Edit tour

Windows Analysis Report
SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe

Overview

General Information

Sample name:	SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe
Analysis ID:	1531603
MD5:	42c90b202519b4b05086d06918a69ef3
SHA1:	3b8cf3f7fd768c1ee772e8879fa2ae9f9c1715ed
SHA256:	1ac2fb6ee7406ea7e1ae3fa3eb32d8fdbd74df230cae8a2194a49dd81748afb0
Tags:	exe
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Found malware configuration

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Injects a PE file into a foreign processes

LummaC encrypted strings found

Machine Learning detection for sample

Sample uses string decryption to hide its real strings

Sigma detected: Silenttrinity Stager Msbuild Activity

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Checks if the current process is being debugged

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE / OLE file has an invalid certificate

PE file contains an invalid checksum

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe (PID: 2344 cmdline: "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe" MD5: 42C90B202519B4B05086D06918A69EF3)

MSBuild.exe (PID: 3712 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

WerFault.exe (PID: 1452 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 2344 -s 304 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["clearancek.site", "trustterwowqm.shop", "mobbipenju.store", "dissapoiznw.store", "spirittunek.store", "licendfilteo.site", "studennotediw.store", "eaglepawnoy.store", "bathdoomgaz.store"], "Build id": "tLYMe5--deli333"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Sigma Signatures

System Summary

Sigma detected: Silenttrinity Stager Msbuild Activity

Source: Network Connection

Author: Kiran kumar s, oscd.community: Data: DestinationIp: 104.102.49.254, DestinationIsIpv6: false, DestinationPort: 443, EventID: 3, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, Initiated: true, ProcessId: 3712, Protocol: tcp, SourceIp: 192.168.2.7, SourceIsIpv6: false, SourcePort: 49699

Suricata Signatures

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-11T12:45:04.093445+0200	2056477	1	Domain Observed Used for C2 Detected	192.168.2.7	52393	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-11T12:45:04.131266+0200	2056471	1	Domain Observed Used for C2 Detected	192.168.2.7	52711	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-11T12:45:04.068391+0200	2056481	1	Domain Observed Used for C2 Detected	192.168.2.7	49782	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-11T12:45:04.058186+0200	2056483	1	Domain Observed Used for C2 Detected	192.168.2.7	65121	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-11T12:45:04.117435+0200	2056473	1	Domain Observed Used for C2 Detected	192.168.2.7	51188	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-11T12:45:04.047374+0200	2056485	1	Domain Observed Used for C2 Detected	192.168.2.7	62038	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-11T12:45:04.104734+0200	2056475	1	Domain Observed Used for C2 Detected	192.168.2.7	62015	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-11T12:45:04.080638+0200	2056479	1	Domain Observed Used for C2 Detected	192.168.2.7	60844	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (trustterwowqm .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-11T12:45:04.015375+0200	2056174	1	Domain Observed Used for C2 Detected	192.168.2.7	49704	1.1.1.1	53	UDP

ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-11T12:45:05.475751+0200	2858666	1	Domain Observed Used for C2 Detected	192.168.2.7	49699	104.102.49.254	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe

Avira: detected

Antivirus detection for URL or domain

Source: https://steamcommunity.com/profiles/76561199724331900

URL Reputation: Label: malware

Found malware configuration

Source: 0.2.SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe.b10000.0.unpack

Malware Configuration Extractor: LummaC {"C2 url": ["clearancek.site", "trustterwowqm.shop", "mobbipenju.store", "dissapoiznw.store", "spirittunek.store", "licendfilteo.site", "studennotediw.store", "eaglepawnoy.store", "bathdoomgaz.store"], "Build id": "tLYMe5--deli333"}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmp	String decryptor: clearancek.site
Source: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmp	String decryptor: licendfilteo.site
Source: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmp	String decryptor: spirittunek.store
Source: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmp	String decryptor: bathdoomgaz.store
Source: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmp	String decryptor: studennotediw.store
Source: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmp	String decryptor: dissapoiznw.store
Source: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmp	String decryptor: eaglepawnoy.store
Source: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmp	String decryptor: mobbipenju.store
Source: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmp	String decryptor: trustterwowqm.shop
Source: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmp	String decryptor: - Screen Resoluton:
Source: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmp	String decryptor: Workgroup: -
Source: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmp	String decryptor: tLYMe5--deli333

