	MSBuild.exe, 00000001.00000002.2096055558.00000000012E5000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://login.steampowered.com/	MSBuild.exe, 00000001.00000002.2096055558.00000000012E5000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/legal/	MSBuild.exe, 00000001.00000002.2096156579.000000000133F000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://licendfilteo.site/api	MSBuild.exe, 00000001.00000002.2095943216.00000000012AE000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://store.steampowered.com/privacy_agreement/	MSBuild.exe, 00000001.00000002.2096156579.000000000133F000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://recaptcha.net	MSBuild.exe, 00000001.00000002.2096055558.00000000012E5000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://upx.sf.net	Amcache.hve.5.dr	false	URL Reputation: safe	unknown
https://store.steampowered.com/	MSBuild.exe, 00000001.00000002.2096055558.00000000012E5000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://clearancek.site/api	MSBuild.exe, 00000001.00000002.2095943216.00000000012AE000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://lv.queniujq.cn	MSBuild.exe, 00000001.00000002.2096055558.00000000012E5000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/profiles/76561199724331900/inventory/	MSBuild.exe, 00000001.00000002.2095943216.00000000012CF000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2096156579.000000000133F000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
https://www.youtube.com/	MSBuild.exe, 00000001.00000002.2096055558.00000000012E5000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://127.0.0.1:27060	MSBuild.exe, 00000001.00000002.2096055558.00000000012E5000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg	MSBuild.exe, 00000001.00000002.2096055558.00000000012DB000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.comT	MSBuild.exe, 00000001.00000002.2096055558.00000000012E5000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.google.com/recaptcha/	MSBuild.exe, 00000001.00000002.2096055558.00000000012E5000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://help.steampowered.com/	MSBuild.exe, 00000001.00000002.2096055558.00000000012E5000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.steampowered.com/	MSBuild.exe, 00000001.00000002.2096055558.00000000012E5000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://store.steampowered.com/account/cookiepreferences/	MSBuild.exe, 00000001.00000002.2096156579.000000000133F000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/	MSBuild.exe, 00000001.00000002.2095943216.00000000012AE000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com/)C	MSBuild.exe, 00000001.00000002.2095943216.00000000012C2000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/;	MSBuild.exe, 00000001.00000002.2096055558.00000000012E5000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/profiles/76561199724331900/badges	MSBuild.exe, 00000001.00000002.2096055558.00000000012DB000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.102.49.254	steamcommunity.com	United States		16625	AKAMAI-ASUS	true
172.67.206.204	sergei-esenin.com	United States		13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1528491
Start date and time:	2024-10-08 00:15:58 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 8s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	9Y6R8fs0wd.exe renamed because original name is a hash value
Original Sample Name:	d4819198f83d952086f5fdacd752c40b.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@4/5@11/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 71% Number of executed functions: 12 Number of non-executed functions: 157
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.190.159.0, 40.126.31.73, 20.190.159.2, 20.190.159.71, 20.190.159.75, 20.190.159.73, 20.190.159.4, 40.126.31.71, 93.184.221.240, 192.229.221.95, 4.175.87.197, 40.69.42.241, 104.208.16.94, 13.85.23.206
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, otelrules.afd.azureedge.net, wu.azureedge.net, ocsp.digicert.com, login.live.com, bg.apr-52dd2-0503.edgecastdns.net, cs11.wpc.v0cdn.net, ocsp.edge.digicert.com, glb.cws.prod.dcat.dsp.trafficmanager.net, hlb.apr-52dd2-0.edgecastdns.net, sls.update.microsoft.com, wu-b-net.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net, onedsblobprdcus16.centralus.cloudapp.azure.com, prdv4a.aadg.msidentity.com, ctldl.windowsupdate.com.delivery.microsoft.com, otelrules.azureedge.net, www.tm.v4.a.prd.aadg.akadns.net, wu.ec.azureedge.net, ctldl.windowsupdate.com, login.msa.msidentity.com, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, blobcollector.events.data.trafficmanager.net, azureedge-t-prod.trafficmanager.net, umwatson.events.data.microsoft.com, www.tm.lg.prod.aadmsa.trafficmanager.net
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: 9Y6R8fs0wd.exe

Simulations

Behavior and APIs

Time	Type	Description
18:16:51	API Interceptor	3x Sleep call for process: MSBuild.exe modified
18:17:14	API Interceptor	1x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.102.49.254	http://gtm-cn-j4g3qqvf603.steamproxy1.com/	Get hash	malicious	Unknown	Browse	www.valvesoftware.com/legal.htm
172.67.206.204	file.exe	Get hash	malicious	LummaC	Browse
	PFW1cgN8EK.exe	Get hash	malicious	LummaC	Browse
	Bn7LPdQA1s.exe	Get hash	malicious	LummaC, Vidar	Browse
	SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	CatalogApp.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	xwZfYpo16i.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Stealc	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
sergei-esenin.com	file.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	PFW1cgN8EK.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	file.exe	Get hash	malicious	LummaC	Browse	104.21.53.8
	SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Get hash	malicious	LummaC	Browse	104.21.53.8
	lihZ6gUU7V.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.21.53.8
	Bn7LPdQA1s.exe	Get hash	malicious	LummaC, Vidar	Browse	172.67.206.204
	SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	file.exe	Get hash	malicious	LummaC	Browse	104.21.53.8
	CSY6k9gpVb.exe	Get hash	malicious	LummaC	Browse	104.21.53.8
	TuQlz67byH.exe	Get hash	malicious	LummaC	Browse	104.21.53.8
s-part-0017.t-0009.t-msedge.net	PFW1cgN8EK.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	https://url.avanan.click/v2/r01/___https://www.tiktok.com/qnspdA7?fni=6cbb&qfsl=js&xhjsj=gnt_zwq&yfwljy=myyux:ddBBB.lttlqj.ht.zpdzwq?v=frudxdBjlfmjfqymhfwj.ht.pjd.kwjsy___.YXAzOnNvdXRoZXJua2l0Y2hlbmFuZGdyaWxsOmE6bzpiNGZlZGFhNjcxOTBhYjU4MTE5MjBlZTRiYTAxZmUwMTo3OmIxYWM6MDg1ODNlNjljZDkwNThkM2ZiM2RjYTI4MzFjZGY4NGFmMTYyZTlhYmVjYWYxY2Q4MmNkZDhiNmFmOWVkOWUxOTpoOlQ6VA#Sm9hbi5LbmlwcGVuQEVsa2F5LkNvbQ==	Get hash	malicious	Unknown	Browse	13.107.246.45
	SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	https://login.stmarytx.edu/cas/logout?service=http%3A%2F%2Fgoogle.com%2Famp%2Fmatrikaengineeringworks.com/hebc/?#?m=bWVsaXNzYWdAd2Utd29ybGR3aWRlLmNvbQ==	Get hash	malicious	Unknown	Browse	13.107.246.45
	https://dsdhie.org/dsjhem	Get hash	malicious	Unknown	Browse	13.107.246.45
	SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	+18365366724753456-83736-10244688.html	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	https://s.craft.me/yB5midhwwaHUPW	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	https://t.dripemail3.com/c/eyJhbGciOiJIUzI1NiJ9.eyJhdWQiOiJkZXRvdXIiLCJpc3MiOiJtb25vbGl0aCIsInN1YiI6ImRldG91cl9saW5rIiwiaWF0IjoxNzI4MzA1Mzk4LCJuYmYiOjE3MjgzMDUzOTgsImFjY291bnRfaWQiOiIyNzYyNjA5IiwiZGVsaXZlcnlfaWQiOiJpeHI5d3pqeGcwZnI2NGJjbGwycyIsInRva2VuIjoiaXhyOXd6anhnMGZyNjRiY2xsMnMiLCJzZW5kX2F0IjoxNzI4MzA0MzU0LCJlbWFpbF9pZCI6OTk2Mzg3MCwiZW1haWxhYmxlX3R5cGUiOiJCcm9hZGNhc3QiLCJlbWFpbGFibGVfaWQiOjM5NTM4MjUsInVybCI6Imh0dHBzOi8vZGFpbHlhbGFza2EuY29tL25ld3M_X19zPWw5bzljOTZzbG8xZjF3aGFiODZrJnV0bV9zb3VyY2U9ZHJpcCZ1dG1fbWVkaXVtPWVtYWlsJnV0bV9jYW1wYWlnbj1TcHJpbmcraGFzK3NwcnVuZyslRjAlOUYlOEMlQjEifQ.HIDfaWGNVn-TCtUT4qZNHq7EdymoLEqvVA8XxZBU8z8	Get hash	malicious	HtmlDropper	Browse	13.107.246.45
	https://entertaininmotionre.pro/IQCm/	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
steamcommunity.com	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	PFW1cgN8EK.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	utmggBCMML.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	lihZ6gUU7V.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.102.49.254
	Bn7LPdQA1s.exe	Get hash	malicious	LummaC, Vidar	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Get hash	malicious	LummaC	Browse	92.122.104.90
	WiTqtf1aiE.exe	Get hash	malicious	LummaC, Vidar	Browse	104.102.49.254

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	file.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	RemittanceDetails(Rjackson)CQDM.html	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	PFW1cgN8EK.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	file.exe	Get hash	malicious	LummaC	Browse	104.21.53.8
	https://url.avanan.click/v2/r01/___https://www.tiktok.com/qnspdA7?fni=6cbb&qfsl=js&xhjsj=gnt_zwq&yfwljy=myyux:ddBBB.lttlqj.ht.zpdzwq?v=frudxdBjlfmjfqymhfwj.ht.pjd.kwjsy___.YXAzOnNvdXRoZXJua2l0Y2hlbmFuZGdyaWxsOmE6bzpiNGZlZGFhNjcxOTBhYjU4MTE5MjBlZTRiYTAxZmUwMTo3OmIxYWM6MDg1ODNlNjljZDkwNThkM2ZiM2RjYTI4MzFjZGY4NGFmMTYyZTlhYmVjYWYxY2Q4MmNkZDhiNmFmOWVkOWUxOTpoOlQ6VA#Sm9hbi5LbmlwcGVuQEVsa2F5LkNvbQ==	Get hash	malicious	Unknown	Browse	188.114.96.3
	EUYIlr7uUX.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	172.65.255.143
	SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Get hash	malicious	LummaC	Browse	104.21.53.8
	lihZ6gUU7V.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.21.53.8
	Bn7LPdQA1s.exe	Get hash	malicious	LummaC, Vidar	Browse	172.67.206.204
	https://www.dropbox.com/scl/fi/qo6796ed7hlrt0v8k9nr6/Patagonia-Health-Barcode-Scanner-Setup-2024.exe?rlkey=5bmndvx8124ztopqewiogbnlt&st=yvxpokhf&dl=0	Get hash	malicious	Unknown	Browse	1.1.1.1
AKAMAI-ASUS	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	PFW1cgN8EK.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	utmggBCMML.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	lihZ6gUU7V.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.102.49.254
	Bn7LPdQA1s.exe	Get hash	malicious	LummaC, Vidar	Browse	104.102.49.254
	https://www.dropbox.com/scl/fi/qo6796ed7hlrt0v8k9nr6/Patagonia-Health-Barcode-Scanner-Setup-2024.exe?rlkey=5bmndvx8124ztopqewiogbnlt&st=yvxpokhf&dl=0	Get hash	malicious	Unknown	Browse	184.28.90.27
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	https://dsdhie.org/dsjhem	Get hash	malicious	Unknown	Browse	88.221.169.152

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	http://xdr.euw31usea1-carbonhelixbytedandomaincontrolpanele-for-github.sentinelone.net/	Get hash	malicious	Unknown	Browse	13.107.246.45
	file.exe	Get hash	malicious	Credential Flusher	Browse	13.107.246.45
	RemittanceDetails(Rjackson)CQDM.html	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	PFW1cgN8EK.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	https://url.avanan.click/v2/r01/___https://www.tiktok.com/qnspdA7?fni=6cbb&qfsl=js&xhjsj=gnt_zwq&yfwljy=myyux:ddBBB.lttlqj.ht.zpdzwq?v=frudxdBjlfmjfqymhfwj.ht.pjd.kwjsy___.YXAzOnNvdXRoZXJua2l0Y2hlbmFuZGdyaWxsOmE6bzpiNGZlZGFhNjcxOTBhYjU4MTE5MjBlZTRiYTAxZmUwMTo3OmIxYWM6MDg1ODNlNjljZDkwNThkM2ZiM2RjYTI4MzFjZGY4NGFmMTYyZTlhYmVjYWYxY2Q4MmNkZDhiNmFmOWVkOWUxOTpoOlQ6VA#Sm9hbi5LbmlwcGVuQEVsa2F5LkNvbQ==	Get hash	malicious	Unknown	Browse	13.107.246.45
	SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	utmggBCMML.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	lihZ6gUU7V.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	13.107.246.45
	Bn7LPdQA1s.exe	Get hash	malicious	LummaC, Vidar	Browse	13.107.246.45
	https://login.stmarytx.edu/cas/logout?service=http%3A%2F%2Fgoogle.com%2Famp%2Fmatrikaengineeringworks.com/hebc/?#?m=bWVsaXNzYWdAd2Utd29ybGR3aWRlLmNvbQ==	Get hash	malicious	Unknown	Browse	13.107.246.45
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254 172.67.206.204
	PFW1cgN8EK.exe	Get hash	malicious	LummaC	Browse	104.102.49.254 172.67.206.204
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254 172.67.206.204
	SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Get hash	malicious	LummaC	Browse	104.102.49.254 172.67.206.204
	utmggBCMML.exe	Get hash	malicious	LummaC	Browse	104.102.49.254 172.67.206.204
	lihZ6gUU7V.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.102.49.254 172.67.206.204
	Bn7LPdQA1s.exe	Get hash	malicious	LummaC, Vidar	Browse	104.102.49.254 172.67.206.204
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254 172.67.206.204
	SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Get hash	malicious	LummaC	Browse	104.102.49.254 172.67.206.204
	WiTqtf1aiE.exe	Get hash	malicious	LummaC, Vidar	Browse	104.102.49.254 172.67.206.204

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_9Y6R8fs0wd.exe_bb31e39e2724a028c6dac54eb34b2828abaea3_69101081_7aea6241-064f-4331-847a-db85fcf4c379\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.6539605164197522
Encrypted:	false
SSDEEP:	96:Uk3dFMtvP53o0RrJCs0Wye0MALf8QXIDcQvc6QcEVcw3cE/twQ+HbHg/5hZAX/dv:UcdsZoiCl0BU/gjhzuiF0Z24IO8c4
MD5:	48742BCC67D158CFE194A30D4FBB4AA3
SHA1:	A4914D3DCD3758246A2758EB6CF38FFCB08E69C6
SHA-256:	2DDE608EF9E5A35A2CA838D5A18A29DC2507A1ABA0ED18D1DDD1D3432F9E1111
SHA-512:	34714DA47A926081398DB1F7EA15EC0E28D6D895D7C5645D8C3A30C2282CF893C29F7E5606138DF1192FD947C79A8DA55BFC8B716AD6B4C44D204E57DE778E07
Malicious:	true
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.2.8.1.3.0.1.2.3.0.0.1.8.3.0.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.2.8.1.3.0.1.2.6.5.9.5.5.7.7.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.7.a.e.a.6.2.4.1.-.0.6.4.f.-.4.3.3.1.-.8.4.7.a.-.d.b.8.5.f.c.f.4.c.3.7.9.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.1.e.4.4.d.1.8.8.-.c.8.3.4.-.4.4.0.1.-.b.5.7.b.-.e.d.1.7.c.a.c.d.5.5.f.f.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.9.Y.6.R.8.f.s.0.w.d...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.p.r.o.q.u.o.t.a...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.6.1.8.-.0.0.0.1.-.0.0.1.4.-.2.b.f.7.-.1.2.9.c.0.6.1.9.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.9.7.d.0.3.f.6.a.1.a.a.4.5.0.5.0.f.7.b.e.5.5.f.8.7.6.f.e.a.2.d.c.0.0.0.0.0.9.0.4.!.0.0.0.0.5.c.9.5.3.1.c.3.a.b.6.c.d.b.f.8.7.6.8.7.d.c.9.a.2.1.6.b.9.c.a.9.2.a.6.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE5F0.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Mon Oct 7 22:16:52 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	32044
Entropy (8bit):	1.8032834928626693
Encrypted:	false
SSDEEP:	96:5B8G4kAzFz5cH77i77+zXm4ee5F/az4gGZILOZrRWIOWIP6LIT8D+O8spz9z:Mbu/Ot2/24iLOZzg8Dcsp9
MD5:	333ED266F8B56CAFA9825972044E844C
SHA1:	C3CD312A62A550A33E6211700B7BA9F62DE96255
SHA-256:	B3C71AC889CEFA420F38BD28364A0AAEBECB44394FB620829BDAE5C5A20AD628
SHA-512:	51FBED1FA6693AB7C5C58D82792BB291529DEB55C66686568282F18743DB0A75D3A11FDCD084FE10C9A24CEEBA4BEB5C55D73ABDC69950106E7F8F3A8B371314
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... ........].g........................d...........................T.......8...........T...............\|r......................................................................................................eJ..............GenuineIntel............T............].g.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE68D.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8328
Entropy (8bit):	3.7000876889048486
Encrypted:	false
SSDEEP:	192:R6l7wVeJxV6A6YEIjSU91UoNgmf1Brzpru89b4ksfhIm:R6lXJT6A6YEMSU9qoNgmf1BrZ4Xfb
MD5:	26252EFDE9E487264D58DB53CD485447
SHA1:	6350526BDED833960F0D080FD409AD1CF4A5B089
SHA-256:	C106EF85830F94AC0B5AA068FE1BA5DF9D978A44A401EC66E54B08EF42DF7972
SHA-512:	4732D845CE0BF0AD787CA08424ECCE067617EF3880E6F9900E4225FAE47666552E20046D80F86026A8D7C3E1F0C789AED492C83F4B2D46B798FF7A3FCD958BC6
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.1.5.6.0.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE6BD.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4678
Entropy (8bit):	4.486461719621924
Encrypted:	false
SSDEEP:	48:cvIwWl8zskJg77aI9+5WpW8VYXYm8M4JkMFZt+q8wLazjad:uIjfiI7kI7V/JJtxazjad
MD5:	12265AD01E64540FD4A51D800376BE43
SHA1:	32BEC5C901E9458DD094EB2E511712A02EDBF4A1
SHA-256:	2EF9F568296B25E28476AF6C499C31524CD1980AD3DED69407719E4241C596D9
SHA-512:	BE98B955A48CD7CEF520832E18CBA09F03BB4192B6B1139C5D38169C3992D386982589FAD15002FD685A3EE0127DA076E54BBB0D9C8618FFDE5E79F8749F3CD5
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="533599" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.4220781513778125
Encrypted:	false
SSDEEP:	6144:PSvfpi6ceLP/9skLmb0OTqWSPHaJG8nAgeMZMMhA2fX4WABlEnNE0uhiTw:avloTqW+EZMM6DFyK03w
MD5:	732B3B6FE88672A6CA2C983DD8298E78
SHA1:	D01F56B629FF10A860AD1D02727B3C54CED87232
SHA-256:	4A53F9AA59E4E4DE7B7EEABD5E8B719BE18B9594DEF86DBB6DD02E7072109908
SHA-512:	EB43D0A12EF5537D331A0972649708CDED37367D20F537EC8F67D8C04A5085E49AF204E2E91D32D0F1CCDC35F2438A4EB1626BB90A7BDE324418D6A91B985050
Malicious:	false
Reputation:	low
Preview:	regf>...>....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm.=l.................................................................................................................................................................................................................................................................................................................................................V.{.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.722026656956725
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	9Y6R8fs0wd.exe
File size:	550'912 bytes
MD5:	d4819198f83d952086f5fdacd752c40b
SHA1:	5c9531c3ab6cdbf87687dc9a216b9ca92a693f0b
SHA256:	d4c6cfd25d667b7371d702fddfb961a15bddaef0974b7bc75bc061bd6e7de0c1
SHA512:	07a11da4e458ad55c43e6a2cb017c22e19d26f47758960abd2d5700c94f84687d1385b6473e9a3571aecf20ce0aed69fcd1de1e6f876a1d1f44f7c92ff1537d8
SSDEEP:	12288:c98AljUKb072yamy3r8Wwe37CfIML/ljYmSCAogsSmL9IcHvBfGnPm4S:cvjU8y+3r8oLCfIML/lEFCAofL9FHvBe
TLSH:	E0C4F10175C1C072D1B225324AE0DB749B7EB8B00B969E9F67D84F7F4F30291DB25A6A
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......=.9.y.WUy.WUy.WU..TTu.WU..RT..WU..STl.WU..VTz.WUy.VU!.WUilTTm.WUilSTk.WUilRT4.WU1m^Tx.WU1m.Ux.WU1mUTx.WURichy.WU...............

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x406f52
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x67045893 [Mon Oct 7 21:54:27 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	d10af643340e1121562abe3e6bd5b0e1

Entrypoint Preview

Instruction
call 00007F6EF4EB08B0h
jmp 00007F6EF4EAFE1Fh
push ebp
mov ebp, esp
mov eax, dword ptr [ebp+08h]
push esi
mov ecx, dword ptr [eax+3Ch]
add ecx, eax
movzx eax, word ptr [ecx+14h]
lea edx, dword ptr [ecx+18h]
add edx, eax
movzx eax, word ptr [ecx+06h]
imul esi, eax, 28h
add esi, edx
cmp edx, esi
je 00007F6EF4EAFFBBh
mov ecx, dword ptr [ebp+0Ch]
cmp ecx, dword ptr [edx+0Ch]
jc 00007F6EF4EAFFACh
mov eax, dword ptr [edx+08h]
add eax, dword ptr [edx+0Ch]
cmp ecx, eax
jc 00007F6EF4EAFFAEh
add edx, 28h
cmp edx, esi
jne 00007F6EF4EAFF8Ch
xor eax, eax
pop esi
pop ebp
ret
mov eax, edx
jmp 00007F6EF4EAFF9Bh
push esi
call 00007F6EF4EB0BC4h
test eax, eax
je 00007F6EF4EAFFC2h
mov eax, dword ptr fs:[00000018h]
mov esi, 00486544h
mov edx, dword ptr [eax+04h]
jmp 00007F6EF4EAFFA6h
cmp edx, eax
je 00007F6EF4EAFFB2h
xor eax, eax
mov ecx, edx
lock cmpxchg dword ptr [esi], ecx
test eax, eax
jne 00007F6EF4EAFF92h
xor al, al
pop esi
ret
mov al, 01h
pop esi
ret
push ebp
mov ebp, esp
cmp dword ptr [ebp+08h], 00000000h
jne 00007F6EF4EAFFA9h
mov byte ptr [00486548h], 00000001h
call 00007F6EF4EB025Ah
call 00007F6EF4EB3177h
test al, al
jne 00007F6EF4EAFFA6h
xor al, al
pop ebp
ret
call 00007F6EF4EBBBD9h
test al, al
jne 00007F6EF4EAFFACh
push 00000000h
call 00007F6EF4EB317Eh
pop ecx
jmp 00007F6EF4EAFF8Bh
mov al, 01h
pop ebp
ret
push ebp
mov ebp, esp
cmp byte ptr [00486549h], 00000000h
je 00007F6EF4EAFFA6h
mov al, 01h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2c6c0	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x88000	0x3d8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x89000	0x1ad4	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x2abc0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x2ab00	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x23000	0x12c	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x210f0	0x21200	f22b1e81594f41e03002b6fcc8923e73	False	0.5865492334905661	data	6.667298896217986	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x23000	0x9d78	0x9e00	5030907f777ff21fc288bf2df1a99e5d	False	0.4352501977848101	data	4.95882031611444	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x2d000	0x5a170	0x59400	dc4f4b7b09dc3c339f8395a5194c7058	False	0.9911179315476191	DOS executable (block device driver \377\377\377\377,32-bit sector-support)	7.992150760707854	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x88000	0x3d8	0x400	c67ba8481d4e7c92e5fe9f152983a3f3	False	0.439453125	data	3.287044161603086	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x89000	0x1ad4	0x1c00	796cb04d6b1ee95f5035aab9ee7761fb	False	0.7267020089285714	data	6.390282111490152	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x88058	0x380	data	English	United States	0.46205357142857145

Imports

DLL

Import

KERNEL32.dll

AttachConsole, MultiByteToWideChar, GetStringTypeW, WideCharToMultiByte, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionEx, DeleteCriticalSection, EncodePointer, DecodePointer, LCMapStringEx, GetCPInfo, IsProcessorFeaturePresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, GetStartupInfoW, GetModuleHandleW, CreateFileW, RaiseException, RtlUnwind, GetLastError, SetLastError, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, GetProcAddress, LoadLibraryExW, GetStdHandle, WriteFile, GetModuleFileNameW, ExitProcess, GetModuleHandleExW, HeapAlloc, HeapFree, GetFileType, LCMapStringW, GetLocaleInfoW, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, GetFileSizeEx, SetFilePointerEx, CloseHandle, FlushFileBuffers, GetConsoleOutputCP, GetConsoleMode, ReadFile, HeapReAlloc, FindClose, FindFirstFileExW, FindNextFileW, IsValidCodePage, GetACP, GetOEMCP, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetStdHandle, GetProcessHeap, ReadConsoleW, HeapSize, WriteConsoleW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-08T00:16:52.311943+0200	2056174	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (trustterwowqm .shop)	1	192.168.2.5	51645	1.1.1.1	53	UDP
2024-10-08T00:16:52.333187+0200	2056485	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store)	1	192.168.2.5	58219	1.1.1.1	53	UDP
2024-10-08T00:16:52.355399+0200	2056483	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store)	1	192.168.2.5	61742	1.1.1.1	53	UDP
2024-10-08T00:16:52.368127+0200	2056481	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store)	1	192.168.2.5	53891	1.1.1.1	53	UDP
2024-10-08T00:16:52.382380+0200	2056479	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store)	1	192.168.2.5	52368	1.1.1.1	53	UDP
2024-10-08T00:16:52.396137+0200	2056477	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store)	1	192.168.2.5	60085	1.1.1.1	53	UDP
2024-10-08T00:16:52.417701+0200	2056475	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store)	1	192.168.2.5	63337	1.1.1.1	53	UDP
2024-10-08T00:16:52.509295+0200	2056473	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site)	1	192.168.2.5	57528	1.1.1.1	53	UDP
2024-10-08T00:16:52.521696+0200	2056471	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site)	1	192.168.2.5	54943	1.1.1.1	53	UDP
2024-10-08T00:16:55.369508+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.5	49706	172.67.206.204	443	TCP
2024-10-08T00:16:55.369508+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49706	172.67.206.204	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 8, 2024 00:16:48.288009882 CEST	49674	443	192.168.2.5	23.1.237.91
Oct 8, 2024 00:16:48.288011074 CEST	49675	443	192.168.2.5	23.1.237.91
Oct 8, 2024 00:16:48.428800106 CEST	49673	443	192.168.2.5	23.1.237.91
Oct 8, 2024 00:16:52.560750008 CEST	49704	443	192.168.2.5	104.102.49.254
Oct 8, 2024 00:16:52.560789108 CEST	443	49704	104.102.49.254	192.168.2.5
Oct 8, 2024 00:16:52.560868025 CEST	49704	443	192.168.2.5	104.102.49.254
Oct 8, 2024 00:16:52.562637091 CEST	49704	443	192.168.2.5	104.102.49.254
Oct 8, 2024 00:16:52.562650919 CEST	443	49704	104.102.49.254	192.168.2.5
Oct 8, 2024 00:16:53.175874949 CEST	443	49704	104.102.49.254	192.168.2.5
Oct 8, 2024 00:16:53.176187038 CEST	49704	443	192.168.2.5	104.102.49.254
Oct 8, 2024 00:16:53.179495096 CEST	49704	443	192.168.2.5	104.102.49.254
Oct 8, 2024 00:16:53.179505110 CEST	443	49704	104.102.49.254	192.168.2.5
Oct 8, 2024 00:16:53.179981947 CEST	443	49704	104.102.49.254	192.168.2.5
Oct 8, 2024 00:16:53.225497961 CEST	49704	443	192.168.2.5	104.102.49.254
Oct 8, 2024 00:16:53.242980957 CEST	49704	443	192.168.2.5	104.102.49.254
Oct 8, 2024 00:16:53.287395954 CEST	443	49704	104.102.49.254	192.168.2.5
Oct 8, 2024 00:16:53.636527061 CEST	443	49704	104.102.49.254	192.168.2.5
Oct 8, 2024 00:16:53.636552095 CEST	443	49704	104.102.49.254	192.168.2.5
Oct 8, 2024 00:16:53.636588097 CEST	443	49704	104.102.49.254	192.168.2.5
Oct 8, 2024 00:16:53.636607885 CEST	443	49704	104.102.49.254	192.168.2.5
Oct 8, 2024 00:16:53.636625051 CEST	443	49704	104.102.49.254	192.168.2.5
Oct 8, 2024 00:16:53.636657000 CEST	49704	443	192.168.2.5	104.102.49.254
Oct 8, 2024 00:16:53.636657000 CEST	49704	443	192.168.2.5	104.102.49.254
Oct 8, 2024 00:16:53.636674881 CEST	443	49704	104.102.49.254	192.168.2.5
Oct 8, 2024 00:16:53.636722088 CEST	49704	443	192.168.2.5	104.102.49.254
Oct 8, 2024 00:16:53.636722088 CEST	49704	443	192.168.2.5	104.102.49.254
Oct 8, 2024 00:16:53.734556913 CEST	443	49704	104.102.49.254	192.168.2.5
Oct 8, 2024 00:16:53.734586000 CEST	443	49704	104.102.49.254	192.168.2.5
Oct 8, 2024 00:16:53.734661102 CEST	49704	443	192.168.2.5	104.102.49.254
Oct 8, 2024 00:16:53.734690905 CEST	443	49704	104.102.49.254	192.168.2.5
Oct 8, 2024 00:16:53.734740019 CEST	49704	443	192.168.2.5	104.102.49.254
Oct 8, 2024 00:16:53.734740019 CEST	49704	443	192.168.2.5	104.102.49.254
Oct 8, 2024 00:16:53.739162922 CEST	443	49704	104.102.49.254	192.168.2.5
Oct 8, 2024 00:16:53.739257097 CEST	49704	443	192.168.2.5	104.102.49.254
Oct 8, 2024 00:16:53.739272118 CEST	443	49704	104.102.49.254	192.168.2.5
Oct 8, 2024 00:16:53.743298054 CEST	49704	443	192.168.2.5	104.102.49.254
Oct 8, 2024 00:16:54.266371012 CEST	49704	443	192.168.2.5	104.102.49.254
Oct 8, 2024 00:16:54.266405106 CEST	443	49704	104.102.49.254	192.168.2.5
Oct 8, 2024 00:16:54.266520977 CEST	49704	443	192.168.2.5	104.102.49.254
Oct 8, 2024 00:16:54.266529083 CEST	443	49704	104.102.49.254	192.168.2.5
Oct 8, 2024 00:16:54.281986952 CEST	49706	443	192.168.2.5	172.67.206.204
Oct 8, 2024 00:16:54.282017946 CEST	443	49706	172.67.206.204	192.168.2.5
Oct 8, 2024 00:16:54.282071114 CEST	49706	443	192.168.2.5	172.67.206.204
Oct 8, 2024 00:16:54.282479048 CEST	49706	443	192.168.2.5	172.67.206.204
Oct 8, 2024 00:16:54.282489061 CEST	443	49706	172.67.206.204	192.168.2.5
Oct 8, 2024 00:16:54.918850899 CEST	443	49706	172.67.206.204	192.168.2.5
Oct 8, 2024 00:16:54.918953896 CEST	49706	443	192.168.2.5	172.67.206.204
Oct 8, 2024 00:16:54.920623064 CEST	49706	443	192.168.2.5	172.67.206.204
Oct 8, 2024 00:16:54.920639992 CEST	443	49706	172.67.206.204	192.168.2.5
Oct 8, 2024 00:16:54.920888901 CEST	443	49706	172.67.206.204	192.168.2.5
Oct 8, 2024 00:16:54.922072887 CEST	49706	443	192.168.2.5	172.67.206.204
Oct 8, 2024 00:16:54.922096014 CEST	49706	443	192.168.2.5	172.67.206.204
Oct 8, 2024 00:16:54.922138929 CEST	443	49706	172.67.206.204	192.168.2.5
Oct 8, 2024 00:16:55.369513988 CEST	443	49706	172.67.206.204	192.168.2.5
Oct 8, 2024 00:16:55.369596004 CEST	443	49706	172.67.206.204	192.168.2.5
Oct 8, 2024 00:16:55.369760990 CEST	49706	443	192.168.2.5	172.67.206.204
Oct 8, 2024 00:16:55.370348930 CEST	49706	443	192.168.2.5	172.67.206.204
Oct 8, 2024 00:16:55.370362043 CEST	443	49706	172.67.206.204	192.168.2.5
Oct 8, 2024 00:16:55.370373964 CEST	49706	443	192.168.2.5	172.67.206.204
Oct 8, 2024 00:16:55.370379925 CEST	443	49706	172.67.206.204	192.168.2.5
Oct 8, 2024 00:16:57.897313118 CEST	49675	443	192.168.2.5	23.1.237.91
Oct 8, 2024 00:16:57.897310972 CEST	49674	443	192.168.2.5	23.1.237.91
Oct 8, 2024 00:16:58.037909031 CEST	49673	443	192.168.2.5	23.1.237.91
Oct 8, 2024 00:16:59.703362942 CEST	443	49703	23.1.237.91	192.168.2.5
Oct 8, 2024 00:16:59.703560114 CEST	49703	443	192.168.2.5	23.1.237.91
Oct 8, 2024 00:17:06.991827965 CEST	49714	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:06.991841078 CEST	443	49714	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:06.992069006 CEST	49714	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:06.992548943 CEST	49714	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:06.992563009 CEST	443	49714	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:07.991668940 CEST	443	49714	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:07.991738081 CEST	49714	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:07.993483067 CEST	49714	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:07.993499994 CEST	443	49714	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:07.993753910 CEST	443	49714	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:08.006020069 CEST	49714	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:08.047405005 CEST	443	49714	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:08.105314970 CEST	443	49714	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:08.105340958 CEST	443	49714	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:08.105357885 CEST	443	49714	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:08.105397940 CEST	49714	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:08.105424881 CEST	443	49714	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:08.105443954 CEST	49714	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:08.105467081 CEST	49714	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:08.183542013 CEST	443	49714	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:08.183564901 CEST	443	49714	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:08.183604956 CEST	49714	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:08.183636904 CEST	443	49714	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:08.183653116 CEST	49714	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:08.183679104 CEST	49714	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:08.185281992 CEST	443	49714	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:08.185297012 CEST	443	49714	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:08.185333014 CEST	49714	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:08.185352087 CEST	443	49714	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:08.185369968 CEST	49714	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:08.185385942 CEST	49714	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:08.266597033 CEST	443	49714	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:08.266614914 CEST	443	49714	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:08.266669035 CEST	49714	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:08.266701937 CEST	443	49714	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:08.266719103 CEST	49714	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:08.267141104 CEST	49714	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:08.267791986 CEST	443	49714	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:08.267811060 CEST	443	49714	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:08.267846107 CEST	49714	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:08.267855883 CEST	443	49714	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:08.267899036 CEST	49714	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:08.267915964 CEST	49714	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:08.269284964 CEST	443	49714	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:08.269301891 CEST	443	49714	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:08.269416094 CEST	49714	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:08.269423962 CEST	443	49714	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:08.269483089 CEST	49714	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:08.269958019 CEST	443	49714	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:08.269973993 CEST	443	49714	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:08.270029068 CEST	49714	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:08.270039082 CEST	443	49714	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:08.270100117 CEST	49714	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:08.350049973 CEST	443	49714	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:08.350070000 CEST	443	49714	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:08.350120068 CEST	49714	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:08.350161076 CEST	443	49714	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:08.350177050 CEST	49714	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:08.350202084 CEST	49714	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:08.350975037 CEST	443	49714	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:08.350990057 CEST	443	49714	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:08.351039886 CEST	49714	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:08.351052046 CEST	443	49714	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:08.351063013 CEST	49714	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:08.351109028 CEST	49714	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:08.351700068 CEST	443	49714	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:08.351715088 CEST	443	49714	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:08.351753950 CEST	49714	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:08.351764917 CEST	443	49714	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:08.351789951 CEST	49714	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:08.351814032 CEST	49714	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:08.352797985 CEST	443	49714	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:08.352813959 CEST	443	49714	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:08.352863073 CEST	49714	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:08.352874041 CEST	443	49714	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:08.352910042 CEST	49714	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:08.353637934 CEST	443	49714	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:08.353653908 CEST	443	49714	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:08.353806019 CEST	49714	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:08.353816032 CEST	443	49714	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:08.353974104 CEST	49714	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:08.354654074 CEST	443	49714	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:08.354670048 CEST	443	49714	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:08.354701996 CEST	443	49714	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:08.354727030 CEST	49714	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:08.354737043 CEST	443	49714	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:08.354769945 CEST	443	49714	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:08.354794979 CEST	49714	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:08.354804993 CEST	49714	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:08.355005980 CEST	49714	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:08.355025053 CEST	443	49714	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:08.355036974 CEST	49714	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:08.355042934 CEST	443	49714	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:08.402255058 CEST	49716	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:08.402293921 CEST	443	49716	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:08.403212070 CEST	49717	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:08.403254032 CEST	443	49717	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:08.403314114 CEST	49717	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:08.403409958 CEST	49716	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:08.403817892 CEST	49717	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:08.403834105 CEST	443	49717	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:08.403834105 CEST	49716	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:08.403846979 CEST	443	49716	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:08.404927969 CEST	49718	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:08.404937029 CEST	443	49718	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:08.404984951 CEST	49718	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:08.405097008 CEST	49718	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:08.405105114 CEST	443	49718	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:08.405941010 CEST	49719	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:08.405955076 CEST	443	49719	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:08.406110048 CEST	49719	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:08.406393051 CEST	49720	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:08.406428099 CEST	443	49720	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:08.406522989 CEST	49720	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:08.406588078 CEST	49720	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:08.406600952 CEST	443	49720	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:08.406717062 CEST	49719	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:08.406730890 CEST	443	49719	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:09.016828060 CEST	443	49720	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:09.017343998 CEST	49720	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:09.017354965 CEST	443	49720	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:09.017802954 CEST	49720	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:09.017807007 CEST	443	49720	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:09.029838085 CEST	443	49719	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:09.030610085 CEST	49719	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:09.030610085 CEST	49719	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:09.030622959 CEST	443	49719	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:09.030642033 CEST	443	49719	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:09.049998999 CEST	443	49716	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:09.050842047 CEST	443	49718	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:09.051062107 CEST	49718	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:09.051070929 CEST	443	49718	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:09.051229000 CEST	49716	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:09.051229000 CEST	49716	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:09.051246881 CEST	443	49716	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:09.051261902 CEST	443	49716	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:09.051403999 CEST	49718	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:09.051409006 CEST	443	49718	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:09.056762934 CEST	443	49717	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:09.057010889 CEST	49717	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:09.057024002 CEST	443	49717	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:09.057388067 CEST	49717	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:09.057391882 CEST	443	49717	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:09.126518965 CEST	443	49720	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:09.126538992 CEST	443	49720	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:09.126590967 CEST	443	49720	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:09.126653910 CEST	49720	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:09.126681089 CEST	49720	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:09.126959085 CEST	49720	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:09.126977921 CEST	443	49720	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:09.126990080 CEST	49720	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:09.126995087 CEST	443	49720	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:09.129966021 CEST	443	49719	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:09.129987955 CEST	49721	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:09.130014896 CEST	443	49719	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:09.130042076 CEST	443	49721	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:09.130110979 CEST	49719	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:09.130194902 CEST	49721	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:09.130240917 CEST	49719	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:09.130240917 CEST	49719	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:09.130261898 CEST	443	49719	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:09.130270958 CEST	443	49719	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:09.130281925 CEST	49721	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:09.130290031 CEST	443	49721	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:09.132455111 CEST	49722	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:09.132467985 CEST	443	49722	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:09.132534981 CEST	49722	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:09.132674932 CEST	49722	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:09.132687092 CEST	443	49722	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:09.163554907 CEST	443	49716	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:09.163589001 CEST	443	49716	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:09.163644075 CEST	443	49716	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:09.163678885 CEST	49716	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:09.163693905 CEST	49716	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:09.163881063 CEST	49716	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:09.163892984 CEST	443	49716	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:09.163975000 CEST	49716	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:09.163980961 CEST	443	49716	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:09.164108992 CEST	443	49718	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:09.164128065 CEST	443	49718	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:09.164176941 CEST	443	49718	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:09.164180040 CEST	49718	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:09.164211988 CEST	49718	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:09.164314985 CEST	49718	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:09.164330959 CEST	443	49718	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:09.164343119 CEST	49718	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:09.164347887 CEST	443	49718	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:09.166903019 CEST	49724	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:09.166914940 CEST	49723	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:09.166934013 CEST	443	49724	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:09.166944981 CEST	443	49723	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:09.167057991 CEST	49723	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:09.167083025 CEST	49724	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:09.167220116 CEST	49724	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:09.167236090 CEST	443	49724	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:09.167242050 CEST	49723	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:09.167256117 CEST	443	49723	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:09.170890093 CEST	443	49717	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:09.170943975 CEST	443	49717	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:09.171000004 CEST	49717	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:09.171093941 CEST	49717	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:09.171099901 CEST	443	49717	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:09.171108961 CEST	49717	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:09.171113014 CEST	443	49717	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:09.173135042 CEST	49725	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:09.173227072 CEST	443	49725	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:09.173300982 CEST	49725	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:09.173402071 CEST	49725	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:09.173437119 CEST	443	49725	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:09.930231094 CEST	443	49723	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:09.930352926 CEST	443	49725	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:09.930794001 CEST	49723	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:09.930821896 CEST	443	49723	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:09.930941105 CEST	49725	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:09.930986881 CEST	443	49725	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:09.931294918 CEST	49723	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:09.931302071 CEST	443	49723	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:09.931318045 CEST	443	49721	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:09.931497097 CEST	49725	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:09.931504965 CEST	443	49722	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:09.931509972 CEST	443	49725	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:09.931636095 CEST	49721	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:09.931668043 CEST	443	49721	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:09.931767941 CEST	49722	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:09.931783915 CEST	443	49722	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:09.931989908 CEST	443	49724	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:09.932101965 CEST	49721	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:09.932106972 CEST	443	49721	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:09.932195902 CEST	49722	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:09.932199955 CEST	443	49722	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:09.932765961 CEST	49724	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:09.932765961 CEST	49724	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:09.932794094 CEST	443	49724	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:09.932807922 CEST	443	49724	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:10.030246973 CEST	443	49723	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:10.030308008 CEST	443	49723	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:10.030419111 CEST	49723	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:10.030776978 CEST	443	49722	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:10.030838013 CEST	443	49722	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:10.030884981 CEST	49722	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:10.031054974 CEST	443	49724	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:10.031112909 CEST	443	49724	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:10.031152010 CEST	49724	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:10.032016993 CEST	49723	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:10.032021046 CEST	443	49721	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:10.032037973 CEST	443	49723	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:10.032052040 CEST	49723	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:10.032057047 CEST	443	49723	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:10.032071114 CEST	443	49721	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:10.032109976 CEST	49721	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:10.032784939 CEST	49721	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:10.032803059 CEST	443	49721	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:10.032814026 CEST	49721	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:10.032820940 CEST	443	49721	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:10.033473015 CEST	49722	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:10.033477068 CEST	443	49722	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:10.033488035 CEST	49722	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:10.033490896 CEST	443	49722	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:10.034009933 CEST	49724	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:10.034034014 CEST	443	49724	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:10.034046888 CEST	49724	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:10.034053087 CEST	443	49724	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:10.036339998 CEST	49727	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:10.036365986 CEST	443	49727	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:10.036375999 CEST	49728	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:10.036400080 CEST	443	49728	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:10.036504030 CEST	49727	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:10.036600113 CEST	49727	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:10.036613941 CEST	443	49727	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:10.036645889 CEST	49728	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:10.036966085 CEST	49728	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:10.036990881 CEST	443	49728	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:10.037550926 CEST	49729	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:10.037570953 CEST	443	49729	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:10.037652016 CEST	49729	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:10.037761927 CEST	49730	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:10.037761927 CEST	49729	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:10.037772894 CEST	443	49730	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:10.037786007 CEST	443	49729	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:10.037822008 CEST	49730	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:10.037966967 CEST	49730	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:10.037981033 CEST	443	49730	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:10.089504957 CEST	443	49725	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:10.089600086 CEST	443	49725	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:10.089755058 CEST	49725	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:10.089823961 CEST	49725	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:10.089823961 CEST	49725	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:10.089864016 CEST	443	49725	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:10.089896917 CEST	443	49725	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:10.091916084 CEST	49731	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:10.091948032 CEST	443	49731	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:10.092048883 CEST	49731	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:10.092175007 CEST	49731	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:10.092190027 CEST	443	49731	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:10.649966955 CEST	443	49730	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:10.650795937 CEST	49730	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:10.650821924 CEST	443	49730	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:10.651211023 CEST	49730	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:10.651217937 CEST	443	49730	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:10.656532049 CEST	443	49729	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:10.657010078 CEST	49729	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:10.657021999 CEST	443	49729	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:10.657342911 CEST	49729	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:10.657350063 CEST	443	49729	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:10.675179958 CEST	443	49728	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:10.675688028 CEST	49728	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:10.675717115 CEST	443	49728	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:10.676047087 CEST	49728	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:10.676054001 CEST	443	49728	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:10.686877012 CEST	443	49727	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:10.687262058 CEST	49727	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:10.687289953 CEST	443	49727	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:10.687637091 CEST	49727	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:10.687644005 CEST	443	49727	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:10.714337111 CEST	443	49731	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:10.720709085 CEST	49731	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:10.720733881 CEST	443	49731	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:10.721309900 CEST	49731	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:10.721317053 CEST	443	49731	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:10.749176025 CEST	443	49730	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:10.749250889 CEST	443	49730	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:10.749310970 CEST	49730	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:10.749578953 CEST	49730	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:10.749598980 CEST	443	49730	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:10.749609947 CEST	49730	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:10.749615908 CEST	443	49730	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:10.752278090 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:10.752327919 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:10.752403021 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:10.752535105 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:10.752547026 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:10.757139921 CEST	443	49729	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:10.757220030 CEST	443	49729	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:10.757272959 CEST	49729	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:10.757370949 CEST	49729	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:10.757385015 CEST	443	49729	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:10.757394075 CEST	49729	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:10.757400990 CEST	443	49729	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:10.759700060 CEST	49733	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:10.759774923 CEST	443	49733	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:10.759874105 CEST	49733	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:10.759983063 CEST	49733	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:10.760016918 CEST	443	49733	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:10.779165983 CEST	443	49728	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:10.779227972 CEST	443	49728	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:10.779294014 CEST	49728	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:10.781860113 CEST	49728	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:10.781894922 CEST	443	49728	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:10.781912088 CEST	49728	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:10.781922102 CEST	443	49728	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:10.785439968 CEST	49734	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:10.785497904 CEST	443	49734	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:10.785583973 CEST	49734	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:10.785759926 CEST	49734	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:10.785789967 CEST	443	49734	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:10.791749001 CEST	443	49727	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:10.791812897 CEST	443	49727	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:10.791852951 CEST	49727	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:10.792157888 CEST	49727	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:10.792171955 CEST	443	49727	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:10.792182922 CEST	49727	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:10.792187929 CEST	443	49727	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:10.794471025 CEST	49735	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:10.794491053 CEST	443	49735	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:10.794538021 CEST	49735	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:10.794805050 CEST	49735	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:10.794820070 CEST	443	49735	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:10.815558910 CEST	443	49731	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:10.815617085 CEST	443	49731	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:10.815779924 CEST	49731	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:10.815835953 CEST	49731	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:10.815835953 CEST	49731	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:10.815860987 CEST	443	49731	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:10.815865993 CEST	443	49731	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:10.819329977 CEST	49737	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:10.819433928 CEST	443	49737	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:10.819606066 CEST	49737	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:10.819780111 CEST	49737	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:10.819818020 CEST	443	49737	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:11.398412943 CEST	443	49734	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:11.398864985 CEST	443	49733	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:11.400643110 CEST	49734	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:11.400682926 CEST	443	49734	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:11.401695013 CEST	49734	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:11.401715040 CEST	443	49734	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:11.401983976 CEST	49733	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:11.401994944 CEST	443	49733	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:11.402790070 CEST	49733	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:11.402796984 CEST	443	49733	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:11.407836914 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:11.409539938 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:11.409559011 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:11.410226107 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:11.410232067 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:11.427860975 CEST	443	49737	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:11.428347111 CEST	49737	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:11.428386927 CEST	443	49737	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:11.429502010 CEST	49737	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:11.429507017 CEST	443	49737	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:11.432540894 CEST	443	49735	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:11.432859898 CEST	49735	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:11.432869911 CEST	443	49735	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:11.433259010 CEST	49735	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:11.433263063 CEST	443	49735	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:11.493580103 CEST	443	49734	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:11.493645906 CEST	443	49734	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:11.493746996 CEST	49734	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:11.493895054 CEST	49734	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:11.493895054 CEST	49734	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:11.493942976 CEST	443	49734	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:11.493968964 CEST	443	49734	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:11.495500088 CEST	443	49733	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:11.495546103 CEST	443	49733	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:11.495599031 CEST	49733	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:11.495728970 CEST	49733	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:11.495742083 CEST	443	49733	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:11.495770931 CEST	49733	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:11.495784044 CEST	443	49733	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:11.496715069 CEST	49739	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:11.496754885 CEST	443	49739	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:11.496814013 CEST	49739	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:11.497272015 CEST	49739	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:11.497284889 CEST	443	49739	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:11.497843027 CEST	49740	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:11.497869968 CEST	443	49740	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:11.497940063 CEST	49740	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:11.498080015 CEST	49740	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:11.498092890 CEST	443	49740	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:11.509926081 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:11.509989023 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:11.510046005 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:11.510179996 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:11.510191917 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:11.510204077 CEST	49732	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:11.510209084 CEST	443	49732	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:11.512696981 CEST	49741	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:11.512757063 CEST	443	49741	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:11.512837887 CEST	49741	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:11.512963057 CEST	49741	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:11.512980938 CEST	443	49741	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:11.522615910 CEST	443	49737	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:11.522675991 CEST	443	49737	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:11.522731066 CEST	49737	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:11.522828102 CEST	49737	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:11.522842884 CEST	443	49737	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:11.522849083 CEST	49737	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:11.522854090 CEST	443	49737	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:11.524689913 CEST	49742	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:11.524703026 CEST	443	49742	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:11.524770975 CEST	49742	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:11.524878979 CEST	49742	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:11.524893999 CEST	443	49742	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:11.532449961 CEST	443	49735	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:11.532509089 CEST	443	49735	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:11.532551050 CEST	49735	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:11.532665014 CEST	49735	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:11.532670021 CEST	443	49735	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:11.532685041 CEST	49735	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:11.532689095 CEST	443	49735	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:11.534683943 CEST	49743	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:11.534718037 CEST	443	49743	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:11.534790993 CEST	49743	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:11.534914970 CEST	49743	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:11.534934998 CEST	443	49743	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:12.106693983 CEST	443	49740	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:12.107317924 CEST	49740	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:12.107336998 CEST	443	49740	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:12.109565020 CEST	49740	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:12.109575987 CEST	443	49740	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:12.128180027 CEST	443	49742	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:12.128591061 CEST	49742	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:12.128619909 CEST	443	49742	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:12.128997087 CEST	49742	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:12.129004002 CEST	443	49742	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:12.129686117 CEST	443	49739	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:12.130135059 CEST	49739	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:12.130153894 CEST	443	49739	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:12.130285025 CEST	49739	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:12.130290031 CEST	443	49739	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:12.145216942 CEST	443	49743	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:12.147403002 CEST	49743	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:12.147403002 CEST	49743	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:12.147413015 CEST	443	49743	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:12.147427082 CEST	443	49743	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:12.161195993 CEST	443	49741	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:12.161479950 CEST	49741	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:12.161489964 CEST	443	49741	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:12.161904097 CEST	49741	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:12.161909103 CEST	443	49741	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:12.211831093 CEST	443	49740	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:12.211905003 CEST	443	49740	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:12.212013006 CEST	49740	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:12.212192059 CEST	49740	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:12.212192059 CEST	49740	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:12.212209940 CEST	443	49740	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:12.212214947 CEST	443	49740	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:12.215102911 CEST	49744	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:12.215147972 CEST	443	49744	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:12.215219975 CEST	49744	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:12.215423107 CEST	49744	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:12.215434074 CEST	443	49744	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:12.222955942 CEST	443	49742	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:12.223023891 CEST	443	49742	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:12.223160028 CEST	49742	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:12.223205090 CEST	49742	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:12.223205090 CEST	49742	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:12.223225117 CEST	443	49742	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:12.223237991 CEST	443	49742	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:12.225452900 CEST	49745	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:12.225482941 CEST	443	49745	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:12.225547075 CEST	49745	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:12.225744963 CEST	49745	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:12.225755930 CEST	443	49745	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:12.228854895 CEST	443	49739	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:12.228910923 CEST	443	49739	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:12.228957891 CEST	49739	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:12.229053974 CEST	49739	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:12.229067087 CEST	443	49739	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:12.229078054 CEST	49739	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:12.229084015 CEST	443	49739	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:12.231215000 CEST	49746	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:12.231225967 CEST	443	49746	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:12.231287003 CEST	49746	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:12.231457949 CEST	49746	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:12.231471062 CEST	443	49746	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:12.240276098 CEST	443	49743	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:12.240334988 CEST	443	49743	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:12.240426064 CEST	49743	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:12.240554094 CEST	49743	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:12.240554094 CEST	49743	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:12.240567923 CEST	443	49743	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:12.240571976 CEST	443	49743	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:12.243380070 CEST	49747	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:12.243418932 CEST	443	49747	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:12.243475914 CEST	49747	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:12.243602991 CEST	49747	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:12.243614912 CEST	443	49747	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:12.261868000 CEST	443	49741	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:12.261962891 CEST	443	49741	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:12.262011051 CEST	49741	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:12.262089014 CEST	49741	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:12.262099028 CEST	443	49741	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:12.262110949 CEST	49741	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:12.262115955 CEST	443	49741	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:12.264396906 CEST	49748	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:12.264432907 CEST	443	49748	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:12.264501095 CEST	49748	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:12.264635086 CEST	49748	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:12.264646053 CEST	443	49748	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:12.841512918 CEST	443	49746	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:12.842166901 CEST	49746	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:12.842195988 CEST	443	49746	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:12.842628002 CEST	49746	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:12.842633963 CEST	443	49746	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:12.846399069 CEST	443	49745	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:12.846960068 CEST	49745	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:12.846973896 CEST	443	49745	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:12.847366095 CEST	49745	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:12.847371101 CEST	443	49745	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:12.848472118 CEST	443	49744	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:12.848841906 CEST	49744	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:12.848874092 CEST	443	49744	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:12.849343061 CEST	49744	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:12.849349022 CEST	443	49744	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:12.877409935 CEST	443	49747	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:12.877963066 CEST	49747	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:12.877980947 CEST	443	49747	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:12.878613949 CEST	49747	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:12.878619909 CEST	443	49747	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:12.884394884 CEST	443	49748	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:12.884680986 CEST	49748	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:12.884701967 CEST	443	49748	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:12.885041952 CEST	49748	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:12.885047913 CEST	443	49748	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:12.939513922 CEST	443	49746	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:12.939572096 CEST	443	49746	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:12.939649105 CEST	49746	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:12.939877033 CEST	49746	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:12.939894915 CEST	443	49746	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:12.939904928 CEST	49746	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:12.939909935 CEST	443	49746	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:12.943116903 CEST	49750	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:12.943152905 CEST	443	49750	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:12.943238974 CEST	49750	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:12.943399906 CEST	49750	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:12.943413019 CEST	443	49750	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:12.946351051 CEST	443	49745	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:12.946413040 CEST	443	49745	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:12.946454048 CEST	49745	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:12.946567059 CEST	49745	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:12.946571112 CEST	443	49745	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:12.946585894 CEST	49745	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:12.946588993 CEST	443	49745	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:12.948908091 CEST	49751	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:12.948940039 CEST	443	49751	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:12.949004889 CEST	49751	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:12.949130058 CEST	49751	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:12.949137926 CEST	443	49751	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:12.951167107 CEST	443	49744	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:12.951242924 CEST	443	49744	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:12.951397896 CEST	49744	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:12.951397896 CEST	49744	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:12.951397896 CEST	49744	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:12.953243971 CEST	49752	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:12.953283072 CEST	443	49752	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:12.953358889 CEST	49752	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:12.953478098 CEST	49752	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:12.953490973 CEST	443	49752	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:12.979908943 CEST	443	49747	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:12.979994059 CEST	443	49747	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:12.980065107 CEST	49747	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:12.980180025 CEST	49747	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:12.980201960 CEST	443	49747	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:12.980214119 CEST	49747	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:12.980218887 CEST	443	49747	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:12.982903957 CEST	49753	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:12.982943058 CEST	443	49753	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:12.983159065 CEST	49753	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:12.983159065 CEST	49753	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:12.983196974 CEST	443	49753	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:12.984862089 CEST	443	49748	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:12.984924078 CEST	443	49748	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:12.984972954 CEST	49748	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:12.985166073 CEST	49748	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:12.985166073 CEST	49748	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:12.985186100 CEST	443	49748	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:12.985200882 CEST	443	49748	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:12.987225056 CEST	49754	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:12.987232924 CEST	443	49754	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:12.987360954 CEST	49754	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:12.987492085 CEST	49754	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:12.987503052 CEST	443	49754	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:13.254594088 CEST	49744	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:13.254616976 CEST	443	49744	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:13.556308031 CEST	443	49750	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:13.556874990 CEST	49750	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:13.556895971 CEST	443	49750	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:13.557317019 CEST	49750	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:13.557328939 CEST	443	49750	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:13.571439028 CEST	443	49752	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:13.571944952 CEST	49752	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:13.571969986 CEST	443	49752	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:13.572422981 CEST	49752	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:13.572428942 CEST	443	49752	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:13.574285030 CEST	443	49751	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:13.574748039 CEST	49751	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:13.574769020 CEST	443	49751	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:13.576328993 CEST	49751	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:13.576333046 CEST	443	49751	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:13.611234903 CEST	443	49754	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:13.611613035 CEST	443	49753	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:13.611723900 CEST	49754	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:13.611737013 CEST	443	49754	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:13.612222910 CEST	49754	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:13.612230062 CEST	443	49754	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:13.612385988 CEST	49753	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:13.612394094 CEST	443	49753	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:13.613040924 CEST	49753	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:13.613048077 CEST	443	49753	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:13.656043053 CEST	443	49750	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:13.656110048 CEST	443	49750	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:13.656168938 CEST	49750	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:13.656343937 CEST	49750	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:13.656363010 CEST	443	49750	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:13.656373978 CEST	49750	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:13.656380892 CEST	443	49750	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:13.659423113 CEST	49755	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:13.659461021 CEST	443	49755	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:13.659557104 CEST	49755	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:13.659660101 CEST	49755	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:13.659676075 CEST	443	49755	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:13.671231031 CEST	443	49752	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:13.671319008 CEST	443	49752	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:13.671381950 CEST	49752	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:13.671431065 CEST	49752	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:13.671447039 CEST	443	49752	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:13.671458006 CEST	49752	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:13.671463013 CEST	443	49752	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:13.674081087 CEST	49756	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:13.674109936 CEST	443	49756	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:13.674170017 CEST	49756	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:13.674407005 CEST	49756	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:13.674420118 CEST	443	49756	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:13.674499989 CEST	443	49751	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:13.674556017 CEST	443	49751	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:13.674643993 CEST	49751	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:13.674840927 CEST	49751	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:13.674860954 CEST	443	49751	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:13.674873114 CEST	49751	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:13.674879074 CEST	443	49751	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:13.677668095 CEST	49757	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:13.677701950 CEST	443	49757	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:13.677778006 CEST	49757	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:13.677962065 CEST	49757	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:13.677973986 CEST	443	49757	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:13.711858988 CEST	443	49754	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:13.711987019 CEST	443	49754	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:13.712148905 CEST	49754	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:13.712210894 CEST	49754	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:13.712210894 CEST	49754	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:13.712230921 CEST	443	49754	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:13.712241888 CEST	443	49754	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:13.713083029 CEST	443	49753	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:13.713156939 CEST	443	49753	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:13.713294983 CEST	49753	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:13.713432074 CEST	49753	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:13.713432074 CEST	49753	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:13.713439941 CEST	443	49753	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:13.713449955 CEST	443	49753	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:13.715405941 CEST	49758	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:13.715445995 CEST	443	49758	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:13.715915918 CEST	49758	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:13.716099024 CEST	49758	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:13.716110945 CEST	443	49758	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:13.716212034 CEST	49759	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:13.716244936 CEST	443	49759	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:13.716336012 CEST	49759	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:13.716449976 CEST	49759	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:13.716464996 CEST	443	49759	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:14.273411036 CEST	443	49755	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:14.274358034 CEST	49755	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:14.274393082 CEST	443	49755	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:14.274818897 CEST	49755	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:14.274833918 CEST	443	49755	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:14.298732996 CEST	443	49757	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:14.299233913 CEST	49757	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:14.299247980 CEST	443	49757	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:14.299819946 CEST	49757	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:14.299823999 CEST	443	49757	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:14.307538033 CEST	443	49756	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:14.308167934 CEST	49756	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:14.308207989 CEST	443	49756	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:14.308659077 CEST	49756	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:14.308665991 CEST	443	49756	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:14.329799891 CEST	443	49758	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:14.330284119 CEST	49758	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:14.330296040 CEST	443	49758	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:14.330791950 CEST	49758	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:14.330796003 CEST	443	49758	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:14.354243994 CEST	443	49759	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:14.354724884 CEST	49759	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:14.354736090 CEST	443	49759	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:14.355392933 CEST	49759	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:14.355417013 CEST	443	49759	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:14.371431112 CEST	443	49755	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:14.371476889 CEST	443	49755	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:14.371527910 CEST	49755	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:14.371691942 CEST	49755	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:14.371707916 CEST	443	49755	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:14.371712923 CEST	49755	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:14.371718884 CEST	443	49755	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:14.374522924 CEST	49762	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:14.374562025 CEST	443	49762	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:14.374665976 CEST	49762	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:14.374823093 CEST	49762	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:14.374833107 CEST	443	49762	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:14.396676064 CEST	443	49757	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:14.396756887 CEST	443	49757	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:14.396825075 CEST	49757	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:14.396910906 CEST	49757	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:14.396927118 CEST	443	49757	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:14.396955013 CEST	49757	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:14.396961927 CEST	443	49757	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:14.399832010 CEST	49763	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:14.399867058 CEST	443	49763	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:14.399928093 CEST	49763	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:14.400204897 CEST	49763	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:14.400219917 CEST	443	49763	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:14.408483982 CEST	443	49756	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:14.408530951 CEST	443	49756	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:14.408720970 CEST	49756	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:14.408783913 CEST	49756	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:14.408791065 CEST	443	49756	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:14.408802986 CEST	49756	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:14.408807039 CEST	443	49756	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:14.410965919 CEST	49764	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:14.411003113 CEST	443	49764	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:14.411061049 CEST	49764	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:14.411184072 CEST	49764	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:14.411200047 CEST	443	49764	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:14.444263935 CEST	443	49758	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:14.444344997 CEST	443	49758	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:14.444477081 CEST	49758	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:14.444669962 CEST	49758	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:14.444689035 CEST	443	49758	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:14.444704056 CEST	49758	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:14.444710016 CEST	443	49758	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:14.447798014 CEST	49765	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:14.447828054 CEST	443	49765	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:14.447993994 CEST	49765	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:14.448401928 CEST	49765	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:14.448412895 CEST	443	49765	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:14.457093000 CEST	443	49759	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:14.457160950 CEST	443	49759	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:14.457401991 CEST	49759	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:14.457448959 CEST	49759	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:14.457448959 CEST	49759	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:14.457472086 CEST	443	49759	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:14.457482100 CEST	443	49759	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:14.461532116 CEST	49766	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:14.461544991 CEST	443	49766	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:14.461724043 CEST	49766	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:14.462680101 CEST	49766	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:14.462690115 CEST	443	49766	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:14.989979029 CEST	443	49762	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:14.990607977 CEST	49762	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:14.990614891 CEST	443	49762	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:14.991180897 CEST	49762	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:14.991184950 CEST	443	49762	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:15.047089100 CEST	443	49764	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:15.048907042 CEST	49764	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:15.048942089 CEST	443	49764	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:15.049240112 CEST	443	49763	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:15.049375057 CEST	49764	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:15.049381018 CEST	443	49764	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:15.049712896 CEST	49763	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:15.049741983 CEST	443	49763	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:15.050061941 CEST	49763	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:15.050066948 CEST	443	49763	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:15.068593025 CEST	443	49765	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:15.069607019 CEST	49765	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:15.069618940 CEST	443	49765	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:15.070008993 CEST	49765	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:15.070014000 CEST	443	49765	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:15.085016966 CEST	443	49762	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:15.085165977 CEST	443	49762	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:15.085252047 CEST	49762	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:15.085432053 CEST	49762	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:15.085432053 CEST	49762	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:15.085453033 CEST	443	49762	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:15.085460901 CEST	443	49762	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:15.088232994 CEST	49767	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:15.088272095 CEST	443	49767	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:15.088438034 CEST	49767	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:15.088596106 CEST	49767	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:15.088612080 CEST	443	49767	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:15.107273102 CEST	443	49766	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:15.109697104 CEST	49766	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:15.109708071 CEST	443	49766	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:15.110168934 CEST	49766	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:15.110172987 CEST	443	49766	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:15.146579027 CEST	443	49764	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:15.146646976 CEST	443	49764	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:15.146815062 CEST	49764	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:15.146858931 CEST	49764	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:15.146858931 CEST	49764	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:15.146881104 CEST	443	49764	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:15.146894932 CEST	443	49764	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:15.149262905 CEST	49768	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:15.149293900 CEST	443	49768	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:15.149374962 CEST	49768	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:15.149488926 CEST	49768	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:15.149501085 CEST	443	49768	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:15.151190996 CEST	443	49763	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:15.151248932 CEST	443	49763	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:15.151401997 CEST	49763	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:15.151443958 CEST	49763	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:15.151443958 CEST	49763	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:15.151464939 CEST	443	49763	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:15.151480913 CEST	443	49763	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:15.153533936 CEST	49769	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:15.153559923 CEST	443	49769	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:15.153630972 CEST	49769	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:15.153763056 CEST	49769	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:15.153778076 CEST	443	49769	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:15.175230026 CEST	443	49765	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:15.175293922 CEST	443	49765	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:15.175407887 CEST	49765	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:15.175604105 CEST	49765	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:15.175604105 CEST	49765	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:15.175620079 CEST	443	49765	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:15.175628901 CEST	443	49765	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:15.177813053 CEST	49770	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:15.177830935 CEST	443	49770	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:15.177892923 CEST	49770	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:15.178029060 CEST	49770	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:15.178035975 CEST	443	49770	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:15.217370033 CEST	443	49766	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:15.217432976 CEST	443	49766	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:15.217593908 CEST	49766	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:15.217686892 CEST	49766	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:15.217686892 CEST	49766	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:15.217694998 CEST	443	49766	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:15.217700958 CEST	443	49766	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:15.220447063 CEST	49771	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:15.220485926 CEST	443	49771	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:15.220567942 CEST	49771	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:15.220726967 CEST	49771	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:15.220741034 CEST	443	49771	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:16.507833958 CEST	443	49770	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:16.508359909 CEST	443	49767	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:16.508462906 CEST	49770	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:16.508521080 CEST	443	49770	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:16.508697033 CEST	49767	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:16.508723021 CEST	443	49767	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:16.508980989 CEST	49770	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:16.508997917 CEST	443	49770	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:16.509161949 CEST	49767	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:16.509167910 CEST	443	49767	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:16.511215925 CEST	443	49768	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:16.511487961 CEST	49768	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:16.511507034 CEST	443	49768	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:16.511822939 CEST	49768	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:16.511826992 CEST	443	49768	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:16.515924931 CEST	443	49771	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:16.516151905 CEST	49771	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:16.516158104 CEST	443	49771	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:16.516472101 CEST	49771	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:16.516475916 CEST	443	49771	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:16.516583920 CEST	443	49769	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:16.516803026 CEST	49769	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:16.516840935 CEST	443	49769	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:16.517116070 CEST	49769	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:16.517132044 CEST	443	49769	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:16.601952076 CEST	443	49770	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:16.602031946 CEST	443	49770	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:16.602300882 CEST	49770	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:16.603199005 CEST	49770	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:16.603199005 CEST	49770	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:16.603246927 CEST	443	49770	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:16.603280067 CEST	443	49770	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:16.603614092 CEST	443	49767	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:16.603720903 CEST	443	49767	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:16.603796005 CEST	49767	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:16.603915930 CEST	49767	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:16.603930950 CEST	443	49767	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:16.603969097 CEST	49767	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:16.603975058 CEST	443	49767	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:16.605029106 CEST	49772	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:16.605072975 CEST	443	49772	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:16.605829954 CEST	49773	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:16.605859995 CEST	443	49773	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:16.605866909 CEST	49772	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:16.605911016 CEST	49773	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:16.606014967 CEST	49772	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:16.606025934 CEST	443	49772	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:16.606048107 CEST	49773	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:16.606060028 CEST	443	49773	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:16.608067036 CEST	443	49768	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:16.608154058 CEST	443	49768	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:16.608256102 CEST	49768	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:16.608278036 CEST	49768	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:16.608292103 CEST	443	49768	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:16.608303070 CEST	49768	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:16.608308077 CEST	443	49768	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:16.610223055 CEST	49774	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:16.610232115 CEST	443	49774	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:16.610306025 CEST	49774	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:16.610425949 CEST	49774	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:16.610435009 CEST	443	49774	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:16.617072105 CEST	443	49769	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:16.617197990 CEST	443	49769	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:16.617249966 CEST	49769	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:16.617273092 CEST	49769	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:16.617279053 CEST	443	49769	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:16.617289066 CEST	49769	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:16.617292881 CEST	443	49769	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:16.617578983 CEST	443	49771	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:16.617635965 CEST	443	49771	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:16.619051933 CEST	49775	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:16.619074106 CEST	443	49775	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:16.619096041 CEST	49771	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:16.619142056 CEST	49775	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:16.619174957 CEST	49771	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:16.619182110 CEST	443	49771	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:16.619194984 CEST	49771	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:16.619199038 CEST	443	49771	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:16.619266987 CEST	49775	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:16.619271040 CEST	443	49775	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:16.621140003 CEST	49776	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:16.621162891 CEST	443	49776	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:16.621347904 CEST	49776	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:16.621347904 CEST	49776	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:16.621370077 CEST	443	49776	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:17.213510036 CEST	443	49772	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:17.215501070 CEST	443	49774	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:17.215678930 CEST	49772	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:17.215692997 CEST	443	49772	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:17.215800047 CEST	49774	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:17.215820074 CEST	443	49774	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:17.216173887 CEST	49772	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:17.216176987 CEST	443	49772	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:17.216248989 CEST	49774	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:17.216257095 CEST	443	49774	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:17.222842932 CEST	443	49775	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:17.223181963 CEST	49775	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:17.223190069 CEST	443	49775	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:17.223537922 CEST	49775	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:17.223541021 CEST	443	49775	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:17.225858927 CEST	443	49776	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:17.226263046 CEST	49776	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:17.226277113 CEST	443	49776	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:17.226881027 CEST	49776	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:17.226888895 CEST	443	49776	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:17.240412951 CEST	443	49773	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:17.241348028 CEST	49773	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:17.241378069 CEST	443	49773	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:17.242229939 CEST	49773	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:17.242237091 CEST	443	49773	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:17.309056044 CEST	443	49772	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:17.309634924 CEST	443	49772	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:17.309709072 CEST	49772	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:17.309782028 CEST	49772	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:17.309782028 CEST	49772	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:17.309823036 CEST	443	49772	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:17.309849977 CEST	443	49772	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:17.310661077 CEST	443	49774	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:17.310724020 CEST	443	49774	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:17.310782909 CEST	49774	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:17.310848951 CEST	49774	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:17.310872078 CEST	443	49774	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:17.310885906 CEST	49774	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:17.310895920 CEST	443	49774	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:17.313328028 CEST	49777	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:17.313363075 CEST	443	49777	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:17.313424110 CEST	49777	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:17.313595057 CEST	49777	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:17.313606977 CEST	443	49777	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:17.313950062 CEST	49778	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:17.313956976 CEST	443	49778	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:17.314021111 CEST	49778	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:17.314130068 CEST	49778	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:17.314142942 CEST	443	49778	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:17.318033934 CEST	443	49775	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:17.318094015 CEST	443	49775	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:17.318146944 CEST	49775	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:17.318257093 CEST	49775	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:17.318257093 CEST	49775	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:17.318273067 CEST	443	49775	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:17.318291903 CEST	443	49775	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:17.320147991 CEST	49779	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:17.320178032 CEST	443	49779	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:17.320302010 CEST	49779	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:17.320415020 CEST	49779	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:17.320426941 CEST	443	49779	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:17.320972919 CEST	443	49776	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:17.321037054 CEST	443	49776	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:17.321094036 CEST	49776	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:17.321175098 CEST	49776	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:17.321175098 CEST	49776	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:17.321183920 CEST	443	49776	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:17.321192980 CEST	443	49776	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:17.322896957 CEST	49780	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:17.322938919 CEST	443	49780	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:17.323025942 CEST	49780	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:17.323131084 CEST	49780	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:17.323144913 CEST	443	49780	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:17.346115112 CEST	443	49773	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:17.346185923 CEST	443	49773	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:17.346255064 CEST	49773	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:17.346368074 CEST	49773	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:17.346386909 CEST	443	49773	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:17.346404076 CEST	49773	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:17.346409082 CEST	443	49773	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:17.348512888 CEST	49781	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:17.348546982 CEST	443	49781	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:17.348618031 CEST	49781	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:17.348742008 CEST	49781	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:17.348752975 CEST	443	49781	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:17.927036047 CEST	443	49779	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:17.927598953 CEST	49779	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:17.927614927 CEST	443	49779	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:17.928005934 CEST	49779	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:17.928011894 CEST	443	49779	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:17.929306030 CEST	443	49780	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:17.929480076 CEST	443	49777	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:17.932559967 CEST	49780	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:17.932569981 CEST	443	49780	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:17.932979107 CEST	49780	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:17.932982922 CEST	443	49780	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:17.933192015 CEST	49777	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:17.933223009 CEST	443	49777	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:17.933521032 CEST	49777	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:17.933526993 CEST	443	49777	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:17.950018883 CEST	443	49778	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:17.950423002 CEST	49778	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:17.950437069 CEST	443	49778	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:17.950872898 CEST	49778	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:17.950885057 CEST	443	49778	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:17.969130039 CEST	443	49781	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:17.969618082 CEST	49781	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:17.969645023 CEST	443	49781	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:17.970107079 CEST	49781	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:17.970113039 CEST	443	49781	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:18.025116920 CEST	443	49779	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:18.025183916 CEST	443	49779	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:18.025346994 CEST	49779	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:18.025734901 CEST	49779	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:18.025734901 CEST	49779	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:18.025758982 CEST	443	49779	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:18.025769949 CEST	443	49779	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:18.028193951 CEST	49782	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:18.028254032 CEST	443	49782	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:18.028330088 CEST	49782	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:18.028479099 CEST	49782	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:18.028497934 CEST	443	49782	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:18.034648895 CEST	443	49780	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:18.034713030 CEST	443	49780	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:18.034820080 CEST	49780	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:18.034895897 CEST	49780	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:18.034895897 CEST	49780	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:18.034913063 CEST	443	49780	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:18.034923077 CEST	443	49780	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:18.037122965 CEST	49783	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:18.037158012 CEST	443	49783	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:18.037252903 CEST	49783	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:18.037442923 CEST	49783	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:18.037453890 CEST	443	49783	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:18.046658039 CEST	443	49777	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:18.046818972 CEST	443	49777	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:18.046911955 CEST	49777	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:18.047013998 CEST	49777	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:18.047043085 CEST	443	49777	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:18.047056913 CEST	49777	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:18.047065973 CEST	443	49777	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:18.049570084 CEST	49784	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:18.049624920 CEST	443	49784	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:18.049688101 CEST	49784	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:18.049809933 CEST	49784	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:18.049825907 CEST	443	49784	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:18.053231955 CEST	443	49778	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:18.053293943 CEST	443	49778	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:18.053400993 CEST	49778	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:18.054270029 CEST	49778	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:18.054294109 CEST	443	49778	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:18.054317951 CEST	49778	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:18.054325104 CEST	443	49778	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:18.056338072 CEST	49785	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:18.056369066 CEST	443	49785	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:18.056440115 CEST	49785	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:18.056540012 CEST	49785	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:18.056550980 CEST	443	49785	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:18.069818020 CEST	443	49781	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:18.069905043 CEST	443	49781	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:18.069957972 CEST	49781	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:18.070332050 CEST	49781	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:18.070354939 CEST	443	49781	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:18.070369959 CEST	49781	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:18.070378065 CEST	443	49781	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:18.072140932 CEST	49786	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:18.072160006 CEST	443	49786	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:18.072227955 CEST	49786	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:18.072355986 CEST	49786	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:18.072365999 CEST	443	49786	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:18.893323898 CEST	443	49783	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:18.893608093 CEST	443	49782	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:18.893625021 CEST	443	49786	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:18.894314051 CEST	49782	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:18.894340038 CEST	443	49782	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:18.894491911 CEST	443	49785	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:18.894531012 CEST	49783	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:18.894556999 CEST	443	49783	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:18.894773006 CEST	49782	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:18.894778967 CEST	443	49782	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:18.894933939 CEST	49783	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:18.894938946 CEST	443	49783	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:18.895035028 CEST	49785	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:18.895090103 CEST	443	49785	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:18.895137072 CEST	443	49784	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:18.895168066 CEST	49786	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:18.895184994 CEST	443	49786	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:18.895473003 CEST	49785	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:18.895483971 CEST	443	49785	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:18.895541906 CEST	49786	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:18.895551920 CEST	443	49786	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:18.895718098 CEST	49784	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:18.895734072 CEST	443	49784	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:18.896054983 CEST	49784	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:18.896061897 CEST	443	49784	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:18.994213104 CEST	443	49783	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:18.994286060 CEST	443	49783	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:18.994335890 CEST	49783	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:18.994522095 CEST	49783	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:18.994544983 CEST	443	49783	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:18.994874954 CEST	49783	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:18.994888067 CEST	443	49783	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:18.995347023 CEST	443	49786	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:18.995572090 CEST	443	49786	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:18.995624065 CEST	49786	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:18.995728970 CEST	49786	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:18.995748043 CEST	443	49786	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:18.995759964 CEST	49786	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:18.995765924 CEST	443	49786	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:18.997267008 CEST	443	49785	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:18.997315884 CEST	443	49785	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:18.997364044 CEST	49785	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:18.997597933 CEST	49787	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:18.997606039 CEST	443	49782	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:18.997636080 CEST	443	49787	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:18.997644901 CEST	443	49782	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:18.997800112 CEST	49787	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:18.997801065 CEST	49785	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:18.997807980 CEST	443	49785	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:18.997823000 CEST	49782	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:18.997824907 CEST	49785	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:18.997829914 CEST	443	49785	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:18.998070002 CEST	49788	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:18.998101950 CEST	443	49788	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:18.998153925 CEST	49788	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:18.998192072 CEST	49782	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:18.998212099 CEST	443	49782	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:18.999217033 CEST	49788	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:18.999233007 CEST	443	49788	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:18.999506950 CEST	49787	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:18.999521971 CEST	443	49787	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:18.999922037 CEST	443	49784	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:18.999975920 CEST	443	49784	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:19.000017881 CEST	49784	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:19.000222921 CEST	49784	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:19.000235081 CEST	443	49784	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:19.000257969 CEST	49784	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:19.000262976 CEST	443	49784	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:19.001718998 CEST	49789	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:19.001740932 CEST	443	49789	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:19.001791954 CEST	49789	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:19.001936913 CEST	49789	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:19.001949072 CEST	443	49789	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:19.002537966 CEST	49790	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:19.002548933 CEST	443	49790	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:19.002600908 CEST	49790	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:19.003473997 CEST	49791	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:19.003492117 CEST	443	49791	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:19.003561974 CEST	49791	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:19.003635883 CEST	49790	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:19.003643990 CEST	443	49790	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:19.003730059 CEST	49791	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:19.003747940 CEST	443	49791	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:19.609752893 CEST	443	49790	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:19.610264063 CEST	49790	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:19.610284090 CEST	443	49790	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:19.610790014 CEST	49790	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:19.610795021 CEST	443	49790	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:19.611655951 CEST	443	49787	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:19.612104893 CEST	49787	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:19.612118959 CEST	443	49787	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:19.612564087 CEST	49787	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:19.612570047 CEST	443	49787	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:19.620524883 CEST	443	49788	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:19.621021986 CEST	49788	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:19.621052980 CEST	443	49788	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:19.621443987 CEST	49788	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:19.621452093 CEST	443	49788	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:19.627218962 CEST	443	49791	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:19.627610922 CEST	49791	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:19.627630949 CEST	443	49791	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:19.628200054 CEST	49791	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:19.628206015 CEST	443	49791	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:19.654036999 CEST	443	49789	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:19.660984993 CEST	49789	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:19.661005020 CEST	443	49789	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:19.661488056 CEST	49789	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:19.661493063 CEST	443	49789	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:19.707711935 CEST	443	49790	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:19.707781076 CEST	443	49790	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:19.707956076 CEST	49790	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:19.708013058 CEST	49790	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:19.708030939 CEST	443	49790	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:19.708066940 CEST	49790	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:19.708072901 CEST	443	49790	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:19.710797071 CEST	49792	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:19.710845947 CEST	443	49792	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:19.710958958 CEST	49792	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:19.711086988 CEST	49792	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:19.711106062 CEST	443	49792	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:19.712340117 CEST	443	49787	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:19.712409973 CEST	443	49787	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:19.712454081 CEST	49787	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:19.712551117 CEST	49787	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:19.712564945 CEST	443	49787	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:19.712575912 CEST	49787	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:19.712580919 CEST	443	49787	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:19.714504004 CEST	49793	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:19.714536905 CEST	443	49793	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:19.714692116 CEST	49793	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:19.714730978 CEST	49793	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:19.714736938 CEST	443	49793	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:19.721194983 CEST	443	49788	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:19.721249104 CEST	443	49788	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:19.721299887 CEST	49788	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:19.721457958 CEST	49788	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:19.721471071 CEST	443	49788	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:19.721479893 CEST	49788	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:19.721484900 CEST	443	49788	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:19.723398924 CEST	49794	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:19.723414898 CEST	443	49794	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:19.723505974 CEST	49794	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:19.723794937 CEST	49794	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:19.723805904 CEST	443	49794	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:19.760890961 CEST	443	49789	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:19.761060953 CEST	443	49789	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:19.761128902 CEST	49789	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:19.761166096 CEST	49789	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:19.761184931 CEST	443	49789	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:19.761192083 CEST	49789	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:19.761198044 CEST	443	49789	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:19.763160944 CEST	49795	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:19.763195038 CEST	443	49795	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:19.763267994 CEST	49795	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:19.763422966 CEST	49795	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:19.763433933 CEST	443	49795	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:19.764092922 CEST	443	49791	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:19.764143944 CEST	443	49791	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:19.764255047 CEST	49791	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:19.764271021 CEST	49791	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:19.764276981 CEST	443	49791	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:19.764286995 CEST	49791	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:19.764290094 CEST	443	49791	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:19.766328096 CEST	49796	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:19.766415119 CEST	443	49796	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:19.766505003 CEST	49796	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:19.766618013 CEST	49796	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:19.766648054 CEST	443	49796	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:20.321324110 CEST	443	49792	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:20.321986914 CEST	49792	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:20.322004080 CEST	443	49792	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:20.322751999 CEST	49792	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:20.322758913 CEST	443	49792	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:20.335911036 CEST	443	49794	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:20.336535931 CEST	49794	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:20.336549997 CEST	443	49794	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:20.337521076 CEST	49794	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:20.337527037 CEST	443	49794	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:20.351496935 CEST	443	49793	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:20.352008104 CEST	49793	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:20.352018118 CEST	443	49793	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:20.352519035 CEST	49793	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:20.352524042 CEST	443	49793	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:20.385143995 CEST	443	49795	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:20.385574102 CEST	49795	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:20.385601044 CEST	443	49795	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:20.386092901 CEST	49795	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:20.386099100 CEST	443	49795	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:20.403062105 CEST	443	49796	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:20.403563976 CEST	49796	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:20.403590918 CEST	443	49796	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:20.403966904 CEST	49796	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:20.403974056 CEST	443	49796	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:20.425228119 CEST	443	49792	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:20.425299883 CEST	443	49792	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:20.425436974 CEST	49792	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:20.425482035 CEST	49792	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:20.425482035 CEST	49792	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:20.425503016 CEST	443	49792	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:20.425515890 CEST	443	49792	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:20.427815914 CEST	49797	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:20.427866936 CEST	443	49797	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:20.427973986 CEST	49797	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:20.428078890 CEST	49797	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:20.428092957 CEST	443	49797	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:20.437103987 CEST	443	49794	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:20.437170029 CEST	443	49794	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:20.437222004 CEST	49794	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:20.437318087 CEST	49794	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:20.437340021 CEST	443	49794	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:20.437345982 CEST	49794	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:20.437350988 CEST	443	49794	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:20.439416885 CEST	49798	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:20.439446926 CEST	443	49798	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:20.439582109 CEST	49798	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:20.439750910 CEST	49798	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:20.439755917 CEST	443	49798	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:20.447762966 CEST	443	49793	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:20.447835922 CEST	443	49793	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:20.447913885 CEST	49793	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:20.448353052 CEST	49793	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:20.448368073 CEST	443	49793	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:20.448378086 CEST	49793	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:20.448381901 CEST	443	49793	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:20.450263023 CEST	49799	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:20.450341940 CEST	443	49799	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:20.450428009 CEST	49799	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:20.450545073 CEST	49799	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:20.450563908 CEST	443	49799	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:20.484630108 CEST	443	49795	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:20.484781981 CEST	443	49795	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:20.484875917 CEST	49795	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:20.484936953 CEST	49795	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:20.484955072 CEST	443	49795	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:20.484973907 CEST	49795	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:20.484980106 CEST	443	49795	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:20.486901999 CEST	49800	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:20.486936092 CEST	443	49800	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:20.487009048 CEST	49800	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:20.487145901 CEST	49800	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:20.487158060 CEST	443	49800	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:20.502854109 CEST	443	49796	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:20.502916098 CEST	443	49796	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:20.503057003 CEST	49796	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:20.503226995 CEST	49796	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:20.503241062 CEST	443	49796	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:20.503252983 CEST	49796	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:20.503258944 CEST	443	49796	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:20.505203962 CEST	49801	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:20.505244017 CEST	443	49801	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:20.505321026 CEST	49801	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:20.505450010 CEST	49801	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:20.505458117 CEST	443	49801	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:21.037692070 CEST	443	49797	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:21.046201944 CEST	49797	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:21.046216011 CEST	443	49797	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:21.046968937 CEST	49797	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:21.046973944 CEST	443	49797	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:21.070921898 CEST	443	49798	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:21.075282097 CEST	443	49799	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:21.102272034 CEST	49798	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:21.102284908 CEST	443	49798	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:21.103255987 CEST	49798	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:21.103260040 CEST	443	49798	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:21.103986025 CEST	49799	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:21.104068041 CEST	443	49799	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:21.105567932 CEST	443	49800	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:21.109930992 CEST	49799	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:21.109947920 CEST	443	49799	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:21.110824108 CEST	49800	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:21.110833883 CEST	443	49800	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:21.111460924 CEST	49800	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:21.111466885 CEST	443	49800	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:21.112210035 CEST	443	49801	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:21.134200096 CEST	49801	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:21.134262085 CEST	443	49801	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:21.134928942 CEST	49801	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:21.134936094 CEST	443	49801	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:21.141096115 CEST	443	49797	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:21.141117096 CEST	443	49797	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:21.141168118 CEST	443	49797	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:21.141179085 CEST	49797	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:21.141231060 CEST	49797	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:21.141464949 CEST	49797	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:21.141464949 CEST	49797	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:21.141483068 CEST	443	49797	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:21.141490936 CEST	443	49797	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:21.159564018 CEST	49802	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:21.159614086 CEST	443	49802	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:21.159684896 CEST	49802	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:21.159835100 CEST	49802	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:21.159852982 CEST	443	49802	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:21.197463036 CEST	443	49798	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:21.197526932 CEST	443	49798	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:21.197659969 CEST	49798	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:21.197897911 CEST	49798	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:21.197897911 CEST	49798	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:21.197912931 CEST	443	49798	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:21.197921991 CEST	443	49798	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:21.200845957 CEST	49803	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:21.200880051 CEST	443	49803	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:21.200979948 CEST	49803	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:21.201138020 CEST	49803	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:21.201148987 CEST	443	49803	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:21.211714983 CEST	443	49800	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:21.211743116 CEST	443	49800	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:21.211796999 CEST	49800	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:21.211808920 CEST	443	49800	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:21.211947918 CEST	443	49800	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:21.211999893 CEST	49800	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:21.212018013 CEST	443	49800	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:21.212028027 CEST	49800	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:21.212028027 CEST	49800	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:21.212034941 CEST	443	49800	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:21.212037086 CEST	443	49800	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:21.213756084 CEST	443	49799	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:21.213820934 CEST	443	49799	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:21.213886023 CEST	49799	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:21.213967085 CEST	49799	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:21.213988066 CEST	443	49799	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:21.213999987 CEST	49799	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:21.214004993 CEST	443	49799	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:21.214287043 CEST	49804	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:21.214329004 CEST	443	49804	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:21.214410067 CEST	49804	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:21.214550018 CEST	49804	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:21.214564085 CEST	443	49804	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:21.215837002 CEST	49805	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:21.215866089 CEST	443	49805	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:21.215929985 CEST	49805	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:21.216037989 CEST	49805	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:21.216044903 CEST	443	49805	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:21.227436066 CEST	443	49801	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:21.227461100 CEST	443	49801	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:21.227528095 CEST	443	49801	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:21.227541924 CEST	49801	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:21.227576971 CEST	49801	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:21.227741957 CEST	49801	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:21.227762938 CEST	443	49801	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:21.227775097 CEST	49801	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:21.227781057 CEST	443	49801	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:21.229887962 CEST	49806	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:21.229912996 CEST	443	49806	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:21.230021954 CEST	49806	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:21.230151892 CEST	49806	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:21.230166912 CEST	443	49806	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:21.783216953 CEST	443	49802	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:21.783819914 CEST	49802	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:21.783849955 CEST	443	49802	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:21.784290075 CEST	49802	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:21.784296036 CEST	443	49802	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:21.834116936 CEST	443	49804	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:21.834738016 CEST	49804	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:21.834755898 CEST	443	49804	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:21.835330009 CEST	49804	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:21.835335970 CEST	443	49804	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:21.839241982 CEST	443	49805	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:21.839576960 CEST	49805	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:21.839598894 CEST	443	49805	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:21.840020895 CEST	49805	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:21.840033054 CEST	443	49805	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:21.852058887 CEST	443	49803	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:21.852425098 CEST	49803	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:21.852456093 CEST	443	49803	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:21.852813959 CEST	49803	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:21.852818966 CEST	443	49803	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:21.870213985 CEST	443	49806	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:21.870579004 CEST	49806	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:21.870608091 CEST	443	49806	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:21.871004105 CEST	49806	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:21.871011972 CEST	443	49806	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:21.884308100 CEST	443	49802	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:21.884331942 CEST	443	49802	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:21.884402990 CEST	49802	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:21.884426117 CEST	443	49802	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:21.884495020 CEST	443	49802	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:21.884543896 CEST	49802	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:21.884637117 CEST	49802	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:21.884656906 CEST	443	49802	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:21.884669065 CEST	49802	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:21.884674072 CEST	443	49802	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:21.887284040 CEST	49807	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:21.887326002 CEST	443	49807	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:21.887413979 CEST	49807	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:21.887528896 CEST	49807	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:21.887542963 CEST	443	49807	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:21.932065010 CEST	443	49804	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:21.932259083 CEST	443	49804	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:21.932321072 CEST	49804	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:21.932393074 CEST	49804	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:21.932404995 CEST	443	49804	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:21.932415009 CEST	49804	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:21.932421923 CEST	443	49804	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:21.935369968 CEST	49808	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:21.935432911 CEST	443	49808	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:21.935544968 CEST	49808	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:21.936104059 CEST	49808	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:21.936130047 CEST	443	49808	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:21.938992023 CEST	443	49805	