Source: SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.7:49699 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.43:443 -> 192.168.2.7:49707 version: TLS 1.2

Source: SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe

Code function: 0_2_00B2A69A FindFirstFileExW,

0_2_00B2A69A

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 62429966h	0_2_00B82060
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_00B6C18D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Code function: 4x nop then cmp word ptr [ebp+edi+02h], 0000h	0_2_00B66120
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], F3285E74h	0_2_00B862A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Code function: 4x nop then jmp ecx	0_2_00B543A6
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_00B66380
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Code function: 4x nop then mov byte ptr [ecx], al	0_2_00B7233F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Code function: 4x nop then mov byte ptr [ebx], al	0_2_00B7233F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Code function: 4x nop then mov byte ptr [ebx], al	0_2_00B7233F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Code function: 4x nop then inc edi	0_2_00B544BC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Code function: 4x nop then mov eax, dword ptr [esi+0Ch]	0_2_00B72452
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Code function: 4x nop then mov byte ptr [ecx], al	0_2_00B72452
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00B88510
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Code function: 4x nop then jmp eax	0_2_00B52677
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 27BAF212h	0_2_00B8465A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F3285E74h	0_2_00B827B0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 27BAF212h	0_2_00B84706
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Code function: 4x nop then push esi	0_2_00B6E773
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], C274D4CAh	0_2_00B848FA
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Code function: 4x nop then mov byte ptr [edi], al	0_2_00B728F0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Code function: 4x nop then mov eax, dword ptr [esi+40h]	0_2_00B52938
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Code function: 4x nop then mov word ptr [eax], dx	0_2_00B60AFA
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00B84A20
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Code function: 4x nop then movzx edx, byte ptr [esi+edi]	0_2_00B42A70
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Code function: 4x nop then mov eax, dword ptr [esp+000000C0h]	0_2_00B50A5C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Code function: 4x nop then movzx ebx, byte ptr [ecx+esi]	0_2_00B4AB00
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Code function: 4x nop then mov eax, dword ptr [ebp-18h]	0_2_00B4CB70
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Code function: 4x nop then mov eax, dword ptr [esp+000001C0h]	0_2_00B50CEC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	0_2_00B4CCD1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Code function: 4x nop then mov byte ptr [esi+edx], bl	0_2_00B4AC10
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Code function: 4x nop then cmp byte ptr [eax+01h], 00000000h	0_2_00B66EDB
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Code function: 4x nop then movzx ebx, byte ptr [eax+esi]	0_2_00B84F80
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Code function: 4x nop then mov dword ptr [esp+2Ch], ebp	0_2_00B86F00
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Code function: 4x nop then mov eax, dword ptr [esi+0Ch]	0_2_00B73011
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Code function: 4x nop then jmp ecx	0_2_00B87064
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Code function: 4x nop then mov eax, dword ptr [esp+08h]	0_2_00B6D1B0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00B87158
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Code function: 4x nop then mov word ptr [esi], ax	0_2_00B69290
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00B4B280
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F3285E74h	0_2_00B832C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Code function: 4x nop then mov eax, dword ptr [esp+08h]	0_2_00B6D23C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Code function: 4x nop then mov eax, dword ptr [esp+40h]	0_2_00B6F3A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Code function: 4x nop then cmp word ptr [eax+esi+02h], 0000h	0_2_00B6D3C4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	0_2_00B6F300
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Code function: 4x nop then jmp eax	0_2_00B8735B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Code function: 4x nop then cmp byte ptr [esi], 00000000h	0_2_00B67428