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:21.939369917 CEST	443	49805	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:21.939433098 CEST	49805	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:21.939492941 CEST	49805	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:21.939507961 CEST	443	49805	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:21.939518929 CEST	49805	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:21.939524889 CEST	443	49805	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:21.941596985 CEST	49809	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:21.941636086 CEST	443	49809	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:21.941709995 CEST	49809	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:21.941854000 CEST	49809	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:21.941869020 CEST	443	49809	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:21.959369898 CEST	443	49803	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:21.959520102 CEST	443	49803	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:21.959597111 CEST	49803	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:21.959667921 CEST	49803	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:21.959685087 CEST	443	49803	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:21.959697008 CEST	49803	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:21.959702015 CEST	443	49803	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:21.961622953 CEST	49810	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:21.961637020 CEST	443	49810	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:21.961847067 CEST	49810	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:21.962003946 CEST	49810	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:21.962017059 CEST	443	49810	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:21.973483086 CEST	443	49806	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:21.973823071 CEST	443	49806	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:21.973886013 CEST	49806	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:21.973936081 CEST	49806	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:21.973958015 CEST	443	49806	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:21.973972082 CEST	49806	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:21.973979950 CEST	443	49806	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:21.976253986 CEST	49811	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:21.976286888 CEST	443	49811	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:21.976378918 CEST	49811	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:21.977005959 CEST	49811	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:21.977019072 CEST	443	49811	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:22.522701979 CEST	443	49807	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:22.523436069 CEST	49807	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:22.523487091 CEST	443	49807	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:22.523900032 CEST	49807	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:22.523912907 CEST	443	49807	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:22.555211067 CEST	443	49808	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:22.556293964 CEST	49808	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:22.556293964 CEST	49808	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:22.556305885 CEST	443	49808	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:22.556320906 CEST	443	49808	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:22.563955069 CEST	443	49809	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:22.564351082 CEST	49809	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:22.564379930 CEST	443	49809	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:22.564752102 CEST	49809	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:22.564759016 CEST	443	49809	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:22.571559906 CEST	443	49810	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:22.571841002 CEST	49810	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:22.571851969 CEST	443	49810	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:22.572206020 CEST	49810	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:22.572211027 CEST	443	49810	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:22.586503029 CEST	443	49811	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:22.587030888 CEST	49811	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:22.587052107 CEST	443	49811	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:22.587260962 CEST	49811	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:22.587265968 CEST	443	49811	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:22.624253988 CEST	443	49807	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:22.624504089 CEST	443	49807	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:22.624586105 CEST	49807	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:22.624643087 CEST	49807	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:22.624666929 CEST	443	49807	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:22.624680996 CEST	49807	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:22.624687910 CEST	443	49807	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:22.627957106 CEST	49812	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:22.627991915 CEST	443	49812	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:22.628083944 CEST	49812	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:22.628304005 CEST	49812	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:22.628314972 CEST	443	49812	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:22.653079987 CEST	443	49808	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:22.653597116 CEST	443	49808	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:22.653731108 CEST	49808	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:22.653925896 CEST	49808	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:22.653925896 CEST	49808	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:22.653938055 CEST	443	49808	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:22.653943062 CEST	443	49808	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:22.656735897 CEST	49813	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:22.656781912 CEST	443	49813	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:22.657017946 CEST	49813	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:22.657017946 CEST	49813	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:22.657052994 CEST	443	49813	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:22.664217949 CEST	443	49809	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:22.664278030 CEST	443	49809	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:22.664343119 CEST	49809	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:22.664491892 CEST	49809	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:22.664541006 CEST	443	49809	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:22.664571047 CEST	49809	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:22.664587975 CEST	443	49809	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:22.666785002 CEST	49814	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:22.666800022 CEST	443	49814	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:22.666990995 CEST	49814	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:22.667112112 CEST	49814	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:22.667124987 CEST	443	49814	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:22.670249939 CEST	443	49810	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:22.670336962 CEST	443	49810	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:22.670393944 CEST	49810	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:22.670488119 CEST	49810	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:22.670495033 CEST	443	49810	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:22.670502901 CEST	49810	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:22.670507908 CEST	443	49810	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:22.672715902 CEST	49815	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:22.672756910 CEST	443	49815	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:22.672868013 CEST	49815	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:22.672960043 CEST	49815	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:22.672981977 CEST	443	49815	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:22.684489012 CEST	443	49811	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:22.684561968 CEST	443	49811	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:22.684655905 CEST	49811	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:22.684725046 CEST	49811	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:22.684725046 CEST	49811	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:22.684735060 CEST	443	49811	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:22.684743881 CEST	443	49811	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:22.687484026 CEST	49816	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:22.687514067 CEST	443	49816	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:22.687585115 CEST	49816	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:22.687714100 CEST	49816	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:22.687728882 CEST	443	49816	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:23.241424084 CEST	443	49812	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:23.241957903 CEST	49812	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:23.241970062 CEST	443	49812	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:23.243411064 CEST	49812	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:23.243416071 CEST	443	49812	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:23.268615007 CEST	443	49813	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:23.269274950 CEST	49813	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:23.269298077 CEST	443	49813	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:23.269809961 CEST	49813	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:23.269815922 CEST	443	49813	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:23.309040070 CEST	443	49815	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:23.309555054 CEST	49815	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:23.309565067 CEST	443	49815	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:23.310003996 CEST	49815	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:23.310009003 CEST	443	49815	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:23.334306955 CEST	443	49816	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:23.334850073 CEST	49816	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:23.334867001 CEST	443	49816	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:23.335283041 CEST	49816	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:23.335289955 CEST	443	49816	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:23.337045908 CEST	443	49812	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:23.337486982 CEST	443	49812	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:23.337570906 CEST	49812	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:23.337570906 CEST	49812	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:23.337593079 CEST	49812	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:23.337605953 CEST	443	49812	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:23.337825060 CEST	443	49814	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:23.338128090 CEST	49814	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:23.338150978 CEST	443	49814	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:23.338639021 CEST	49814	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:23.338644028 CEST	443	49814	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:23.340164900 CEST	49817	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:23.340200901 CEST	443	49817	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:23.340274096 CEST	49817	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:23.340390921 CEST	49817	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:23.340403080 CEST	443	49817	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:23.364228010 CEST	443	49813	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:23.364254951 CEST	443	49813	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:23.364295006 CEST	443	49813	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:23.364311934 CEST	49813	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:23.364347935 CEST	49813	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:23.364533901 CEST	49813	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:23.364554882 CEST	443	49813	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:23.364564896 CEST	49813	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:23.364569902 CEST	443	49813	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:23.367137909 CEST	49818	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:23.367161036 CEST	443	49818	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:23.367223978 CEST	49818	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:23.367363930 CEST	49818	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:23.367376089 CEST	443	49818	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:23.407985926 CEST	443	49815	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:23.408018112 CEST	443	49815	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:23.408071041 CEST	443	49815	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:23.408103943 CEST	49815	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:23.408149958 CEST	49815	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:23.408339024 CEST	49815	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:23.408339024 CEST	49815	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:23.408360004 CEST	443	49815	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:23.408370018 CEST	443	49815	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:23.410617113 CEST	49819	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:23.410666943 CEST	443	49819	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:23.410729885 CEST	49819	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:23.410871029 CEST	49819	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:23.410883904 CEST	443	49819	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:23.434866905 CEST	443	49816	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:23.435044050 CEST	443	49816	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:23.435112000 CEST	49816	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:23.435148954 CEST	49816	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:23.435170889 CEST	443	49816	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:23.435184002 CEST	49816	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:23.435190916 CEST	443	49816	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:23.436263084 CEST	443	49814	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:23.436425924 CEST	443	49814	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:23.436486959 CEST	49814	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:23.436708927 CEST	49814	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:23.436722994 CEST	443	49814	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:23.436738968 CEST	49814	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:23.436744928 CEST	443	49814	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:23.438472986 CEST	49820	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:23.438514948 CEST	443	49820	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:23.438587904 CEST	49820	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:23.438875914 CEST	49820	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:23.438889027 CEST	443	49820	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:23.440037012 CEST	49821	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:23.440082073 CEST	443	49821	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:23.440150023 CEST	49821	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:23.440249920 CEST	49821	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:23.440263033 CEST	443	49821	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:23.948287010 CEST	443	49817	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:23.949055910 CEST	49817	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:23.949081898 CEST	443	49817	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:23.949536085 CEST	49817	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:23.949542046 CEST	443	49817	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:24.024411917 CEST	443	49819	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:24.024900913 CEST	49819	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:24.024923086 CEST	443	49819	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:24.025369883 CEST	49819	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:24.025377035 CEST	443	49819	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:24.043606997 CEST	443	49818	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:24.044116974 CEST	49818	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:24.044147015 CEST	443	49818	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:24.044581890 CEST	49818	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:24.044589043 CEST	443	49818	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:24.047770023 CEST	443	49817	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:24.048388004 CEST	443	49817	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:24.048469067 CEST	49817	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:24.048536062 CEST	49817	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:24.048552990 CEST	443	49817	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:24.048566103 CEST	49817	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:24.048573017 CEST	443	49817	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:24.051141024 CEST	49822	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:24.051188946 CEST	443	49822	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:24.051266909 CEST	49822	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:24.051477909 CEST	49822	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:24.051492929 CEST	443	49822	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:24.065557003 CEST	443	49821	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:24.066699982 CEST	49821	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:24.066723108 CEST	443	49821	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:24.067147017 CEST	49821	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:24.067152023 CEST	443	49821	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:24.076771975 CEST	443	49820	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:24.077152967 CEST	49820	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:24.077167988 CEST	443	49820	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:24.077589989 CEST	49820	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:24.077594995 CEST	443	49820	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:24.127224922 CEST	443	49819	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:24.127268076 CEST	443	49819	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:24.127316952 CEST	49819	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:24.127331018 CEST	443	49819	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:24.127346039 CEST	443	49819	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:24.127401114 CEST	49819	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:24.127520084 CEST	49819	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:24.127538919 CEST	443	49819	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:24.127551079 CEST	49819	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:24.127557993 CEST	443	49819	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:24.133451939 CEST	49823	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:24.133512020 CEST	443	49823	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:24.133570910 CEST	49823	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:24.134495974 CEST	49823	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:24.134516954 CEST	443	49823	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:24.147811890 CEST	443	49818	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:24.147881031 CEST	443	49818	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:24.147944927 CEST	49818	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:24.149025917 CEST	49818	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:24.149048090 CEST	443	49818	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:24.149055958 CEST	49818	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:24.149064064 CEST	443	49818	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:24.152592897 CEST	49824	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:24.152636051 CEST	443	49824	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:24.152702093 CEST	49824	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:24.153048038 CEST	49824	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:24.153060913 CEST	443	49824	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:24.166768074 CEST	443	49821	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:24.167100906 CEST	443	49821	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:24.167166948 CEST	49821	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:24.177459002 CEST	49821	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:24.177479029 CEST	443	49821	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:24.177490950 CEST	49821	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:24.177495956 CEST	443	49821	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:24.179732084 CEST	443	49820	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:24.179815054 CEST	443	49820	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:24.179862976 CEST	49820	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:24.181770086 CEST	49820	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:24.181786060 CEST	443	49820	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:24.181801081 CEST	49820	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:24.181807041 CEST	443	49820	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:24.184334040 CEST	49825	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:24.184357882 CEST	443	49825	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:24.184415102 CEST	49825	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:24.185005903 CEST	49826	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:24.185019970 CEST	443	49826	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:24.185067892 CEST	49826	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:24.185172081 CEST	49825	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:24.185184002 CEST	443	49825	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:24.185271978 CEST	49826	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:24.185280085 CEST	443	49826	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:24.677417994 CEST	443	49822	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:24.677975893 CEST	49822	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:24.677989006 CEST	443	49822	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:24.678450108 CEST	49822	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:24.678455114 CEST	443	49822	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:24.747934103 CEST	443	49823	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:24.748457909 CEST	49823	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:24.748492956 CEST	443	49823	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:24.748917103 CEST	49823	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:24.748924017 CEST	443	49823	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:24.769503117 CEST	443	49824	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:24.769958019 CEST	49824	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:24.769968033 CEST	443	49824	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:24.770380974 CEST	49824	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:24.770385981 CEST	443	49824	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:24.782393932 CEST	443	49822	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:24.782591105 CEST	443	49822	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:24.782677889 CEST	49822	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:24.782732010 CEST	49822	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:24.782732010 CEST	49822	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:24.782766104 CEST	443	49822	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:24.782783031 CEST	443	49822	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:24.785455942 CEST	49827	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:24.785494089 CEST	443	49827	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:24.785574913 CEST	49827	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:24.785726070 CEST	49827	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:24.785737038 CEST	443	49827	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:24.815448046 CEST	443	49826	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:24.815888882 CEST	49826	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:24.815913916 CEST	443	49826	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:24.816315889 CEST	49826	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:24.816320896 CEST	443	49826	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:24.841104984 CEST	443	49825	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:24.845094919 CEST	49825	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:24.845118999 CEST	443	49825	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:24.845571995 CEST	49825	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:24.845583916 CEST	443	49825	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:24.847815990 CEST	443	49823	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:24.847847939 CEST	443	49823	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:24.847908974 CEST	443	49823	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:24.847917080 CEST	49823	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:24.847965002 CEST	49823	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:24.848149061 CEST	49823	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:24.848170042 CEST	443	49823	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:24.848180056 CEST	49823	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:24.848186016 CEST	443	49823	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:24.850980997 CEST	49828	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:24.851047993 CEST	443	49828	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:24.851150036 CEST	49828	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:24.861826897 CEST	49828	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:24.861846924 CEST	443	49828	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:24.868072033 CEST	443	49824	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:24.868273020 CEST	443	49824	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:24.868350983 CEST	49824	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:24.868558884 CEST	49824	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:24.868570089 CEST	443	49824	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:24.868577957 CEST	49824	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:24.868583918 CEST	443	49824	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:24.871316910 CEST	49829	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:24.871440887 CEST	443	49829	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:24.871531010 CEST	49829	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:24.871696949 CEST	49829	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:24.871733904 CEST	443	49829	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:24.915771961 CEST	443	49826	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:24.915842056 CEST	443	49826	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:24.915941954 CEST	443	49826	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:24.915940046 CEST	49826	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:24.916214943 CEST	49826	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:24.916279078 CEST	443	49826	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:24.916317940 CEST	49826	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:24.916317940 CEST	49826	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:24.916342974 CEST	443	49826	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:24.916363955 CEST	443	49826	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:24.919533014 CEST	49830	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:24.919564962 CEST	443	49830	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:24.919672012 CEST	49830	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:24.919861078 CEST	49830	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:24.919871092 CEST	443	49830	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:24.946500063 CEST	443	49825	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:24.946737051 CEST	443	49825	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:24.946834087 CEST	49825	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:24.946904898 CEST	49825	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:24.946906090 CEST	49825	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:24.946943998 CEST	443	49825	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:24.946968079 CEST	443	49825	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:24.949496031 CEST	49831	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:24.949532032 CEST	443	49831	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:24.949610949 CEST	49831	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:24.949752092 CEST	49831	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:24.949764013 CEST	443	49831	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:25.426047087 CEST	443	49827	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:25.426565886 CEST	49827	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:25.426598072 CEST	443	49827	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:25.427057028 CEST	49827	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:25.427062988 CEST	443	49827	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:25.490411043 CEST	443	49828	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:25.491219997 CEST	49828	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:25.491238117 CEST	443	49828	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:25.491677999 CEST	49828	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:25.491683960 CEST	443	49828	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:25.498733044 CEST	443	49829	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:25.499083996 CEST	49829	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:25.499111891 CEST	443	49829	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:25.499484062 CEST	49829	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:25.499490976 CEST	443	49829	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:25.528803110 CEST	443	49827	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:25.529017925 CEST	443	49827	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:25.529082060 CEST	49827	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:25.529119968 CEST	49827	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:25.529138088 CEST	443	49827	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:25.529150963 CEST	49827	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:25.529156923 CEST	443	49827	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:25.531584978 CEST	49832	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:25.531630993 CEST	443	49832	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:25.531713963 CEST	49832	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:25.531821012 CEST	49832	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:25.531831980 CEST	443	49832	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:25.545624018 CEST	443	49830	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:25.548011065 CEST	49830	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:25.548029900 CEST	443	49830	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:25.548459053 CEST	49830	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:25.548463106 CEST	443	49830	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:25.590734959 CEST	443	49828	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:25.590841055 CEST	443	49828	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:25.590899944 CEST	49828	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:25.591018915 CEST	49828	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:25.591043949 CEST	443	49828	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:25.591051102 CEST	49828	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:25.591056108 CEST	443	49828	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:25.593656063 CEST	49833	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:25.593713999 CEST	443	49833	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:25.594060898 CEST	49833	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:25.594197989 CEST	49833	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:25.594213963 CEST	443	49833	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:25.606168985 CEST	443	49831	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:25.606580019 CEST	49831	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:25.606592894 CEST	443	49831	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:25.607146025 CEST	49831	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:25.607151985 CEST	443	49831	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:25.648319006 CEST	443	49830	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:25.648616076 CEST	443	49830	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:25.648678064 CEST	49830	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:25.648706913 CEST	49830	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:25.648724079 CEST	443	49830	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:25.648734093 CEST	49830	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:25.648741007 CEST	443	49830	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:25.651536942 CEST	49834	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:25.651576042 CEST	443	49834	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:25.651644945 CEST	49834	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:25.651760101 CEST	49834	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:25.651772022 CEST	443	49834	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:25.712658882 CEST	443	49831	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:25.712713957 CEST	443	49831	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:25.712770939 CEST	49831	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:25.712975979 CEST	49831	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:25.712992907 CEST	443	49831	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:25.713004112 CEST	49831	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:25.713011026 CEST	443	49831	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:25.715651035 CEST	49835	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:25.715689898 CEST	443	49835	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:25.715811014 CEST	49835	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:25.715955019 CEST	49835	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:25.715969086 CEST	443	49835	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:25.997513056 CEST	443	49829	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:25.997595072 CEST	443	49829	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:25.997687101 CEST	49829	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:25.997715950 CEST	443	49829	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:25.997736931 CEST	443	49829	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:25.997791052 CEST	49829	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:25.998002052 CEST	49829	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:25.998016119 CEST	443	49829	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:25.998027086 CEST	49829	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:25.998033047 CEST	443	49829	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:26.001017094 CEST	49836	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:26.001038074 CEST	443	49836	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:26.001126051 CEST	49836	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:26.001328945 CEST	49836	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:26.001338005 CEST	443	49836	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:26.071899891 CEST	443	49832	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:26.072526932 CEST	49832	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:26.072537899 CEST	443	49832	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:26.073019981 CEST	49832	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:26.073034048 CEST	443	49832	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:26.150450945 CEST	443	49833	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:26.151031971 CEST	49833	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:26.151051044 CEST	443	49833	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:26.151485920 CEST	49833	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:26.151493073 CEST	443	49833	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:26.173423052 CEST	443	49832	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:26.173692942 CEST	443	49832	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:26.173769951 CEST	49832	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:26.173809052 CEST	49832	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:26.173809052 CEST	49832	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:26.173825979 CEST	443	49832	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:26.173830986 CEST	443	49832	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:26.176704884 CEST	49837	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:26.176754951 CEST	443	49837	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:26.176842928 CEST	49837	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:26.176997900 CEST	49837	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:26.177011013 CEST	443	49837	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:26.255264997 CEST	443	49833	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:26.255286932 CEST	443	49833	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:26.255330086 CEST	443	49833	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:26.255584955 CEST	49833	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:26.255584955 CEST	49833	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:26.255745888 CEST	49833	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:26.255778074 CEST	443	49833	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:26.255793095 CEST	49833	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:26.255800009 CEST	443	49833	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:26.258903027 CEST	49838	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:26.259016037 CEST	443	49838	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:26.259130955 CEST	49838	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:26.259337902 CEST	49838	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:26.259378910 CEST	443	49838	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:26.270711899 CEST	443	49834	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:26.271276951 CEST	49834	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:26.271310091 CEST	443	49834	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:26.271743059 CEST	49834	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:26.271749973 CEST	443	49834	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:26.327265978 CEST	443	49835	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:26.327805996 CEST	49835	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:26.327825069 CEST	443	49835	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:26.328284025 CEST	49835	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:26.328290939 CEST	443	49835	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:26.374274015 CEST	443	49834	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:26.374701023 CEST	443	49834	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:26.374769926 CEST	49834	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:26.374831915 CEST	49834	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:26.374856949 CEST	443	49834	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:26.374867916 CEST	49834	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:26.374875069 CEST	443	49834	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:26.377774954 CEST	49839	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:26.377804041 CEST	443	49839	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:26.377893925 CEST	49839	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:26.378186941 CEST	49839	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:26.378197908 CEST	443	49839	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:26.427555084 CEST	443	49835	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:26.427701950 CEST	443	49835	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:26.427911043 CEST	49835	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:26.428081989 CEST	49835	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:26.428081989 CEST	49835	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:26.428100109 CEST	443	49835	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:26.428107977 CEST	443	49835	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:26.431256056 CEST	49840	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:26.431298018 CEST	443	49840	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:26.431365967 CEST	49840	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:26.431529999 CEST	49840	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:26.431540012 CEST	443	49840	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:26.966808081 CEST	443	49837	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:26.966824055 CEST	443	49836	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:26.967731953 CEST	49837	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:26.967763901 CEST	443	49837	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:26.967993975 CEST	49836	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:26.968005896 CEST	443	49836	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:26.968154907 CEST	49837	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:26.968161106 CEST	443	49837	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:26.968255043 CEST	49836	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:26.968261003 CEST	443	49836	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:27.065560102 CEST	443	49837	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:27.065771103 CEST	443	49837	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:27.065814018 CEST	443	49837	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:27.065835953 CEST	49837	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:27.065875053 CEST	49837	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:27.065907001 CEST	49837	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:27.065931082 CEST	443	49837	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:27.065941095 CEST	49837	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:27.065947056 CEST	443	49837	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:27.067013025 CEST	443	49836	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:27.067085028 CEST	443	49836	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:27.067136049 CEST	49836	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:27.067255020 CEST	49836	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:27.067255974 CEST	49836	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:27.067270041 CEST	443	49836	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:27.067277908 CEST	443	49836	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:27.069540977 CEST	49841	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:27.069567919 CEST	443	49841	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:27.069641113 CEST	49841	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:27.069745064 CEST	49842	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:27.069751978 CEST	443	49842	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:27.069787979 CEST	49842	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:27.069863081 CEST	49841	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:27.069868088 CEST	443	49841	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:27.070004940 CEST	49842	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:27.070008039 CEST	443	49842	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:27.138104916 CEST	443	49839	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:27.138942003 CEST	49839	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:27.138953924 CEST	443	49839	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:27.139431000 CEST	49839	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:27.139435053 CEST	443	49839	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:27.141278982 CEST	443	49838	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:27.141601086 CEST	49838	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:27.141633034 CEST	443	49838	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:27.141768932 CEST	443	49840	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:27.141917944 CEST	49838	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:27.141925097 CEST	443	49838	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:27.142003059 CEST	49840	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:27.142020941 CEST	443	49840	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:27.142333031 CEST	49840	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:27.142338991 CEST	443	49840	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:27.232419968 CEST	443	49839	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:27.232640982 CEST	443	49839	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:27.232743025 CEST	49839	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:27.232897997 CEST	49839	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:27.232913017 CEST	443	49839	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:27.232925892 CEST	49839	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:27.232933998 CEST	443	49839	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:27.235910892 CEST	49843	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:27.235944986 CEST	443	49843	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:27.236036062 CEST	49843	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:27.236196995 CEST	49843	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:27.236207962 CEST	443	49843	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:27.237102032 CEST	443	49838	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:27.237164974 CEST	443	49838	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:27.237215042 CEST	49838	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:27.237296104 CEST	49838	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:27.237319946 CEST	443	49838	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:27.237329960 CEST	49838	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:27.237335920 CEST	443	49838	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:27.239283085 CEST	49844	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:27.239315033 CEST	443	49844	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:27.239427090 CEST	49844	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:27.239554882 CEST	49844	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:27.239567995 CEST	443	49844	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:27.249810934 CEST	443	49840	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:27.250320911 CEST	443	49840	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:27.250400066 CEST	49840	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:27.250427961 CEST	49840	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:27.250441074 CEST	443	49840	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:27.250446081 CEST	49840	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:27.250451088 CEST	443	49840	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:27.252468109 CEST	49845	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:27.252513885 CEST	443	49845	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:27.252577066 CEST	49845	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:27.252697945 CEST	49845	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:27.252712965 CEST	443	49845	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:27.681663036 CEST	443	49842	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:27.682254076 CEST	49842	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:27.682277918 CEST	443	49842	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:27.682712078 CEST	49842	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:27.682718039 CEST	443	49842	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:27.694252014 CEST	443	49841	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:27.694705009 CEST	49841	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:27.694719076 CEST	443	49841	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:27.695146084 CEST	49841	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:27.695151091 CEST	443	49841	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:27.791639090 CEST	443	49842	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:27.791735888 CEST	443	49842	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:27.791810036 CEST	49842	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:27.791986942 CEST	49842	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:27.792004108 CEST	443	49842	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:27.792016029 CEST	49842	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:27.792021990 CEST	443	49842	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:27.794692993 CEST	49846	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:27.794722080 CEST	443	49846	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:27.794804096 CEST	49846	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:27.794956923 CEST	49846	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:27.794972897 CEST	443	49846	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:27.817543983 CEST	443	49841	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:27.817615986 CEST	443	49841	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:27.817722082 CEST	443	49841	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:27.817764997 CEST	49841	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:27.817764997 CEST	49841	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:27.817811012 CEST	49841	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:27.817828894 CEST	443	49841	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:27.817842007 CEST	49841	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:27.817848921 CEST	443	49841	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:27.820156097 CEST	49847	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:27.820169926 CEST	443	49847	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:27.820238113 CEST	49847	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:27.820358038 CEST	49847	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:27.820369005 CEST	443	49847	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:27.860100985 CEST	443	49844	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:27.860554934 CEST	49844	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:27.860575914 CEST	443	49844	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:27.861011982 CEST	49844	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:27.861017942 CEST	443	49844	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:27.861664057 CEST	443	49845	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:27.861990929 CEST	49845	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:27.862011909 CEST	443	49845	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:27.862411976 CEST	49845	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:27.862417936 CEST	443	49845	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:27.911117077 CEST	443	49843	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:27.911679029 CEST	49843	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:27.911701918 CEST	443	49843	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:27.912126064 CEST	49843	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:27.912131071 CEST	443	49843	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:27.961093903 CEST	443	49844	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:27.962198019 CEST	443	49844	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:27.962291956 CEST	49844	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:27.962337971 CEST	49844	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:27.962357998 CEST	443	49844	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:27.962363958 CEST	49844	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:27.962369919 CEST	443	49844	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:27.964715958 CEST	443	49845	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:27.964749098 CEST	443	49845	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:27.964796066 CEST	443	49845	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:27.964802980 CEST	49845	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:27.964843035 CEST	49845	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:27.965112925 CEST	49848	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:27.965163946 CEST	443	49848	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:27.965230942 CEST	49848	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:27.965271950 CEST	49845	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:27.965290070 CEST	443	49845	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:27.965301037 CEST	49845	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:27.965306997 CEST	443	49845	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:27.966176987 CEST	49848	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:27.966197014 CEST	443	49848	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:27.967334986 CEST	49849	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:27.967361927 CEST	443	49849	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:27.967422009 CEST	49849	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:27.967561960 CEST	49849	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:27.967570066 CEST	443	49849	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:28.016177893 CEST	443	49843	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:28.016202927 CEST	443	49843	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:28.016249895 CEST	443	49843	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:28.016316891 CEST	49843	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:28.016340017 CEST	49843	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:28.016503096 CEST	49843	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:28.016519070 CEST	443	49843	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:28.016568899 CEST	49843	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:28.016575098 CEST	443	49843	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:28.018764019 CEST	49850	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:28.018800020 CEST	443	49850	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:28.018882990 CEST	49850	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:28.019018888 CEST	49850	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:28.019030094 CEST	443	49850	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:28.469752073 CEST	443	49846	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:28.470434904 CEST	49846	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:28.470468044 CEST	443	49846	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:28.470881939 CEST	49846	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:28.470887899 CEST	443	49846	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:28.483308077 CEST	443	49847	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:28.483900070 CEST	49847	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:28.483932018 CEST	443	49847	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:28.484338999 CEST	49847	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:28.484357119 CEST	443	49847	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:28.714693069 CEST	443	49846	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:28.714849949 CEST	443	49846	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:28.714955091 CEST	49846	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:28.715087891 CEST	49846	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:28.715106964 CEST	443	49846	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:28.715117931 CEST	49846	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:28.715125084 CEST	443	49846	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:28.717983961 CEST	49851	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:28.718044996 CEST	443	49851	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:28.718137026 CEST	49851	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:28.718375921 CEST	49851	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:28.718398094 CEST	443	49851	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:28.719162941 CEST	443	49848	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:28.719362974 CEST	443	49849	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:28.719369888 CEST	443	49850	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:28.719535112 CEST	49848	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:28.719552994 CEST	443	49848	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:28.719635963 CEST	49849	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:28.719645023 CEST	443	49849	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:28.720027924 CEST	49848	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:28.720033884 CEST	443	49848	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:28.720144987 CEST	49850	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:28.720151901 CEST	443	49850	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:28.720206976 CEST	49849	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:28.720211983 CEST	443	49849	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:28.720515013 CEST	49850	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:28.720519066 CEST	443	49850	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:28.940584898 CEST	443	49847	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:28.940663099 CEST	443	49847	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:28.940773964 CEST	49847	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:28.940788031 CEST	443	49847	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:28.940849066 CEST	49847	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:28.941056013 CEST	49847	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:28.941077948 CEST	443	49847	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:28.941090107 CEST	49847	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:28.941096067 CEST	443	49847	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:28.943851948 CEST	49852	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:28.943905115 CEST	443	49852	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:28.943979979 CEST	49852	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:28.944272041 CEST	49852	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:28.944293022 CEST	443	49852	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:29.030227900 CEST	443	49849	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:29.030294895 CEST	443	49848	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:29.030452013 CEST	443	49848	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:29.030539036 CEST	49848	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:29.030648947 CEST	49848	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:29.030673027 CEST	443	49848	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:29.030680895 CEST	49848	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:29.030689001 CEST	443	49848	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:29.030879974 CEST	443	49849	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:29.030927896 CEST	443	49849	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:29.030983925 CEST	49849	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:29.030983925 CEST	49849	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:29.031039953 CEST	49849	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:29.031039953 CEST	49849	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:29.031052113 CEST	443	49849	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:29.031060934 CEST	443	49849	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:29.032624006 CEST	443	49850	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:29.032953024 CEST	443	49850	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:29.033061981 CEST	49850	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:29.033548117 CEST	49850	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:29.033548117 CEST	49850	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:29.033555984 CEST	443	49850	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:29.033560038 CEST	443	49850	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:29.033816099 CEST	49853	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:29.033852100 CEST	443	49853	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:29.033916950 CEST	49853	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:29.033948898 CEST	49854	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:29.033971071 CEST	443	49854	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:29.034010887 CEST	49854	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:29.034130096 CEST	49853	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:29.034143925 CEST	443	49853	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:29.034243107 CEST	49854	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:29.034254074 CEST	443	49854	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:29.035695076 CEST	49855	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:29.035749912 CEST	443	49855	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:29.035821915 CEST	49855	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:29.035933018 CEST	49855	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:29.035948038 CEST	443	49855	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:29.541460037 CEST	443	49851	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:29.541929007 CEST	49851	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:29.541966915 CEST	443	49851	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:29.542488098 CEST	49851	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:29.542500973 CEST	443	49851	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:29.913975000 CEST	443	49851	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:29.914056063 CEST	443	49851	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:29.914165974 CEST	49851	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:29.919908047 CEST	49851	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:29.919908047 CEST	49851	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:29.919936895 CEST	443	49851	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:29.919950962 CEST	443	49851	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:29.920949936 CEST	443	49855	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:29.920970917 CEST	443	49852	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:29.921063900 CEST	443	49854	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:29.921566010 CEST	443	49853	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:29.926836014 CEST	49853	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:29.926846027 CEST	443	49853	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:29.927258015 CEST	49853	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:29.927278042 CEST	443	49853	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:29.927489042 CEST	49854	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:29.927495956 CEST	443	49854	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:29.927855968 CEST	49854	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:29.927870035 CEST	443	49854	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:29.928337097 CEST	49855	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:29.928349972 CEST	443	49855	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:29.928718090 CEST	49855	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:29.928725004 CEST	443	49855	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:29.928936958 CEST	49852	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:29.928951025 CEST	443	49852	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:29.929284096 CEST	49852	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:29.929289103 CEST	443	49852	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:29.931845903 CEST	49856	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:29.931894064 CEST	443	49856	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:29.931965113 CEST	49856	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:29.933372021 CEST	49856	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:29.933393955 CEST	443	49856	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:30.021507978 CEST	443	49855	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:30.021661043 CEST	443	49855	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:30.021714926 CEST	443	49855	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:30.021717072 CEST	49855	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:30.021826982 CEST	49855	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:30.022121906 CEST	49855	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:30.022121906 CEST	49855	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:30.022144079 CEST	443	49855	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:30.022156000 CEST	443	49855	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:30.024210930 CEST	443	49852	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:30.024879932 CEST	49857	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:30.024916887 CEST	443	49857	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:30.024996996 CEST	49857	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:30.025094032 CEST	443	49852	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:30.025173903 CEST	49852	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:30.025252104 CEST	49857	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:30.025263071 CEST	443	49857	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:30.025290966 CEST	49852	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:30.025296926 CEST	443	49852	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:30.025377989 CEST	49852	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:30.025384903 CEST	443	49852	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:30.026815891 CEST	443	49853	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:30.026854038 CEST	443	49853	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:30.026905060 CEST	443	49853	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:30.026905060 CEST	49853	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:30.026963949 CEST	49853	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:30.027040958 CEST	49853	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:30.027050018 CEST	443	49853	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:30.027060986 CEST	49853	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:30.027066946 CEST	443	49853	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:30.027379036 CEST	49858	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:30.027401924 CEST	443	49858	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:30.027477026 CEST	49858	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:30.027618885 CEST	49858	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:30.027627945 CEST	443	49858	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:30.028733969 CEST	443	49854	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:30.029052973 CEST	443	49854	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:30.029145002 CEST	49854	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:30.029145002 CEST	49854	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:30.029164076 CEST	49854	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:30.029169083 CEST	443	49854	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:30.029434919 CEST	49859	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:30.029491901 CEST	443	49859	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:30.029556990 CEST	49859	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:30.029719114 CEST	49859	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:30.029740095 CEST	443	49859	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:30.031220913 CEST	49860	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:30.031254053 CEST	443	49860	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:30.031336069 CEST	49860	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:30.031506062 CEST	49860	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:30.031519890 CEST	443	49860	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:30.563307047 CEST	443	49856	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:30.564212084 CEST	49856	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:30.564244032 CEST	443	49856	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:30.564703941 CEST	49856	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:30.564712048 CEST	443	49856	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:30.647640944 CEST	443	49858	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:30.648263931 CEST	49858	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:30.648286104 CEST	443	49858	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:30.648785114 CEST	49858	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:30.648789883 CEST	443	49858	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:30.659043074 CEST	443	49860	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:30.660356045 CEST	49860	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:30.660397053 CEST	443	49860	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:30.660901070 CEST	49860	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:30.660907030 CEST	443	49860	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:30.662472010 CEST	443	49857	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:30.662816048 CEST	49857	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:30.662826061 CEST	443	49857	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:30.663737059 CEST	49857	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:30.663741112 CEST	443	49857	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:30.664705992 CEST	443	49856	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:30.664769888 CEST	443	49856	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:30.664822102 CEST	49856	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:30.665734053 CEST	49856	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:30.665760040 CEST	443	49856	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:30.665774107 CEST	49856	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:30.665781975 CEST	443	49856	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:30.668294907 CEST	49861	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:30.668329954 CEST	443	49861	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:30.668479919 CEST	49861	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:30.668591022 CEST	49861	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:30.668602943 CEST	443	49861	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:30.669368029 CEST	443	49859	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:30.669672012 CEST	49859	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:30.669693947 CEST	443	49859	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:30.670070887 CEST	49859	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:30.670078039 CEST	443	49859	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:30.747353077 CEST	443	49858	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:30.747433901 CEST	443	49858	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:30.747581005 CEST	49858	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:30.747998953 CEST	49858	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:30.748016119 CEST	443	49858	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:30.748028994 CEST	49858	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:30.748035908 CEST	443	49858	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:30.751187086 CEST	49862	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:30.751221895 CEST	443	49862	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:30.751351118 CEST	49862	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:30.751585960 CEST	49862	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:30.751599073 CEST	443	49862	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:30.760974884 CEST	443	49860	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:30.761034966 CEST	443	49860	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:30.761121035 CEST	49860	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:30.761392117 CEST	49860	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:30.761392117 CEST	49860	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:30.761399984 CEST	443	49860	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:30.761409044 CEST	443	49860	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:30.763509989 CEST	49863	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:30.763530970 CEST	443	49863	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:30.763629913 CEST	49863	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:30.763763905 CEST	49863	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:30.763772964 CEST	443	49863	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:30.769303083 CEST	443	49857	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:30.769587994 CEST	443	49857	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:30.769643068 CEST	49857	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:30.769714117 CEST	49857	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:30.769714117 CEST	49857	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:30.769730091 CEST	443	49857	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:30.769742966 CEST	443	49857	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:30.771718979 CEST	49864	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:30.771763086 CEST	443	49864	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:30.771836042 CEST	49864	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:30.771991014 CEST	49864	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:30.772001982 CEST	443	49864	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:30.773228884 CEST	443	49859	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:30.773338079 CEST	443	49859	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:30.773410082 CEST	443	49859	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:30.773411989 CEST	49859	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:30.773448944 CEST	49859	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:30.773495913 CEST	49859	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:30.773511887 CEST	443	49859	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:30.773534060 CEST	49859	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:30.773540020 CEST	443	49859	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:30.775530100 CEST	49865	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:30.775546074 CEST	443	49865	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:30.775616884 CEST	49865	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:30.775748968 CEST	49865	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:30.775758982 CEST	443	49865	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:31.313698053 CEST	443	49861	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:31.314235926 CEST	49861	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:31.314248085 CEST	443	49861	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:31.315294027 CEST	49861	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:31.315301895 CEST	443	49861	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:31.374073982 CEST	443	49863	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:31.374769926 CEST	49863	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:31.374784946 CEST	443	49863	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:31.375408888 CEST	49863	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:31.375413895 CEST	443	49863	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:31.378762007 CEST	443	49862	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:31.379264116 CEST	49862	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:31.379276991 CEST	443	49862	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:31.380001068 CEST	49862	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:31.380008936 CEST	443	49862	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:31.413739920 CEST	443	49864	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:31.414144993 CEST	49864	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:31.414161921 CEST	443	49864	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:31.414305925 CEST	443	49865	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:31.414561033 CEST	49864	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:31.414566040 CEST	443	49864	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:31.414884090 CEST	49865	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:31.414905071 CEST	443	49865	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:31.415301085 CEST	49865	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:31.415307999 CEST	443	49865	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:31.417052031 CEST	443	49861	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:31.417397976 CEST	443	49861	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:31.417443037 CEST	443	49861	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:31.417509079 CEST	49861	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:31.417509079 CEST	49861	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:31.417558908 CEST	49861	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:31.417577982 CEST	443	49861	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:31.417673111 CEST	49861	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:31.417680979 CEST	443	49861	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:31.420243979 CEST	49866	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:31.420280933 CEST	443	49866	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:31.420521021 CEST	49866	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:31.420649052 CEST	49866	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:31.420664072 CEST	443	49866	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:31.471645117 CEST	443	49863	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:31.471807957 CEST	443	49863	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:31.471894026 CEST	49863	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:31.471992970 CEST	49863	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:31.471992970 CEST	49863	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:31.472011089 CEST	443	49863	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:31.472019911 CEST	443	49863	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:31.474436045 CEST	49867	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:31.474473000 CEST	443	49867	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:31.474555016 CEST	49867	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:31.474672079 CEST	49867	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:31.474678993 CEST	443	49867	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:31.477653980 CEST	443	49862	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:31.477809906 CEST	443	49862	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:31.477915049 CEST	49862	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:31.477915049 CEST	49862	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:31.478055000 CEST	49862	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:31.478070021 CEST	443	49862	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:31.479789019 CEST	49868	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:31.479819059 CEST	443	49868	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:31.479897976 CEST	49868	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:31.480015039 CEST	49868	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:31.480029106 CEST	443	49868	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:31.513921022 CEST	443	49864	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:31.514132977 CEST	443	49864	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:31.514219999 CEST	49864	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:31.514385939 CEST	49864	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:31.514401913 CEST	443	49864	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:31.514413118 CEST	49864	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:31.514419079 CEST	443	49864	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:31.517075062 CEST	49869	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:31.517111063 CEST	443	49869	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:31.517191887 CEST	49869	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:31.517313957 CEST	49869	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:31.517326117 CEST	443	49869	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:31.517679930 CEST	443	49865	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:31.518155098 CEST	443	49865	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:31.518215895 CEST	49865	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:31.518274069 CEST	49865	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:31.518292904 CEST	443	49865	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:31.518304110 CEST	49865	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:31.518310070 CEST	443	49865	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:31.520200014 CEST	49870	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:31.520210028 CEST	443	49870	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:31.520284891 CEST	49870	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:31.520407915 CEST	49870	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:31.520414114 CEST	443	49870	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:32.030637026 CEST	443	49866	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:32.033124924 CEST	49866	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:32.033138990 CEST	443	49866	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:32.033643961 CEST	49866	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:32.033648968 CEST	443	49866	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:32.086621046 CEST	443	49867	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:32.087136030 CEST	49867	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:32.087147951 CEST	443	49867	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:32.087575912 CEST	49867	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:32.087580919 CEST	443	49867	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:32.104723930 CEST	443	49868	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:32.105139971 CEST	49868	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:32.105159998 CEST	443	49868	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:32.105521917 CEST	49868	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:32.105528116 CEST	443	49868	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:32.135366917 CEST	443	49866	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:32.135438919 CEST	443	49866	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:32.135641098 CEST	49866	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:32.135641098 CEST	49866	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:32.135641098 CEST	49866	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:32.138139009 CEST	49871	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:32.138175011 CEST	443	49871	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:32.138185978 CEST	443	49869	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:32.138219118 CEST	443	49870	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:32.138253927 CEST	49871	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:32.138372898 CEST	49871	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:32.138385057 CEST	443	49871	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:32.138603926 CEST	49869	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:32.138622999 CEST	443	49869	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:32.138988972 CEST	49869	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:32.138994932 CEST	443	49869	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:32.139168978 CEST	49870	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:32.139177084 CEST	443	49870	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:32.139525890 CEST	49870	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:32.139530897 CEST	443	49870	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:32.182832003 CEST	443	49867	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:32.182898998 CEST	443	49867	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:32.182979107 CEST	49867	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:32.183204889 CEST	49867	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:32.183237076 CEST	443	49867	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:32.183248043 CEST	49867	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:32.183253050 CEST	443	49867	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:32.185859919 CEST	49872	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:32.185893059 CEST	443	49872	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:32.185980082 CEST	49872	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:32.186120987 CEST	49872	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:32.186125040 CEST	443	49872	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:32.202614069 CEST	443	49868	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:32.202775955 CEST	443	49868	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:32.202863932 CEST	49868	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:32.202934027 CEST	49868	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:32.202951908 CEST	443	49868	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:32.202961922 CEST	49868	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:32.202967882 CEST	443	49868	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:32.205971956 CEST	49873	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:32.206011057 CEST	443	49873	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:32.206135035 CEST	49873	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:32.206227064 CEST	49873	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:32.206238031 CEST	443	49873	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:32.432712078 CEST	443	49870	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:32.432789087 CEST	443	49870	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:32.432893991 CEST	49870	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:32.432996035 CEST	443	49869	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:32.433070898 CEST	443	49869	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:32.433140993 CEST	49870	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:32.433166027 CEST	443	49870	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:32.433182955 CEST	443	49869	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:32.433183908 CEST	49870	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:32.433183908 CEST	49869	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:32.433192968 CEST	443	49870	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:32.433229923 CEST	49869	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:32.433695078 CEST	49869	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:32.433700085 CEST	443	49869	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:32.433708906 CEST	49869	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:32.433712959 CEST	443	49869	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:32.437002897 CEST	49874	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:32.437041998 CEST	443	49874	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:32.437124014 CEST	49874	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:32.437239885 CEST	49875	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:32.437274933 CEST	443	49875	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:32.437443018 CEST	49875	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:32.437443018 CEST	49875	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:32.437472105 CEST	443	49875	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:32.437652111 CEST	49874	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:32.437670946 CEST	443	49874	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:32.444144964 CEST	49866	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:32.444166899 CEST	443	49866	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:33.036834955 CEST	443	49872	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:33.037642956 CEST	49872	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:33.037664890 CEST	443	49872	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:33.038090944 CEST	49872	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:33.038104057 CEST	443	49872	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:33.041296959 CEST	443	49873	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:33.042126894 CEST	49873	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:33.042145967 CEST	443	49873	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:33.042165041 CEST	49873	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:33.042169094 CEST	443	49873	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:33.044794083 CEST	443	49871	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:33.045259953 CEST	49871	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:33.045280933 CEST	443	49871	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:33.045640945 CEST	49871	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:33.045646906 CEST	443	49871	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:33.134280920 CEST	443	49872	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:33.134480000 CEST	443	49872	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:33.134537935 CEST	49872	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:33.134628057 CEST	49872	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:33.134628057 CEST	49872	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:33.134645939 CEST	443	49872	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:33.134654999 CEST	443	49872	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:33.137383938 CEST	49876	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:33.137420893 CEST	443	49876	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:33.137612104 CEST	49876	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:33.137729883 CEST	49876	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:33.137744904 CEST	443	49876	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:33.139177084 CEST	443	49873	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:33.139234066 CEST	443	49873	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:33.139302015 CEST	49873	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:33.139323950 CEST	443	49873	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:33.139354944 CEST	443	49873	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:33.139406919 CEST	49873	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:33.139442921 CEST	49873	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:33.139444113 CEST	49873	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:33.139456034 CEST	443	49873	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:33.139465094 CEST	443	49873	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:33.141608953 CEST	49877	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:33.141655922 CEST	443	49877	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:33.141719103 CEST	49877	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:33.141832113 CEST	49877	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:33.141840935 CEST	443	49877	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:33.144129992 CEST	443	49871	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:33.144551992 CEST	443	49871	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:33.144612074 CEST	49871	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:33.144664049 CEST	49871	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:33.144686937 CEST	443	49871	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:33.144701004 CEST	49871	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:33.144709110 CEST	443	49871	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:33.146778107 CEST	49878	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:33.146791935 CEST	443	49878	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:33.146902084 CEST	49878	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:33.147030115 CEST	49878	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:33.147043943 CEST	443	49878	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:33.482238054 CEST	443	49875	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:33.482712030 CEST	49875	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:33.482728004 CEST	443	49875	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:33.483211994 CEST	49875	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:33.483225107 CEST	443	49875	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:33.501691103 CEST	443	49874	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:33.502093077 CEST	49874	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:33.502124071 CEST	443	49874	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:33.502538919 CEST	49874	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:33.502545118 CEST	443	49874	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:33.576978922 CEST	443	49875	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:33.577054977 CEST	443	49875	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:33.577117920 CEST	49875	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:33.577128887 CEST	443	49875	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:33.577173948 CEST	443	49875	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:33.577234030 CEST	49875	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:33.577399969 CEST	49875	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:33.577399969 CEST	49875	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:33.577414989 CEST	443	49875	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:33.577419043 CEST	443	49875	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:33.580216885 CEST	49879	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:33.580250025 CEST	443	49879	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:33.580310106 CEST	49879	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:33.580460072 CEST	49879	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:33.580471039 CEST	443	49879	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:33.611597061 CEST	443	49874	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:33.611720085 CEST	443	49874	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:33.611769915 CEST	443	49874	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:33.611833096 CEST	49874	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:33.611833096 CEST	49874	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:33.611912012 CEST	49874	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:33.611912012 CEST	49874	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:33.611932039 CEST	443	49874	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:33.611942053 CEST	443	49874	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:33.614356995 CEST	49880	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:33.614401102 CEST	443	49880	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:33.614479065 CEST	49880	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:33.614603996 CEST	49880	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:33.614620924 CEST	443	49880	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:33.759248018 CEST	443	49878	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:33.759737015 CEST	49878	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:33.759763956 CEST	443	49878	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:33.759900093 CEST	443	49877	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:33.760181904 CEST	49878	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:33.760190964 CEST	443	49878	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:33.760319948 CEST	49877	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:33.760332108 CEST	443	49877	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:33.760942936 CEST	49877	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:33.760946989 CEST	443	49877	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:33.772733927 CEST	443	49876	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:33.773305893 CEST	49876	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:33.773324013 CEST	443	49876	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:33.773735046 CEST	49876	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:33.773741007 CEST	443	49876	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:33.864414930 CEST	443	49878	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:33.864496946 CEST	443	49878	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:33.864567041 CEST	49878	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:33.864754915 CEST	49878	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:33.864778996 CEST	443	49878	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:33.864784956 CEST	49878	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:33.864792109 CEST	443	49878	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:33.865046024 CEST	443	49877	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:33.865088940 CEST	443	49877	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:33.865127087 CEST	49877	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:33.865143061 CEST	443	49877	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:33.865164042 CEST	443	49877	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:33.865206957 CEST	49877	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:33.865297079 CEST	49877	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:33.865303993 CEST	443	49877	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:33.865331888 CEST	49877	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:33.865335941 CEST	443	49877	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:33.867806911 CEST	49881	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:33.867846966 CEST	443	49881	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:33.867918015 CEST	49882	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:33.867918015 CEST	49881	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:33.867928028 CEST	443	49882	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:33.867978096 CEST	49882	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:33.868047953 CEST	49881	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:33.868067026 CEST	443	49881	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:33.868114948 CEST	49882	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:33.868124008 CEST	443	49882	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:33.880774975 CEST	443	49876	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:33.881299019 CEST	443	49876	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:33.881505966 CEST	49876	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:33.881505966 CEST	49876	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:33.881597042 CEST	49876	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:33.881609917 CEST	443	49876	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:33.883992910 CEST	49883	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:33.884028912 CEST	443	49883	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:33.884109020 CEST	49883	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:33.884259939 CEST	49883	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:33.884274960 CEST	443	49883	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:34.222378969 CEST	443	49879	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:34.223148108 CEST	49879	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:34.223164082 CEST	443	49879	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:34.223567009 CEST	49879	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:34.223572016 CEST	443	49879	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:34.236582041 CEST	443	49880	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:34.236996889 CEST	49880	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:34.237021923 CEST	443	49880	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:34.237387896 CEST	49880	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:34.237394094 CEST	443	49880	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:34.324776888 CEST	443	49879	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:34.324805975 CEST	443	49879	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:34.324872017 CEST	443	49879	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:34.324903965 CEST	49879	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:34.324923992 CEST	49879	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:34.325196981 CEST	49879	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:34.325196981 CEST	49879	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:34.325215101 CEST	443	49879	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:34.325225115 CEST	443	49879	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:34.327836037 CEST	49884	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:34.327874899 CEST	443	49884	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:34.327955008 CEST	49884	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:34.328248978 CEST	49884	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:34.328264952 CEST	443	49884	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:34.336275101 CEST	443	49880	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:34.336605072 CEST	443	49880	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:34.336652994 CEST	443	49880	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:34.336669922 CEST	49880	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:34.336703062 CEST	49880	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:34.336703062 CEST	49880	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:34.336725950 CEST	443	49880	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:34.336749077 CEST	49880	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:34.336755991 CEST	443	49880	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:34.338970900 CEST	49885	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:34.339010000 CEST	443	49885	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:34.339082003 CEST	49885	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:34.339221001 CEST	49885	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:34.339231968 CEST	443	49885	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:34.492319107 CEST	443	49881	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:34.494075060 CEST	49881	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:34.494116068 CEST	443	49881	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:34.495676041 CEST	49881	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:34.495685101 CEST	443	49881	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:34.503432989 CEST	443	49882	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:34.504333019 CEST	49882	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:34.504347086 CEST	443	49882	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:34.504864931 CEST	49882	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:34.504869938 CEST	443	49882	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:34.508554935 CEST	443	49883	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:34.508924961 CEST	49883	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:34.508948088 CEST	443	49883	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:34.509497881 CEST	49883	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:34.509501934 CEST	443	49883	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:34.587522030 CEST	443	49881	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:34.587718964 CEST	443	49881	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:34.587781906 CEST	49881	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:34.587816000 CEST	49881	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:34.587831974 CEST	443	49881	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:34.591873884 CEST	49886	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:34.591974020 CEST	443	49886	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:34.592067957 CEST	49886	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:34.592405081 CEST	49886	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:34.592439890 CEST	443	49886	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:34.600219965 CEST	443	49882	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:34.600821018 CEST	443	49882	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:34.600873947 CEST	49882	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:34.600883961 CEST	443	49882	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:34.600969076 CEST	49882	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:34.600975037 CEST	443	49882	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:34.601061106 CEST	443	49882	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:34.601072073 CEST	49882	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:34.601078987 CEST	443	49882	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:34.604640007 CEST	49887	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:34.604684114 CEST	443	49887	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:34.604742050 CEST	49887	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:34.605073929 CEST	49887	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:34.605088949 CEST	443	49887	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:34.607347965 CEST	443	49883	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:34.607547998 CEST	443	49883	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:34.607614994 CEST	49883	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:34.607705116 CEST	49883	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:34.607723951 CEST	443	49883	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:34.607733965 CEST	49883	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:34.607739925 CEST	443	49883	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:34.610827923 CEST	49888	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:34.610840082 CEST	443	49888	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:34.610891104 CEST	49888	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:34.611504078 CEST	49888	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:34.611526966 CEST	443	49888	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:34.944996119 CEST	443	49884	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:34.945611000 CEST	49884	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:34.945630074 CEST	443	49884	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:34.946341038 CEST	49884	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:34.946356058 CEST	443	49884	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:34.948247910 CEST	443	49885	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:34.948829889 CEST	49885	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:34.948894978 CEST	443	49885	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:34.949455976 CEST	49885	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:34.949476957 CEST	443	49885	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:35.040540934 CEST	443	49884	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:35.042785883 CEST	443	49884	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:35.042896032 CEST	49884	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:35.042896032 CEST	49884	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:35.043423891 CEST	49884	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:35.043445110 CEST	443	49884	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:35.045036077 CEST	443	49885	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:35.045064926 CEST	443	49885	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:35.045125961 CEST	443	49885	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:35.045130014 CEST	49885	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:35.045191050 CEST	49885	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:35.045258045 CEST	49885	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:35.045298100 CEST	443	49885	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:35.045321941 CEST	49885	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:35.045336008 CEST	443	49885	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:35.050692081 CEST	49889	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:35.050735950 CEST	443	49889	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:35.050821066 CEST	49889	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:35.052090883 CEST	49889	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:35.052113056 CEST	443	49889	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:35.053977013 CEST	49890	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:35.054028988 CEST	443	49890	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:35.054100990 CEST	49890	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:35.054255962 CEST	49890	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:35.054280043 CEST	443	49890	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:35.216337919 CEST	443	49886	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:35.216891050 CEST	49886	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:35.216959000 CEST	443	49886	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:35.217364073 CEST	49886	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:35.217379093 CEST	443	49886	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:35.220869064 CEST	443	49888	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:35.221313000 CEST	49888	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:35.221354961 CEST	443	49888	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:35.221652031 CEST	49888	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:35.221658945 CEST	443	49888	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:35.222918987 CEST	443	49887	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:35.223253965 CEST	49887	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:35.223263979 CEST	443	49887	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:35.223599911 CEST	49887	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:35.223607063 CEST	443	49887	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:35.311688900 CEST	443	49886	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:35.311850071 CEST	443	49886	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:35.312047005 CEST	49886	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:35.312047958 CEST	49886	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:35.314743996 CEST	49886	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:35.314776897 CEST	443	49886	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:35.314812899 CEST	49891	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:35.314868927 CEST	443	49891	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:35.315066099 CEST	49891	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:35.315066099 CEST	49891	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:35.315108061 CEST	443	49891	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:35.315975904 CEST	443	49888	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:35.316126108 CEST	443	49888	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:35.316221952 CEST	49888	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:35.316361904 CEST	49888	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:35.316361904 CEST	49888	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:35.316376925 CEST	443	49888	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:35.316386938 CEST	443	49888	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:35.318617105 CEST	49892	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:35.318646908 CEST	443	49892	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:35.318726063 CEST	49892	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:35.318942070 CEST	49892	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:35.318957090 CEST	443	49892	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:35.328610897 CEST	443	49887	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:35.328816891 CEST	443	49887	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:35.328871965 CEST	49887	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:35.328877926 CEST	443	49887	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:35.328974009 CEST	49887	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:35.328974009 CEST	49887	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:35.329005957 CEST	49887	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:35.329011917 CEST	443	49887	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:35.330887079 CEST	49893	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:35.330930948 CEST	443	49893	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:35.330988884 CEST	49893	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:35.331108093 CEST	49893	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:35.331121922 CEST	443	49893	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:35.984497070 CEST	443	49890	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:35.985120058 CEST	443	49889	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:35.985238075 CEST	49890	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:35.985261917 CEST	443	49890	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:35.985627890 CEST	49889	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:35.985635042 CEST	443	49889	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:35.985680103 CEST	49890	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:35.985683918 CEST	443	49890	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:35.985929012 CEST	443	49893	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:35.986298084 CEST	49889	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:35.986301899 CEST	443	49889	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:35.986635923 CEST	49893	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:35.986649036 CEST	443	49893	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:35.987035990 CEST	443	49892	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:35.987154961 CEST	49893	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:35.987159967 CEST	443	49893	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:35.987366915 CEST	49892	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:35.987396002 CEST	443	49892	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:35.987871885 CEST	49892	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:35.987878084 CEST	443	49892	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:35.996692896 CEST	443	49891	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:35.997309923 CEST	49891	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:35.997318029 CEST	443	49891	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:35.997523069 CEST	49891	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:35.997528076 CEST	443	49891	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:36.084583044 CEST	443	49890	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:36.085479975 CEST	443	49890	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:36.086399078 CEST	443	49889	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:36.086538076 CEST	443	49889	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:36.086610079 CEST	443	49889	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:36.086651087 CEST	49890	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:36.086651087 CEST	49889	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:36.086690903 CEST	49889	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:36.086983919 CEST	49890	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:36.087001085 CEST	443	49890	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:36.087014914 CEST	49890	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:36.087021112 CEST	443	49890	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:36.087928057 CEST	443	49893	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:36.088439941 CEST	49889	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:36.088448048 CEST	443	49889	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:36.088455915 CEST	49889	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:36.088459969 CEST	443	49889	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:36.088510990 CEST	443	49893	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:36.089059114 CEST	49893	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:36.089879990 CEST	49893	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:36.089894056 CEST	443	49893	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:36.089926958 CEST	49893	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:36.089934111 CEST	443	49893	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:36.093096018 CEST	49894	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:36.093118906 CEST	443	49894	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:36.094264984 CEST	49895	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:36.094295979 CEST	443	49895	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:36.094311953 CEST	49894	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:36.094672918 CEST	49894	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:36.094685078 CEST	443	49894	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:36.094691992 CEST	49895	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:36.095149994 CEST	49895	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:36.095166922 CEST	443	49895	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:36.095699072 CEST	49896	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:36.095736980 CEST	443	49896	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:36.097074032 CEST	49896	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:36.097229004 CEST	49896	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:36.097242117 CEST	443	49896	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:36.098443031 CEST	443	49891	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:36.098519087 CEST	443	49891	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:36.099730015 CEST	443	49892	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:36.099795103 CEST	443	49892	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:36.099809885 CEST	49891	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:36.099852085 CEST	49892	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:36.099992037 CEST	49891	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:36.100008965 CEST	443	49891	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:36.100023031 CEST	49891	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:36.100029945 CEST	443	49891	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:36.100961924 CEST	49892	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:36.100981951 CEST	443	49892	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:36.100997925 CEST	49892	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:36.101003885 CEST	443	49892	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:36.103415966 CEST	49897	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:36.103467941 CEST	443	49897	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:36.103667021 CEST	49898	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:36.103687048 CEST	443	49898	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:36.103722095 CEST	49897	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:36.103770018 CEST	49898	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:36.103826046 CEST	49897	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:36.103854895 CEST	443	49897	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:36.103908062 CEST	49898	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:36.103929043 CEST	443	49898	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:36.708772898 CEST	443	49894	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:36.709398031 CEST	49894	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:36.709424973 CEST	443	49894	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:36.710058928 CEST	49894	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:36.710064888 CEST	443	49894	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:36.718727112 CEST	443	49895	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:36.719202995 CEST	49895	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:36.719225883 CEST	443	49895	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:36.719269037 CEST	443	49896	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:36.719707966 CEST	49895	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:36.719715118 CEST	443	49895	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:36.719990015 CEST	49896	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:36.720004082 CEST	443	49896	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:36.720592022 CEST	49896	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:36.720597029 CEST	443	49896	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:36.734707117 CEST	443	49898	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:36.735270023 CEST	49898	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:36.735301971 CEST	443	49898	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:36.735758066 CEST	49898	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:36.735764980 CEST	443	49898	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:36.744527102 CEST	443	49897	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:36.744940996 CEST	49897	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:36.744951010 CEST	443	49897	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:36.745408058 CEST	49897	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:36.745410919 CEST	443	49897	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:36.808839083 CEST	443	49894	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:36.809056044 CEST	443	49894	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:36.809113026 CEST	49894	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:36.809139967 CEST	49894	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:36.809153080 CEST	443	49894	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:36.809165001 CEST	49894	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:36.809170008 CEST	443	49894	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:36.811745882 CEST	49899	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:36.811774969 CEST	443	49899	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:36.811892986 CEST	49899	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:36.811981916 CEST	49899	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:36.811991930 CEST	443	49899	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:36.819156885 CEST	443	49895	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:36.819708109 CEST	443	49895	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:36.819749117 CEST	443	49895	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:36.819772959 CEST	49895	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:36.819840908 CEST	49895	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:36.819840908 CEST	49895	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:36.819863081 CEST	49895	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:36.819876909 CEST	443	49895	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:36.822257042 CEST	443	49896	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:36.822653055 CEST	443	49896	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:36.822732925 CEST	49896	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:36.822767973 CEST	49896	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:36.822774887 CEST	443	49896	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:36.822788000 CEST	49896	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:36.822792053 CEST	443	49896	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:36.823225021 CEST	49900	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:36.823256016 CEST	443	49900	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:36.823457003 CEST	49900	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:36.823806047 CEST	49900	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:36.823817015 CEST	443	49900	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:36.825340986 CEST	49901	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:36.825387955 CEST	443	49901	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:36.825464964 CEST	49901	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:36.825607061 CEST	49901	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:36.825628996 CEST	443	49901	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:36.834377050 CEST	443	49898	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:36.834988117 CEST	443	49898	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:36.835059881 