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Code function: 4x nop then mov edx, dword ptr [esp]	0_2_00B3F40F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Code function: 4x nop then mov eax, dword ptr [ebp-10h]	0_2_00B4F40B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], C85F7986h	0_2_00B6B450
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], C85F7986h	0_2_00B6B450
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Code function: 4x nop then mov word ptr [ebx], ax	0_2_00B6D580
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Code function: 4x nop then push 00000000h	0_2_00B415D0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Code function: 4x nop then mov eax, edi	0_2_00B676FE
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Code function: 4x nop then cmp byte ptr [edi], 00000000h	0_2_00B5371A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Code function: 4x nop then mov eax, dword ptr [esi+0Ch]	0_2_00B71766
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Code function: 4x nop then cmp byte ptr [esi+01h], 00000000h	0_2_00B4D833
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 7789B0CBh	0_2_00B85810
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Code function: 4x nop then mov dword ptr [esp], 00000000h	0_2_00B59960
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Code function: 4x nop then movzx edx, byte ptr [ecx+eax]	0_2_00B4D950
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Code function: 4x nop then mov byte ptr [ecx], al	0_2_00B71AEC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Code function: 4x nop then mov byte ptr [ebx], al	0_2_00B71AEC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Code function: 4x nop then mov byte ptr [ebx], al	0_2_00B71AEC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Code function: 4x nop then movzx ecx, word ptr [edi+eax]	0_2_00B85A10
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Code function: 4x nop then mov byte ptr [ebx], al	0_2_00B5DBB0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Code function: 4x nop then mov eax, dword ptr [esp+0Ch]	0_2_00B87BB0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 53F09CFAh	0_2_00B87BB0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	0_2_00B79B90
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Code function: 4x nop then lea eax, dword ptr [edi+04h]	0_2_00B6BBD3
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Code function: 4x nop then movzx edx, byte ptr [esi+ebx]	0_2_00B43B20
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Code function: 4x nop then movzx eax, word ptr [esi+ecx]	0_2_00B7FC20
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00B81C20
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Code function: 4x nop then push ebx	0_2_00B53D63
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Code function: 4x nop then mov eax, dword ptr [esp+0Ch]	0_2_00B87D40
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 53F09CFAh	0_2_00B87D40
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Code function: 4x nop then cmp word ptr [ecx+edx+02h], 0000h	0_2_00B87EC0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Code function: 4x nop then cmp dword ptr [ebp+edx*8+00h], 9ECF05EBh	0_2_00B87EC0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Code function: 4x nop then mov word ptr [ebx], ax	0_2_00B5FF88
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00B87FF0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Code function: 4x nop then mov word ptr [eax], dx	0_2_00B5BF45
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp]	2_2_0040D390
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 27BAF212h	2_2_0044676A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], C274D4CAh	2_2_00446A0A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx ebx, byte ptr [eax+esi]	2_2_00447082
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 62429966h	2_2_00444170
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp]	2_2_0044A100
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esi+0Ch]	2_2_00435121
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp]	2_2_004491F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp eax	2_2_004491F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp word ptr [ebp+edi+02h], 0000h	2_2_00428230
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp+08h]	2_2_0042F2C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F3285E74h	2_2_004453D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov word ptr [esi], ax	2_2_0042B3A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], F3285E74h	2_2_004483B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp+08h]	2_2_0042F46A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	2_2_00431410
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp word ptr [eax+esi+02h], 0000h	2_2_0042F4D4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov word ptr [eax], cx	2_2_00428490