CEST	49898	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:36.835130930 CEST	49898	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:36.835130930 CEST	49898	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:36.835144997 CEST	443	49898	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:36.835154057 CEST	443	49898	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:36.837595940 CEST	49902	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:36.837615967 CEST	443	49902	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:36.837682009 CEST	49902	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:36.837802887 CEST	49902	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:36.837809086 CEST	443	49902	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:36.845834017 CEST	443	49897	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:36.845896006 CEST	443	49897	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:36.845990896 CEST	49897	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:36.845999002 CEST	443	49897	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:36.846018076 CEST	443	49897	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:36.846065044 CEST	49897	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:36.846159935 CEST	49897	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:36.846163988 CEST	443	49897	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:36.846174955 CEST	49897	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:36.846179962 CEST	443	49897	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:36.848488092 CEST	49903	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:36.848519087 CEST	443	49903	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:36.848611116 CEST	49903	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:36.848809004 CEST	49903	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:36.848822117 CEST	443	49903	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:37.437158108 CEST	443	49901	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:37.437340021 CEST	443	49899	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:37.437714100 CEST	49901	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:37.437726974 CEST	443	49901	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:37.437913895 CEST	49899	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:37.437923908 CEST	443	49899	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:37.438441992 CEST	49901	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:37.438447952 CEST	443	49901	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:37.438621998 CEST	49899	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:37.438626051 CEST	443	49899	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:37.456918001 CEST	443	49902	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:37.457428932 CEST	49902	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:37.457443953 CEST	443	49902	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:37.457918882 CEST	49902	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:37.457923889 CEST	443	49902	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:37.459470034 CEST	443	49900	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:37.459966898 CEST	49900	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:37.460019112 CEST	443	49900	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:37.460270882 CEST	49900	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:37.460280895 CEST	443	49900	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:37.495979071 CEST	443	49903	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:37.496553898 CEST	49903	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:37.496579885 CEST	443	49903	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:37.496840954 CEST	49903	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:37.496846914 CEST	443	49903	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:37.537786961 CEST	443	49899	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:37.538218021 CEST	443	49899	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:37.538289070 CEST	443	49899	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:37.538372040 CEST	49899	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:37.538499117 CEST	49899	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:37.538647890 CEST	49899	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:37.538647890 CEST	49899	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:37.538665056 CEST	443	49899	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:37.538678885 CEST	443	49899	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:37.538984060 CEST	443	49901	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:37.539014101 CEST	443	49901	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:37.539057016 CEST	443	49901	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:37.539102077 CEST	49901	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:37.539139986 CEST	49901	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:37.539980888 CEST	49901	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:37.539999962 CEST	443	49901	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:37.542505026 CEST	49904	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:37.542537928 CEST	443	49904	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:37.542601109 CEST	49904	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:37.542632103 CEST	49905	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:37.542675018 CEST	443	49905	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:37.542723894 CEST	49905	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:37.542792082 CEST	49904	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:37.542803049 CEST	443	49904	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:37.542887926 CEST	49905	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:37.542905092 CEST	443	49905	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:37.555876970 CEST	443	49902	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:37.556401968 CEST	443	49902	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:37.556473017 CEST	49902	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:37.556663036 CEST	49902	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:37.556663036 CEST	49902	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:37.556690931 CEST	443	49902	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:37.556714058 CEST	443	49902	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:37.558896065 CEST	49906	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:37.558927059 CEST	443	49906	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:37.558991909 CEST	49906	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:37.559195042 CEST	49906	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:37.559210062 CEST	443	49906	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:37.561526060 CEST	443	49900	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:37.561595917 CEST	443	49900	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:37.561706066 CEST	49900	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:37.561799049 CEST	49900	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:37.561799049 CEST	49900	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:37.561820030 CEST	443	49900	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:37.561830997 CEST	443	49900	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:37.563688993 CEST	49907	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:37.563704967 CEST	443	49907	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:37.563765049 CEST	49907	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:37.563868999 CEST	49907	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:37.563879013 CEST	443	49907	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:37.603627920 CEST	443	49903	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:37.603676081 CEST	443	49903	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:37.603800058 CEST	443	49903	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:37.603872061 CEST	49903	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:37.604048967 CEST	49903	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:37.604048967 CEST	49903	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:37.604072094 CEST	443	49903	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:37.604080915 CEST	443	49903	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:37.606587887 CEST	49908	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:37.606622934 CEST	443	49908	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:37.606709957 CEST	49908	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:37.606856108 CEST	49908	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:37.606867075 CEST	443	49908	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:38.172697067 CEST	443	49904	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:38.173383951 CEST	49904	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:38.173403978 CEST	443	49904	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:38.174009085 CEST	49904	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:38.174015999 CEST	443	49904	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:38.177906036 CEST	443	49907	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:38.178201914 CEST	49907	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:38.178215027 CEST	443	49907	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:38.178723097 CEST	49907	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:38.178731918 CEST	443	49907	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:38.198776960 CEST	443	49905	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:38.199237108 CEST	49905	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:38.199256897 CEST	443	49905	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:38.199805021 CEST	49905	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:38.199810982 CEST	443	49905	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:38.216680050 CEST	443	49906	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:38.216985941 CEST	49906	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:38.216998100 CEST	443	49906	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:38.217463970 CEST	49906	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:38.217468977 CEST	443	49906	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:38.236995935 CEST	443	49908	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:38.237427950 CEST	49908	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:38.237461090 CEST	443	49908	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:38.237915993 CEST	49908	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:38.237926960 CEST	443	49908	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:38.269249916 CEST	443	49904	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:38.269577980 CEST	443	49904	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:38.269634962 CEST	443	49904	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:38.269653082 CEST	49904	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:38.269702911 CEST	49904	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:38.269753933 CEST	49904	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:38.269773960 CEST	443	49904	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:38.269788980 CEST	49904	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:38.269794941 CEST	443	49904	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:38.272527933 CEST	443	49907	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:38.272608042 CEST	443	49907	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:38.272667885 CEST	443	49907	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:38.272691965 CEST	49907	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:38.272805929 CEST	49907	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:38.272852898 CEST	49909	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:38.272917032 CEST	443	49909	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:38.273039103 CEST	49909	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:38.273153067 CEST	49907	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:38.273166895 CEST	443	49907	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:38.273175955 CEST	49907	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:38.273180962 CEST	443	49907	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:38.274085999 CEST	49909	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:38.274105072 CEST	443	49909	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:38.275266886 CEST	49910	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:38.275275946 CEST	443	49910	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:38.275368929 CEST	49910	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:38.275499105 CEST	49910	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:38.275509119 CEST	443	49910	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:38.300015926 CEST	443	49905	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:38.300043106 CEST	443	49905	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:38.300223112 CEST	49905	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:38.300252914 CEST	443	49905	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:38.300293922 CEST	443	49905	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:38.300416946 CEST	49905	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:38.300530910 CEST	49905	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:38.300551891 CEST	443	49905	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:38.300565004 CEST	49905	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:38.300570011 CEST	443	49905	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:38.303446054 CEST	49911	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:38.303514004 CEST	443	49911	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:38.303649902 CEST	49911	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:38.303792953 CEST	49911	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:38.303821087 CEST	443	49911	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:38.317420006 CEST	443	49906	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:38.317507029 CEST	443	49906	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:38.317564964 CEST	49906	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:38.317641973 CEST	49906	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:38.317651033 CEST	443	49906	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:38.317663908 CEST	49906	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:38.317667961 CEST	443	49906	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:38.320375919 CEST	49912	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:38.320452929 CEST	443	49912	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:38.320600986 CEST	49912	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:38.320784092 CEST	49912	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:38.320821047 CEST	443	49912	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:38.333334923 CEST	443	49908	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:38.333554983 CEST	443	49908	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:38.333631992 CEST	49908	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:38.333698988 CEST	49908	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:38.333698988 CEST	49908	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:38.333733082 CEST	443	49908	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:38.333759069 CEST	443	49908	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:38.336090088 CEST	49913	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:38.336122036 CEST	443	49913	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:38.336242914 CEST	49913	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:38.336318016 CEST	49913	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:38.336329937 CEST	443	49913	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:38.957856894 CEST	443	49911	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:38.958390951 CEST	49911	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:38.958414078 CEST	443	49911	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:38.958848953 CEST	49911	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:38.958853960 CEST	443	49911	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:38.964010954 CEST	443	49912	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:38.964338064 CEST	49912	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:38.964359999 CEST	443	49912	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:38.964698076 CEST	49912	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:38.964704990 CEST	443	49912	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:38.966569901 CEST	443	49909	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:38.966833115 CEST	49909	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:38.966856956 CEST	443	49909	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:38.967152119 CEST	49909	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:38.967158079 CEST	443	49909	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:38.974019051 CEST	443	49913	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:38.974301100 CEST	49913	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:38.974313021 CEST	443	49913	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:38.974652052 CEST	49913	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:38.974663973 CEST	443	49913	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:39.018188000 CEST	443	49910	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:39.018682003 CEST	49910	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:39.018690109 CEST	443	49910	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:39.018951893 CEST	49910	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:39.018956900 CEST	443	49910	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:39.061008930 CEST	443	49911	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:39.061045885 CEST	443	49911	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:39.061096907 CEST	443	49911	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:39.061120987 CEST	49911	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:39.061141014 CEST	49911	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:39.061367035 CEST	49911	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:39.061382055 CEST	443	49911	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:39.061388016 CEST	49911	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:39.061393976 CEST	443	49911	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:39.064308882 CEST	49914	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:39.064342976 CEST	443	49914	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:39.064459085 CEST	49914	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:39.064625978 CEST	49914	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:39.064637899 CEST	443	49914	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:39.066364050 CEST	443	49912	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:39.066430092 CEST	443	49912	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:39.066533089 CEST	49912	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:39.066757917 CEST	49912	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:39.066757917 CEST	49912	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:39.066777945 CEST	443	49912	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:39.066783905 CEST	443	49912	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:39.068909883 CEST	49915	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:39.068936110 CEST	443	49915	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:39.069020987 CEST	49915	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:39.069227934 CEST	49915	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:39.069252968 CEST	443	49915	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:39.069372892 CEST	443	49909	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:39.069567919 CEST	443	49909	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:39.069613934 CEST	443	49909	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:39.069643021 CEST	49909	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:39.069679976 CEST	49909	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:39.069725037 CEST	49909	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:39.069737911 CEST	443	49909	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:39.069749117 CEST	49909	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:39.069753885 CEST	443	49909	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:39.071871996 CEST	49916	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:39.071901083 CEST	443	49916	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:39.071962118 CEST	49916	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:39.072088003 CEST	49916	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:39.072112083 CEST	443	49916	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:39.077320099 CEST	443	49913	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:39.077533960 CEST	443	49913	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:39.077569008 CEST	443	49913	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:39.077646971 CEST	49913	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:39.077745914 CEST	49913	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:39.077745914 CEST	49913	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:39.077763081 CEST	443	49913	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:39.077770948 CEST	443	49913	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:39.079706907 CEST	49917	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:39.079724073 CEST	443	49917	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:39.079827070 CEST	49917	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:39.079929113 CEST	49917	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:39.079940081 CEST	443	49917	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:39.128345013 CEST	443	49910	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:39.128401041 CEST	443	49910	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:39.128464937 CEST	49910	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:39.128627062 CEST	49910	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:39.128633976 CEST	443	49910	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:39.128654957 CEST	49910	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:39.128659964 CEST	443	49910	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:39.130800962 CEST	49918	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:39.130815983 CEST	443	49918	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:39.130928993 CEST	49918	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:39.131011963 CEST	49918	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:39.131021976 CEST	443	49918	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:39.678499937 CEST	443	49914	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:39.682064056 CEST	49914	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:39.682064056 CEST	49914	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:39.682087898 CEST	443	49914	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:39.682102919 CEST	443	49914	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:39.692218065 CEST	443	49915	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:39.692894936 CEST	49915	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:39.692914009 CEST	443	49915	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:39.693150997 CEST	49915	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:39.693156004 CEST	443	49915	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:39.694192886 CEST	443	49917	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:39.694490910 CEST	49917	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:39.694499016 CEST	443	49917	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:39.694686890 CEST	443	49916	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:39.695022106 CEST	49916	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:39.695051908 CEST	49917	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:39.695056915 CEST	443	49917	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:39.695059061 CEST	443	49916	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:39.695352077 CEST	49916	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:39.695358992 CEST	443	49916	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:39.739494085 CEST	443	49918	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:39.740333080 CEST	49918	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:39.740333080 CEST	49918	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:39.740346909 CEST	443	49918	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:39.740360975 CEST	443	49918	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:39.775124073 CEST	443	49914	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:39.775196075 CEST	443	49914	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:39.775288105 CEST	49914	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:39.775477886 CEST	49914	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:39.775477886 CEST	49914	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:39.775501966 CEST	443	49914	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:39.775510073 CEST	443	49914	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:39.778300047 CEST	49919	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:39.778345108 CEST	443	49919	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:39.778413057 CEST	49919	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:39.778534889 CEST	49919	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:39.778556108 CEST	443	49919	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:39.789799929 CEST	443	49917	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:39.790157080 CEST	443	49917	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:39.790292025 CEST	49917	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:39.790405989 CEST	49917	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:39.790405989 CEST	49917	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:39.790426970 CEST	443	49917	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:39.790436029 CEST	443	49917	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:39.790683031 CEST	443	49915	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:39.790846109 CEST	443	49915	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:39.791009903 CEST	49915	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:39.791009903 CEST	49915	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:39.791155100 CEST	49915	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:39.791168928 CEST	443	49915	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:39.791193008 CEST	443	49916	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:39.791774035 CEST	443	49916	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:39.791853905 CEST	49916	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:39.791887999 CEST	443	49916	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:39.791910887 CEST	443	49916	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:39.791968107 CEST	49916	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:39.792469025 CEST	49916	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:39.792490959 CEST	443	49916	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:39.792525053 CEST	49916	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:39.792532921 CEST	443	49916	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:39.794800997 CEST	49920	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:39.794831991 CEST	443	49920	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:39.794852018 CEST	49921	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:39.794877052 CEST	443	49921	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:39.794948101 CEST	49920	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:39.794949055 CEST	49921	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:39.795006990 CEST	49920	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:39.795012951 CEST	443	49920	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:39.795145035 CEST	49921	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:39.795161963 CEST	443	49921	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:39.796255112 CEST	49922	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:39.796262980 CEST	443	49922	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:39.796430111 CEST	49922	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:39.796466112 CEST	49922	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:39.796473026 CEST	443	49922	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:39.834662914 CEST	443	49918	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:39.834728956 CEST	443	49918	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:39.834883928 CEST	49918	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:39.835082054 CEST	49918	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:39.835095882 CEST	443	49918	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:39.835124016 CEST	49918	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:39.835129023 CEST	443	49918	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:39.838090897 CEST	49923	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:39.838135004 CEST	443	49923	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:39.838435888 CEST	49923	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:39.838495970 CEST	49923	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:39.838504076 CEST	443	49923	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:40.389825106 CEST	443	49919	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:40.390254974 CEST	49919	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:40.390281916 CEST	443	49919	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:40.390702009 CEST	49919	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:40.390707970 CEST	443	49919	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:40.404906034 CEST	443	49922	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:40.405330896 CEST	49922	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:40.405353069 CEST	443	49922	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:40.405745029 CEST	49922	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:40.405757904 CEST	443	49922	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:40.410516977 CEST	443	49920	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:40.410856962 CEST	49920	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:40.410868883 CEST	443	49920	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:40.411288023 CEST	49920	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:40.411293030 CEST	443	49920	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:40.431377888 CEST	443	49921	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:40.431926012 CEST	49921	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:40.431941986 CEST	443	49921	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:40.432352066 CEST	49921	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:40.432367086 CEST	443	49921	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:40.457792997 CEST	443	49923	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:40.458157063 CEST	49923	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:40.458168030 CEST	443	49923	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:40.458622932 CEST	49923	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:40.458628893 CEST	443	49923	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:40.488996029 CEST	443	49919	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:40.489425898 CEST	443	49919	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:40.489483118 CEST	49919	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:40.489500999 CEST	443	49919	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:40.489538908 CEST	443	49919	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:40.489583015 CEST	49919	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:40.489605904 CEST	49919	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:40.489617109 CEST	443	49919	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:40.489625931 CEST	49919	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:40.489630938 CEST	443	49919	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:40.492294073 CEST	49924	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:40.492335081 CEST	443	49924	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:40.492410898 CEST	49924	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:40.492547989 CEST	49924	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:40.492558956 CEST	443	49924	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:40.505388021 CEST	443	49922	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:40.505419016 CEST	443	49922	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:40.505462885 CEST	443	49922	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:40.505474091 CEST	49922	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:40.505507946 CEST	49922	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:40.505594969 CEST	49922	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:40.505594969 CEST	49922	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:40.505614996 CEST	443	49922	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:40.505624056 CEST	443	49922	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:40.507817984 CEST	49925	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:40.507843971 CEST	443	49925	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:40.507915974 CEST	49925	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:40.508024931 CEST	49925	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:40.508033991 CEST	443	49925	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:40.509494066 CEST	443	49920	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:40.509562969 CEST	443	49920	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:40.509634972 CEST	49920	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:40.509715080 CEST	49920	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:40.509715080 CEST	49920	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:40.509730101 CEST	443	49920	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:40.509738922 CEST	443	49920	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:40.511492014 CEST	49926	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:40.511503935 CEST	443	49926	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:40.511575937 CEST	49926	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:40.511756897 CEST	49926	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:40.511769056 CEST	443	49926	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:40.534830093 CEST	443	49921	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:40.535617113 CEST	443	49921	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:40.535718918 CEST	49921	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:40.535754919 CEST	49921	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:40.535754919 CEST	49921	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:40.535772085 CEST	443	49921	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:40.535784006 CEST	443	49921	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:40.538244009 CEST	49927	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:40.538285017 CEST	443	49927	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:40.538361073 CEST	49927	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:40.538501978 CEST	49927	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:40.538513899 CEST	443	49927	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:40.556822062 CEST	443	49923	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:40.557033062 CEST	443	49923	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:40.557238102 CEST	49923	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:40.557310104 CEST	49923	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:40.557310104 CEST	49923	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:40.557327032 CEST	443	49923	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:40.557337046 CEST	443	49923	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:40.559533119 CEST	49928	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:40.559562922 CEST	443	49928	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:40.559648991 CEST	49928	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:40.559783936 CEST	49928	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:40.559794903 CEST	443	49928	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:41.128947020 CEST	443	49926	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:41.129703999 CEST	49926	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:41.129736900 CEST	443	49926	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:41.130224943 CEST	49926	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:41.130233049 CEST	443	49926	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:41.132998943 CEST	443	49924	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:41.133621931 CEST	49924	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:41.133621931 CEST	49924	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:41.133641958 CEST	443	49924	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:41.133651972 CEST	443	49924	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:41.145286083 CEST	443	49925	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:41.145560026 CEST	49925	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:41.145576954 CEST	443	49925	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:41.145884037 CEST	49925	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:41.145889997 CEST	443	49925	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:41.151325941 CEST	443	49927	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:41.151583910 CEST	49927	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:41.151617050 CEST	443	49927	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:41.152045965 CEST	49927	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:41.152051926 CEST	443	49927	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:41.173002005 CEST	443	49928	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:41.173732996 CEST	49928	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:41.173748016 CEST	443	49928	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:41.174132109 CEST	49928	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:41.174139023 CEST	443	49928	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:41.223297119 CEST	443	49926	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:41.223630905 CEST	443	49926	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:41.223809004 CEST	49926	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:41.223865986 CEST	49926	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:41.223886013 CEST	443	49926	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:41.223898888 CEST	49926	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:41.223906040 CEST	443	49926	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:41.227647066 CEST	49929	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:41.227688074 CEST	443	49929	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:41.227767944 CEST	49929	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:41.227906942 CEST	49929	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:41.227917910 CEST	443	49929	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:41.228001118 CEST	443	49924	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:41.228035927 CEST	443	49924	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:41.228072882 CEST	443	49924	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:41.228079081 CEST	49924	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:41.228182077 CEST	49924	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:41.228266954 CEST	49924	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:41.228266954 CEST	49924	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:41.228285074 CEST	443	49924	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:41.228293896 CEST	443	49924	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:41.230469942 CEST	49930	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:41.230488062 CEST	443	49930	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:41.230565071 CEST	49930	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:41.230695963 CEST	49930	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:41.230707884 CEST	443	49930	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:41.244080067 CEST	443	49925	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:41.244435072 CEST	443	49925	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:41.244509935 CEST	49925	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:41.244555950 CEST	49925	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:41.244570971 CEST	443	49925	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:41.244587898 CEST	49925	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:41.244595051 CEST	443	49925	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:41.246699095 CEST	443	49927	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:41.246778011 CEST	49931	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:41.246798038 CEST	443	49931	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:41.246860027 CEST	49931	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:41.246972084 CEST	49931	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:41.246985912 CEST	443	49931	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:41.247124910 CEST	443	49927	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:41.247167110 CEST	443	49927	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:41.247175932 CEST	49927	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:41.247248888 CEST	49927	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:41.247267008 CEST	49927	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:41.247277021 CEST	443	49927	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:41.247298956 CEST	49927	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:41.247307062 CEST	443	49927	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:41.249289036 CEST	49932	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:41.249300003 CEST	443	49932	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:41.249366045 CEST	49932	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:41.249495029 CEST	49932	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:41.249509096 CEST	443	49932	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:41.268750906 CEST	443	49928	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:41.268810987 CEST	443	49928	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:41.268858910 CEST	49928	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:41.268968105 CEST	49928	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:41.268976927 CEST	443	49928	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:41.269001961 CEST	49928	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:41.269006968 CEST	443	49928	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:41.270904064 CEST	49933	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:41.270934105 CEST	443	49933	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:41.271083117 CEST	49933	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:41.271214008 CEST	49933	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:41.271234035 CEST	443	49933	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:41.948076010 CEST	443	49930	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:41.948672056 CEST	443	49931	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:41.948812962 CEST	49930	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:41.948828936 CEST	443	49930	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:41.948991060 CEST	49931	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:41.949012995 CEST	443	49931	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:41.949095011 CEST	443	49932	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:41.949305058 CEST	49930	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:41.949310064 CEST	443	49930	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:41.949465036 CEST	49931	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:41.949470997 CEST	443	49931	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:41.949583054 CEST	49932	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:41.949594021 CEST	443	49932	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:41.949934006 CEST	49932	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:41.949939013 CEST	443	49932	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:41.951235056 CEST	443	49929	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:41.951525927 CEST	49929	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:41.951531887 CEST	443	49929	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:41.951898098 CEST	49929	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:41.951900959 CEST	443	49929	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:42.043270111 CEST	443	49931	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:42.043747902 CEST	443	49931	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:42.043844938 CEST	49931	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:42.043886900 CEST	49931	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:42.043906927 CEST	443	49931	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:42.043934107 CEST	49931	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:42.043941975 CEST	443	49931	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:42.046032906 CEST	443	49932	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:42.046411037 CEST	443	49932	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:42.046421051 CEST	443	49930	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:42.046472073 CEST	49932	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:42.046564102 CEST	49934	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:42.046606064 CEST	443	49934	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:42.046688080 CEST	49934	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:42.046710968 CEST	49932	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:42.046710968 CEST	49932	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:42.046724081 CEST	443	49932	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:42.046732903 CEST	443	49932	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:42.046755075 CEST	443	49930	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:42.046817064 CEST	49930	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:42.047647953 CEST	49930	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:42.047668934 CEST	443	49930	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:42.047678947 CEST	49930	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:42.047684908 CEST	443	49930	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:42.048499107 CEST	49934	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:42.048510075 CEST	443	49934	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:42.049853086 CEST	49935	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:42.049905062 CEST	443	49935	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:42.049982071 CEST	49935	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:42.050081015 CEST	49935	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:42.050093889 CEST	443	49935	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:42.050873041 CEST	49936	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:42.050919056 CEST	443	49936	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:42.050988913 CEST	49936	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:42.051085949 CEST	49936	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:42.051107883 CEST	443	49936	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:42.052777052 CEST	443	49929	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:42.053196907 CEST	443	49929	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:42.053268909 CEST	49929	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:42.053277969 CEST	443	49929	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:42.053309917 CEST	443	49929	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:42.053354979 CEST	49929	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:42.053495884 CEST	49929	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:42.053503990 CEST	443	49929	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:42.053514004 CEST	49929	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:42.053519964 CEST	443	49929	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:42.055496931 CEST	49937	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:42.055540085 CEST	443	49937	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:42.055671930 CEST	49937	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:42.055731058 CEST	49937	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:42.055742025 CEST	443	49937	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:42.130882978 CEST	443	49933	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:42.131413937 CEST	49933	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:42.131431103 CEST	443	49933	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:42.132134914 CEST	49933	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:42.132139921 CEST	443	49933	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:42.233592033 CEST	443	49933	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:42.233618975 CEST	443	49933	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:42.233668089 CEST	443	49933	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:42.233719110 CEST	49933	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:42.233750105 CEST	49933	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:42.233983994 CEST	49933	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:42.234000921 CEST	443	49933	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:42.234010935 CEST	49933	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:42.234016895 CEST	443	49933	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:42.236645937 CEST	49938	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:42.236696005 CEST	443	49938	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:42.236783981 CEST	49938	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:42.236916065 CEST	49938	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:42.236938953 CEST	443	49938	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:42.690844059 CEST	443	49935	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:42.691338062 CEST	49935	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:42.691345930 CEST	443	49935	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:42.691955090 CEST	49935	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:42.691958904 CEST	443	49935	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:42.698524952 CEST	443	49934	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:42.700628996 CEST	49934	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:42.700643063 CEST	443	49934	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:42.701045036 CEST	49934	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:42.701050997 CEST	443	49934	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:42.706499100 CEST	443	49936	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:42.706937075 CEST	49936	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:42.706960917 CEST	443	49936	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:42.707326889 CEST	49936	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:42.707335949 CEST	443	49936	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:42.708122969 CEST	443	49937	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:42.708677053 CEST	49937	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:42.708688021 CEST	443	49937	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:42.708947897 CEST	49937	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:42.708965063 CEST	443	49937	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:42.794737101 CEST	443	49935	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:42.795358896 CEST	443	49935	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:42.795490980 CEST	443	49935	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:42.795587063 CEST	49935	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:42.795686960 CEST	49935	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:42.795706034 CEST	443	49935	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:42.795718908 CEST	49935	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:42.795725107 CEST	443	49935	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:42.798337936 CEST	49939	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:42.798381090 CEST	443	49939	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:42.798468113 CEST	49939	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:42.798594952 CEST	49939	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:42.798603058 CEST	443	49939	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:42.803852081 CEST	443	49934	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:42.804214001 CEST	443	49934	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:42.804277897 CEST	49934	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:42.804410934 CEST	49934	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:42.804428101 CEST	443	49934	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:42.804440022 CEST	49934	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:42.804445982 CEST	443	49934	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:42.806642056 CEST	49940	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:42.806668997 CEST	443	49940	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:42.806880951 CEST	49940	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:42.806880951 CEST	49940	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:42.806905985 CEST	443	49940	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:42.814105988 CEST	443	49936	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:42.814354897 CEST	443	49937	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:42.814388990 CEST	443	49937	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:42.814477921 CEST	49937	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:42.814487934 CEST	443	49937	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:42.814609051 CEST	49937	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:42.814609051 CEST	49937	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:42.814615965 CEST	443	49937	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:42.815022945 CEST	443	49936	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:42.815090895 CEST	49936	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:42.815113068 CEST	49936	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:42.815113068 CEST	49936	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:42.815128088 CEST	443	49936	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:42.815141916 CEST	443	49936	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:42.815265894 CEST	443	49937	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:42.816977024 CEST	49941	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:42.817004919 CEST	443	49941	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:42.817115068 CEST	49942	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:42.817121983 CEST	443	49942	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:42.817162037 CEST	49941	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:42.817270994 CEST	49942	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:42.817270994 CEST	49941	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:42.817289114 CEST	443	49941	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:42.817320108 CEST	49942	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:42.817328930 CEST	443	49942	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:42.880213022 CEST	443	49938	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:42.881654024 CEST	49938	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:42.881675005 CEST	443	49938	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:42.882200956 CEST	49938	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:42.882205963 CEST	443	49938	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:42.982779980 CEST	443	49938	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:42.983313084 CEST	443	49938	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:42.983422995 CEST	49938	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:42.983633995 CEST	49938	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:42.983633995 CEST	49938	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:42.983655930 CEST	443	49938	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:42.983665943 CEST	443	49938	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:42.986416101 CEST	49943	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:42.986449957 CEST	443	49943	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:42.986536026 CEST	49943	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:42.986690044 CEST	49943	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:42.986702919 CEST	443	49943	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:43.426749945 CEST	443	49942	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:43.427350998 CEST	49942	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:43.427365065 CEST	443	49942	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:43.427762985 CEST	49942	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:43.427774906 CEST	443	49942	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:43.439335108 CEST	443	49939	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:43.439800024 CEST	49939	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:43.439810991 CEST	443	49939	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:43.440373898 CEST	49939	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:43.440378904 CEST	443	49939	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:43.448682070 CEST	443	49940	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:43.449289083 CEST	49940	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:43.449300051 CEST	443	49940	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:43.449582100 CEST	443	49941	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:43.449635029 CEST	49940	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:43.449640036 CEST	443	49940	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:43.449892044 CEST	49941	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:43.449901104 CEST	443	49941	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:43.450366020 CEST	49941	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:43.450371981 CEST	443	49941	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:43.531179905 CEST	443	49942	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:43.531254053 CEST	443	49942	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:43.531359911 CEST	49942	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:43.531568050 CEST	49942	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:43.531568050 CEST	49942	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:43.531585932 CEST	443	49942	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:43.531594992 CEST	443	49942	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:43.534612894 CEST	49944	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:43.534647942 CEST	443	49944	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:43.534751892 CEST	49944	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:43.534946918 CEST	49944	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:43.534960985 CEST	443	49944	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:43.553719044 CEST	443	49939	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:43.553782940 CEST	443	49939	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:43.553843975 CEST	49939	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:43.554059982 CEST	49939	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:43.554069042 CEST	443	49939	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:43.554085016 CEST	49939	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:43.554090977 CEST	443	49939	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:43.554889917 CEST	443	49941	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:43.555022001 CEST	443	49941	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:43.555074930 CEST	443	49941	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:43.555078983 CEST	49941	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:43.555206060 CEST	49941	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:43.555407047 CEST	49941	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:43.555418968 CEST	443	49941	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:43.555524111 CEST	49941	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:43.555531979 CEST	443	49941	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:43.557122946 CEST	443	49940	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:43.557269096 CEST	49945	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:43.557308912 CEST	443	49945	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:43.557312965 CEST	443	49940	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:43.557363987 CEST	49946	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:43.557370901 CEST	443	49946	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:43.557383060 CEST	49945	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:43.557410955 CEST	49946	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:43.557410955 CEST	49940	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:43.557598114 CEST	49945	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:43.557611942 CEST	443	49945	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:43.557657003 CEST	49940	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:43.557657003 CEST	49940	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:43.557672977 CEST	443	49940	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:43.557682991 CEST	443	49940	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:43.557722092 CEST	49946	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:43.557734013 CEST	443	49946	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:43.559946060 CEST	49947	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:43.559971094 CEST	443	49947	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:43.560041904 CEST	49947	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:43.560179949 CEST	49947	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:43.560192108 CEST	443	49947	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:43.602155924 CEST	443	49943	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:43.602806091 CEST	49943	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:43.602816105 CEST	443	49943	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:43.603245020 CEST	49943	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:43.603250027 CEST	443	49943	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:43.710263014 CEST	443	49943	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:43.710342884 CEST	443	49943	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:43.710474968 CEST	49943	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:43.711051941 CEST	49943	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:43.711051941 CEST	49943	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:43.711072922 CEST	443	49943	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:43.711081028 CEST	443	49943	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:43.713630915 CEST	49948	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:43.713677883 CEST	443	49948	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:43.713764906 CEST	49948	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:43.713939905 CEST	49948	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:43.713952065 CEST	443	49948	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:44.148962021 CEST	443	49944	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:44.149643898 CEST	49944	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:44.149660110 CEST	443	49944	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:44.150110960 CEST	49944	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:44.150116920 CEST	443	49944	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:44.213726044 CEST	443	49945	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:44.214303970 CEST	49945	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:44.214318991 CEST	443	49945	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:44.214720011 CEST	49945	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:44.214728117 CEST	443	49945	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:44.217959881 CEST	443	49946	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:44.218355894 CEST	49946	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:44.218370914 CEST	443	49946	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:44.218688965 CEST	49946	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:44.218693972 CEST	443	49946	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:44.223212957 CEST	443	49947	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:44.223586082 CEST	49947	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:44.223599911 CEST	443	49947	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:44.224216938 CEST	49947	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:44.224222898 CEST	443	49947	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:44.250843048 CEST	443	49944	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:44.251669884 CEST	443	49944	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:44.251745939 CEST	49944	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:44.251805067 CEST	49944	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:44.251811981 CEST	443	49944	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:44.251822948 CEST	49944	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:44.251827955 CEST	443	49944	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:44.254831076 CEST	49949	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:44.254853010 CEST	443	49949	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:44.254933119 CEST	49949	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:44.255103111 CEST	49949	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:44.255120993 CEST	443	49949	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:44.315567017 CEST	443	49945	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:44.315635920 CEST	443	49945	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:44.315737963 CEST	49945	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:44.316028118 CEST	49945	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:44.316056967 CEST	443	49945	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:44.316080093 CEST	49945	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:44.316087008 CEST	443	49945	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:44.319442034 CEST	49950	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:44.319483995 CEST	443	49950	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:44.319581032 CEST	49950	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:44.319698095 CEST	49950	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:44.319713116 CEST	443	49950	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:44.321806908 CEST	443	49946	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:44.321921110 CEST	443	49946	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:44.321974039 CEST	49946	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:44.322052002 CEST	49946	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:44.322052002 CEST	49946	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:44.322062969 CEST	443	49946	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:44.322071075 CEST	443	49946	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:44.324450970 CEST	49951	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:44.324485064 CEST	443	49951	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:44.324569941 CEST	49951	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:44.324810982 CEST	49951	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:44.324822903 CEST	443	49951	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:44.329617023 CEST	443	49947	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:44.330292940 CEST	443	49947	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:44.330378056 CEST	49947	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:44.330441952 CEST	49947	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:44.330456018 CEST	443	49947	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:44.330470085 CEST	49947	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:44.330476046 CEST	443	49947	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:44.332568884 CEST	49952	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:44.332587957 CEST	443	49952	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:44.332669973 CEST	49952	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:44.332830906 CEST	49952	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:44.332844973 CEST	443	49952	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:44.370542049 CEST	443	49948	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:44.371433973 CEST	49948	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:44.371459961 CEST	443	49948	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:44.372138023 CEST	49948	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:44.372143984 CEST	443	49948	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:44.761780977 CEST	443	49948	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:44.761846066 CEST	443	49948	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:44.761946917 CEST	49948	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:44.762152910 CEST	49948	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:44.762171030 CEST	443	49948	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:44.762182951 CEST	49948	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:44.762188911 CEST	443	49948	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:44.765151024 CEST	49954	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:44.765177011 CEST	443	49954	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:44.765258074 CEST	49954	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:44.765448093 CEST	49954	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:44.765463114 CEST	443	49954	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:44.948385000 CEST	443	49949	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:44.948987961 CEST	49949	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:44.949012995 CEST	443	49949	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:44.949608088 CEST	49949	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:44.949618101 CEST	443	49949	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:44.950583935 CEST	443	49951	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:44.950930119 CEST	49951	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:44.950954914 CEST	443	49951	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:44.951491117 CEST	49951	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:44.951498032 CEST	443	49951	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:44.963090897 CEST	443	49950	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:44.963573933 CEST	49950	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:44.963614941 CEST	443	49950	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:44.964030027 CEST	49950	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:44.964040995 CEST	443	49950	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:45.032020092 CEST	443	49952	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:45.032640934 CEST	49952	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:45.032663107 CEST	443	49952	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:45.033128023 CEST	49952	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:45.033134937 CEST	443	49952	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:45.050766945 CEST	443	49951	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:45.050795078 CEST	443	49951	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:45.050837994 CEST	443	49951	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:45.050890923 CEST	49951	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:45.050936937 CEST	49951	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:45.051249981 CEST	49951	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:45.051263094 CEST	443	49951	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:45.051275969 CEST	49951	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:45.051281929 CEST	443	49951	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:45.054466963 CEST	443	49949	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:45.054822922 CEST	49955	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:45.054860115 CEST	443	49955	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:45.054919958 CEST	49955	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:45.055064917 CEST	49955	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:45.055079937 CEST	443	49955	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:45.055195093 CEST	443	49949	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:45.055232048 CEST	49949	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:45.055244923 CEST	443	49949	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:45.055258036 CEST	443	49949	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:45.055309057 CEST	49949	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:45.062515020 CEST	49949	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:45.062541008 CEST	443	49949	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:45.062553883 CEST	49949	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:45.062561035 CEST	443	49949	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:45.064223051 CEST	443	49950	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:45.064708948 CEST	443	49950	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:45.064779997 CEST	49950	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:45.065372944 CEST	49956	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:45.065407038 CEST	443	49956	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:45.065469980 CEST	49956	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:45.065670013 CEST	49950	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:45.065690041 CEST	443	49950	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:45.065701008 CEST	49950	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:45.065706015 CEST	443	49950	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:45.068101883 CEST	49956	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:45.068114996 CEST	443	49956	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:45.069545031 CEST	49957	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:45.069565058 CEST	443	49957	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:45.069619894 CEST	49957	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:45.069941998 CEST	49957	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:45.069958925 CEST	443	49957	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:45.138988972 CEST	443	49952	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:45.139154911 CEST	443	49952	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:45.139224052 CEST	49952	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:45.147716045 CEST	49952	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:45.147739887 CEST	443	49952	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:45.147753000 CEST	49952	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:45.147759914 CEST	443	49952	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:45.155004025 CEST	49958	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:45.155035019 CEST	443	49958	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:45.155087948 CEST	49958	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:45.155242920 CEST	49958	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:45.155257940 CEST	443	49958	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:45.396198988 CEST	443	49954	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:45.397018909 CEST	49954	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:45.397031069 CEST	443	49954	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:45.397489071 CEST	49954	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:45.397495031 CEST	443	49954	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:45.496400118 CEST	443	49954	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:45.496429920 CEST	443	49954	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:45.496478081 CEST	443	49954	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:45.496488094 CEST	49954	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:45.496530056 CEST	49954	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:45.496762037 CEST	49954	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:45.496784925 CEST	443	49954	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:45.496808052 CEST	49954	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:45.496814966 CEST	443	49954	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:45.500092030 CEST	49959	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:45.500148058 CEST	443	49959	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:45.500230074 CEST	49959	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:45.500427961 CEST	49959	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:45.500442982 CEST	443	49959	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:45.677174091 CEST	443	49955	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:45.677779913 CEST	49955	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:45.677803040 CEST	443	49955	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:45.678370953 CEST	49955	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:45.678378105 CEST	443	49955	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:45.678616047 CEST	443	49956	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:45.679023981 CEST	49956	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:45.679049969 CEST	443	49956	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:45.679593086 CEST	49956	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:45.679600000 CEST	443	49956	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:45.696830034 CEST	443	49957	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:45.697364092 CEST	49957	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:45.697381973 CEST	443	49957	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:45.697990894 CEST	49957	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:45.697995901 CEST	443	49957	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:45.763314009 CEST	443	49958	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:45.765471935 CEST	49958	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:45.765496969 CEST	443	49958	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:45.766163111 CEST	49958	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:45.766170979 CEST	443	49958	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:45.774674892 CEST	443	49955	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:45.774765015 CEST	443	49956	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:45.774938107 CEST	443	49956	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:45.775544882 CEST	443	49955	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:45.775620937 CEST	49956	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:45.775624037 CEST	49955	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:45.775661945 CEST	49956	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:45.775682926 CEST	443	49956	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:45.775695086 CEST	49956	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:45.775701046 CEST	443	49956	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:45.776499987 CEST	49955	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:45.776515961 CEST	443	49955	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:45.776530027 CEST	49955	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:45.776537895 CEST	443	49955	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:45.779407024 CEST	49960	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:45.779443026 CEST	443	49960	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:45.779489040 CEST	49961	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:45.779530048 CEST	443	49961	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:45.779530048 CEST	49960	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:45.779642105 CEST	49961	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:45.779684067 CEST	49960	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:45.779699087 CEST	443	49960	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:45.779798985 CEST	49961	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:45.779814005 CEST	443	49961	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:45.794953108 CEST	443	49957	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:45.795150995 CEST	443	49957	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:45.795222998 CEST	49957	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:45.795255899 CEST	49957	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:45.795255899 CEST	49957	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:45.795269012 CEST	443	49957	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:45.795279026 CEST	443	49957	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:45.797848940 CEST	49962	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:45.797883987 CEST	443	49962	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:45.797954082 CEST	49962	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:45.798448086 CEST	49962	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:45.798463106 CEST	443	49962	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:45.871766090 CEST	443	49958	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:45.871839046 CEST	443	49958	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:45.871920109 CEST	49958	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:45.871933937 CEST	443	49958	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:45.871956110 CEST	443	49958	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:45.872009039 CEST	49958	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:45.872188091 CEST	49958	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:45.872205019 CEST	443	49958	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:45.872217894 CEST	49958	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:45.872225046 CEST	443	49958	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:45.875406981 CEST	49963	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:45.875433922 CEST	443	49963	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:45.876086950 CEST	49963	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:45.876086950 CEST	49963	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:45.876117945 CEST	443	49963	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:46.107377052 CEST	443	49959	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:46.107844114 CEST	49959	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:46.107872009 CEST	443	49959	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:46.108381987 CEST	49959	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:46.108387947 CEST	443	49959	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:46.212088108 CEST	443	49959	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:46.212241888 CEST	443	49959	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:46.212301970 CEST	49959	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:46.212496996 CEST	49959	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:46.212515116 CEST	443	49959	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:46.212526083 CEST	49959	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:46.212531090 CEST	443	49959	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:46.215306044 CEST	49964	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:46.215343952 CEST	443	49964	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:46.216097116 CEST	49964	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:46.216229916 CEST	49964	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:46.216244936 CEST	443	49964	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:46.620915890 CEST	443	49960	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:46.621577024 CEST	49960	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:46.621587038 CEST	443	49960	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:46.621728897 CEST	443	49961	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:46.621917963 CEST	443	49962	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:46.622339964 CEST	49960	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:46.622345924 CEST	443	49960	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:46.622715950 CEST	49961	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:46.622733116 CEST	443	49961	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:46.623290062 CEST	49961	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:46.623305082 CEST	443	49961	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:46.623614073 CEST	49962	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:46.623627901 CEST	443	49962	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:46.624196053 CEST	49962	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:46.624202967 CEST	443	49962	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:46.718813896 CEST	443	49960	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:46.718878984 CEST	443	49960	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:46.719027042 CEST	49960	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:46.719413996 CEST	49960	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:46.719413996 CEST	49960	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:46.719429970 CEST	443	49960	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:46.719434977 CEST	443	49960	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:46.720331907 CEST	443	49962	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:46.720419884 CEST	443	49962	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:46.720544100 CEST	49962	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:46.720628023 CEST	49962	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:46.720644951 CEST	443	49962	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:46.720676899 CEST	49962	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:46.720684052 CEST	443	49962	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:46.721468925 CEST	443	49961	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:46.721488953 CEST	443	49961	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:46.721556902 CEST	49961	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:46.721565962 CEST	443	49961	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:46.721712112 CEST	443	49961	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:46.721863031 CEST	49961	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:46.721863985 CEST	49961	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:46.721875906 CEST	443	49961	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:46.722270966 CEST	49965	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:46.722309113 CEST	443	49965	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:46.722454071 CEST	49965	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:46.722757101 CEST	49965	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:46.722779036 CEST	443	49965	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:46.723491907 CEST	49966	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:46.723505974 CEST	443	49966	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:46.723598957 CEST	49966	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:46.723731995 CEST	49966	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:46.723740101 CEST	443	49966	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:46.723951101 CEST	49967	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:46.723984003 CEST	443	49967	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:46.725616932 CEST	49967	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:46.725616932 CEST	49967	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:46.725650072 CEST	443	49967	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:46.798162937 CEST	443	49963	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:46.801440001 CEST	49963	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:46.801489115 CEST	443	49963	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:46.802014112 CEST	49963	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:46.802021027 CEST	443	49963	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:46.843703032 CEST	443	49964	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:46.845396042 CEST	49964	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:46.845423937 CEST	443	49964	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:46.845860004 CEST	49964	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:46.845865011 CEST	443	49964	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:46.902391911 CEST	443	49963	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:46.902432919 CEST	443	49963	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:46.902545929 CEST	49963	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:46.902561903 CEST	443	49963	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:46.902595043 CEST	443	49963	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:46.902971029 CEST	49963	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:46.903314114 CEST	49963	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:46.903314114 CEST	49963	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:46.903333902 CEST	443	49963	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:46.903338909 CEST	443	49963	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:46.906090021 CEST	49968	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:46.906141996 CEST	443	49968	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:46.906210899 CEST	49968	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:46.906399012 CEST	49968	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:46.906424046 CEST	443	49968	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:46.945071936 CEST	443	49964	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:46.945094109 CEST	443	49964	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:46.945159912 CEST	49964	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:46.945184946 CEST	443	49964	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:46.945341110 CEST	443	49964	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:46.947855949 CEST	49964	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:46.948328018 CEST	49964	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:46.948345900 CEST	443	49964	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:46.948355913 CEST	49964	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:46.948360920 CEST	443	49964	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:46.951284885 CEST	49969	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:46.951314926 CEST	443	49969	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:46.951423883 CEST	49969	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:46.951549053 CEST	49969	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:46.951554060 CEST	443	49969	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:47.022011042 CEST	49961	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:47.022033930 CEST	443	49961	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:47.333172083 CEST	443	49965	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:47.333585978 CEST	443	49967	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:47.364398956 CEST	443	49966	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:47.381421089 CEST	49965	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:47.383261919 CEST	49967	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:47.387392998 CEST	49965	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:47.387401104 CEST	443	49965	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:47.387634039 CEST	49965	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:47.387650013 CEST	443	49965	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:47.391243935 CEST	49967	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:47.391261101 CEST	443	49967	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:47.391635895 CEST	49967	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:47.391642094 CEST	443	49967	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:47.406892061 CEST	49966	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:47.406907082 CEST	443	49966	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:47.410851955 CEST	49966	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:47.410857916 CEST	443	49966	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:47.480609894 CEST	443	49965	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:47.480645895 CEST	443	49965	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:47.480725050 CEST	443	49965	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:47.480741024 CEST	49965	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:47.481062889 CEST	49965	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:47.483479023 CEST	49965	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:47.483496904 CEST	443	49965	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:47.483505011 CEST	49965	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:47.483511925 CEST	443	49965	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:47.484019995 CEST	443	49967	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:47.484091997 CEST	443	49967	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:47.484394073 CEST	49967	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:47.484853983 CEST	49967	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:47.484877110 CEST	443	49967	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:47.484888077 CEST	49967	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:47.484895945 CEST	443	49967	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:47.488620043 CEST	49970	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:47.488647938 CEST	443	49970	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:47.489036083 CEST	49970	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:47.489761114 CEST	49971	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:47.489795923 CEST	443	49971	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:47.489898920 CEST	49970	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:47.489911079 CEST	443	49970	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:47.490060091 CEST	49971	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:47.490349054 CEST	49971	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:47.490372896 CEST	443	49971	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:47.506799936 CEST	443	49966	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:47.506824970 CEST	443	49966	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:47.506947994 CEST	49966	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:47.506957054 CEST	443	49966	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:47.507076979 CEST	443	49966	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:47.509031057 CEST	49966	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:47.509418964 CEST	49966	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:47.509418964 CEST	49966	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:47.509435892 CEST	443	49966	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:47.509443998 CEST	443	49966	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:47.517375946 CEST	443	49968	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:47.529212952 CEST	49968	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:47.529223919 CEST	443	49968	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:47.529897928 CEST	49968	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:47.529906034 CEST	443	49968	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:47.536753893 CEST	49972	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:47.536792994 CEST	443	49972	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:47.536880970 CEST	49972	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:47.537221909 CEST	49972	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:47.537242889 CEST	443	49972	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:47.899629116 CEST	443	49968	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:47.899698973 CEST	443	49968	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:47.899892092 CEST	49968	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:47.900018930 CEST	49968	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:47.900018930 CEST	49968	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:47.900038958 CEST	443	49968	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:47.900049925 CEST	443	49968	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:47.901366949 CEST	443	49969	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:47.908205986 CEST	49969	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:47.908215046 CEST	443	49969	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:47.908677101 CEST	49969	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:47.908683062 CEST	443	49969	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:47.910166979 CEST	49973	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:47.910200119 CEST	443	49973	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:47.910377979 CEST	49973	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:47.910518885 CEST	49973	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:47.910531044 CEST	443	49973	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:48.002564907 CEST	443	49969	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:48.002659082 CEST	443	49969	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:48.002789021 CEST	49969	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:48.003115892 CEST	49969	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:48.003115892 CEST	49969	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:48.003134012 CEST	443	49969	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:48.003144979 CEST	443	49969	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:48.007061005 CEST	49974	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:48.007090092 CEST	443	49974	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:48.007261038 CEST	49974	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:48.007422924 CEST	49974	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:48.007435083 CEST	443	49974	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:48.099451065 CEST	443	49970	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:48.100100040 CEST	49970	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:48.100110054 CEST	443	49970	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:48.100575924 CEST	49970	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:48.100580931 CEST	443	49970	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:48.100807905 CEST	443	49971	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:48.101099968 CEST	49971	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:48.101121902 CEST	443	49971	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:48.101430893 CEST	49971	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:48.101438046 CEST	443	49971	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:48.143371105 CEST	443	49972	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:48.143928051 CEST	49972	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:48.143955946 CEST	443	49972	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:48.144401073 CEST	49972	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:48.144407988 CEST	443	49972	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:48.212800026 CEST	443	49970	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:48.212997913 CEST	443	49970	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:48.213082075 CEST	49970	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:48.213176966 CEST	49970	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:48.213176966 CEST	49970	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:48.213188887 CEST	443	49971	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:48.213224888 CEST	443	49970	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:48.213253975 CEST	443	49971	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:48.213254929 CEST	443	49970	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:48.213335037 CEST	49971	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:48.213351965 CEST	443	49971	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:48.213392973 CEST	49971	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:48.213433027 CEST	443	49971	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:48.213489056 CEST	443	49971	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:48.213525057 CEST	49971	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:48.213613033 CEST	49971	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:48.213613033 CEST	49971	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:48.213630915 CEST	443	49971	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:48.213639975 CEST	443	49971	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:48.216600895 CEST	49975	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:48.216634035 CEST	443	49975	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:48.216717005 CEST	49975	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:48.217385054 CEST	49976	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:48.217431068 CEST	443	49976	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:48.217515945 CEST	49975	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:48.217526913 CEST	49976	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:48.217529058 CEST	443	49975	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:48.217730045 CEST	49976	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:48.217755079 CEST	443	49976	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:48.243036985 CEST	443	49972	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:48.243062019 CEST	443	49972	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:48.243136883 CEST	443	49972	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:48.243160963 CEST	49972	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:48.243186951 CEST	49972	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:48.243357897 CEST	49972	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:48.243371964 CEST	443	49972	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:48.254352093 CEST	49977	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:48.254381895 CEST	443	49977	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:48.254476070 CEST	49977	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:48.254611969 CEST	49977	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:48.254627943 CEST	443	49977	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:48.700138092 CEST	443	49974	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:48.700587988 CEST	443	49973	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:48.700732946 CEST	49974	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:48.700751066 CEST	443	49974	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:48.701031923 CEST	49973	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:48.701042891 CEST	443	49973	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:48.701212883 CEST	49974	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:48.701216936 CEST	443	49974	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:48.701498032 CEST	49973	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:48.701500893 CEST	443	49973	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:48.806021929 CEST	443	49974	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:48.806042910 CEST	443	49974	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:48.806102991 CEST	49974	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:48.806117058 CEST	443	49974	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:48.806318998 CEST	49974	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:48.806324005 CEST	443	49974	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:48.806332111 CEST	49974	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:48.806337118 CEST	443	49974	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:48.809269905 CEST	49978	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:48.809304953 CEST	443	49978	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:48.809402943 CEST	49978	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:48.809546947 CEST	49978	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:48.809564114 CEST	443	49978	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:48.815452099 CEST	443	49973	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:48.815474033 CEST	443	49973	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:48.815551043 CEST	443	49973	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:48.815571070 CEST	49973	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:48.815581083 CEST	443	49973	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:48.815630913 CEST	49973	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:48.815630913 CEST	49973	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:48.840676069 CEST	443	49976	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:48.841217041 CEST	49976	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:48.841231108 CEST	443	49976	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:48.841689110 CEST	49976	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:48.841698885 CEST	443	49976	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:48.878786087 CEST	443	49977	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:48.879317999 CEST	49977	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:48.879343033 CEST	443	49977	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:48.879844904 CEST	49977	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:48.879851103 CEST	443	49977	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:48.888711929 CEST	443	49975	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:48.889385939 CEST	49975	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:48.889399052 CEST	443	49975	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:48.889848948 CEST	49975	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:48.889857054 CEST	443	49975	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:48.901453018 CEST	443	49973	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:48.901525974 CEST	443	49973	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:48.901601076 CEST	49973	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:48.901652098 CEST	49973	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:48.901669979 CEST	49973	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:48.901684999 CEST	443	49973	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:48.901726961 CEST	49973	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:48.901732922 CEST	443	49973	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:48.904576063 CEST	49979	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:48.904618979 CEST	443	49979	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:48.904697895 CEST	49979	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:48.904854059 CEST	49979	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:48.904866934 CEST	443	49979	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:48.945916891 CEST	443	49976	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:48.945940018 CEST	443	49976	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:48.946434975 CEST	443	49976	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:48.946496964 CEST	49976	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:48.946496964 CEST	49976	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:48.946577072 CEST	49976	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:48.946587086 CEST	443	49976	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:48.946599007 CEST	49976	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:48.946604013 CEST	443	49976	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:48.949193001 CEST	49980	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:48.949224949 CEST	443	49980	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:48.949354887 CEST	49980	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:48.949498892 CEST	49980	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:48.949511051 CEST	443	49980	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:48.980293989 CEST	443	49977	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:48.980321884 CEST	443	49977	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:48.980395079 CEST	49977	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:48.980429888 CEST	443	49977	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:48.980443954 CEST	443	49977	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:48.980500937 CEST	49977	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:48.980670929 CEST	49977	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:48.980691910 CEST	443	49977	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:48.980701923 CEST	49977	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:48.980706930 CEST	443	49977	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:48.983414888 CEST	49981	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:48.983453989 CEST	443	49981	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:48.983656883 CEST	49981	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:48.983656883 CEST	49981	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:48.983685970 CEST	443	49981	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:49.002932072 CEST	443	49975	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:49.002959967 CEST	443	49975	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:49.002975941 CEST	443	49975	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:49.003058910 CEST	49975	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:49.003091097 CEST	443	49975	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:49.003151894 CEST	49975	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:49.089956999 CEST	443	49975	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:49.090029001 CEST	443	49975	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:49.090063095 CEST	443	49975	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:49.090115070 CEST	49975	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:49.090135098 CEST	49975	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:49.090265036 CEST	49975	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:49.090291977 CEST	443	49975	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:49.090305090 CEST	49975	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:49.090315104 CEST	443	49975	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:49.092943907 CEST	49982	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:49.092981100 CEST	443	49982	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:49.093278885 CEST	49982	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:49.093278885 CEST	49982	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:49.093313932 CEST	443	49982	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:49.749557018 CEST	443	49978	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:49.749737024 CEST	443	49980	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:49.750264883 CEST	49980	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:49.750288010 CEST	443	49980	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:49.750593901 CEST	443	49981	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:49.750761986 CEST	49980	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:49.750767946 CEST	443	49980	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:49.750991106 CEST	49978	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:49.751007080 CEST	443	49978	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:49.751358986 CEST	49978	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:49.751364946 CEST	443	49978	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:49.751991987 CEST	49981	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:49.751991987 CEST	49981	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:49.752006054 CEST	443	49981	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:49.752029896 CEST	443	49981	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:49.757124901 CEST	443	49979	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:49.757777929 CEST	49979	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:49.757792950 CEST	443	49979	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:49.757846117 CEST	49979	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:49.757852077 CEST	443	49979	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:49.759109020 CEST	443	49982	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:49.759414911 CEST	49982	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:49.759432077 CEST	443	49982	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:49.759767056 CEST	49982	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:49.759772062 CEST	443	49982	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:49.852653980 CEST	443	49981	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:49.852660894 CEST	443	49978	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:49.852901936 CEST	443	49981	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:49.852925062 CEST	443	49978	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:49.852989912 CEST	49978	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:49.853024960 CEST	49981	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:49.853223085 CEST	443	49980	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:49.853288889 CEST	443	49980	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:49.853347063 CEST	49980	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:49.863497019 CEST	443	49979	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:49.863636017 CEST	443	49979	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:49.863852024 CEST	49979	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:49.863926888 CEST	443	49982	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:49.864288092 CEST	443	49982	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:49.864329100 CEST	443	49982	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:49.864384890 CEST	49982	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:49.888242006 CEST	49981	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:49.888267040 CEST	443	49981	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:49.888324976 CEST	49981	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:49.888333082 CEST	443	49981	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:49.888564110 CEST	49982	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:49.888564110 CEST	49982	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:49.888575077 CEST	443	49982	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:49.888580084 CEST	443	49982	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:49.889178038 CEST	49978	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:49.889199972 CEST	443	49978	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:49.889205933 CEST	49978	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:49.889213085 CEST	443	49978	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:49.889914036 CEST	49980	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:49.889914989 CEST	49980	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:49.889933109 CEST	443	49980	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:49.889944077 CEST	443	49980	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:49.890625954 CEST	49979	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:49.890625954 CEST	49979	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:49.890664101 CEST	443	49979	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:49.890678883 CEST	443	49979	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:49.893915892 CEST	49983	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:49.893940926 CEST	443	49983	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:49.894447088 CEST	49983	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:49.906249046 CEST	49984	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:49.906303883 CEST	443	49984	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:49.906424999 CEST	49984	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:49.917773008 CEST	49985	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:49.917825937 CEST	443	49985	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:49.917952061 CEST	49985	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:49.929847956 CEST	49986	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:49.929862976 CEST	443	49986	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:49.929949045 CEST	49986	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:49.930007935 CEST	49983	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:49.930031061 CEST	443	49983	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:49.930140018 CEST	49984	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:49.930166006 CEST	443	49984	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:50.009749889 CEST	49985	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:50.009768963 CEST	443	49985	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:50.017359972 CEST	49986	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:50.017379045 CEST	443	49986	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:50.560554028 CEST	443	49984	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:50.561089993 CEST	49984	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:50.561113119 CEST	443	49984	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:50.561561108 CEST	49984	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:50.561574936 CEST	443	49984	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:50.562078953 CEST	443	49983	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:50.562387943 CEST	49983	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:50.562397003 CEST	443	49983	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:50.562741041 CEST	49983	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:50.562752962 CEST	443	49983	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:50.623634100 CEST	443	49985	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:50.624289989 CEST	49985	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:50.624320030 CEST	443	49985	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:50.624768019 CEST	49985	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:50.624773979 CEST	443	49985	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:50.642273903 CEST	443	49986	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:50.642709017 CEST	49986	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:50.642724037 CEST	443	49986	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:50.643146992 CEST	49986	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:50.643155098 CEST	443	49986	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:50.656233072 CEST	443	49984	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:50.656308889 CEST	443	49984	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:50.656330109 CEST	443	49983	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:50.656379938 CEST	49984	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:50.656547070 CEST	49984	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:50.656547070 CEST	49984	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:50.656563997 CEST	443	49984	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:50.656573057 CEST	443	49984	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:50.657213926 CEST	443	49983	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:50.657279015 CEST	49983	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:50.657419920 CEST	49983	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:50.657435894 CEST	443	49983	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:50.657447100 CEST	49983	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:50.657453060 CEST	443	49983	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:50.719182014 CEST	443	49985	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:50.719254971 CEST	443	49985	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:50.719389915 CEST	49985	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:50.719559908 CEST	49985	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:50.719582081 CEST	443	49985	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:50.719588995 CEST	49985	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:50.719594955 CEST	443	49985	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:53.029205084 CEST	443	49986	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:53.029258966 CEST	443	49986	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:53.029447079 CEST	49986	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:53.029716969 CEST	49986	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:53.029732943 CEST	443	49986	13.107.246.45	192.168.2.5
Oct 8, 2024 00:17:53.029743910 CEST	49986	443	192.168.2.5	13.107.246.45
Oct 8, 2024 00:17:53.029750109 CEST	443	49986	13.107.246.45	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 8, 2024 00:16:52.311943054 CEST	51645	53	192.168.2.5	1.1.1.1
Oct 8, 2024 00:16:52.322021008 CEST	53	51645	1.1.1.1	192.168.2.5
Oct 8, 2024 00:16:52.333187103 CEST	58219	53	192.168.2.5	1.1.1.1
Oct 8, 2024 00:16:52.351874113 CEST	53	58219	1.1.1.1	192.168.2.5
Oct 8, 2024 00:16:52.355398893 CEST	61742	53	192.168.2.5	1.1.1.1
Oct 8, 2024 00:16:52.366529942 CEST	53	61742	1.1.1.1	192.168.2.5
Oct 8, 2024 00:16:52.368127108 CEST	53891	53	192.168.2.5	1.1.1.1
Oct 8, 2024 00:16:52.378460884 CEST	53	53891	1.1.1.1	192.168.2.5
Oct 8, 2024 00:16:52.382380009 CEST	52368	53	192.168.2.5	1.1.1.1
Oct 8, 2024 00:16:52.393532038 CEST	53	52368	1.1.1.1	192.168.2.5
Oct 8, 2024 00:16:52.396136999 CEST	60085	53	192.168.2.5	1.1.1.1
Oct 8, 2024 00:16:52.413325071 CEST	53	60085	1.1.1.1	192.168.2.5
Oct 8, 2024 00:16:52.417701006 CEST	63337	53	192.168.2.5	1.1.1.1
Oct 8, 2024 00:16:52.428541899 CEST	53	63337	1.1.1.1	192.168.2.5
Oct 8, 2024 00:16:52.509294987 CEST	57528	53	192.168.2.5	1.1.1.1
Oct 8, 2024 00:16:52.519819975 CEST	53	57528	1.1.1.1	192.168.2.5
Oct 8, 2024 00:16:52.521696091 CEST	54943	53	192.168.2.5	1.1.1.1
Oct 8, 2024 00:16:52.531420946 CEST	53	54943	1.1.1.1	192.168.2.5
Oct 8, 2024 00:16:52.533294916 CEST	57059	53	192.168.2.5	1.1.1.1
Oct 8, 2024 00:16:52.542015076 CEST	53	57059	1.1.1.1	192.168.2.5
Oct 8, 2024 00:16:54.269088030 CEST	49629	53	192.168.2.5	1.1.1.1
Oct 8, 2024 00:16:54.281223059 CEST	53	49629	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 8, 2024 00:16:52.311943054 CEST	192.168.2.5	1.1.1.1	0x2ee3	Standard query (0)	trustterwowqm.shop	A (IP address)	IN (0x0001)	false
Oct 8, 2024 00:16:52.333187103 CEST	192.168.2.5	1.1.1.1	0x2da0	Standard query (0)	mobbipenju.store	A (IP address)	IN (0x0001)	false
Oct 8, 2024 00:16:52.355398893 CEST	192.168.2.5	1.1.1.1	0x8ade	Standard query (0)	eaglepawnoy.store	A (IP address)	IN (0x0001)	false
Oct 8, 2024 00:16:52.368127108 CEST	192.168.2.5	1.1.1.1	0x97b4	Standard query (0)	dissapoiznw.store	A (IP address)	IN (0x0001)	false
Oct 8, 2024 00:16:52.382380009 CEST	192.168.2.5	1.1.1.1	0x89a1	Standard query (0)	studennotediw.store	A (IP address)	IN (0x0001)	false
Oct 8, 2024 00:16:52.396136999 CEST	192.168.2.5	1.1.1.1	0xcd76	Standard query (0)	bathdoomgaz.store	A (IP address)	IN (0x0001)	false
Oct 8, 2024 00:16:52.417701006 CEST	192.168.2.5	1.1.1.1	0xe88e	Standard query (0)	spirittunek.store	A (IP address)	IN (0x0001)	false
Oct 8, 2024 00:16:52.509294987 CEST	192.168.2.5	1.1.1.1	0xcb1c	Standard query (0)	licendfilteo.site	A (IP address)	IN (0x0001)	false
Oct 8, 2024 00:16:52.521696091 CEST	192.168.2.5	1.1.1.1	0xb19f	Standard query (0)	clearancek.site	A (IP address)	IN (0x0001)	false
Oct 8, 2024 00:16:52.533294916 CEST	192.168.2.5	1.1.1.1	0x9b32	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false
Oct 8, 2024 00:16:54.269088030 CEST	192.168.2.5	1.1.1.1	0x9a33	Standard query (0)	sergei-esenin.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 8, 2024 00:16:52.322021008 CEST	1.1.1.1	192.168.2.5	0x2ee3	Name error (3)	trustterwowqm.shop	none	none	A (IP address)	IN (0x0001)	false
Oct 8, 2024 00:16:52.351874113 CEST	1.1.1.1	192.168.2.5	0x2da0	Name error (3)	mobbipenju.store	none	none	A (IP address)	IN (0x0001)	false
Oct 8, 2024 00:16:52.366529942 CEST	1.1.1.1	192.168.2.5	0x8ade	Name error (3)	eaglepawnoy.store	none	none	A (IP address)	IN (0x0001)	false
Oct 8, 2024 00:16:52.378460884 CEST	1.1.1.1	192.168.2.5	0x97b4	Name error (3)	dissapoiznw.store	none	none	A (IP address)	IN (0x0001)	false
Oct 8, 2024 00:16:52.393532038 CEST	1.1.1.1	192.168.2.5	0x89a1	Name error (3)	studennotediw.store	none	none	A (IP address)	IN (0x0001)	false
Oct 8, 2024 00:16:52.413325071 CEST	1.1.1.1	192.168.2.5	0xcd76	Name error (3)	bathdoomgaz.store	none	none	A (IP address)	IN (0x0001)	false
Oct 8, 2024 00:16:52.428541899 CEST	1.1.1.1	192.168.2.5	0xe88e	Name error (3)	spirittunek.store	none	none	A (IP address)	IN (0x0001)	false
Oct 8, 2024 00:16:52.519819975 CEST	1.1.1.1	192.168.2.5	0xcb1c	Name error (3)	licendfilteo.site	none	none	A (IP address)	IN (0x0001)	false
Oct 8, 2024 00:16:52.531420946 CEST	1.1.1.1	192.168.2.5	0xb19f	Name error (3)	clearancek.site	none	none	A (IP address)	IN (0x0001)	false
Oct 8, 2024 00:16:52.542015076 CEST	1.1.1.1	192.168.2.5	0x9b32	No error (0)	steamcommunity.com		104.102.49.254	A (IP address)	IN (0x0001)	false
Oct 8, 2024 00:16:54.281223059 CEST	1.1.1.1	192.168.2.5	0x9a33	No error (0)	sergei-esenin.com		172.67.206.204	A (IP address)	IN (0x0001)	false
Oct 8, 2024 00:16:54.281223059 CEST	1.1.1.1	192.168.2.5	0x9a33	No error (0)	sergei-esenin.com		104.21.53.8	A (IP address)	IN (0x0001)	false
Oct 8, 2024 00:16:56.283159018 CEST	1.1.1.1	192.168.2.5	0x98c2	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 8, 2024 00:16:56.283159018 CEST	1.1.1.1	192.168.2.5	0x98c2	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
Oct 8, 2024 00:17:06.991173983 CEST	1.1.1.1	192.168.2.5	0x2fee	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 8, 2024 00:17:06.991173983 CEST	1.1.1.1	192.168.2.5	0x2fee	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