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp+40h]	2_2_004314B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], C85F7986h	2_2_0042D560
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], C85F7986h	2_2_0042D560
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esi+0Ch]	2_2_0043456A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov byte ptr [ecx], al	2_2_0043456A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [ebp-10h]	2_2_0041151B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov edx, dword ptr [esp]	2_2_0040151F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then inc edi	2_2_004165CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp]	2_2_0044A620
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp eax	2_2_0041463D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esi+40h]	2_2_0041463D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then push 00000000h	2_2_004036E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov word ptr [ebx], ax	2_2_0042F690
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esi+0Ch]	2_2_0043387B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 27BAF212h	2_2_00446816
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp byte ptr [edi], 00000000h	2_2_0041582B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F3285E74h	2_2_004448C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then push esi	2_2_00430883
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp byte ptr [esi+01h], 00000000h	2_2_0040F943
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 7789B0CBh	2_2_00447920
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov word ptr [eax], cx	2_2_0042D9A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx edx, byte ptr [ecx+eax]	2_2_0040FA60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov dword ptr [esp], 00000000h	2_2_0041BA70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov byte ptr [edi], al	2_2_00434A00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then lea eax, dword ptr [edi+04h]	2_2_0042DB64
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp+000000C0h]	2_2_00412B6C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov word ptr [ebx], ax	2_2_00421B20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx ecx, word ptr [edi+eax]	2_2_00447B20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp]	2_2_00446B30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov byte ptr [ecx], al	2_2_00433BD3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov byte ptr [ebx], al	2_2_00433BD3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov byte ptr [ebx], al	2_2_00433BD3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov word ptr [eax], dx	2_2_00422BEF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx edx, byte ptr [esi+edi]	2_2_00404B80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx ebx, byte ptr [ecx+esi]	2_2_0040CC10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx edx, byte ptr [esi+ebx]	2_2_00405C30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov byte ptr [ebx], al	2_2_0041FCC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp+0Ch]	2_2_00449CC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 53F09CFAh	2_2_00449CC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [ebp-18h]	2_2_0040EC80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov byte ptr [ebx], al	2_2_00434C90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov byte ptr [ebx], al	2_2_00434C90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	2_2_0043BCA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov byte ptr [esi+edx], bl	2_2_0040CD20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp]	2_2_00443D30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx eax, word ptr [esi+ecx]	2_2_00441D30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	2_2_0040EDE1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp ecx	2_2_00448DE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp]	2_2_00448DE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp eax	2_2_00448DE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp+000001C0h]	2_2_00412DFC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov word ptr [eax], dx	2_2_0041DD90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp+0Ch]	2_2_00449E50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 53F09CFAh	2_2_00449E50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov dword ptr [esp+2Ch], ebp	2_2_00448ED0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp ecx	2_2_00448ED0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp]	2_2_00448ED0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp eax	2_2_00448ED0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp word ptr [ecx+edx+02h], 0000h	2_2_00449FD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [ebp+edx*8+00h], 9ECF05EBh	2_2_00449FD0