steamcommunity.com

sergei-esenin.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	104.102.49.254	443	6352	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 22:16:53 UTC	219	OUT	GET /profiles/76561199724331900 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: steamcommunity.com
2024-10-07 22:16:53 UTC	1870	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.akamai.steamstatic.com/ https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq. [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Mon, 07 Oct 2024 22:16:53 GMT Content-Length: 34837 Connection: close Set-Cookie: sessionid=c58c94b9dd49287deae6c99e; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7Cd7fb65801182a5f50a3169fe2a0b7ef0; Path=/; Secure; HttpOnly; SameSite=None
2024-10-07 22:16:53 UTC	14514	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0d 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0d 0a 09 09 3c Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><
2024-10-07 22:16:53 UTC	16384	IN	Data Raw: 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0d 0a 09 09 6a 51 75 65 72 79 28 66 75 6e 63 74 69 6f 6e 28 24 29 20 7b 0d 0a 09 09 09 24 28 27 23 67 6c 6f 62 61 6c 5f 68 65 61 64 65 72 20 2e 73 75 70 65 72 6e 61 76 27 29 2e 76 5f 74 6f 6f 6c 74 69 70 28 7b 27 6c 6f 63 61 74 69 6f 6e 27 3a 27 62 6f 74 74 6f 6d 27 2c 20 27 64 65 73 74 72 6f 79 57 68 65 6e 44 6f 6e 65 27 3a 20 66 61 6c 73 65 2c 20 27 74 6f 6f 6c 74 69 70 43 6c 61 73 73 27 3a 20 27 73 75 70 65 72 6e 61 76 5f 63 6f 6e 74 65 6e 74 27 2c 20 27 6f 66 66 73 65 74 59 27 3a 2d 36 2c 20 27 6f 66 66 73 65 74 58 27 3a 20 31 2c 20 27 68 6f 72 69 7a 6f 6e 74 61 6c 53 6e 61 70 27 3a 20 34 2c 20 27 74 6f 6f 6c 74 69 70 50 61 72 65 6e 74 27 3a 20 27 23 67 6c 6f Data Ascii: <script type="text/javascript">jQuery(function($) {$('#global_header .supernav').v_tooltip({'location':'bottom', 'destroyWhenDone': false, 'tooltipClass': 'supernav_content', 'offsetY':-6, 'offsetX': 1, 'horizontalSnap': 4, 'tooltipParent': '#glo
2024-10-07 22:16:53 UTC	3768	IN	Data Raw: 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 72 6f 66 69 6c 65 5f 73 75 6d 6d 61 72 79 5f 66 6f 6f 74 65 72 22 3e 0d 0a 09 09 09 09 09 09 09 3c 73 70 61 6e 20 64 61 74 61 2d 70 61 6e 65 6c 3d 22 7b 26 71 75 6f 74 3b 66 6f 63 75 73 61 62 6c 65 26 71 75 6f 74 3b 3a 74 72 75 65 2c 26 71 75 6f 74 3b 63 6c 69 63 6b 4f 6e 41 63 74 69 76 61 74 65 26 71 75 6f 74 3b 3a 74 72 75 65 7d 22 20 63 6c 61 73 73 3d 22 77 68 69 74 65 4c 69 6e 6b 22 20 63 6c 61 73 73 3d 22 77 68 69 74 65 4c 69 6e 6b 22 3e 56 69 65 77 20 6d 6f 72 65 20 69 6e 66 6f 3c 2f 73 70 61 6e 3e 0d 0a 09 09 09 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 09 09 09 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 20 24 4a 28 20 66 75 6e 63 74 69 6f 6e 28 29 Data Ascii: <div class="profile_summary_footer"><span data-panel="{"focusable":true,"clickOnActivate":true}" class="whiteLink" class="whiteLink">View more info</span></div><script type="text/javascript"> $J( function()
2024-10-07 22:16:53 UTC	171	IN	Data Raw: 09 3c 73 70 61 6e 3e 56 69 65 77 20 6d 6f 62 69 6c 65 20 77 65 62 73 69 74 65 3c 2f 73 70 61 6e 3e 0d 0a 09 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 0d 0a 09 3c 2f 64 69 76 3e 09 3c 21 2d 2d 20 72 65 73 70 6f 6e 73 69 76 65 5f 70 61 67 65 5f 63 6f 6e 74 65 6e 74 20 2d 2d 3e 0d 0a 0d 0a 3c 2f 64 69 76 3e 09 3c 21 2d 2d 20 72 65 73 70 6f 6e 73 69 76 65 5f 70 61 67 65 5f 66 72 61 6d 65 20 2d 2d 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <span>View mobile website</span></div></div></div></div>... responsive_page_content --></div>... responsive_page_frame --></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49706	172.67.206.204	443	6352	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 22:16:54 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: sergei-esenin.com
2024-10-07 22:16:54 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-10-07 22:16:55 UTC	827	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 22:16:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=0nii84hs44l51h740qrqg8imt6; expires=Fri, 31 Jan 2025 16:03:34 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=oS6de24xNBuVrN6tOdxi59tqOvk%2BYuwmtF%2FeVRde06E2Rs55jLoiA70mo3KxSENuvKVp2RtG%2FKYuxgtFpy5t2NeeJsNVOzV5miszsu9gpUAoAY8jLPBBB2WE8JfPjFw9tFwGSw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cf1421fbe440caa-EWR alt-svc: h3=":443"; ma=86400
2024-10-07 22:16:55 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-10-07 22:16:55 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	18:16:51
Start date:	07/10/2024
Path:	C:\Users\user\Desktop\9Y6R8fs0wd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\9Y6R8fs0wd.exe"
Imagebase:	0x700000
File size:	550'912 bytes
MD5 hash:	D4819198F83D952086F5FDACD752C40B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	18:16:51
Start date:	07/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Imagebase:	0xdd0000
File size:	262'432 bytes
MD5 hash:	8FDF47E0FF70C40ED3A17014AEEA4232
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	18:16:52
Start date:	07/10/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 1560 -s 268
Imagebase:	0xa80000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	0.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	6.1%
Total number of Nodes:	229
Total number of Limit Nodes:	3

Executed Functions

Function 00702021 Relevance: 9.4, APIs: 1, Strings: 4, Instructions: 631
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(007858D8,?,00000040,?), ref: 00702738

Strings

MZx, xrefs: 0070274B, 00702757, 0070275C
', xrefs: 00702718
S, xrefs: 0070206A
a, xrefs: 00702296

Memory Dump Source

Source File: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID: ProtectVirtual
String ID: '$MZx$S$a
API String ID: 544645111-3057195942
Opcode ID: 5b202a2ddba7ddf98fc0a1b89a456b1fdd496ab79a048fb4bc2180be5ea39485
Instruction ID: bb1de23ec26ef4b9c89de6088ceb3b4c77e8789d050bd0ce32369e68c72eff2d
Opcode Fuzzy Hash: 5b202a2ddba7ddf98fc0a1b89a456b1fdd496ab79a048fb4bc2180be5ea39485
Instruction Fuzzy Hash: D3F1D127934E1B86E70864398C5A2E595CAD7EA730FD24333BE22D73F6E36D09439244

Function 00716368 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LCMapStringEx.KERNELBASE(?,00718F1C,?,?,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 0071639C
LCMapStringW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,?,?,00718F1C,?,?,00000000,?,00000000), ref: 007163BA

Strings

R[p, xrefs: 00716396

Memory Dump Source

Source File: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID: String
String ID: R[p
API String ID: 2568140703-2570311279
Opcode ID: f5e2b914c93f9808e4b3e7eb90aaf4125a0ffd6dc7f22424ed8646bdbff475c2
Instruction ID: 615c84dcc1f76c7019377b265517fe903cd65e130139553e4fa9081845056163
Opcode Fuzzy Hash: f5e2b914c93f9808e4b3e7eb90aaf4125a0ffd6dc7f22424ed8646bdbff475c2
Instruction Fuzzy Hash: 41F07A3200015AFBCF125F94DC09EDE7F26EF48760F058011FA2865060C73AD9B2EB94

Function 00718E2E Relevance: 4.7, APIs: 3, Instructions: 202
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__freea.LIBCMT ref: 00718FDD

Part of subcall function 00713A83: HeapAlloc.KERNEL32(00000000,0071A1AA,?,?,0071A1AA,00000220,?,?,?), ref: 00713AB5

__freea.LIBCMT ref: 00718FF2
__freea.LIBCMT ref: 00719002

Memory Dump Source

Source File: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID: __freea$AllocHeap
String ID:
API String ID: 85559729-0
Opcode ID: 93d93fcb33f99fe17062da3f381c036f0231072cb3d24f80c7aeb317eba5479b
Instruction ID: b6b936ab4782e48ed5cddb2c3ffd356f2db093574b003e1bbbd7e47f6fc5d047
Opcode Fuzzy Hash: 93d93fcb33f99fe17062da3f381c036f0231072cb3d24f80c7aeb317eba5479b
Instruction Fuzzy Hash: 4A51B272600206AFEB659F68CC85EFB36AEEF44750F190229FD04D61D0EB39DD928661

Function 0071A3A6 Relevance: 3.2, APIs: 2, Instructions: 177
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00719ED6: GetOEMCP.KERNEL32(00000000,?,?,?,?), ref: 00719F01

IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,?,?,?,?,0071A1ED,?,00000000,?,?,?), ref: 0071A407
GetCPInfo.KERNEL32(00000000,?,?,?,?,?,?,?,?,0071A1ED,?,00000000,?,?,?), ref: 0071A449

Memory Dump Source

Source File: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID: CodeInfoPageValid
String ID:
API String ID: 546120528-0
Opcode ID: ea1bf7092c46c22564e5508bd823e737ab5ddc49508c506509737336f2cffac9
Instruction ID: 91f49f9148d54def52d568826165c05670e91423cbbb1c5ccca91d1a0716f4e6
Opcode Fuzzy Hash: ea1bf7092c46c22564e5508bd823e737ab5ddc49508c506509737336f2cffac9
Instruction Fuzzy Hash: 5B511771905285AFDB21CF3DC885AEABBF5EF44300F14416ED4868B2D1E6BCD986CB52

Function 00719FAA Relevance: 1.6, APIs: 1, Instructions: 147
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCPInfo.KERNEL32(E8458D00,?,0071A1F9,0071A1ED,00000000), ref: 00719FDC

Memory Dump Source

Source File: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID: Info
String ID:
API String ID: 1807457897-0
Opcode ID: 7434dc0eebdd2ebdcfcb159c7721d94cbe33e307a054118dda2c3fc1b2dd0464
Instruction ID: d9661cb71f7b569b68a7e3ef0c6f75e58554c01a3577da2bfe333c34024a7afc
Opcode Fuzzy Hash: 7434dc0eebdd2ebdcfcb159c7721d94cbe33e307a054118dda2c3fc1b2dd0464
Instruction Fuzzy Hash: 9B517D7190525CAEDB218A2CCC84AE67BB8EB59304F2405EDD19AC71C2E339DD86DF21

Non-executed Functions

Function 0074CB98 Relevance: 20.7, Strings: 15, Instructions: 1988COMMON

Download Yara Rule

Strings

(+*-, xrefs: 0074D6A1
4, xrefs: 0074D80C
pwvu, xrefs: 0074D8AB
yz{|, xrefs: 0074D6B7
,, xrefs: 0074DC6F
lcba, xrefs: 0074D8CC
0325, xrefs: 0074D6E3
8;:=, xrefs: 0074D6CD
`onm, xrefs: 0074D8F8
efgh, xrefs: 0074D6D8
p, xrefs: 0074E019
@GFE, xrefs: 0074D92F
lkji, xrefs: 0074D903
,/.!, xrefs: 0074D6AC
$'&9, xrefs: 0074D6C2

Memory Dump Source

Source File: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID:
String ID: $'&9$(+*-$,$,/.!$0325$4$8;:=$@GFE$`onm$efgh$lcba$lkji$p$pwvu$yz{|
API String ID: 0-4284672935
Opcode ID: 17a9da9fb198ce4cff53889ca9a74bbfb73063c59ecad7ce56909eb832305105
Instruction ID: 55dd6bd2940329ae00dec4a5bb44d5af0108ca03dd6695e610fcae88dd623a0e
Opcode Fuzzy Hash: 17a9da9fb198ce4cff53889ca9a74bbfb73063c59ecad7ce56909eb832305105
Instruction Fuzzy Hash: 6CF266B16083819BDB31CF54C888BAFBBE1BF86315F58491DE4C99B292D7399804CB53

Function 0075C568 Relevance: 11.5, Strings: 9, Instructions: 256COMMON

Download Yara Rule

Strings

W7JI, xrefs: 0075C5DB
;_(Q, xrefs: 0075C605
7S.U, xrefs: 0075C60C
8O?A, xrefs: 0075C5E9
4[&], xrefs: 0075C5FE
A3W5, xrefs: 0075C5D4
2C!E, xrefs: 0075C5F0
0W4i, xrefs: 0075C613
=G!Y, xrefs: 0075C5F7

Memory Dump Source

Source File: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID:
String ID: 0W4i$2C!E$4[&]$7S.U$8O?A$;_(Q$=G!Y$A3W5$W7JI
API String ID: 0-83756894
Opcode ID: c1abe5d969104e4faaeeb94a57dcd0a77674fd740321b7385ce3fa244a949eb5
Instruction ID: 68d9bad9eb90bb53ae2fc37d10eb2f63ecd6b0cbb809b33f266b5fdd295b0c8e
Opcode Fuzzy Hash: c1abe5d969104e4faaeeb94a57dcd0a77674fd740321b7385ce3fa244a949eb5
Instruction Fuzzy Hash: 68818BB49003069FDB11CF94C991BAEB7B1FF46302F644088E845AB791E378AE55CBA1

Function 0071C9E9 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 183COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00714EB1: GetLastError.KERNEL32(?,00000008,00719482), ref: 00714EB5
Part of subcall function 00714EB1: SetLastError.KERNEL32(00000000,0072C480,00000024,00710419), ref: 00714F57

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 0071CAF5
IsValidCodePage.KERNEL32(00000000), ref: 0071CB3E
IsValidLocale.KERNEL32(?,00000001), ref: 0071CB4D
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 0071CB95
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 0071CBB4

Strings

||r, xrefs: 0071CA4E

Memory Dump Source

Source File: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID: ||r
API String ID: 415426439-2670423756
Opcode ID: 0b65b1137806d92e5ff6b70b876c13a71814f52a08216a91c4e3ea26423a0bdc
Instruction ID: 24bde2b147b024c905c6b702aebee86ab8672bdbeb2560f12edad31093aeb2b2
Opcode Fuzzy Hash: 0b65b1137806d92e5ff6b70b876c13a71814f52a08216a91c4e3ea26423a0bdc
Instruction Fuzzy Hash: E7515171A402099BEB22DFE9DC46EFA77B8EF04700F148469E910E71D0E7789A85C765

Function 0071D39B Relevance: 10.2, APIs: 1, Strings: 4, Instructions: 1436COMMONLIBRARYCODE

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 0071D57F

Strings

1#SNAN, xrefs: 0071D4A7
1#INF, xrefs: 0071D4D1
1#QNAN, xrefs: 0071D4AE
1#IND, xrefs: 0071D4A0

Memory Dump Source

Source File: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 01ee5586b6e88233ff438867e03b26529764c44b3a3e6226f1e533b7fd52a48b
Instruction ID: 0e4679e853e3cffc0fe8ddf9d75fdd56d6099c83937458a17a7432c1c3bb58d3
Opcode Fuzzy Hash: 01ee5586b6e88233ff438867e03b26529764c44b3a3e6226f1e533b7fd52a48b
Instruction Fuzzy Hash: 98D2F571E086298FDB75CE28DD447EAB7B5EB45304F1441EAD84EA7280E778AEC18F41

Function 0071C085 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 251COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00714EB1: GetLastError.KERNEL32(?,00000008,00719482), ref: 00714EB5
Part of subcall function 00714EB1: SetLastError.KERNEL32(00000000,0072C480,00000024,00710419), ref: 00714F57

GetACP.KERNEL32(?,?,?,?,?,?,00711848,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 0071C146
IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,00711848,?,?,?,00000055,?,-00000050,?,?), ref: 0071C171
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 0071C2D4

Strings

utf8, xrefs: 0071C243
||r, xrefs: 0071C0C7

Memory Dump Source

Source File: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID: ErrorLast$CodeInfoLocalePageValid
String ID: utf8$||r
API String ID: 607553120-2574459922
Opcode ID: bce3d5f131a5d30950c312f295d9e35803289cda0e491ba11d25747b6ee42a35
Instruction ID: cb1d377156df3e5ee3ceda29b704d80d4d88cdb418958d134c8cc2245c8a6dc7
Opcode Fuzzy Hash: bce3d5f131a5d30950c312f295d9e35803289cda0e491ba11d25747b6ee42a35
Instruction Fuzzy Hash: 2C71D571A80216EBDB26ABBCDC46BEA73A8FF45700F144029F905D71C1EB7CD9C196A4

Function 0071C814 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,0071CB32,00000002,00000000,?,?,?,0071CB32,?,00000000), ref: 0071C8AD
GetLocaleInfoW.KERNEL32(?,20001004,0071CB32,00000002,00000000,?,?,?,0071CB32,?,00000000), ref: 0071C8D6
GetACP.KERNEL32(?,?,0071CB32,?,00000000), ref: 0071C8EB

Strings

OCP, xrefs: 0071C868
ACP, xrefs: 0071C832

Memory Dump Source

Source File: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 03699a3227b1c9f308811bbc84870d6046db626eabd47de84ee7fc65cdf96589
Instruction ID: c72a5fa845c187af3794235395fffe583bdfb83e8a0b8da29c3f8b8ae6db90c3
Opcode Fuzzy Hash: 03699a3227b1c9f308811bbc84870d6046db626eabd47de84ee7fc65cdf96589
Instruction Fuzzy Hash: 2B21A432A80201E6DB368FDDC981AD773A7BF54F50B568464E909E7180EB3ADEC1D360

Function 0070FEF0 Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 449COMMONLIBRARYCODE

Download Yara Rule

Strings

Gq, xrefs: 0070FF0B, 0071008E, 007102B7, 00710250, 007100DD
Gq, xrefs: 00710233, 00710211

Memory Dump Source

Source File: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID:
String ID: Gq$Gq
API String ID: 0-2192918204
Opcode ID: b78e9bc5a25061f1abca4818c36b3245c47596756df3441acd3b4668cd2eb70a
Instruction ID: 03278eafd0c10a3055231b77ffcc266f84dd2ab4ecc62c99a146a0b9e5418426
Opcode Fuzzy Hash: b78e9bc5a25061f1abca4818c36b3245c47596756df3441acd3b4668cd2eb70a
Instruction Fuzzy Hash: D0F12D71E002199FDF14CFA8D8846EDB7B1FF89324F158269E915AB381D774AE81CB90

Function 0072E175 Relevance: 7.2, Strings: 5, Instructions: 909COMMON

Download Yara Rule

Strings

0, xrefs: 0072ED58
i, xrefs: 0072F7FE
0, xrefs: 0072ECA9
@, xrefs: 0072F90C
0, xrefs: 0072F3A0

Memory Dump Source

Source File: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID:
String ID: 0$0$0$@$i
API String ID: 0-3124195287
Opcode ID: 71f3d092406bf2b1da397f9251c19992cfeb9473183140990b6d77d2ed173c24
Instruction ID: c0c7ee1a24d94af4c5d3ee6e528376221778c793984881354afb6942dcc9a461
Opcode Fuzzy Hash: 71f3d092406bf2b1da397f9251c19992cfeb9473183140990b6d77d2ed173c24
Instruction Fuzzy Hash: A372C071A0C3618FD318DE28D49076ABBE1EBC5714F188A3DE8DA97391D678DC45CB82

Function 0072E2D5 Relevance: 6.7, Strings: 5, Instructions: 453COMMON

Download Yara Rule

Strings

gfff, xrefs: 0072F0EC
-, xrefs: 0072EFFD
gfff, xrefs: 0072F033
gfff, xrefs: 0072F0A1
0, xrefs: 0072E5FB

Memory Dump Source

Source File: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID:
String ID: -$0$gfff$gfff$gfff
API String ID: 0-1217629319
Opcode ID: e70ea6af7df4099828697e47c503092b59018ffd614456e3a52484d2297035ff
Instruction ID: d766b0eea4ebfcef190dcc3bf2bf40cc45b94556c734715b1c921c13c4c3b391
Opcode Fuzzy Hash: e70ea6af7df4099828697e47c503092b59018ffd614456e3a52484d2297035ff
Instruction Fuzzy Hash: CFF1B171A087618FD318CE2DD49075AFBE1ABD9314F488A3DE8D5CB382D278D945CB42

Function 0073C938 Relevance: 6.7, Strings: 5, Instructions: 409COMMON

Download Yara Rule

Strings

JpzN, xrefs: 0073CCA5
q-s, xrefs: 0073CA32
vLyB, xrefs: 0073CCDB, 0073CCE3
\W, xrefs: 0073CAEC
d`df, xrefs: 0073C94A

Memory Dump Source

Source File: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID:
String ID: JpzN$\W$d`df$vLyB$q-s
API String ID: 0-2943124228
Opcode ID: c0123f9ddd81bde4ead67e13c59693835463b28b846828819b093025ea9eb232
Instruction ID: 4019c71161093bea78f020f3f4bd89d8e16fc1c355bc8c1d6d0e7001741ed605
Opcode Fuzzy Hash: c0123f9ddd81bde4ead67e13c59693835463b28b846828819b093025ea9eb232
Instruction Fuzzy Hash: 38D19BB150C3808BE712DF18C49062EBBE1AF96744F680D5CF4D5AB352D33AD949CBA6

Function 0074EF70 Relevance: 6.5, Strings: 5, Instructions: 258COMMON

Download Yara Rule

Strings

H~, xrefs: 0074EFD5
KC, xrefs: 0074EFCD
zC, xrefs: 0074EFC5
k$i, xrefs: 0074F259, 0074F25D
-{4y, xrefs: 0074F17B, 0074F183

Memory Dump Source

Source File: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID:
String ID: k$i$-{4y$H~$KC$zC
API String ID: 0-1198185020
Opcode ID: cb060303c5a1a0c4baba74594868201dd970643a30ef342180b2144766bb590c
Instruction ID: a90a24fa754c85d3a0d51e7bd0ef06547c677fa09ec6d43712b62b68a6f050f9
Opcode Fuzzy Hash: cb060303c5a1a0c4baba74594868201dd970643a30ef342180b2144766bb590c
Instruction Fuzzy Hash: 618179B0508340DBD720EF18C881B2AB7F0FF96764F54991CE4D59B2A2E379D905CBA6

Function 00713C92 Relevance: 6.3, APIs: 4, Instructions: 337COMMONLIBRARYCODE

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00713D1F

Memory Dump Source

Source File: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 40f0e063838af908aa0c23a01ee66fead67f3bdac29e3056e6e3dd52480c6ad0
Instruction ID: 1ca3e11876c24816f57ad5fe06f21ce7c9bf3a50c95f8ac42989b4c757873254
Opcode Fuzzy Hash: 40f0e063838af908aa0c23a01ee66fead67f3bdac29e3056e6e3dd52480c6ad0
Instruction Fuzzy Hash: CAB13872E042559FDB158F6CC881BEEBBB5EF55310F14416AE845AB2C1D23CDE86C7A0

Function 00707922 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 0070792E
IsDebuggerPresent.KERNEL32 ref: 007079FA
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00707A13
UnhandledExceptionFilter.KERNEL32(?), ref: 00707A1D

Memory Dump Source

Source File: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: e57e5414035300fd926b9b30a9cce733ed1ebf5d3c6aa08d0fd651edfc5af26b
Instruction ID: d052d43ecc529dd50e76837aea0e828332b1f91402bc9f5f11516d83e9d9fac2
Opcode Fuzzy Hash: e57e5414035300fd926b9b30a9cce733ed1ebf5d3c6aa08d0fd651edfc5af26b
Instruction Fuzzy Hash: 1531E7B5D05218DADB60DFA4D9497CDBBF8AF08300F1041AAE50CAB290EB789B85CF55

Function 00775288 Relevance: 5.3, Strings: 4, Instructions: 348COMMON

Download Yara Rule

Strings

oD, xrefs: 0077551C
, xrefs: 007755BE, 00775717, 007756EB, 0077559B, 007755A3, 007756F3
P, xrefs: 0077542E
kD, xrefs: 00775509

Memory Dump Source

Source File: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID:
String ID: P$kD$oD$
API String ID: 0-1115615460
Opcode ID: ed1cfad7e5831a2e1b48057f332d66576bd6f5d84c9fae2d0d95bb32115eec55
Instruction ID: ff779121d577c34752fd8ca1b169477ebc65c62a0ce6dc1494f02c9a8c9cd945
Opcode Fuzzy Hash: ed1cfad7e5831a2e1b48057f332d66576bd6f5d84c9fae2d0d95bb32115eec55
Instruction Fuzzy Hash: DFC1F0725087A08FCB15CF28D84061EB7E1ABC1754F19CA2CE8A99B391D7B9DC45CBC2

Function 0074FAE2 Relevance: 5.2, Strings: 4, Instructions: 209COMMON

Download Yara Rule

Strings

I}, xrefs: 0074FB3E
I}, xrefs: 0074FD29
~, xrefs: 0074FB45
v}, xrefs: 0074FB37

Memory Dump Source

Source File: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID:
String ID: I}$I}$v}$~
API String ID: 0-1535326304
Opcode ID: 18d941ddf0c7df2a2020a84959c7baed37afdcccf923d2de2c574be5e132557b
Instruction ID: dfbf6308dc7d1974ec0e2913ba2da1f71b9dd451a5a43e1828e1eab6f63ce680
Opcode Fuzzy Hash: 18d941ddf0c7df2a2020a84959c7baed37afdcccf923d2de2c574be5e132557b
Instruction Fuzzy Hash: 18617BB0901256CBDB10CF94CC91BBEBBB1FF46341F584958E891AF392D3789841CBA5

Function 00773642 Relevance: 5.1, Strings: 4, Instructions: 142COMMON

Download Yara Rule

Strings

US, xrefs: 0077364A
, xrefs: 0077385E, 0077383B, 00773843
@, xrefs: 007737F5
Q_, xrefs: 00773652

Memory Dump Source

Source File: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID:
String ID: @$Q_$US$
API String ID: 0-1387636662
Opcode ID: b84bd2cad6fc919d03a3147de07ecc8b5f863db2d204b0a85fdfcd1955775bcd
Instruction ID: a9165b0ddd0cfde3ee358261764251e419744e761e16a732aace562d8648a4dc
Opcode Fuzzy Hash: b84bd2cad6fc919d03a3147de07ecc8b5f863db2d204b0a85fdfcd1955775bcd
Instruction Fuzzy Hash: 234196B0418341ABDB14DF14C490A2BBBF0FF86384F54891DF4C9AB261E339DA45DB6A

Function 0071C498 Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 00714EB1: GetLastError.KERNEL32(?,00000008,00719482), ref: 00714EB5
Part of subcall function 00714EB1: SetLastError.KERNEL32(00000000,0072C480,00000024,00710419), ref: 00714F57

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0071C4EC
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0071C536
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0071C5FC

Memory Dump Source

Source File: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID: InfoLocale$ErrorLast
String ID:
API String ID: 661929714-0
Opcode ID: 9a8e5915a3aa10b5279da540e91e93c9d04e75faf3241b5e296a983e017fff59
Instruction ID: bd3cca925ad7bfcf1a7918ba18d7e651eaec48703fc9abb6be3244855f9150fc
Opcode Fuzzy Hash: 9a8e5915a3aa10b5279da540e91e93c9d04e75faf3241b5e296a983e017fff59
Instruction Fuzzy Hash: 0A617F72590207DBDB2A9F6CCC86BEA77A9EF04310F10416AE905C61C5E73CE991CB64

Function 0070DA73 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 0070DB6B
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 0070DB75
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 0070DB82

Memory Dump Source

Source File: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 475ba35087e923e774a4c26f9aa77ff165e455a38eb5cefb9d052efe2a4bd77d
Instruction ID: a42e150bb48d6ba47e233f7ff1a424c888cd62c934b3fb68352706558e757e9c
Opcode Fuzzy Hash: 475ba35087e923e774a4c26f9aa77ff165e455a38eb5cefb9d052efe2a4bd77d
Instruction Fuzzy Hash: 2531B474901218DBCB61DF68DD89B9DB7F8BF08310F5042DAE41CA6290E7789F858F54

Function 00735618 Relevance: 4.1, Strings: 3, Instructions: 379COMMON

Download Yara Rule

Strings

), xrefs: 00735695
), xrefs: 0073569F
IEND, xrefs: 00735A65

Memory Dump Source

Source File: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID:
String ID: )$)$IEND
API String ID: 0-588110143
Opcode ID: e3af02e7cd14337d65bc99edb6bb6da9af78cbb27c27db32bd75912408caa374
Instruction ID: 5ae03bcfa85faf827d37b9418cd628f9247954cc77949ed6239a6b954e00b844
Opcode Fuzzy Hash: e3af02e7cd14337d65bc99edb6bb6da9af78cbb27c27db32bd75912408caa374
Instruction Fuzzy Hash: 70E1D1B1A08741EFE310CF24C88575ABBE0BB84314F14862DF99997382D779E915CBD2

Function 007736EE Relevance: 3.9, Strings: 3, Instructions: 122COMMON

Download Yara Rule

Strings

, xrefs: 0077385E, 0077383B, 00773843
@, xrefs: 007737F5
]oXm, xrefs: 00773716

Memory Dump Source

Source File: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID:
String ID: @$]oXm$
API String ID: 0-4013158905
Opcode ID: 08b563d773aac84b36ad4809571cbbdf506584426bf330bc6785f7f8a4602933
Instruction ID: ccbcdf96fb445528883e3872c511051f3dd35a33de2f36d36ce06c027238c703
Opcode Fuzzy Hash: 08b563d773aac84b36ad4809571cbbdf506584426bf330bc6785f7f8a4602933
Instruction Fuzzy Hash: CF4153B44183419BDB14DF14C49462EBBF0FF86384F54891CF4C9AB261D33ACA85DB9A

Function 0075C224 Relevance: 3.8, Strings: 3, Instructions: 38COMMON

Download Yara Rule

Strings

UNOc, xrefs: 0075C232
KFCI, xrefs: 0075C252
Q^\X, xrefs: 0075C23A

Memory Dump Source

Source File: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID:
String ID: KFCI$Q^\X$UNOc
API String ID: 0-1593643587
Opcode ID: c1021c8647da17318554d3aa5cff67c87dd53425995099f84c7b189f47ca34d0
Instruction ID: c2db701047cfff6158a6bf247e08318c0086be8fefdbf04a6db72dab5d18fbf0
Opcode Fuzzy Hash: c1021c8647da17318554d3aa5cff67c87dd53425995099f84c7b189f47ca34d0
Instruction Fuzzy Hash: D9110DB0508380AFE3118F94C484A5EFFF0AB8A781F10980CF9D857222C3B9C8858F13

Function 0071622B Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,?,?,007123AE,?,20001004,00000000,00000002,?,?,007119B0), ref: 0071625F

Strings

R[p, xrefs: 0071624A

Memory Dump Source

Source File: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID: InfoLocale
String ID: R[p
API String ID: 2299586839-2570311279
Opcode ID: f134907f39e987905513e0e80bb92f8be074aef158678eb3bd500502ef2743ee
Instruction ID: 429f899b024f979604d9dbaac8ea81ed48d482e2a27796cccad56c1f33c1eb19
Opcode Fuzzy Hash: f134907f39e987905513e0e80bb92f8be074aef158678eb3bd500502ef2743ee
Instruction Fuzzy Hash: 48E04F32500628FBCF222F64DC08EEE7F2AEF44760F008011FD05651A1CB798E65AAA5

Function 007749F8 Relevance: 2.8, Strings: 2, Instructions: 288COMMON

Download Yara Rule

Strings

, xrefs: 00774A69, 00774B39, 00774C4D, 00774B70, 00774B0C, 00774A3C, 00774A48, 00774B18, 00774B7B, 00774C56
, xrefs: 00774C0C, 00774BDC, 00774BE5

Memory Dump Source

Source File: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-1425349742
Opcode ID: a72b061ef2fa19078f6f09b4256c813a26286e548eea71359ce8abeef3a1e115
Instruction ID: ee32547c39cf4b89c123357b09154349de4f69e3931075a92da9f5a5c7c2065c
Opcode Fuzzy Hash: a72b061ef2fa19078f6f09b4256c813a26286e548eea71359ce8abeef3a1e115
Instruction Fuzzy Hash: 5DA1B171608341ABDF24CB14CC40BABB7E5EB85390F55C92CF58997391E738E940CB96

Function 00776FD8 Relevance: 2.7, Strings: 2, Instructions: 228COMMON

Download Yara Rule

Strings

, xrefs: 007770CE
, xrefs: 0077702E, 00777142, 0077711B, 0077700B, 00777013, 00777123

Memory Dump Source

Source File: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-1425349742
Opcode ID: e90198aaeed22a300b19465d833889039e3ddf500042478477c72a525097edc6
Instruction ID: 588fbc1450acf5b895ac29a143e8e633dc9f8b1af8b7c87381cdb7cd50808a22
Opcode Fuzzy Hash: e90198aaeed22a300b19465d833889039e3ddf500042478477c72a525097edc6
Instruction Fuzzy Hash: 00719E7050C341ABCB18AB58C880A2EB7F5FF95790F54C92CF5C98B2A2D739D814CB56

Function 00755EC3 Relevance: 2.6, Strings: 2, Instructions: 140COMMON

Download Yara Rule

Strings

6, xrefs: 00756061
^TPX, xrefs: 00755FE9

Memory Dump Source

Source File: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID:
String ID: 6$^TPX
API String ID: 0-3674074485
Opcode ID: e2faa7a7b5874149e8eed49c136e69c5cac99755a3b347c5e8b82d654e240883
Instruction ID: 7568879d3eb6272633461c2d526c6beb4822e2a174fa0265fd3fee1f933c673b
Opcode Fuzzy Hash: e2faa7a7b5874149e8eed49c136e69c5cac99755a3b347c5e8b82d654e240883
Instruction Fuzzy Hash: DC5102B050C7808FD3529F26849066AFBF2AB92746F64595CE4E14B3A1D375C449CF17

Function 00776EA8 Relevance: 2.6, Strings: 2, Instructions: 98COMMON

Download Yara Rule

Strings

, xrefs: 00776F7E, 00776F5B, 00776F63
@, xrefs: 00776F10

Memory Dump Source

Source File: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID:
String ID: @$
API String ID: 0-736778079
Opcode ID: 0ac285f3c4d7bf6ff568a0e3d31a6644a2a8a6f4a62bd3ece0da7e21683cf0fc
Instruction ID: 6b0294fcbe161d21bd301ef4b9bcce4c3fa01c16113348102ae85f46abfbb4d7
Opcode Fuzzy Hash: 0ac285f3c4d7bf6ff568a0e3d31a6644a2a8a6f4a62bd3ece0da7e21683cf0fc
Instruction Fuzzy Hash: DA3178719083049BDB14DF14D880A2FFBF5EF86344F14C92DE59897295D379D908CBA6

Function 0073BB58 Relevance: 2.6, Strings: 2, Instructions: 82COMMON

Download Yara Rule

Strings

p, xrefs: 0073BBC1, 0073BB9B
p, xrefs: 0073BBE9

Memory Dump Source

Source File: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID:
String ID: p$p
API String ID: 0-2001073228
Opcode ID: 9ccebd6029074dcc193b65c5d4f3edf18eb513497d73d4234c938a2efa72fd27
Instruction ID: 70de0160336d2b242b2b928628f1e04cd9f7ea57d93b2c158b09f1dfa9fc9d3c
Opcode Fuzzy Hash: 9ccebd6029074dcc193b65c5d4f3edf18eb513497d73d4234c938a2efa72fd27
Instruction Fuzzy Hash: 39311FB0D0024A9BEB00CF98C4866AEFFB1FB0A310F144519E654B7752D738A994CBE5

Function 00736C29 Relevance: 2.6, Strings: 2, Instructions: 71COMMON

Download Yara Rule

Strings

0, xrefs: 00736C87
8, xrefs: 00736C7F

Memory Dump Source

Source File: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID:
String ID: 0$8
API String ID: 0-46163386
Opcode ID: 101362e4397cd3868e0d82b2d27283c317da1e6fc92abe76afbb474ffa19d7ef
Instruction ID: 8f1cdabcf22d09ed5f19f9fa52d88d7e61cb3932eac0240d8aa493647964c85e
Opcode Fuzzy Hash: 101362e4397cd3868e0d82b2d27283c317da1e6fc92abe76afbb474ffa19d7ef
Instruction Fuzzy Hash: 8131D43660D3C58BD315CA68948069FFBE1ABE6314F488D5DE8C4A7342CA74D809CBA3

Function 0072DED8 Relevance: 2.5, Strings: 1, Instructions: 1296COMMON

Download Yara Rule

Strings

@, xrefs: 0072FE4D

Memory Dump Source

Source File: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 0f2fb15fb640a0ac74f7ebf11ae0a00e79eb1ebbcee514835237cce2622ebf17
Instruction ID: 67e4d7af3612b1e5c5212a2a9b4981e4cf684f4a7a0a219b1962371fdd4ea828
Opcode Fuzzy Hash: 0f2fb15fb640a0ac74f7ebf11ae0a00e79eb1ebbcee514835237cce2622ebf17
Instruction Fuzzy Hash: 569205716083618FD714CE28D49476EBBE2AFC9314F188A3DE8999B392D338DD45CB91

Function 00771798 Relevance: 1.9, Strings: 1, Instructions: 618COMMON

Download Yara Rule

Strings

f, xrefs: 00771976

Memory Dump Source

Source File: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID:
String ID: f
API String ID: 0-1993550816
Opcode ID: b38e6f6da0f4ee892dc7bd84d3849ea3ee91e3c5acb601456a1049e317f3aa66
Instruction ID: a3d2dd245c81f1c2aa14785d0f7413d8c6d10fd232fc9fb7b33be22ab41a3271
Opcode Fuzzy Hash: b38e6f6da0f4ee892dc7bd84d3849ea3ee91e3c5acb601456a1049e317f3aa66
Instruction Fuzzy Hash: EA22BE716083419FCB14CF18C890A2ABBE1AF89354F58CA2CF599973A1D739E945CB52

Function 0071572C Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00715727,?,?,00000008,?,?,007215F5,00000000), ref: 00715959

Memory Dump Source

Source File: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: ed672a85a6bbf429d5a735155db8c4fedd58d0a2d004f75a3738dac82ca83be0
Instruction ID: 92a49ba47f2284e03c5c144e8d2a6849b1a8576bb5ac1835f4db0272c3248454
Opcode Fuzzy Hash: ed672a85a6bbf429d5a735155db8c4fedd58d0a2d004f75a3738dac82ca83be0
Instruction Fuzzy Hash: 50B11D31610A09DFD719CF2CC48ABA57BA0FF85365F258659E899CF2E1C339E991CB40

Function 0070729C Relevance: 1.7, APIs: 1, Instructions: 242COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 007072B2

Memory Dump Source

Source File: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: bfab0dc60c3c8e292b0656001e74c8d0050273b2714493289edee0a60773c9db
Instruction ID: ad0c5c53ff8c8c70c3e394023cb96b897aa51f1085673561e46640a1f792832e
Opcode Fuzzy Hash: bfab0dc60c3c8e292b0656001e74c8d0050273b2714493289edee0a60773c9db
Instruction Fuzzy Hash: 15A12E71D15605CFDB38CF64D881699BBF1FB44714F24822AD419EB2A0D338A952CF54

Function 007305B8 Relevance: 1.7, Strings: 1, Instructions: 448COMMON

Download Yara Rule

Strings

CD, xrefs: 00730616

Memory Dump Source

Source File: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID:
String ID: CD
API String ID: 0-3115673787
Opcode ID: 4c0b4b88843fe66386dd9f80ba3723d5ab93d35f761372caa74b535c6bc6894e
Instruction ID: 6b979b6f03f5d256a2754cdc7a21da59ccfec1f3d3cca95046dc7ec321d57aab
Opcode Fuzzy Hash: 4c0b4b88843fe66386dd9f80ba3723d5ab93d35f761372caa74b535c6bc6894e
Instruction Fuzzy Hash: D9E1E472A083019BD704CF28C89065AB7E6EBC8750F25CA2DF89897391E778DD458BC2

Function 00755368 Relevance: 1.7, Strings: 1, Instructions: 415COMMON

Download Yara Rule

Strings

TW, xrefs: 0075538A

Memory Dump Source

Source File: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID:
String ID: TW
API String ID: 0-1778470648
Opcode ID: 37e65682408c37040f626a0ca88badc03505eecafd751e2c16e196c146a53e28
Instruction ID: fab701b840adfc36e2c02ad54ab0defda606264bfa3f107913b17b77b50c08ee
Opcode Fuzzy Hash: 37e65682408c37040f626a0ca88badc03505eecafd751e2c16e196c146a53e28
Instruction Fuzzy Hash: 5EC1D2B1508740DBDB10AB14C861A6FB7F5EF95752F48881CF8C887252E3B9ED58CB62

Function 00719ABF Relevance: 1.6, APIs: 1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 729a08cbc1f73f188402ba5a9b91537c2cb316e80a9411b62a1ffbec9e26ab1f
Instruction ID: bfa6ea3e4b3cfe558d3155236be2195b095b04d1e1708ef067ee4aa0af038c09
Opcode Fuzzy Hash: 729a08cbc1f73f188402ba5a9b91537c2cb316e80a9411b62a1ffbec9e26ab1f
Instruction Fuzzy Hash: E331E872900219AFCB20DFBCDC99DEB777DEB84310F144158F90597284EA34AE818B64

Function 0070CAF2 Relevance: 1.6, Strings: 1, Instructions: 344COMMONLIBRARYCODE

Download Yara Rule

Strings

0, xrefs: 0070CC80

Memory Dump Source

Source File: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: a275e4e3f2cfeaf715da2da112b806062c65dd29accd298007a5eac95eb8a70d
Instruction ID: e664cbc9fd14cab08f53a086ab848fb3df63214f128ed08735610f87a8222987
Opcode Fuzzy Hash: a275e4e3f2cfeaf715da2da112b806062c65dd29accd298007a5eac95eb8a70d
Instruction Fuzzy Hash: 3BC1DDB0A0064ACFDB3ACF68C4856BEBBF2AF45310F244759D4569B2E1C738AD45CB91

Function 0076074E Relevance: 1.6, Strings: 1, Instructions: 336COMMON

Download Yara Rule

Strings

-'.$, xrefs: 00760989

Memory Dump Source

Source File: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID:
String ID: -'.$
API String ID: 0-2031752551
Opcode ID: 34e3f814482b72035446470293d0cf0e4fa038b8cce2f5f390abddc47372c923
Instruction ID: 63ab87aeff9fdb6c21f590425567d2cc3e9ad7a0d4de6d10028db1a79faa68b1
Opcode Fuzzy Hash: 34e3f814482b72035446470293d0cf0e4fa038b8cce2f5f390abddc47372c923
Instruction Fuzzy Hash: 77B15B70504B818FD7268F29C090B26FBF1EF56314F14859DD8EA9BB52C739E806CB95

Function 0071C6EB Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 00714EB1: GetLastError.KERNEL32(?,00000008,00719482), ref: 00714EB5
Part of subcall function 00714EB1: SetLastError.KERNEL32(00000000,0072C480,00000024,00710419), ref: 00714F57

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0071C73F

Memory Dump Source

Source File: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 33c6593061ac406baf45f0a42df21c6835a3f7855309ad067a2c652ae098f1e9
Instruction ID: 2ca17d8689573b7b45acb2762099dc9662d92141685b1cd64b6ef500be0699cd
Opcode Fuzzy Hash: 33c6593061ac406baf45f0a42df21c6835a3f7855309ad067a2c652ae098f1e9
Instruction Fuzzy Hash: C421B032640206ABEB299B69DC46AFA73A8EF04710B14007AF905D61C1EB7CED818A54

Function 0071C372 Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00714EB1: GetLastError.KERNEL32(?,00000008,00719482), ref: 00714EB5
Part of subcall function 00714EB1: SetLastError.KERNEL32(00000000,0072C480,00000024,00710419), ref: 00714F57

EnumSystemLocalesW.KERNEL32(0071C498,00000001,00000000,?,-00000050,?,0071CAC9,00000000,?,?,?,00000055,?), ref: 0071C3E4

Memory Dump Source

Source File: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: c593a22b300551072a0d957140338b867570380c829fac885a7bd5418d50aa40
Instruction ID: 63d5853edc5cace12ec10c82181ba2291903b8f3dc75979e48539e1a846b5cc8
Opcode Fuzzy Hash: c593a22b300551072a0d957140338b867570380c829fac885a7bd5418d50aa40
Instruction Fuzzy Hash: 6E1129362043019FDB189F7CC8A15FABB91FF84768B14842CE94787A80D379A983C740

Function 0071C91A Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 00714EB1: GetLastError.KERNEL32(?,00000008,00719482), ref: 00714EB5
Part of subcall function 00714EB1: SetLastError.KERNEL32(00000000,0072C480,00000024,00710419), ref: 00714F57

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,0071C6B4,00000000,00000000,?), ref: 0071C946

Memory Dump Source

Source File: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 61bdb0192d33096702bdb9aab9f0cc9d3cdc34fefcf0c2a92c8108b6fbf31fff
Instruction ID: e28cc6b2ab9031e48a8a27de5448571c1bfb93a387342d11aaa88371fb98017a
Opcode Fuzzy Hash: 61bdb0192d33096702bdb9aab9f0cc9d3cdc34fefcf0c2a92c8108b6fbf31fff
Instruction Fuzzy Hash: 01F0A973540115BBDB2556A98806BFA7758EB40754F154468ED46A31C0DA78FE82C590

Function 0071C40D Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00714EB1: GetLastError.KERNEL32(?,00000008,00719482), ref: 00714EB5
Part of subcall function 00714EB1: SetLastError.KERNEL32(00000000,0072C480,00000024,00710419), ref: 00714F57