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2056477 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store) : 192.168.2.7:52393 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056485 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store) : 192.168.2.7:62038 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056479 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store) : 192.168.2.7:60844 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056174 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (trustterwowqm .shop) : 192.168.2.7:49704 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056483 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store) : 192.168.2.7:65121 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056481 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store) : 192.168.2.7:49782 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056471 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site) : 192.168.2.7:52711 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056473 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site) : 192.168.2.7:51188 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056475 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store) : 192.168.2.7:62015 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2858666 - Severity 1 - ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup : 192.168.2.7:49699 -> 104.102.49.254:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: clearancek.site
Source: Malware configuration extractor	URLs: trustterwowqm.shop
Source: Malware configuration extractor	URLs: mobbipenju.store
Source: Malware configuration extractor	URLs: dissapoiznw.store
Source: Malware configuration extractor	URLs: spirittunek.store
Source: Malware configuration extractor	URLs: licendfilteo.site
Source: Malware configuration extractor	URLs: studennotediw.store
Source: Malware configuration extractor	URLs: eaglepawnoy.store
Source: Malware configuration extractor	URLs: bathdoomgaz.store

Source: Joe Sandbox View

IP Address: 104.102.49.254 104.102.49.254

Source: Joe Sandbox View

ASN Name: AKAMAI-ASUS AKAMAI-ASUS

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: global traffic

HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

Source: MSBuild.exe, 00000002.00000002.1262880442.00000000016AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.akamai.steamstatic.com/ https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https: equals www.youtube.com (Youtube)
Source: MSBuild.exe, 00000002.00000002.1262852391.0000000001678000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policydefault-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.akamai.steamstatic.com/ https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7Cd7fb65801182a5f50a3169fe2a0b7ef0; Path=/; Secure; HttpOnly; SameSite=Nonesessionid=e18c921cc996c1e73cbf0ac7; Path=/; Secure; SameSite=NoneSet-CookienginxServerRetry-AfterProxy-SupportProxy-AuthenticateP3PLocationETagAuthentication-InfoAgeAccept-RangesLast-ModifiedMon, 26 Jul 1997 05:00:00 GMTExpiresContent-RangeContent-MD5Content-LocationContent-LanguageContent-Encodingtext/html; charset=UTF-8Content-Type25489Content-LengthAllowWarningViaUpgradeTransfer-EncodingTrailerPragmaKeep-AliveFri, 11 Oct 2024 10:45:05 GMTDateProxy-ConnectioncloseConnectionno-cacheCache-Control equals www.youtube.com (Youtube)
Source: MSBuild.exe, 00000002.00000002.1262852391.0000000001678000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.akamai.steamstatic.com/ https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: trustterwowqm.shop
Source: global traffic	DNS traffic detected: DNS query: mobbipenju.store
Source: global traffic	DNS traffic detected: DNS query: eaglepawnoy.store
Source: global traffic	DNS traffic detected: DNS query: dissapoiznw.store
Source: global traffic	DNS traffic detected: DNS query: studennotediw.store
Source: global traffic	DNS traffic detected: DNS query: bathdoomgaz.store
Source: global traffic	DNS traffic detected: DNS query: spirittunek.store
Source: global traffic	DNS traffic detected: DNS query: licendfilteo.site
Source: global traffic	DNS traffic detected: DNS query: clearancek.site
Source: global traffic	DNS traffic detected: DNS query: steamcommunity.com
Source: global traffic	DNS traffic detected: DNS query: time.windows.com