EnumSystemLocalesW.KERNEL32(0071C6EB,00000001,?,?,-00000050,?,0071CA8D,-00000050,?,?,?,00000055,?,-00000050,?,?), ref: 0071C457

Memory Dump Source

Source File: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 1b884cd3dd1c6db97fac91b802f4dde2ae80b9c80e33c6c542e3a4e370d3e34d
Instruction ID: 6a5442975f8e4b533b062fa6314f86790f10801130d403cc49634ffc9b996e99
Opcode Fuzzy Hash: 1b884cd3dd1c6db97fac91b802f4dde2ae80b9c80e33c6c542e3a4e370d3e34d
Instruction Fuzzy Hash: 39F022722043445FCB259FBCDC91ABA7B91EB80768F04842CF9468BAC0C2799C82C614

Function 00715D7F Relevance: 1.5, APIs: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0070DDC1: EnterCriticalSection.KERNEL32(?,?,00714B89,?,0072C2E0,00000008,00714D4D,?,0070C446,?), ref: 0070DDD0

EnumSystemLocalesW.KERNEL32(00715D72,00000001,0072C3A0,0000000C,00716127,00000000), ref: 00715DB7

Memory Dump Source

Source File: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: 4efcf4c3afc2c7c80a7aaf7fd3fcc5ed4f18c3135df1d096e429f1d86c2efe2b
Instruction ID: 93fd790f6ddb5c640437ee6ad943c95fe0ed3324e5cf43a4490e37ce32728d73
Opcode Fuzzy Hash: 4efcf4c3afc2c7c80a7aaf7fd3fcc5ed4f18c3135df1d096e429f1d86c2efe2b
Instruction Fuzzy Hash: 16F08C72A40200DFD724EF98E846B8C77F0FB44320F20851AE411972E1D7BD5940CB94

Function 0071C327 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00714EB1: GetLastError.KERNEL32(?,00000008,00719482), ref: 00714EB5
Part of subcall function 00714EB1: SetLastError.KERNEL32(00000000,0072C480,00000024,00710419), ref: 00714F57

EnumSystemLocalesW.KERNEL32(0071C280,00000001,?,?,?,0071CAEB,-00000050,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 0071C35E

Memory Dump Source

Source File: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 823e5c0cb044493fa96ffc7db261a0acadb9c57affc166f70ad4a08db5e3457e
Instruction ID: db3ce6cb85a1203c6a68425aab1cc8c73bffa91da5533393cec86aa660e7cd2d
Opcode Fuzzy Hash: 823e5c0cb044493fa96ffc7db261a0acadb9c57affc166f70ad4a08db5e3457e
Instruction Fuzzy Hash: CAF0553634020457CB159FB9C8096AABF90FFC1B20B068058EA098B2C0C2399982C7A0

Function 0075A059 Relevance: 1.5, Strings: 1, Instructions: 267COMMON

Download Yara Rule

Strings

P, xrefs: 0075A397

Memory Dump Source

Source File: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID:
String ID: P
API String ID: 0-3110715001
Opcode ID: 4bfaa7626ea9b600e4b84af23bd05a8ca6e36999e86aa202f38862eca0be855c
Instruction ID: b6a90d9e4eede7115d8f0fcb52aa061e437c08710cfecd883f648b7d29af64a9
Opcode Fuzzy Hash: 4bfaa7626ea9b600e4b84af23bd05a8ca6e36999e86aa202f38862eca0be855c
Instruction Fuzzy Hash: 11A1E571908345ABE7009A14C8913AFBBE1EBD5391F184A3DED8987392E3BDD949C743

Function 00737908 Relevance: 1.5, Strings: 1, Instructions: 265COMMON

Download Yara Rule

Strings

,, xrefs: 00737A3E

Memory Dump Source

Source File: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID:
String ID: ,
API String ID: 0-3772416878
Opcode ID: 4ab73c068909bf4a579edcd3551088511d35e91c35163eb6544c071a430a9b34
Instruction ID: 8b3287617a51517657122d3e2b06bd85d6af2c46cd6f996a4439701785af3521
Opcode Fuzzy Hash: 4ab73c068909bf4a579edcd3551088511d35e91c35163eb6544c071a430a9b34
Instruction Fuzzy Hash: 26B148B010D3819FD324CF18C88061BFBE0AFA9304F444A2DE5D997782D635E918CBA7

Function 0072E212 Relevance: 1.5, Strings: 1, Instructions: 264COMMON

Download Yara Rule

Strings

@, xrefs: 0072E7F8

Memory Dump Source

Source File: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 306e642b51b2512054d38a46158e9f08723d7b25d1953b1fc47caece9ac7f322
Instruction ID: 39eb154dc59c29ed997983d67eb8ee6fc8364d0fc6d299b333d9d982cc3f2f1e
Opcode Fuzzy Hash: 306e642b51b2512054d38a46158e9f08723d7b25d1953b1fc47caece9ac7f322
Instruction Fuzzy Hash: C4A1BA71A087619FD314CE18E09475AFBF2AFC4314F298A2DE8D997391C7389C49CB82

Function 00707AAF Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00007ABB,00706DC9), ref: 00707AB4

Memory Dump Source

Source File: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: beb04247e988cbd5bf8aa62ce70a9f9da157ebb7066139ca9167006775e2383d
Instruction ID: 62fab5baed11b82bbde4e2e565f2acafd81ef8a27d825e609596dee95ad21faa
Opcode Fuzzy Hash: beb04247e988cbd5bf8aa62ce70a9f9da157ebb7066139ca9167006775e2383d
Instruction Fuzzy Hash:

Function 007774F8 Relevance: 1.5, Strings: 1, Instructions: 247COMMON

Download Yara Rule

Strings

, xrefs: 00777552, 0077760E, 007775EB, 0077752B, 00777533, 007775F3

Memory Dump Source

Source File: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3019521637
Opcode ID: 08d3931baa2a9c42408cb6ec1c64e50b571bbd3c3c2ceb0987ed0c3721af9082
Instruction ID: 09780dabb9f7e482e8ec9c0ae5aef0714d234fe82cb8b82f6184a7fe17c181cc
Opcode Fuzzy Hash: 08d3931baa2a9c42408cb6ec1c64e50b571bbd3c3c2ceb0987ed0c3721af9082
Instruction Fuzzy Hash: 4C81BE756083519BCB289F18C840A2AB7E5FF85790F19892CF9899B351D739EC60CB92

Function 0075E388 Relevance: 1.5, Strings: 1, Instructions: 237COMMON

Download Yara Rule

Strings

", xrefs: 0075E64C

Memory Dump Source

Source File: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: 7e98b4656ee7a597cc4d0ae5467a7c4b97e5a60aa5ade5d03bcc0f57a0d03316
Instruction ID: 638e651c3434d3262e363266ee039827a0d713de8136167c0dae8819d7ba165a
Opcode Fuzzy Hash: 7e98b4656ee7a597cc4d0ae5467a7c4b97e5a60aa5ade5d03bcc0f57a0d03316
Instruction Fuzzy Hash: DD71D8327087504FD7288D2CC88029EB6D2ABD6336F299769F874CB3E1D6B9DD498741

Function 007747F8 Relevance: 1.4, Strings: 1, Instructions: 183COMMON

Download Yara Rule

Strings

, xrefs: 007748BE, 007749A8, 0077497B, 0077489B, 007748A3, 00774983

Memory Dump Source

Source File: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3019521637
Opcode ID: caa00a0baa876a8884e4083aa7b8b58c4b77efdead5d9ec54620c567e662e154
Instruction ID: 252a41123c86bb950f64a2fad6bd592cbaab61b379381d8cdcc7ee49e6f02812
Opcode Fuzzy Hash: caa00a0baa876a8884e4083aa7b8b58c4b77efdead5d9ec54620c567e662e154
Instruction Fuzzy Hash: 0751D031608310ABDB149A19CC91B2FB7E5EB86754F14CA2CEAD957392D739EC00CB56

Function 00760AD4 Relevance: 1.4, Strings: 1, Instructions: 161COMMON

Download Yara Rule

Strings

2FD>, xrefs: 00761F68

Memory Dump Source

Source File: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID:
String ID: 2FD>
API String ID: 0-1510312430
Opcode ID: 242552adc178d8c3491bf93f30874780fcc0fbb89b54cad1dcff1d541b57b90a
Instruction ID: 0eea43ce0b7904e3a61b7cee142d0f0d6a58ddac8d4df386a92725c2d7828c0c
Opcode Fuzzy Hash: 242552adc178d8c3491bf93f30874780fcc0fbb89b54cad1dcff1d541b57b90a
Instruction Fuzzy Hash: 9B519F704057818FDB268F25C054A66FBB1EF17355B68888ED8D79BA83C339E806CB65

Function 0073FA44 Relevance: 1.4, Strings: 1, Instructions: 160COMMON

Download Yara Rule

Strings

2, xrefs: 0073FADA

Memory Dump Source

Source File: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID:
String ID: 2
API String ID: 0-450215437
Opcode ID: e6034f399045d4b6abb2554f6b82214a593dffe65b117c12c080d18cf511f5b9
Instruction ID: 382d02b0288dfef704f3bb367530cff838e0cc05b835b5b6004cce0ed3908a04
Opcode Fuzzy Hash: e6034f399045d4b6abb2554f6b82214a593dffe65b117c12c080d18cf511f5b9
Instruction Fuzzy Hash: 695142B1A4A380DBF731A710885AFEFB6A5BFD5301F48092CE48957283DB7A9505C763

Function 0073FCD4 Relevance: 1.4, Strings: 1, Instructions: 156COMMON

Download Yara Rule

Strings

2, xrefs: 0073FD63

Memory Dump Source

Source File: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID:
String ID: 2
API String ID: 0-450215437
Opcode ID: 15cde75e9d06dabda2588e85d20db4463443109759951a92bfa7a8f5d5147061
Instruction ID: bd6e857749ff0bb3a16344340bfb798dd83bce160925f8c0c16f61c495c02a88
Opcode Fuzzy Hash: 15cde75e9d06dabda2588e85d20db4463443109759951a92bfa7a8f5d5147061
Instruction Fuzzy Hash: 495160B1A4A380D7F631A710885AFEFB6A5BFD5301F48092CE48957283DB7A9505C763

Function 00701D79 Relevance: 1.4, Strings: 1, Instructions: 156COMMON

Download Yara Rule

Strings

Z81xbyuAua, xrefs: 00701E9B

Memory Dump Source

Source File: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID:
String ID: Z81xbyuAua
API String ID: 0-3121583705
Opcode ID: ad60539c3051c9f83583beca78778e1c9cc1e5efd2bd054af5e0f764bdde4682
Instruction ID: e3958f9edbbcf33bbd9ece8b6de99f850995496db0832dc779600f7f72647dea
Opcode Fuzzy Hash: ad60539c3051c9f83583beca78778e1c9cc1e5efd2bd054af5e0f764bdde4682
Instruction Fuzzy Hash: C6412F76E10527DBCB0CEEB8C4550AFBBA9D745350B44437ADD11DB3D1E2348A01C6D0

Function 00761327 Relevance: 1.4, Strings: 1, Instructions: 141COMMON

Download Yara Rule

Strings

2FD>, xrefs: 00761F68

Memory Dump Source

Source File: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID:
String ID: 2FD>
API String ID: 0-1510312430
Opcode ID: 482e1bb03dcd7035389772e6bba219ce3904a568faca1742d2efed7deef8c6d7
Instruction ID: 6b181724ec7b9696c5f88d4ca5867ca468c2bec22bb63a7de4aae5cbcc621962
Opcode Fuzzy Hash: 482e1bb03dcd7035389772e6bba219ce3904a568faca1742d2efed7deef8c6d7
Instruction Fuzzy Hash: 234192700057818EDB268F25C054A36FBF0AF17344F68988DD8D69BA83C33AE806CB54

Function 00776B98 Relevance: 1.4, Strings: 1, Instructions: 131COMMON

Download Yara Rule

Strings

, xrefs: 00776BF7, 00776CAE, 00776C8B, 00776BCC, 00776BD5, 00776C93

Memory Dump Source

Source File: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3019521637
Opcode ID: 3f681d420308340ce622b70d3801fe125027f74667fc1b293c25dd6169613fb3
Instruction ID: eccc271b012ff0e0ea44fc92f5578285af2a077dbb97c85e8c2ff7ef3c78da98
Opcode Fuzzy Hash: 3f681d420308340ce622b70d3801fe125027f74667fc1b293c25dd6169613fb3
Instruction Fuzzy Hash: D4419070608300ABDB159F14C990B2BBBE5EB86750F24C82CE5CD9B296D339E804C766

Function 00776D28 Relevance: 1.4, Strings: 1, Instructions: 128COMMON

Download Yara Rule

Strings

, xrefs: 00776D87, 00776E3E, 00776E1B, 00776D5C, 00776D65, 00776E23

Memory Dump Source

Source File: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3019521637
Opcode ID: 35ff341fea01c2b82f004fdc622a9334d9847dfee3824cdca80f10c1f8328be7
Instruction ID: 0300840f2f0699a5d8db7d9491693648fb3a69fbb71453e5abdaea4f62aceb8c
Opcode Fuzzy Hash: 35ff341fea01c2b82f004fdc622a9334d9847dfee3824cdca80f10c1f8328be7
Instruction Fuzzy Hash: D6416D78608340ABDF249F14C984B2BB7E5EF86790F64D82CE48D57296D379D810CB66

Function 0074AF2D Relevance: 1.4, Strings: 1, Instructions: 108COMMON

Download Yara Rule

Strings

qs, xrefs: 0074AF96

Memory Dump Source

Source File: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID:
String ID: qs
API String ID: 0-1399850505
Opcode ID: 8aaebf1e4c3640f5f3ce392bc9914373ba4fadcd76e73042caaaaaebe0853f7e
Instruction ID: 213a4047bc2bb3002eb03959a3c85386541011a07bdd11869b13c7bbc80e45fc
Opcode Fuzzy Hash: 8aaebf1e4c3640f5f3ce392bc9914373ba4fadcd76e73042caaaaaebe0853f7e
Instruction Fuzzy Hash: 5D3134B0140B008BC730CF24D991A23B7F1FF1A751B549A0CE8AA8BAA5E339F844CB15

Function 007738E2 Relevance: 1.3, Strings: 1, Instructions: 81COMMON

Download Yara Rule

Strings

, xrefs: 0077394E, 0077392B, 00773933

Memory Dump Source

Source File: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3019521637
Opcode ID: 6755f9bab069ea5934903f8183f253ded6f2aca177a558b48b1de12272a79bcd
Instruction ID: cbac874d5d7aa7c088d9aa5b85afd1dbee0ad078d257e7065c048cb6308f2743
Opcode Fuzzy Hash: 6755f9bab069ea5934903f8183f253ded6f2aca177a558b48b1de12272a79bcd
Instruction Fuzzy Hash: 6321A170208301ABDB14DF08CC55B2AB7E5AB85759F54891CF2C9972E2C3B9E950CF56

Function 0071CC4B Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0071CC4B

Memory Dump Source

Source File: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: ff67190e203017d175a1754f41e13516db29bc343295393714c46c0bceaba8cb
Instruction ID: ce272974e79e14191871b97eba41f28c721e6fdb9e8acdc78b6cad89ee9092dd
Opcode Fuzzy Hash: ff67190e203017d175a1754f41e13516db29bc343295393714c46c0bceaba8cb
Instruction Fuzzy Hash: 09A02430500104CF4300CF355D0F30C37D455411C0314D0145001C4030D73CC151DF4C

Function 00738F38 Relevance: .8, Instructions: 789COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55bdd7183e786f206f49eb0e89a9435e12bd88c65a2001897e8b962e1375b007
Instruction ID: 861fe96ad4e2e21f3f406a257330d923704c72c1777fcdcfdfdbe58fc0793dee
Opcode Fuzzy Hash: 55bdd7183e786f206f49eb0e89a9435e12bd88c65a2001897e8b962e1375b007
Instruction Fuzzy Hash: 7B42D5316087158BD725DF28D8806BEB3E1FFD4315F298A2DDA96C7282E778D851CB42

Function 00751908 Relevance: .7, Instructions: 700COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16869c809fe6b9c013eb52f11e203e487ef228a061d05dc0c8baca727ee9c214
Instruction ID: 616c1bcb5b4c5e305e8ce9edb40b4600c997500942c1ba151566791b87b3acb9
Opcode Fuzzy Hash: 16869c809fe6b9c013eb52f11e203e487ef228a061d05dc0c8baca727ee9c214
Instruction Fuzzy Hash: DD72F8B0508B81DED371CF3C8849796BFE4AB1A324F044A5EE4EA8B3D2C3756505CB66

Function 00738428 Relevance: .7, Instructions: 670COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 169fd697c981202875bdf4f7b877c3bbabddd2f5e73f7c32bbe4a1385d044f0b
Instruction ID: ea591e2c5c1475b6afae22c3f84b1e9d7c5b2faefbf027ed7f437e0129122105
Opcode Fuzzy Hash: 169fd697c981202875bdf4f7b877c3bbabddd2f5e73f7c32bbe4a1385d044f0b
Instruction Fuzzy Hash: 4852B1B0A08B848FF7758B24C4843ABBBE1EB55310F54492EE5E6076C3DB7DA985C712

Function 00734278 Relevance: .7, Instructions: 657COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e65e6d0ec29a0286690b312841c0ba80701f8bb5ada55794a20425fd9e091869
Instruction ID: 7e44b9edf3df84518a546b9a9d9bd31f34b12ea5136ff36490778ef419c7e886
Opcode Fuzzy Hash: e65e6d0ec29a0286690b312841c0ba80701f8bb5ada55794a20425fd9e091869
Instruction Fuzzy Hash: A152D2715083858FDB18CF14C0906AEBBE1FF89314F598A6DE8D957352D778E889CB81

Function 00734C78 Relevance: .6, Instructions: 592COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b4942d6c5a04db89343f61d2bd896b7a754b8bfa492006bc517a5ac4323522e
Instruction ID: 35c8eb4cf5af95ff00d6303c579babfc1414ceab67a7932c023f0ff462855fba
Opcode Fuzzy Hash: 8b4942d6c5a04db89343f61d2bd896b7a754b8bfa492006bc517a5ac4323522e
Instruction Fuzzy Hash: 4E322370515B118FD368CF29C58052ABBF1BF45710BA44A2ED6A787F92D37AF845CB10

Function 00737338 Relevance: .5, Instructions: 504COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2ed25ed2ecece428dec3d662da4c49c86df14d0f0cac3c7bd7da9d139c37883
Instruction ID: 5f8c283fcb0f36d1fb5bd8135bf56d502596bb5157089fde1ece5e5173b2142b
Opcode Fuzzy Hash: c2ed25ed2ecece428dec3d662da4c49c86df14d0f0cac3c7bd7da9d139c37883
Instruction Fuzzy Hash: E102B07160C7418FD728CF29C89166BFBE2AFD9300F08892DE4D687792E679D904CB56

Function 0075A438 Relevance: .4, Instructions: 380COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83d948c1b98276872fbedeb4ae571c7f1df7ffbfed0eb7000220ee8de56deee4
Instruction ID: db9dc957b5c447c5ba2a36077451f8e9ab945df6b1928675c008b6058b1184f1
Opcode Fuzzy Hash: 83d948c1b98276872fbedeb4ae571c7f1df7ffbfed0eb7000220ee8de56deee4
Instruction Fuzzy Hash: C8B10571608341ABDB14DB14C850AAFB7E2EF95306F184A3CE9C597352E3B9E918CB53

Function 0076143A Relevance: .4, Instructions: 358COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5e5a161c1ab45c4b1e480cfbddb13b76eded34dc1ce46f9e0b718e5efcd9d52
Instruction ID: 016ce468e24ff5c0e2328bc8b1a310f5ded5fdd4f5b92c5753cc2b52a73205ad
Opcode Fuzzy Hash: c5e5a161c1ab45c4b1e480cfbddb13b76eded34dc1ce46f9e0b718e5efcd9d52
Instruction Fuzzy Hash: 12D14CB4800B419FD321AF39C546756BFB0FB02300F548A9DE8EA5B686D335A45ACFD6

Function 00774DA8 Relevance: .3, Instructions: 330COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5adaadb379de4d0ac6695891303286d85bf5796d7f1c210cbcdbab9b523f8b94
Instruction ID: 86d63ad52a91d553d3e7b5f9867d41247291c53d457a03352c4b70b967289e02
Opcode Fuzzy Hash: 5adaadb379de4d0ac6695891303286d85bf5796d7f1c210cbcdbab9b523f8b94
Instruction Fuzzy Hash: 4FA116B2A083509BEB149F28CC8476BB7E5EBC5354F08892CF99C97342E779DD048792

Function 0071BB36 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID: ErrorLastProcess$CurrentFeatureInfoLocalePresentProcessorTerminate
String ID:
API String ID: 3471368781-0
Opcode ID: a9831f664406461db493908550bc2aae9e8d8d8006c41f4e47b097766df0a86b
Instruction ID: 8f8feef1339e5f4f9529f655eeaf4f2db08ae200162ad0c00c9360bb34378b7e
Opcode Fuzzy Hash: a9831f664406461db493908550bc2aae9e8d8d8006c41f4e47b097766df0a86b
Instruction Fuzzy Hash: 91B1F5756007058BDB389F2DCC96AF7B3A9EF44308F14452DEA82C65C0EB79A9C6CB50

Function 007434A4 Relevance: .3, Instructions: 284COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d6742bc921a87cbc0d7ecdfc3dd5ce11be376d8912454172b111acada42123f
Instruction ID: 6074486fd9ef778e83624951ebcfa2401fc9250c93ad470eb8b6fe26ffaae242
Opcode Fuzzy Hash: 7d6742bc921a87cbc0d7ecdfc3dd5ce11be376d8912454172b111acada42123f
Instruction Fuzzy Hash: 12C102B0500B508BE7258F24C885B67BBF1FF46300F14895DE99A8BB92E73AB905CB51

Function 00766078 Relevance: .3, Instructions: 277COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6242de2c158a3e25abd914ef81a7081ec85dc90910a15599f474a425946f381
Instruction ID: 5eef6cb0c7ee241d3cc75ab84d78fc993951370380ba238e4862a2e17b3fed08
Opcode Fuzzy Hash: c6242de2c158a3e25abd914ef81a7081ec85dc90910a15599f474a425946f381
Instruction Fuzzy Hash: 2B81C937A1599147C3189D3D4C112A9AA835FD7330B7EC37AADB6DB3E5D92988024390

Function 00732302 Relevance: .3, Instructions: 271COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9bb0e1251b43261e23572b6fe04e2d9b66b4d052610f955a5f7654400d35fefe
Instruction ID: 7a41486396f2d4a42c681da2a5b21e73c1c29b10439e5e7f7b1edbfeef64e9c6
Opcode Fuzzy Hash: 9bb0e1251b43261e23572b6fe04e2d9b66b4d052610f955a5f7654400d35fefe
Instruction Fuzzy Hash: B19116B2A08355CBF7258E54988032AB7D2AFA1308F1D857DD9854B353E7B9DC4BC382

Function 0075BADA Relevance: .3, Instructions: 256COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a435c7ff7e61a266175cc740b2df94f4f0bcffa5dc796596f52e14c951997eae
Instruction ID: 387e464271322a921037fe31eea01b42ce6e17359586ca12a603ff6988b0ec25
Opcode Fuzzy Hash: a435c7ff7e61a266175cc740b2df94f4f0bcffa5dc796596f52e14c951997eae
Instruction Fuzzy Hash: A5710B73A14B154BC728893C8C517AA76D29BC4211F4E833CDD9ADB386EBB8AD0587C0

Function 00764A88 Relevance: .3, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8b4e1efa5495fb8a019b3a8f09c75cd24c53d3083fb3dc6746e68a82280d218
Instruction ID: 617147db0547e5783049c81310a007b99d9bedb937ab5aaf112f858edd94162a
Opcode Fuzzy Hash: e8b4e1efa5495fb8a019b3a8f09c75cd24c53d3083fb3dc6746e68a82280d218
Instruction Fuzzy Hash: F0810736A4A6914BD3189A3C8C513B9AE934BD3330F2D876DEDF78B3E1C66D88018351

Function 00755108 Relevance: .2, Instructions: 242COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17b631a1ef9c90cdc196109c47057cb6dd3a7c54a8c9dd28249f1b39c8e723b3
Instruction ID: 71e1eb814d25596c4db63ba3ac7a7ccd3cf01f857d015190fcf10571636c507e
Opcode Fuzzy Hash: 17b631a1ef9c90cdc196109c47057cb6dd3a7c54a8c9dd28249f1b39c8e723b3
Instruction Fuzzy Hash: B351E1B1600704ABEB209B64CCA6BB737B4FF81365F044558F985CB391E7B8E908C762

Function 00732268 Relevance: .2, Instructions: 223COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f99aab2791bd1aba6dfb3b61b9a4968c41f01324f8c9ecb9249fe38aea401d4
Instruction ID: e627e7cb28aaee2f0184174b04c7dc3fc9442692d2b30064539d15a46ad438e7
Opcode Fuzzy Hash: 5f99aab2791bd1aba6dfb3b61b9a4968c41f01324f8c9ecb9249fe38aea401d4
Instruction Fuzzy Hash: 717137B690878287F7258A18D450336FBA2AFE1314F29869DD8AA4B353E779DC17C341

Function 007722A8 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 260186d478aae003c652c9c0622f6da14b7ca9a12c80829d925b8ad8623de31d
Instruction ID: 6219fd3505c1c17472994df1151de3e8cb7bf3723c8d2b51ab933575d9cedcc1
Opcode Fuzzy Hash: 260186d478aae003c652c9c0622f6da14b7ca9a12c80829d925b8ad8623de31d
Instruction Fuzzy Hash: 1F71D171608380ABDF11DF19C840B2AB7E6EF95394F18C91CE5E9972A2D339DC42CB56

Function 007618D8 Relevance: .2, Instructions: 215COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2ecac1f06bdf61436ed265659ed9f52c64cc52bcee91badaf8e5f8c506a0b22
Instruction ID: 0f8e25c0fc0082014a3fe6cc8e5a95304c9f47182f47a48e30b5cca05f51400c
Opcode Fuzzy Hash: b2ecac1f06bdf61436ed265659ed9f52c64cc52bcee91badaf8e5f8c506a0b22
Instruction Fuzzy Hash: 117148B44047818FDB258F29C094A26BFB0EF13310B68859DD8D65F74BD339E849CBA1

Function 0073B2D8 Relevance: .2, Instructions: 214COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78f57911bcbd89b49419ee3ef9dd8a7705bfb666a251f11caf1017bd8e3f52b3
Instruction ID: 46d96015f37115be821641e66ede1282b925c2108100ac89b7132910940c0f4c
Opcode Fuzzy Hash: 78f57911bcbd89b49419ee3ef9dd8a7705bfb666a251f11caf1017bd8e3f52b3
Instruction Fuzzy Hash: 765146377486904BE3285D7D5CA12B9BA834BC6330F2D837EEAB58B3E3EA5D48015354

Function 0072E3F7 Relevance: .2, Instructions: 213COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 118f1cef26720b4861566893e0de54ebb40160411a9db2ff76e9d22af775da4a
Instruction ID: 71b79734a2d0b6e71ebab74196639cd803d9039f6ec983d84158a4dc5f0c8d89
Opcode Fuzzy Hash: 118f1cef26720b4861566893e0de54ebb40160411a9db2ff76e9d22af775da4a
Instruction Fuzzy Hash: 3C71BE71A083619BD718CE28E09472EBBE2AFC5714F14893DF89A97395D778DC448B82

Function 00764858 Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b5a5ab0e6f08e1212459a1051d072897d816136cec1085f020d45d75109a894
Instruction ID: 243a4342bf28633a22b10cc32a2ec94a85f0e7d9e1248807155f93d75686de0d
Opcode Fuzzy Hash: 1b5a5ab0e6f08e1212459a1051d072897d816136cec1085f020d45d75109a894
Instruction Fuzzy Hash: 64513A3BA89AC14BC7249E7C4C412A9AB571BD733473E837ADCB24B3D2D52E9C028351

Function 0073BCB9 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98426d52609b44d71ace9bc0825109431283409a88027502b5f6118697708dcb
Instruction ID: e8fcdd9b9e656805c77c9d5e0c0f3134ad9b7a1651e9a9f40f9126d5d3a7685e
Opcode Fuzzy Hash: 98426d52609b44d71ace9bc0825109431283409a88027502b5f6118697708dcb
Instruction Fuzzy Hash: 91515CB1E115458FEF01CFA8CA95ABEBBB2EF46301F640068E401B7352D7359E14CB66

Function 0076BCB8 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55836fbddb03cbdaf9cff1c314ca2634526aaf9b730aac6315943972a0646e05
Instruction ID: c6e54443f439ddf787abaaa2d509f1231a42b8cdeaff0eac8e602cad8c627c9f
Opcode Fuzzy Hash: 55836fbddb03cbdaf9cff1c314ca2634526aaf9b730aac6315943972a0646e05
Instruction Fuzzy Hash: 79517DB16087548FE314DF29C49475BBBE1BBC8314F044A2DE9E687390E379D6088F92

Function 00766378 Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b9b159b4f3877c8d9d6b0debf22a3b75361e34386abef763474a0b287f0c785
Instruction ID: 78e0201bb38303841db32f43ba0a9e7feacde9c39ec0344b5de09a150ca23189
Opcode Fuzzy Hash: 6b9b159b4f3877c8d9d6b0debf22a3b75361e34386abef763474a0b287f0c785
Instruction Fuzzy Hash: DA511A37A0A5C04BCB159E3C5C462A46E135BE3334B7D836BDCB38B3E6D92AC9129351

Function 00771048 Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d0570097160aab1b68a550f4511c957a43b2e8abafe0f435217c9cb9528a807
Instruction ID: 63f8264e3ddecb940a4bc8c718f0a8b6f783df5543c79f3d5d843e26377f4710
Opcode Fuzzy Hash: 2d0570097160aab1b68a550f4511c957a43b2e8abafe0f435217c9cb9528a807
Instruction Fuzzy Hash: 5D51C2746083409BDF24DF19C844A2AB7E6EF85785F94C82CE5CD9B252D33ADC50DB26

Function 0073A268 Relevance: .2, Instructions: 164COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 054442773fa85cc7e7f2bc6a691852260fd407d19e094a4ce9a9a5ee557263b7
Instruction ID: 24813a5f77e4b2bbb5c09720c058396487c7bcd62c691245ca255b96a5e59642
Opcode Fuzzy Hash: 054442773fa85cc7e7f2bc6a691852260fd407d19e094a4ce9a9a5ee557263b7
Instruction Fuzzy Hash: 0F4103B040D380ABE701BF58D58AA1EFBE5EF56741F548D1CE5C497262D33AD8108B67

Function 00732B08 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8bda98c2f30a516d50807ce0b98e746189b08d9b89d3b03278e09447c629b6b2
Instruction ID: b7a2e231d3694f38bc96c10de396c6ffb373dae8b5e95497cd3a873a16cface8
Opcode Fuzzy Hash: 8bda98c2f30a516d50807ce0b98e746189b08d9b89d3b03278e09447c629b6b2
Instruction Fuzzy Hash: 3C51A2B1A043109FE714DF18C88092AB7E1FF95364F19566CEC959B353E635EC42CBA2

Function 0073E3F3 Relevance: .1, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34b2c5dc47880b26d63c4cac224246904b14b76870b104fed36430456e3dcfb5
Instruction ID: e8cebbe3a5ca8c99739b628271a722b35866d407f2447d71f38775d960e54e3d
Opcode Fuzzy Hash: 34b2c5dc47880b26d63c4cac224246904b14b76870b104fed36430456e3dcfb5
Instruction Fuzzy Hash: 3641FCB490126ADBEF018F94CC95BBEBB71FF0A741F144855E851AB292D374A910CBA4

Function 0073E768 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5e34cb232997b27782127b8cd1ef61722e578a9a41e811742eb7c47ee6c68f4
Instruction ID: 56b0ac93cbd15dbfebabc0dc880047aa65a766b361c4cafc13d3c0f54ca099f7
Opcode Fuzzy Hash: f5e34cb232997b27782127b8cd1ef61722e578a9a41e811742eb7c47ee6c68f4
Instruction Fuzzy Hash: 03412472A0C3944FE358CE7A889412A7BD2ABC5210F18C63EF4E5863C5E6748A05E750

Function 0075ABBB Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b10cf0e7097aa983af4eec26b10cdff308d4fbafdfb15f8fa67f104f1a184b0
Instruction ID: f7187d961810197dd67bfd19a565815fbebe28764d014b2c853d5b441ad463fa
Opcode Fuzzy Hash: 6b10cf0e7097aa983af4eec26b10cdff308d4fbafdfb15f8fa67f104f1a184b0
Instruction Fuzzy Hash: E1410AB1A083419FC714CB24C4516AFB7E2AFDA301F484A7DF89597342D678E909CB53

Function 00775EE8 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e225b96c8bf2e769cc8697a4cfbe4e2a1212ad77f5d165699b061e557b09fc9
Instruction ID: 4296e852fe2f50f2e8926152c2b1553a438412e89cda305896296188ff98af4d
Opcode Fuzzy Hash: 8e225b96c8bf2e769cc8697a4cfbe4e2a1212ad77f5d165699b061e557b09fc9
Instruction Fuzzy Hash: F131BE32B4D6004FD708DA29CC4165EBBE79BCA364F0DD52DE898D7295CA7DC8018B41

Function 00761FF9 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d162afb33da07c4bd60f7c483336d076906e7f1409a5580b2f65c4fffe7ae7c
Instruction ID: 1fae4d2ae21a189bc2e5e9fa10c47a6964e266d3391c1c0ee3b4dfe89c3b1645
Opcode Fuzzy Hash: 0d162afb33da07c4bd60f7c483336d076906e7f1409a5580b2f65c4fffe7ae7c
Instruction Fuzzy Hash: 14319E70904B818FD7268F298450B22BFE19F57345F28848DD8D79B653CA3AE80BCB61

Function 0076D598 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e41c94bf4b0e2099e2558e9e672031c0a6948b5c6cff94468f528954f99504a0
Instruction ID: 5df1486e85151f69b8102ecb8a8525808bd788a505495ddfdccb441b32ff378c
Opcode Fuzzy Hash: e41c94bf4b0e2099e2558e9e672031c0a6948b5c6cff94468f528954f99504a0
Instruction Fuzzy Hash: 3831E532F297144BD3359D38C88026AB792ABC6370F19872DEDBB4B3C5DA784C419392

Function 00739AE8 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff721506fae7554bc00bc682493813926a926291962e7d101190d432c5989efe
Instruction ID: c6fcfbc933134a471aed64bdf79d2f49f70b08124dace15921fc21df86e03c4a
Opcode Fuzzy Hash: ff721506fae7554bc00bc682493813926a926291962e7d101190d432c5989efe
Instruction Fuzzy Hash: DC3158298496F106E7328A3D94A04ADFF906D96224B9942EDC8F10F7C3C586898AD3E1

Function 00770C08 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba455b42178d8c6815bdc6dc6395f760710097916b5094dc96ff09895023de6e
Instruction ID: 29764c6507b46126a0e782f23d4e4ae734210a4171a60d2b7b41cfdaf6920561
Opcode Fuzzy Hash: ba455b42178d8c6815bdc6dc6395f760710097916b5094dc96ff09895023de6e
Instruction Fuzzy Hash: BE315870608340EFDB11DF59C584B1BFBE6AB85748F14C92CE4C89B252C33AD909DBA6

Function 00731A58 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 592ae079f84e3206837f27edfef0d756db5bd63b1ae8b67b4edac06f6a01af03
Instruction ID: 7b7f5bcc8db3dcc0dce6eba00759359dc4bc938cadaa2f69c2b75ac87e1365fa
Opcode Fuzzy Hash: 592ae079f84e3206837f27edfef0d756db5bd63b1ae8b67b4edac06f6a01af03
Instruction Fuzzy Hash: 2731C8317092009BE7149E59C88093AB7E1EFC5316F98C96DE899DB353E239DD52CB42

Function 00742702 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d538187a92fb4ac2440c57b712b554e1d8159c40c43cb23878864ac6b56818ea
Instruction ID: 474afbb7b7c3c56ef53e783fae17a4134daad5d7c00878352f8e2c3f41802f8a
Opcode Fuzzy Hash: d538187a92fb4ac2440c57b712b554e1d8159c40c43cb23878864ac6b56818ea
Instruction Fuzzy Hash: FE3189B0A007108FE725CF24C8C0A7AB7F5AF5A704F14892DD59A97682E738F944CB61

Function 0075B175 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d31ba30025e973e205b9eb2b84926fbe6cfd1052fcf67400e8907e88fc818d30
Instruction ID: 568792b047b0cf0b9e864e39ef59a40ae258a2b216fad3ff1bd913aae810fc41
Opcode Fuzzy Hash: d31ba30025e973e205b9eb2b84926fbe6cfd1052fcf67400e8907e88fc818d30
Instruction Fuzzy Hash: 35216DB09083409BD7149F55C89166BBBF1FF86391F44590DF8C28B760E3B9C884CB52

Function 00773F68 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b89c87bf8a49416322561c17cacfa981ac5946f4534b3d23e182106c98db3fcd
Instruction ID: 17cc9892e100e465dda3ec33b243d115f51868a716f88420e2c6a98b7cb3ed71
Opcode Fuzzy Hash: b89c87bf8a49416322561c17cacfa981ac5946f4534b3d23e182106c98db3fcd
Instruction Fuzzy Hash: 8D314B36A042924BDB26CA3C44A046D7EA06E5612138A43EED8A08B3D3DAA5C980C7D4

Function 00739BF8 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 732362d4dea3aa06521cfd35fc4552f794cef7578ca5345e22e1eca341dced0c
Instruction ID: c40ed9d1eb6f14d8d0291b0f64c29140a39ca269bf9144dc0fc46606bd34ea6a
Opcode Fuzzy Hash: 732362d4dea3aa06521cfd35fc4552f794cef7578ca5345e22e1eca341dced0c
Instruction Fuzzy Hash: B3113A736497944ACB1A89288C6007BFBC59BF2104B8DD5BDD6C693346D426EC0DC27A

Function 00758278 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10fd84eb35d493625d844e637e1fb177c40288a20f3196d160322e86c00bf206
Instruction ID: a75091e4bca027c794fd495e30d5a1e285f546d501fc5771cd2b45e1ebde7503
Opcode Fuzzy Hash: 10fd84eb35d493625d844e637e1fb177c40288a20f3196d160322e86c00bf206
Instruction Fuzzy Hash: C921197690026987CB248F5488002EDB7B0FF16752FA4D4D9D88877240EF799A85DFA6

Function 007566E6 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a4db2e7a7e6a4b6bfbd63caea179ea7f405d1524a8af3c95513a11a8f7ada3b
Instruction ID: c3bf7e0e68c49f9e1996fcb80312fef04cfad58c2a827622e9def7fd11d0b63b
Opcode Fuzzy Hash: 5a4db2e7a7e6a4b6bfbd63caea179ea7f405d1524a8af3c95513a11a8f7ada3b
Instruction Fuzzy Hash: 7711B1705083409FDB40EF14CC80AAAB7F9EB8A306F945D1CE4C187262E379E918CB16

Function 0075C198 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c51315b3c12bd18b55da43b597f25570391444391c721ad26d4c76662b1ac61
Instruction ID: 8260e4ac65433c7bd28a5e179a1a561aed4329df69ca9882f1209ef85f4d4cc9
Opcode Fuzzy Hash: 9c51315b3c12bd18b55da43b597f25570391444391c721ad26d4c76662b1ac61
Instruction Fuzzy Hash: 6C212AB1508381AFE755CB15C88075BBBF2BB86352F949C1CF8C497262D3B9D848CB56

Function 00741920 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b896b6d8164971cb7ba37414f80df5efc22a3a844d39286caadf7c5c62d1198
Instruction ID: e7c1f94e254d8625224f46e9471e6995664214f75e425cbaa7b9f32db6152d23
Opcode Fuzzy Hash: 5b896b6d8164971cb7ba37414f80df5efc22a3a844d39286caadf7c5c62d1198
Instruction Fuzzy Hash: 54213870400B908FD7229B34C895A67BBF1FF42301F44495DE6879BA92D73AF805CB54

Function 00768B78 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction ID: 08a30aba2f0e1dfd7867b9da1694049e520abc84b7ec8532054a44ee1ec6c3b6
Opcode Fuzzy Hash: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction Fuzzy Hash: 1011E9B3A451D40DC3168D3C8440579BFA30A93235F5D83D9F8BD9B2D6DA268D8A8356

Function 0075E2E8 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 960e2e00e3628e1f5e3ba26c325b6cc30fadb638be8208b4fd5208f2d766984d
Instruction ID: 42b01b032ecce09009c518ba70a37d79a1293f28393fb98485395d1e5410a576
Opcode Fuzzy Hash: 960e2e00e3628e1f5e3ba26c325b6cc30fadb638be8208b4fd5208f2d766984d
Instruction Fuzzy Hash: FC01B1F1A0070187FB289E9584C57BBB2A86F91701F08056CED0457202DBF9EE0983A1

Function 00756410 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad1a30c5f86df9b29ac032a507831b123af95fa9cc9c1ef612b51c76bc2b554d
Instruction ID: 664509322205b0408a6f71c581628318f4ac229a3bf69086a3162aada90c2ab9
Opcode Fuzzy Hash: ad1a30c5f86df9b29ac032a507831b123af95fa9cc9c1ef612b51c76bc2b554d
Instruction Fuzzy Hash: 7C1100714083589FD710EF14C8806EAB7E8AF06342F45582CEC8593262E7B9E688CB56

Function 0073C81B Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7537f5fd8384a83163d866f176097abd77cb40ec27a0881dcf1d300453dad3e
Instruction ID: 9b51db764fffc2f19717b20d05925ca1c466cd5207b2dc08e44bf1d29039e75d
Opcode Fuzzy Hash: d7537f5fd8384a83163d866f176097abd77cb40ec27a0881dcf1d300453dad3e
Instruction Fuzzy Hash: 6E11C8B1E042559BEB06CF64D9802FDB7B7AF97304F284428D005B7342E778AA05C764

Function 0075C3AC Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc9d6f7422685d54ac9c4b229ea6dda6c46a3da1920c7261afbe68902de17981
Instruction ID: 3d3d4d27cd23d4055afecb76b9a04c8f137935a3af942ba6cff46772cc84f37f
Opcode Fuzzy Hash: cc9d6f7422685d54ac9c4b229ea6dda6c46a3da1920c7261afbe68902de17981
Instruction Fuzzy Hash: F701BC70E01606CFCB14CF08C8506EAB3B1FF96321F149169E811A73A0E7789945CB51

Function 0073F058 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0bcc21ab59f3068ab92d7e069a64477687dc0058f8902c272e32a697d861a1d
Instruction ID: c63440f853c9597595619fa4ce77ea6bf8d3953273f841e4d94b7e73d783b460
Opcode Fuzzy Hash: e0bcc21ab59f3068ab92d7e069a64477687dc0058f8902c272e32a697d861a1d
Instruction Fuzzy Hash: 67012173A28921078748DD3DDC1156B7AD15BC5630F19873DB9BAC73D0D634C8458655

Function 00748948 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1feb0ecdb06b802b1560528e9a5af3474081b4572b374f0f40b5c4f3f9bd469
Instruction ID: 05f205c4624c5bcb0df85af18bdf3211cd4c8e8cad637532ce96a582c9f64199
Opcode Fuzzy Hash: c1feb0ecdb06b802b1560528e9a5af3474081b4572b374f0f40b5c4f3f9bd469
Instruction Fuzzy Hash: 2BF0A7F2A045159BEB6189959C80B7BFBDCCB87314F191455E88567102E2656880C7E7

Function 00773A08 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 085a7920e2e5b4e779e34a684b632e4f4ebff8cfa837e5ac39cd2be3ef1db2f6
Instruction ID: 45adf946c9831843a48e5786ae35f4e8caa3f797a00a6581556391d5602ac7c1
Opcode Fuzzy Hash: 085a7920e2e5b4e779e34a684b632e4f4ebff8cfa837e5ac39cd2be3ef1db2f6
Instruction Fuzzy Hash: 32F0343450C380AFD709EB18C885A2EFBF5EB96245F56CD1CE0C997222C339D890CB26

Function 00776140 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dba64387f099f4ffb45be2b82222d83dc5fb2b584328ce1a123674adc3a9cf20
Instruction ID: 3dcc55fc6b5e12dbba94d6ff20964a2768b76b44149f78efceff12f543d1fa2c
Opcode Fuzzy Hash: dba64387f099f4ffb45be2b82222d83dc5fb2b584328ce1a123674adc3a9cf20
Instruction Fuzzy Hash: C9F01234508240EBC702AF18C48492EFBF1EF0A740F44982CE1C883222D33AD820CB66