Source: MSBuild.exe, 00000002.00000002.1262852391.0000000001678000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1262880442.00000000016AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:27060
Source: MSBuild.exe, 00000002.00000002.1262462902.000000000162C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
Source: MSBuild.exe, 00000002.00000002.1262462902.000000000162C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/privacy_agreement/
Source: MSBuild.exe, 00000002.00000002.1262462902.000000000162C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/subscriber_agreement/
Source: Amcache.hve.5.dr	String found in binary or memory: http://upx.sf.net
Source: MSBuild.exe, 00000002.00000002.1262880442.00000000016AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.steampowered.com/
Source: MSBuild.exe, 00000002.00000002.1262852391.0000000001678000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1262880442.00000000016AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://broadcast.st.dl.eccdnx.com
Source: MSBuild.exe, 00000002.00000002.1262852391.0000000001678000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1262880442.00000000016AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/
Source: MSBuild.exe, 00000002.00000002.1262852391.0000000001678000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1262880442.00000000016AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://checkout.steampowered.com/
Source: MSBuild.exe, 00000002.00000002.1262880442.00000000016AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/
Source: MSBuild.exe, 00000002.00000002.1262610882.0000000001638000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/applications/community/main.css?v=2Ih2WOq7ErXY&a
Source: MSBuild.exe, 00000002.00000002.1262462902.000000000162C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
Source: MSBuild.exe, 00000002.00000002.1262462902.000000000162C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6
Source: MSBuild.exe, 00000002.00000002.1262462902.000000000162C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/main.js?v=Gu9gs5hf
Source: MSBuild.exe, 00000002.00000002.1262462902.000000000162C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/manifest.js?v=M7aU
Source: MSBuild.exe, 00000002.00000002.1262880442.00000000016AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/
Source: MSBuild.exe, 00000002.00000002.1262880442.00000000016AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.steampowered.com/
Source: MSBuild.exe, 00000002.00000002.1262852391.0000000001678000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1262880442.00000000016AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lv.queniujq.cn
Source: MSBuild.exe, 00000002.00000002.1262852391.0000000001678000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://medal.tv
Source: MSBuild.exe, 00000002.00000002.1262852391.0000000001678000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1262880442.00000000016AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://player.vimeo.com
Source: MSBuild.exe, 00000002.00000002.1262852391.0000000001678000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1262880442.00000000016AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net
Source: MSBuild.exe, 00000002.00000002.1262852391.0000000001678000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net/recaptcha/;
Source: MSBuild.exe, 00000002.00000002.1262852391.0000000001678000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1262880442.00000000016AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s.ytimg.com;
Source: MSBuild.exe, 00000002.00000002.1262852391.0000000001678000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1262880442.00000000016AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sketchfab.com
Source: MSBuild.exe, 00000002.00000002.1262852391.0000000001678000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1262880442.00000000016AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steam.tv/
Source: MSBuild.exe, 00000002.00000002.1262852391.0000000001678000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1262880442.00000000016AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast-test.akamaized.net
Source: MSBuild.exe, 00000002.00000002.1262852391.0000000001678000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1262880442.00000000016AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast.akamaized.net
Source: MSBuild.exe, 00000002.00000002.1262852391.0000000001678000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1262880442.00000000016AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcastchat.akamaized.net
Source: MSBuild.exe, 00000002.00000002.1262462902.000000000162C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com
Source: MSBuild.exe, 00000002.00000002.1262852391.0000000001678000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1262880442.00000000016AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/
Source: MSBuild.exe, 00000002.00000002.1262610882.0000000001652000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/Fn
Source: MSBuild.exe, 00000002.00000002.1262462902.000000000162C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
Source: MSBuild.exe, 00000002.00000002.1262610882.0000000001652000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900
Source: MSBuild.exe, 00000002.00000002.1262610882.0000000001652000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900%
Source: MSBuild.exe, 00000002.00000002.1262610882.0000000001652000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900e
Source: MSBuild.exe, 00000002.00000002.1262880442.00000000016AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/re
Source: MSBuild.exe, 00000002.00000002.1262880442.00000000016AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/
Source: MSBuild.exe, 00000002.00000002.1262852391.0000000001678000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;
Source: MSBuild.exe, 00000002.00000002.1262852391.0000000001678000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7Cd7fb65801182a5f
Source: MSBuild.exe, 00000002.00000002.1262462902.000000000162C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/legal/
Source: MSBuild.exe, 00000002.00000002.1262852391.0000000001678000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1262880442.00000000016AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: MSBuild.exe, 00000002.00000002.1262852391.0000000001678000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1262880442.00000000016AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/recaptcha/
Source: MSBuild.exe, 00000002.00000002.1262852391.0000000001678000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1262880442.00000000016AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.cn/recaptcha/
Source: MSBuild.exe, 00000002.00000002.1262852391.0000000001678000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1262880442.00000000016AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/recaptcha/
Source: MSBuild.exe, 00000002.00000002.1262852391.0000000001678000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1262880442.00000000016AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com
Source: MSBuild.exe, 00000002.00000002.1262852391.0000000001678000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1262880442.00000000016AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49698
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49698 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49947 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49677 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49969 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49942
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49940
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49939
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49938
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49937
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49936
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49935
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49934
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49933
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49932
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49931
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49930
Source: unknown	Network traffic detected: HTTP traffic on port 49925 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49971 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49936 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49960 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49929
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49928
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49927
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49926
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49925
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49924
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49923
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49922

Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.7:49699 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.43:443 -> 192.168.2.7:49707 version: TLS 1.2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 2_2_004396A0 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

2_2_004396A0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 2_2_004396A0 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