Function 0071A64C Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d30a52f00f890bd01d6e84b1357bca7669443c8ff688bb46904ed1c21e63159d
Instruction ID: 2803d9fe294d5cdeb71b0d2d8f4efcf9d8f4ade14c5da9ff950c7188a533d288
Opcode Fuzzy Hash: d30a52f00f890bd01d6e84b1357bca7669443c8ff688bb46904ed1c21e63159d
Instruction Fuzzy Hash: 76E04632922268EBCB15DBDC890898AF2ACEB48B00B150496B501D3250C274DE80C7D0

Function 0076EC08 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4b5204e339133bf84330416a5308528dd9e98d6cb7a6fcb91640552a86da4e7
Instruction ID: d2d47ddc3f8a39f8a793176b87628722dcd3b17e29539cbb17599c4c43da0fb5
Opcode Fuzzy Hash: a4b5204e339133bf84330416a5308528dd9e98d6cb7a6fcb91640552a86da4e7
Instruction Fuzzy Hash: ECD05B2550822146DB648D199400877F7E0EA87711B45555EF982E3144D234DC41C279

Function 00702003 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3776845c1faa20a4a1993e96fe2db3e7cb74b29baebb0a3eb6aa25b50e723a31
Instruction ID: cb7c9963915cedd2f500bd816d472b8de6f398f79b76f0c9846e600d376adae4
Opcode Fuzzy Hash: 3776845c1faa20a4a1993e96fe2db3e7cb74b29baebb0a3eb6aa25b50e723a31
Instruction Fuzzy Hash: 6ED0953AA45A149FC310CF09E480941F7B8FB99630B2680A6E905A3B20C338FC42CAE0

Function 00710F2E Relevance: .0, Instructions: 12COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f509db719341cefea6c6c824f556d87c4149af31b656ab04d21882e9f704e7b0
Instruction ID: f0b714739562c15f8ff035d2c40cd5ad162a090b5a82f62a31173d305a421c6f
Opcode Fuzzy Hash: f509db719341cefea6c6c824f556d87c4149af31b656ab04d21882e9f704e7b0
Instruction Fuzzy Hash: 87C08C34001900C6CF39A9188272BF43399A3A2782F8404CCDC1A8B7C2C55E9CC3DA41

Function 00742D4B Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a927264b8af54b329c315b56f05fbf2d8de1dbd38e325cfc03de9a518d2d83b6
Instruction ID: 373801565fd8efdae013fb45339c13e14035aade0f4c0f296b87593215e41ba3
Opcode Fuzzy Hash: a927264b8af54b329c315b56f05fbf2d8de1dbd38e325cfc03de9a518d2d83b6
Instruction Fuzzy Hash: 5BB092E2C00341C6FE902A212C5643AB2280623311F443430E80722263A52AD518816B

Function 0075D75B Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9bde8e0a18542e65954db997d1931066d1f8d4cb0ee69fd957d26d9737444eaa
Instruction ID: d1f80266b2a4be2b92fb5456e29d9b2080d609ae2df8bea34bf16acd08cc2c5b
Opcode Fuzzy Hash: 9bde8e0a18542e65954db997d1931066d1f8d4cb0ee69fd957d26d9737444eaa
Instruction Fuzzy Hash: 9AB092E1C0A510C6A8122E912D075EEB1240953201F0420B5E90622203AA9AF21A82EF

Function 00776343 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 005c4ba806c1f729e01d7b345e607bcf037a1a2af418616e2fc01539d0967c76
Instruction ID: 7795c8e62c6c1a2cba6d6766a4d5bb610867df3ac219b3c08ddfb2e365f90ae1
Opcode Fuzzy Hash: 005c4ba806c1f729e01d7b345e607bcf037a1a2af418616e2fc01539d0967c76
Instruction Fuzzy Hash: D2B092B09083409BE644CF04C4A053AF3B5FB87229F00A82CE15AA3152C330E808CF0E

Function 0077604C Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e353222c480a1e836f2e88ec6b0f54e01aefb973cbd9e2a65436a63ab80d9507
Instruction ID: 90b20a1011eb729eb64d159c706abf0f2e45b7b0e11e27798d7b31732cf018ce
Opcode Fuzzy Hash: e353222c480a1e836f2e88ec6b0f54e01aefb973cbd9e2a65436a63ab80d9507
Instruction Fuzzy Hash: F7A00225E5C10197C60CCF24A950571E2B95BBF205F513428C005BB852D510D440961C

Function 0074338E Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee70fe1013954b18253420cd7c879e3bafbcdc7016d02e7bb28bbb050ed5ff3e
Instruction ID: eb9c71f61387cf9290d7c446bbbdb1ba1a08eb420cde55b5b5e8e69408f34382
Opcode Fuzzy Hash: ee70fe1013954b18253420cd7c879e3bafbcdc7016d02e7bb28bbb050ed5ff3e
Instruction Fuzzy Hash: C0900224D4830086C2488E409490470E23A564F606E117018850D334924620E500850C

Function 0074165F Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0348c40113168c569ecdbaf33ce4c7ca3883923b3352dc9550a20db56e356de0
Instruction ID: 125aa2fd33e84a88d69890093f1abe8245766079576a578208108fcfe1822cf2
Opcode Fuzzy Hash: 0348c40113168c569ecdbaf33ce4c7ca3883923b3352dc9550a20db56e356de0
Instruction Fuzzy Hash: D9900228D582008A8100CE4494A0470F278620B206F1034109008F3012D210E804850C

Function 007053B1 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 007053B8
std::_Lockit::_Lockit.LIBCPMT ref: 007053C2
int.LIBCPMT ref: 007053D9

Part of subcall function 007016B4: std::_Lockit::_Lockit.LIBCPMT ref: 007016C5
Part of subcall function 007016B4: std::_Lockit::~_Lockit.LIBCPMT ref: 007016DF

std::_Facet_Register.LIBCPMT ref: 00705413
std::_Lockit::~_Lockit.LIBCPMT ref: 00705433
Concurrency::cancel_current_task.LIBCPMT ref: 00705440

Strings

R[p, xrefs: 00705420

Memory Dump Source

Source File: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Register
String ID: R[p
API String ID: 55977855-2570311279
Opcode ID: 87ca0f49c7632684b8ce31607dc9f7d612b21aa22dfdbe6ed2b65ba1c9b6c9a5
Instruction ID: 3fd852fb78e65cb37c2d2cdc8f3a71fe9c669dcddf81b746c49aa8f927c484f6
Opcode Fuzzy Hash: 87ca0f49c7632684b8ce31607dc9f7d612b21aa22dfdbe6ed2b65ba1c9b6c9a5
Instruction Fuzzy Hash: B811E471910624DBCB14EB64D8496AEB7F5AF44320F644609F505A72D1DFBCAE00CF90

Function 0070A5C8 Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 0070A6E7
___TypeMatch.LIBVCRUNTIME ref: 0070A7F5
CallUnexpected.LIBVCRUNTIME ref: 0070A962

Strings

csm, xrefs: 0070A672
csm, xrefs: 0070A71E
csm, xrefs: 0070A605

Memory Dump Source

Source File: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID: CallMatchTypeUnexpectedtype_info::operator==
String ID: csm$csm$csm
API String ID: 1206542248-393685449
Opcode ID: c137cd32f31567f50322da67559445cc67bd8ab50763c9b1598e920b3379b46d
Instruction ID: 0482ac8dd205fb21c50df1cb38672adf349f8738aef0e816a05d23e1b5bb0605
Opcode Fuzzy Hash: c137cd32f31567f50322da67559445cc67bd8ab50763c9b1598e920b3379b46d
Instruction Fuzzy Hash: 13B17971800309FFCF15DFA4C8859AEB7F5BF14310F158269E8116B292D779EA52CB92

Function 00715F4A Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,F8250000,?,B2EBBA01,?,00716057,0070C446,?,F8250000,00000000), ref: 0071600B

Strings

ext-ms-, xrefs: 00715FB5
api-ms-, xrefs: 00715FA1

Memory Dump Source

Source File: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 092b3e53f1edf8c6b185028d1771b5cde76dd482f38e7d8bc26015d934359cd7
Instruction ID: 7c4914e320318c0ee580966be45623db0e5f09d0008f5aff1454986db405c1f9
Opcode Fuzzy Hash: 092b3e53f1edf8c6b185028d1771b5cde76dd482f38e7d8bc26015d934359cd7
Instruction Fuzzy Hash: AA21D572A01510E7D7359B28AC44EAA776CEB81760F254111F915A72D0EB3CEE82C6A0

Function 0070507A Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00705081
std::_Lockit::_Lockit.LIBCPMT ref: 0070508C
std::locale::_Setgloballocale.LIBCPMT ref: 007050A7
_Yarn.LIBCPMT ref: 007050BD
std::_Lockit::~_Lockit.LIBCPMT ref: 007050FA

Strings

R[p, xrefs: 007050C9, 007050ED

Memory Dump Source

Source File: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID: Lockitstd::_$H_prolog3Lockit::_Lockit::~_SetgloballocaleYarnstd::locale::_
String ID: R[p
API String ID: 156189095-2570311279
Opcode ID: ac31abd2e25bd89fedbf064e9ebd3bddece72a39a9c3c85637ea1989d7037d48
Instruction ID: 1894531a1951c996dc96c62b0f852709a5ff426d0f204e44bb880576207f24c1
Opcode Fuzzy Hash: ac31abd2e25bd89fedbf064e9ebd3bddece72a39a9c3c85637ea1989d7037d48
Instruction Fuzzy Hash: 27017CB5A00969DBD709EB20EC59A7D77E1BF94340B258209E911573C1DB3CAE02CFD5

Function 00710F50 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,B2EBBA01,?,?,00000000,00721FC8,000000FF,?,00710EE0,00711010,?,00710EB4,00000000), ref: 00710F85
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00710F97
FreeLibrary.KERNEL32(00000000,?,?,00000000,00721FC8,000000FF,?,00710EE0,00711010,?,00710EB4,00000000), ref: 00710FB9

Strings

CorExitProcess, xrefs: 00710F8F
mscoree.dll, xrefs: 00710F7E
R[p, xrefs: 00710FA8

Memory Dump Source

Source File: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$R[p$mscoree.dll
API String ID: 4061214504-2944747566
Opcode ID: 5aeaf64f6e6a6be391befb223104dc61e183e01e93c253d1b6daec8dcaf217bc
Instruction ID: e4fc5213a6abd713e8b48e125117074c5feabd578e9cd1ef35c3b8b194df06c6
Opcode Fuzzy Hash: 5aeaf64f6e6a6be391befb223104dc61e183e01e93c253d1b6daec8dcaf217bc
Instruction Fuzzy Hash: 76018B71504629EFDB318F54DC0AFAEBBB9FB04B14F044525F811A22D0DB7D9A45CA94

Function 0071F356 Relevance: 9.3, APIs: 6, Instructions: 298COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac6d2ab472017d728259c30cbe4c9de37f62b55172238b77242b47c00e9b22fd
Instruction ID: c27a8401f71cd32a1ed0765a24a5af2355e6a5c75b3e1d235a28d3dfa6f78337
Opcode Fuzzy Hash: ac6d2ab472017d728259c30cbe4c9de37f62b55172238b77242b47c00e9b22fd
Instruction Fuzzy Hash: A9B1C170B00249EFDB25DFACD884BED7BB5AF45310F148269E4119B2E2D7799D81CB60

Function 0070A25A Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,0070A251,00708978,00707AFF), ref: 0070A268
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0070A276
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0070A28F
SetLastError.KERNEL32(00000000,0070A251,00708978,00707AFF), ref: 0070A2E1

Memory Dump Source

Source File: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 8e3d6aefd10ee8f7265e70fdda6ac2515985b5a4ac1e6e8f3865c7ab5bfd33e6
Instruction ID: 22e7747729d0a2ded7db2b9efdd79253ee94d6f59997020f28209de1ba424172
Opcode Fuzzy Hash: 8e3d6aefd10ee8f7265e70fdda6ac2515985b5a4ac1e6e8f3865c7ab5bfd33e6
Instruction Fuzzy Hash: 4801883220D351EAE63426B4BC8AB6A27C5BB82B75F204339F510410E2EB5E4E02524A

Function 0070A371 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 0070A438
___AdjustPointer.LIBCMT ref: 0070A45B
___AdjustPointer.LIBCMT ref: 0070A4F7

Strings

R[p, xrefs: 0070A3D0

Memory Dump Source

Source File: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID: AdjustPointer
String ID: R[p
API String ID: 1740715915-2570311279
Opcode ID: 10847a2467dd259f3c7cf43e31d4045113b45860100d310e31677a98c39da7b2
Instruction ID: 52787449212c0290b5ad5678e22f5015f719e1f2eb0ccf63871ecf877aa2a22a
Opcode Fuzzy Hash: 10847a2467dd259f3c7cf43e31d4045113b45860100d310e31677a98c39da7b2
Instruction Fuzzy Hash: 8E51D07A600346FFDB298F18D849B7AB7E4EF10310F24462DF8458A1D1E779AC50C792

Function 00704436 Relevance: 7.5, APIs: 5, Instructions: 48COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00704442
int.LIBCPMT ref: 00704455

Part of subcall function 007016B4: std::_Lockit::_Lockit.LIBCPMT ref: 007016C5
Part of subcall function 007016B4: std::_Lockit::~_Lockit.LIBCPMT ref: 007016DF

std::_Facet_Register.LIBCPMT ref: 00704488
std::_Lockit::~_Lockit.LIBCPMT ref: 0070449E
Concurrency::cancel_current_task.LIBCPMT ref: 007044A9

Memory Dump Source

Source File: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 04c8f7212d4490cf4453e7dc2fb9143db81e6caa0e66632b942d7569785cf44c
Instruction ID: f10f4749061502e87360b8123747571380a1317c4021f88ce8f3eec84dfe9396
Opcode Fuzzy Hash: 04c8f7212d4490cf4453e7dc2fb9143db81e6caa0e66632b942d7569785cf44c
Instruction Fuzzy Hash: 2A01A7B2900114EBCB15EB64DC09DAD77E8EF80760B244359FA15A72D1EF38AE01C780

Function 00703DB1 Relevance: 7.5, APIs: 5, Instructions: 48COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00703DBD
int.LIBCPMT ref: 00703DD0

Part of subcall function 007016B4: std::_Lockit::_Lockit.LIBCPMT ref: 007016C5
Part of subcall function 007016B4: std::_Lockit::~_Lockit.LIBCPMT ref: 007016DF

std::_Facet_Register.LIBCPMT ref: 00703E03
std::_Lockit::~_Lockit.LIBCPMT ref: 00703E19
Concurrency::cancel_current_task.LIBCPMT ref: 00703E24

Memory Dump Source

Source File: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 4f2f56400553e09c1154476373148cd0882bff9fbfaaca2d650ba455d22df4aa
Instruction ID: 75067908be79d70ec82a8c525cc61a524e7ade61077fb61d9263eabb6811cc06
Opcode Fuzzy Hash: 4f2f56400553e09c1154476373148cd0882bff9fbfaaca2d650ba455d22df4aa
Instruction Fuzzy Hash: B4018472904118EBCB29AB54DC4989D77E8DF80360B200399F905A72D1EF38DE01C780

Function 00704308 Relevance: 7.5, APIs: 5, Instructions: 47COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00704315
int.LIBCPMT ref: 00704328

Part of subcall function 007016B4: std::_Lockit::_Lockit.LIBCPMT ref: 007016C5
Part of subcall function 007016B4: std::_Lockit::~_Lockit.LIBCPMT ref: 007016DF

std::_Facet_Register.LIBCPMT ref: 0070435B
std::_Lockit::~_Lockit.LIBCPMT ref: 00704371
Concurrency::cancel_current_task.LIBCPMT ref: 0070437C

Memory Dump Source

Source File: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: edb3656d2376d7d2a1ec09d080204a8b24d030445dbd5b043d43f5b2d1ab83bb
Instruction ID: 86d3a6a7539e60aef7cddc8ac0d7a7544de9b3857a11465b3283f205303f420d
Opcode Fuzzy Hash: edb3656d2376d7d2a1ec09d080204a8b24d030445dbd5b043d43f5b2d1ab83bb
Instruction Fuzzy Hash: 370184B6900518E7CB15EB64D84989DB7E4AF91750F205255EA01672D1EF3C9E05CBC4

Function 0070A060 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 0070A09F
__IsNonwritableInCurrentImage.LIBCMT ref: 0070A153

Strings

csm, xrefs: 0070A13D
R[p, xrefs: 0070A16C

Memory Dump Source

Source File: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID: CurrentImageNonwritable___except_validate_context_record
String ID: R[p$csm
API String ID: 3480331319-3030601561
Opcode ID: 45414047b7f2c2749164d0dd7fc91ff01ed093f6cf187ec2b49317983da9dac4
Instruction ID: a75cd9a1a1f66742e80d416f3a716eb5ae4feda72e35f7d325dbaf659f5e308f
Opcode Fuzzy Hash: 45414047b7f2c2749164d0dd7fc91ff01ed093f6cf187ec2b49317983da9dac4
Instruction Fuzzy Hash: D1418130A0031DEBCF10DF68D885A9EBBF5BF45314F148255E814AB392D7399E55CB92

Function 0070B3A2 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,0070B353,00000000,?,007868D4,?,?,?,0070B4F6,00000004,InitializeCriticalSectionEx,00724BD8,InitializeCriticalSectionEx), ref: 0070B3AF
GetLastError.KERNEL32(?,0070B353,00000000,?,007868D4,?,?,?,0070B4F6,00000004,InitializeCriticalSectionEx,00724BD8,InitializeCriticalSectionEx,00000000,?,0070B2AD), ref: 0070B3B9
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 0070B3E1

Strings

api-ms-, xrefs: 0070B3C6

Memory Dump Source

Source File: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 8c4ab5479dec6b6094931d9a6c00518a1d00316e8f8ed1064da6ae57f3daca6d
Instruction ID: 1d910ec7f00a42620b310a2aca46fd7ce2522a6f621c78ca48899e7864ead6f5
Opcode Fuzzy Hash: 8c4ab5479dec6b6094931d9a6c00518a1d00316e8f8ed1064da6ae57f3daca6d
Instruction Fuzzy Hash: 95E09A71784204F7EB311BB1EC4AF697E99AB00B55F204121FA0DE80E1E76D9B519698

Function 00717747 Relevance: 6.3, APIs: 4, Instructions: 338fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(B2EBBA01,00000000,00000000,00000000), ref: 007177AA

Part of subcall function 0071952A: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,00718FD3,?,00000000,-00000008), ref: 007195D6

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00717A05
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00717A4D
GetLastError.KERNEL32 ref: 00717AF0

Memory Dump Source

Source File: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: c4a5f258a776340a85121ef47d36ef8ae6e7114105a15684c3a1f620d322f1e7
Instruction ID: 064a369277aa9fe6bcbd76c398f2b6f95ebe5047eae58250e12a8a8d643540a5
Opcode Fuzzy Hash: c4a5f258a776340a85121ef47d36ef8ae6e7114105a15684c3a1f620d322f1e7
Instruction Fuzzy Hash: CDD14A75E04258DFCB19CFACD8849EDBBB5FF49300F18852AE856E7291D734A981CB50

Function 007206EF Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,0000000C,?,00000000,00000000,?,0071F713,00000000,00000001,00000000,00000000,?,00717B44,00000000,00000000,00000000), ref: 00720706
GetLastError.KERNEL32(?,0071F713,00000000,00000001,00000000,00000000,?,00717B44,00000000,00000000,00000000,00000000,00000000,?,007180CB,00000000), ref: 00720712

Part of subcall function 007206D8: CloseHandle.KERNEL32(FFFFFFFE,00720722,?,0071F713,00000000,00000001,00000000,00000000,?,00717B44,00000000,00000000,00000000,00000000,00000000), ref: 007206E8

___initconout.LIBCMT ref: 00720722

Part of subcall function 0072069A: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,007206C9,0071F700,00000000,?,00717B44,00000000,00000000,00000000,00000000), ref: 007206AD

WriteConsoleW.KERNEL32(00000000,0000000C,?,00000000,?,0071F713,00000000,00000001,00000000,00000000,?,00717B44,00000000,00000000,00000000,00000000), ref: 00720737

Memory Dump Source

Source File: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: d6633cb2adef633b46a78fe0fff46d74202382cd6d0c708762b31e42aa68da49
Instruction ID: e134c13386bd832e396ab7f2fe4448c51104ea9b734f619d1d10dbde7617a019
Opcode Fuzzy Hash: d6633cb2adef633b46a78fe0fff46d74202382cd6d0c708762b31e42aa68da49
Instruction Fuzzy Hash: B5F03036100168FBCF321F95EC09D993FA6FB493A1B008010FA1995131CA3A8D31DFE8

Function 00721093 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147COMMONLIBRARYCODE

Download Yara Rule

APIs

DecodePointer.KERNEL32(?,?,?,?,?,?,?,?,?,007209EF), ref: 007210AC

Strings

Lir, xrefs: 00721241
R[p, xrefs: 00721176, 00721220, 00721266

Memory Dump Source

Source File: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID: DecodePointer
String ID: Lir$R[p
API String ID: 3527080286-4211874394
Opcode ID: a65de8f544803c837bb412f27ab9f0ec6c9ae70d4b492e42764c34313fe23691
Instruction ID: 100e973864e7292dda1da0d9a204dfa0848cf125ab8d45277ad2026482305ead
Opcode Fuzzy Hash: a65de8f544803c837bb412f27ab9f0ec6c9ae70d4b492e42764c34313fe23691
Instruction Fuzzy Hash: 8E51AE70A0062EDBCF208FA8F94C1BDBFB4FF65300F914155E581A6258CB7C9A65CB54

Function 00705F4D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

_Fputc.LIBCPMT ref: 00706026

Strings

R[p, xrefs: 00706005

Memory Dump Source

Source File: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID: Fputc
String ID: R[p
API String ID: 3078413507-2570311279
Opcode ID: 39b1f2ca0bba55043b08bfd568452e867a36e8743e702595719f712ab89da5c3
Instruction ID: a86bae88739539dfcbdf8d081bd570393f483e987f4fe9b7af5899522fbf990e
Opcode Fuzzy Hash: 39b1f2ca0bba55043b08bfd568452e867a36e8743e702595719f712ab89da5c3
Instruction Fuzzy Hash: A6417C32900A1BEBCB14DF64C5948EEBBF9FF08310B144626E541A7680E739F951CFA0

Function 0070A96D Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?), ref: 0070A992

Strings

MOC, xrefs: 0070A9A4
RCC, xrefs: 0070A9AC

Memory Dump Source

Source File: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: d587a7699eee40fea589845fa4eec0578b05821a9a56e0a00714a3bfb28a149d
Instruction ID: 8cd049118ebb51852cc5cf5b85636e7548599c9fa23ebb0a6f5412e9ebda9bc5
Opcode Fuzzy Hash: d587a7699eee40fea589845fa4eec0578b05821a9a56e0a00714a3bfb28a149d
Instruction Fuzzy Hash: 53415871A00209FFCF16DF98CD85AAEBBB5BF48300F158259F904A7291D339A950DB52

Function 00706CA2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 00707643
___raise_securityfailure.LIBCMT ref: 0070772B

Strings

pex, xrefs: 00707726

Memory Dump Source

Source File: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID: FeaturePresentProcessor___raise_securityfailure
String ID: pex
API String ID: 3761405300-3991197614
Opcode ID: 83dff4e6bed959178dbc156fdcfd80974a6c47c55483d6122e69047af41c83ce
Instruction ID: f204680e68ab6bed588e35ce0919a95681ff33fa46093d82c80172bef5704deb
Opcode Fuzzy Hash: 83dff4e6bed959178dbc156fdcfd80974a6c47c55483d6122e69047af41c83ce
Instruction Fuzzy Hash: C421B3B4A81284EAD724CF24F95AB403BB4FB58710F20D62AE505CB7B0F3BD5981CB08

Function 00705107 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00705113
std::_Lockit::~_Lockit.LIBCPMT ref: 0070516F

Strings

R[p, xrefs: 0070513A, 00705154

Memory Dump Source

Source File: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_
String ID: R[p
API String ID: 593203224-2570311279
Opcode ID: dd25b2578ea0292f8be2e4f90028d516bb5beda6e786a3e2cdedc8ba6e97cca7
Instruction ID: 397dd75613ab79c8f5f263d92d5aa7e9a54403006934dc3b505bb2d601beccea
Opcode Fuzzy Hash: dd25b2578ea0292f8be2e4f90028d516bb5beda6e786a3e2cdedc8ba6e97cca7
Instruction Fuzzy Hash: 48019E71600A18EFCB10DB18C885E9E77F9EF85710B044199E9019B3A1DF74EE01CF50

Function 00707740 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 0070774B
___raise_securityfailure.LIBCMT ref: 00707808

Strings

pex, xrefs: 00707803

Memory Dump Source

Source File: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID: FeaturePresentProcessor___raise_securityfailure
String ID: pex
API String ID: 3761405300-3991197614
Opcode ID: 97e3971310507b8f53117c342f063fe78c9df61b9f883507a0ea2f11765104c4
Instruction ID: cbd7280598bb1d44a8aa29d91a36b3addf2f8320cc0b42e61f0f2b2aa71e819e
Opcode Fuzzy Hash: 97e3971310507b8f53117c342f063fe78c9df61b9f883507a0ea2f11765104c4
Instruction Fuzzy Hash: 7111AFB4A91284EFD700CF29F945A403BB4FB18740F20D22AE8088B7A4F77C9941CF49

Function 007015DF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 007015E6
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 0070161E

Part of subcall function 00705178: _Yarn.LIBCPMT ref: 00705197
Part of subcall function 00705178: _Yarn.LIBCPMT ref: 007051BB

Strings

bad locale name, xrefs: 0070162C

Memory Dump Source

Source File: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID: Yarnstd::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 1908188788-1405518554
Opcode ID: 7d09a369dd451b862ffaa87ff37e91ff0bc427942aecea8499928e8ce64934c7
Instruction ID: 8fef14f70fb23e410bd2fbc439d14a7fb7e10a52efa201eb5236f6de4bc52cbb
Opcode Fuzzy Hash: 7d09a369dd451b862ffaa87ff37e91ff0bc427942aecea8499928e8ce64934c7
Instruction Fuzzy Hash: 53F017B1505B94EEC3319F7A9485447FBE4BE283103948A2EE1DEC3A51D738A404CB6A

Function 007162A6 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 26COMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(?,?), ref: 007162E6

Strings

InitializeCriticalSectionEx, xrefs: 007162B6
R[p, xrefs: 007162D6

Memory Dump Source

Source File: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpin
String ID: InitializeCriticalSectionEx$R[p
API String ID: 2593887523-3132401377
Opcode ID: 6c83bff442e5aca1f6acf27dca7619442c41742b2ad50edb8f258d782a208453
Instruction ID: 257fd26bee3695dfed2a0b0428d4d504d63d8fe6f9f4279fd634045d6b1a387b
Opcode Fuzzy Hash: 6c83bff442e5aca1f6acf27dca7619442c41742b2ad50edb8f258d782a208453
Instruction Fuzzy Hash: 1DE09276240228B7CF212F54FC06EDE7F15EB447A1B008021FD18251A0C6BED961DAD8

Function 0071612C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22memoryCOMMON

Download Yara Rule

APIs

TlsAlloc.KERNEL32 ref: 00716160

Strings

FlsAlloc, xrefs: 0071613C
R[p, xrefs: 00716156

Memory Dump Source

Source File: 00000000.00000002.2291687748.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2291654541.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291721518.0000000000723000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291752695.000000000072D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291797212.0000000000785000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291815689.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291832389.0000000000788000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_9Y6R8fs0wd.jbxd

Similarity

API ID: Alloc
String ID: FlsAlloc$R[p
API String ID: 2773662609-2408770876
Opcode ID: 525f45c92f439c77feeb210cbc520932073cacb2c1d4d88578aa88cdd98e2c7d
Instruction ID: db6337d2e521ee21b860f7bb9d98110d23080967739f6e9195681fe0be1208ed
Opcode Fuzzy Hash: 525f45c92f439c77feeb210cbc520932073cacb2c1d4d88578aa88cdd98e2c7d
Instruction Fuzzy Hash: 17E0C2B668463CB393312664BD0AEDE7A148B44B61B044020FA04261C1DAEE9A51E6E9

Analysis Process: MSBuild.exePID: 6352, Parent PID: 1560COMMON

Execution Graph

Execution Coverage:	1.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	2.1%
Total number of Nodes:	47
Total number of Limit Nodes:	6

Executed Functions

Function 0040D390 Relevance: 6.2, APIs: 4, Instructions: 154
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetInputState.USER32 ref: 0040D3A1
GetCurrentThreadId.KERNEL32 ref: 0040D3B6
GetCurrentProcessId.KERNEL32 ref: 0040D3BC
ExitProcess.KERNEL32 ref: 0040D580

Memory Dump Source

Source File: 00000001.00000002.2095756245.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Similarity

API ID: CurrentProcess$ExitInputStateThread
String ID:
API String ID: 1029096631-0
Opcode ID: 91b0cbc643e4b4ebeb18023be9ae76da3501924d19314061550aa6d351ab72eb
Instruction ID: 7fe0d86d4b211a0ed1928a564c0dc3b48ff1420feaec6627cd99d8fdc632b15c
Opcode Fuzzy Hash: 91b0cbc643e4b4ebeb18023be9ae76da3501924d19314061550aa6d351ab72eb
Instruction Fuzzy Hash: CE41277480C240ABD301BFA9D544A1EFBF5EF56708F148D2EE5C4A7392D23AD8148B6B

Function 004464F0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 14
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL(00449A1D,005C003F,00000006,?,?,00000018,,?,?), ref: 0044651E

Strings

, xrefs: 004464F0, 0044650C, 0044651A

Memory Dump Source

Source File: 00000001.00000002.2095756245.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-3019521637
Opcode ID: b66ff63dfd389af1bc8afcc0025f999e8b2b47508af02e865142dda64173a8e3
Instruction ID: fb6f357373f259be8b0e83fffc5d2a3912a28e0da7d2036ce94b71e982b3a7e9
Opcode Fuzzy Hash: b66ff63dfd389af1bc8afcc0025f999e8b2b47508af02e865142dda64173a8e3
Instruction Fuzzy Hash: 76E0FE75908316AB9A09CF45C14444EFBE5BFC4714F11CC8DA4D867210D3B0AD46DF82

Function 00446040 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 72
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlReAllocateHeap.NTDLL(?,00000000), ref: 004460C4

Strings

;:9, xrefs: 004460B6, 00446093, 0044609B
aD, xrefs: 004460CA

Memory Dump Source

Source File: 00000001.00000002.2095756245.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Similarity

API ID: AllocateHeap
String ID: aD$;:9
API String ID: 1279760036-3784982549
Opcode ID: b2b91b6383baed23bd5779aad5e8932164b52d5e1660306671fc792bfb274a1b
Instruction ID: 81d8e38a202773684cb26477d2aab6f794b7f55265c2f37ac0847f9732ca8712
Opcode Fuzzy Hash: b2b91b6383baed23bd5779aad5e8932164b52d5e1660306671fc792bfb274a1b
Instruction Fuzzy Hash: 70119D75508200EBD301EF28E900A1ABBF5AF86B16F05483DE5C58B212E73AD854CB9B

Function 00446709 Relevance: 3.0, APIs: 2, Instructions: 22
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetForegroundWindow.USER32 ref: 00446709
GetForegroundWindow.USER32 ref: 00446720

Memory Dump Source

Source File: 00000001.00000002.2095756245.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: 61e954c21ccda2bc507880c9326b32b816de450e3ecc2bacd25776dc5b00f227
Instruction ID: 906c729b96ff40db5e6bb0cb1f2bfce635365c04e2c32f2be8addff1d813b1a5
Opcode Fuzzy Hash: 61e954c21ccda2bc507880c9326b32b816de450e3ecc2bacd25776dc5b00f227
Instruction Fuzzy Hash: 4ED05EACA12240A7EA04FB37FC1E85B3615E79221E7464838E40686312D636E851C65B

Function 00445C4A Relevance: 1.6, APIs: 1, Instructions: 71
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNEL32(33A03193,00000000,00000800), ref: 00445CD7

Memory Dump Source

Source File: 00000001.00000002.2095756245.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 72bf814f0518dc5835282787a3600c9ebb27de0fde571f4b41e5eadb2c516951
Instruction ID: 1ed73a75136f75e105c7bb7e785e3dfd24c55cc57a7816ce4e470644bd5d90c0
Opcode Fuzzy Hash: 72bf814f0518dc5835282787a3600c9ebb27de0fde571f4b41e5eadb2c516951
Instruction Fuzzy Hash: 7A218C7520C380AFE745CF29E99061BBBE1ABC9205F58C82DF5C987352C238D905DB6A

Function 00443A20 Relevance: 1.5, APIs: 1, Instructions: 36
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(?,00000000,?), ref: 00443A83

Memory Dump Source

Source File: 00000001.00000002.2095756245.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: bbe3c0725eeb12269a4fd9373789c992c7f1f0aafca5c16579677f982f5a7c14
Instruction ID: 208812190be25b9880a5f29952ef9a922b1c788544e9e186d94aa430ee1b0748
Opcode Fuzzy Hash: bbe3c0725eeb12269a4fd9373789c992c7f1f0aafca5c16579677f982f5a7c14
Instruction Fuzzy Hash: 67F0373410C2409BE301EF19D954A0EBBF4EF9A701F14886CE4C89B2A2C335E814CBAB

Function 00443AA0 Relevance: 1.5, APIs: 1, Instructions: 36
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL(?,00000000), ref: 00443B03

Memory Dump Source

Source File: 00000001.00000002.2095756245.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 5c61f5cf0f16499e49ba7738a8fe8bc67c56cab5a0bd252042df475734ab51e5
Instruction ID: 302f255876a8acf85142c7b8a32416b12f9909014dbe577f3d47d642ddc48781
Opcode Fuzzy Hash: 5c61f5cf0f16499e49ba7738a8fe8bc67c56cab5a0bd252042df475734ab51e5
Instruction Fuzzy Hash: 84F04F3450C2509BD701AF18E945A1EFBF5EF56706F454C68F4C4AB261C339DD60CB9A

Non-executed Functions

Function 0042D9A0 Relevance: 14.4, APIs: 1, Strings: 7, Instructions: 396COMMON

Download Yara Rule

Strings

WJL{, xrefs: 0042E5FA, 0042E604, 0042E464, 0042E46D, 0042E60D, 0042E62F
Dtgr, xrefs: 0042E5C6
sB, xrefs: 0042E66D
RB, xrefs: 0042E64C
sLlS, xrefs: 0042E5D6
US, xrefs: 0042E1C3
9u9s, xrefs: 0042E183

Memory Dump Source

Source File: 00000001.00000002.2095756245.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Similarity

API ID:
String ID: 9u9s$Dtgr$RB$WJL{$sLlS$sB$US
API String ID: 0-3351958040
Opcode ID: 276c1ab203addd20c735120bb759d55bade8af3356c5969ab96734506833bd0c
Instruction ID: cba3938b4c7428f4d552087925c859a69b1ab55a6ae02eac8884ff4f61b23fd4
Opcode Fuzzy Hash: 276c1ab203addd20c735120bb759d55bade8af3356c5969ab96734506833bd0c
Instruction Fuzzy Hash: B1F167B4508340DFD710AF66E89061BBBF0AF86345F54892EF5848B362D3B9C844CF9A

Function 004396A0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 99clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 004396B0
GetWindowLongW.USER32 ref: 004396D5
GetClipboardData.USER32 ref: 004396E5
GlobalLock.KERNEL32 ref: 004396FE
GlobalUnlock.KERNEL32 ref: 004397EC
CloseClipboard.USER32 ref: 004397F5

Strings

=, xrefs: 00439773

Memory Dump Source

Source File: 00000001.00000002.2095756245.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Similarity

API ID: Clipboard$Global$CloseDataLockLongOpenUnlockWindow
String ID: =
API String ID: 2832541153-2322244508
Opcode ID: 78c8dc26131ed5dac9393a6ada90e30b4fdfd99cd617a6bba74dde0b2099fdf1
Instruction ID: 322da3c77394848e095178107a49c73a551c132a77b07a9a0bf135f40f579efd
Opcode Fuzzy Hash: 78c8dc26131ed5dac9393a6ada90e30b4fdfd99cd617a6bba74dde0b2099fdf1
Instruction Fuzzy Hash: 4941537551C381CED311AF7C944831EBFE09B96224F044E6DF4E5862D1D3788945C797

Function 00428230 Relevance: 1.7, APIs: 1, Instructions: 242comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(0044DB80,00000000,00000001,0044DB70), ref: 00428259

Memory Dump Source

Source File: 00000001.00000002.2095756245.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Similarity

API ID: CreateInstance
String ID:
API String ID: 542301482-0
Opcode ID: e7c828e8500b304e47737f2c036b73e87bd74cd8a23869b162ce918d436332e7
Instruction ID: 8b374b447a84a3eb6516e4531b44e52363fa817f3f4265ccba2139a59f939f2f
Opcode Fuzzy Hash: e7c828e8500b304e47737f2c036b73e87bd74cd8a23869b162ce918d436332e7
Instruction Fuzzy Hash: C651EDB07002209BDB20EB64EC92B6B33B4EF81758F54455DF9858B390FB79E801C76A

Function 0043FDBB Relevance: 31.9, APIs: 11, Strings: 7, Instructions: 425memorycomCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(0044DCE0,00000000,00000001,0044DCD0,?), ref: 0043FE41
SysAllocString.OLEAUT32(?), ref: 0043FEC5
CoSetProxyBlanket.OLE32(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0043FF03
SysAllocString.OLEAUT32(?), ref: 0043FF65
SysAllocString.OLEAUT32(?), ref: 00440015
VariantInit.OLEAUT32(6D3F6B39), ref: 0044007E
VariantClear.OLEAUT32(?), ref: 00440123
SysFreeString.OLEAUT32(?), ref: 00440145
SysFreeString.OLEAUT32(?), ref: 0044014E
SysFreeString.OLEAUT32(?), ref: 00440181

Strings

l3u5, xrefs: 0043FF77
9k?m, xrefs: 0043FFBD
q7bI, xrefs: 0043FF7E
"_kQ, xrefs: 0043FFA8
hKpM, xrefs: 0043FF85
bS3U, xrefs: 0043FFAF
1[!], xrefs: 0043FFA1

Memory Dump Source

Source File: 00000001.00000002.2095756245.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Similarity

API ID: String$AllocFree$Variant$BlanketClearCreateInitInstanceProxy
String ID: "_kQ$1[!]$9k?m$bS3U$hKpM$l3u5$q7bI
API String ID: 2485776651-1023481837
Opcode ID: 3b03e2147dce430a0f8925663908d52cba351bca58096ea1b67891df1644cd7a
Instruction ID: abc33ae36a095545e2bb41dcd0e979c6fcd6de482cd85a6a90bd509a0ecf98e9
Opcode Fuzzy Hash: 3b03e2147dce430a0f8925663908d52cba351bca58096ea1b67891df1644cd7a
Instruction Fuzzy Hash: 1FE16974100B01EFE3208F15C985B16BBF1FF4AB02F148969E59A8BAA1C775F855CF98

Function 004365E8 Relevance: 19.3, APIs: 2, Strings: 9, Instructions: 78COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 004365F4
VariantInit.OLEAUT32 ref: 00436606

Strings

Y, xrefs: 00436647
_, xrefs: 0043665F
O, xrefs: 0043661F
], xrefs: 00436657
Q, xrefs: 00436627
[, xrefs: 0043664F
S, xrefs: 0043662F
W, xrefs: 0043663F
U, xrefs: 00436637

Memory Dump Source

Source File: 00000001.00000002.2095756245.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Similarity

API ID: Variant$ClearInit
String ID: O$Q$S$U$W$Y$[$]$_
API String ID: 2610073882-3709029455
Opcode ID: bf4df09837cc0999f8912889e458b68c9d6c2582af1171711b600cbe8bd283c9
Instruction ID: 617472aee6f7647b6791f64ddb482ed0964e05965680e50c34387cf75e2fd40f
Opcode Fuzzy Hash: bf4df09837cc0999f8912889e458b68c9d6c2582af1171711b600cbe8bd283c9
Instruction Fuzzy Hash: 8041E970008B81CED721DF38C894756BFE0AB56314F08869DD8EA4F3D6C775A549CB66

Function 004360C9 Relevance: 19.3, APIs: 2, Strings: 9, Instructions: 73COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 004360DA
VariantInit.OLEAUT32 ref: 004360EC

Strings

O, xrefs: 00436105
W, xrefs: 00436125
U, xrefs: 0043611D
[, xrefs: 00436135
Y, xrefs: 0043612D
], xrefs: 0043613D
S, xrefs: 00436115
Q, xrefs: 0043610D
_, xrefs: 00436145

Memory Dump Source

Source File: 00000001.00000002.2095756245.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Similarity

API ID: Variant$ClearInit
String ID: O$Q$S$U$W$Y$[$]$_
API String ID: 2610073882-3709029455
Opcode ID: f7635afb3bd54eb494f8a0a77bb65c5c2b8a5d4eaa981fde32eb2f6ea89c106d
Instruction ID: 3870ab933f990c28619918e5480d85312f3f30b48fe24ca90a854e860725b9d7
Opcode Fuzzy Hash: f7635afb3bd54eb494f8a0a77bb65c5c2b8a5d4eaa981fde32eb2f6ea89c106d
Instruction Fuzzy Hash: 9C41B474009BC1CEE725DF38C898B46BFA06B56314F088A9DD8E94F296C375A515CB62

Function 00438B2F Relevance: 12.3, APIs: 1, Strings: 6, Instructions: 95COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32 ref: 00438B74

Strings

p, xrefs: 00438BC6
i, xrefs: 00438B96
|, xrefs: 00438BB6
t, xrefs: 00438BD6
d, xrefs: 00438B8E
}, xrefs: 00438BDE

Memory Dump Source

Source File: 00000001.00000002.2095756245.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Similarity

API ID: InitVariant
String ID: d$i$p$t$|$}
API String ID: 1927566239-2434808017
Opcode ID: 554a65b0e6783a8a587c5d9d5a1a59090ef91d405a8573379fac870fe920457a
Instruction ID: 0b84109ddb38ce271a869d6b766c0ab2b1e4120020a45687ac22dc4c2f8272eb
Opcode Fuzzy Hash: 554a65b0e6783a8a587c5d9d5a1a59090ef91d405a8573379fac870fe920457a
Instruction Fuzzy Hash: FE411870508781CED725CF28C494716BFE0AB66324F08869DD8EA4F397C775E515CBA2

Function 00438417 Relevance: 12.3, APIs: 1, Strings: 6, Instructions: 82COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32 ref: 00438444

Strings

}, xrefs: 004384AE
|, xrefs: 00438486
d, xrefs: 0043845E
t, xrefs: 004384A6
i, xrefs: 00438466
p, xrefs: 00438496

Memory Dump Source

Source File: 00000001.00000002.2095756245.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Similarity

API ID: InitVariant
String ID: d$i$p$t$|$}
API String ID: 1927566239-2434808017
Opcode ID: 752ed3a4123867835ced7968c358781d81873fa4b79cdbc7d9d63c2e707b67c3
Instruction ID: 90d411813917745457a09f1c6fb0e7b6a5668ded3b473b778bf00fa4b3dd6296
Opcode Fuzzy Hash: 752ed3a4123867835ced7968c358781d81873fa4b79cdbc7d9d63c2e707b67c3
Instruction Fuzzy Hash: 9541D760108781CED721DF2CC484716BFE06B66214F088A8DD8EA4F7D7C375D519CB62

Function 004126B3 Relevance: 9.1, APIs: 1, Strings: 4, Instructions: 301COMMON

Download Yara Rule

Strings

wCA, xrefs: 00412B66
fch%, xrefs: 00412788
GD, xrefs: 004126C0
tBA, xrefs: 00412AE7

Memory Dump Source

Source File: 00000001.00000002.2095756245.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Similarity

API ID:
String ID: GD$fch%$tBA$wCA
API String ID: 0-2815851639
Opcode ID: 18b95ce0547799c8335b9632188030b7790c54437027a763add69c76ec3f01d7
Instruction ID: d035267a3a9853f3dfc0ceb4180196f553011948bb1c76c1f0fbabd1dc92564a
Opcode Fuzzy Hash: 18b95ce0547799c8335b9632188030b7790c54437027a763add69c76ec3f01d7
Instruction Fuzzy Hash: F6B158B04093C1CBE7318F149554BEFBBE0BB8A348F140A6EE4C99B242D7799545CB66

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 9Y6R8fs0wd.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_9Y6R8fs0wd.exe_bb31e39e2724a028c6dac54eb34b2828abaea3_69101081_7aea6241-064f-4331-847a-db85fcf4c379\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE5F0.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE68D.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE6BD.tmp.xml

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Windows Analysis Report
9Y6R8fs0wd.exe

Function 00702021 Relevance: 9.4, APIs: 1, Strings: 4, Instructions: 631
memoryCOMMON

Function 00716368 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34
COMMONLIBRARYCODE

Function 00718E2E Relevance: 4.7, APIs: 3, Instructions: 202
COMMON

Function 0071A3A6 Relevance: 3.2, APIs: 2, Instructions: 177
COMMON

Function 00719FAA Relevance: 1.6, APIs: 1, Instructions: 147
COMMON