2_2_004396A0

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Code function: 0_2_00B120C7	0_2_00B120C7
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Code function: 0_2_00B2E095	0_2_00B2E095
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Code function: 0_2_00B50070	0_2_00B50070
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Code function: 0_2_00B862A0	0_2_00B862A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Code function: 0_2_00B4C2F0	0_2_00B4C2F0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Code function: 0_2_00B48350	0_2_00B48350
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Code function: 0_2_00B7E5B0	0_2_00B7E5B0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Code function: 0_2_00B206C0	0_2_00B206C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Code function: 0_2_00B46630	0_2_00B46630
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Code function: 0_2_00B827B0	0_2_00B827B0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Code function: 0_2_00B2C711	0_2_00B2C711
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Code function: 0_2_00B24843	0_2_00B24843
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Code function: 0_2_00B48920	0_2_00B48920
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Code function: 0_2_00B62920	0_2_00B62920
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Code function: 0_2_00B6CAF2	0_2_00B6CAF2
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Code function: 0_2_00B7CCD0	0_2_00B7CCD0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Code function: 0_2_00B3EEF0	0_2_00B3EEF0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Code function: 0_2_00B1CF34	0_2_00B1CF34
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Code function: 0_2_00B77090	0_2_00B77090
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Code function: 0_2_00B6B071	0_2_00B6B071
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Code function: 0_2_00B3F18D	0_2_00B3F18D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Code function: 0_2_00B45290	0_2_00B45290
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Code function: 0_2_00B43280	0_2_00B43280
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Code function: 0_2_00B3F2ED	0_2_00B3F2ED
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Code function: 0_2_00B3F22A	0_2_00B3F22A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Code function: 0_2_00B77390	0_2_00B77390
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Code function: 0_2_00B4331A	0_2_00B4331A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Code function: 0_2_00B1730C	0_2_00B1730C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Code function: 0_2_00B6B450	0_2_00B6B450
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Code function: 0_2_00B49440	0_2_00B49440
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Code function: 0_2_00B415D0	0_2_00B415D0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Code function: 0_2_00B4F780	0_2_00B4F780
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Code function: 0_2_00B75870	0_2_00B75870
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Code function: 0_2_00B29964	0_2_00B29964
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Code function: 0_2_00B75AA0	0_2_00B75AA0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Code function: 0_2_00B5DBB0	0_2_00B5DBB0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Code function: 0_2_00B45C90	0_2_00B45C90
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Code function: 0_2_00B47C41	0_2_00B47C41
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Code function: 0_2_00B85DC0	0_2_00B85DC0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Code function: 0_2_00B11E49	0_2_00B11E49
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Code function: 0_2_00B49F50	0_2_00B49F50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0040FFE0	2_2_0040FFE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0040C060	2_2_0040C060
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00401000	2_2_00401000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00447082	2_2_00447082
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00409110	2_2_00409110
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_004491F0	2_2_004491F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00412180	2_2_00412180
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0042D181	2_2_0042D181
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_004391A0	2_2_004391A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0040129D	2_2_0040129D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00405340	2_2_00405340
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0042D181	2_2_0042D181
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_004073A0	2_2_004073A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_004483B0	2_2_004483B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0040A460	2_2_0040A460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0040E400	2_2_0040E400
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_004394A0	2_2_004394A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0040B550	2_2_0040B550
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0042D560	2_2_0042D560
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_004305E0	2_2_004305E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_004406C0	2_2_004406C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_004036E0	2_2_004036E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0042B69D	2_2_0042B69D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00408740	2_2_00408740
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_004448C0	2_2_004448C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_004298E2	2_2_004298E2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00411890	2_2_00411890
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0042E977	2_2_0042E977
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00409903	2_2_00409903
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_004489D7	2_2_004489D7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00437980	2_2_00437980
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0042D9A0	2_2_0042D9A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0042FA20	2_2_0042FA20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0040AA30	2_2_0040AA30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00424A30	2_2_00424A30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0042CAF0	2_2_0042CAF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00406B60	2_2_00406B60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0042DB64	2_2_0042DB64
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00448B00	2_2_00448B00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00409B1C	2_2_00409B1C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00437BB0	2_2_00437BB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0042EC02	2_2_0042EC02
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0041FCC0	2_2_0041FCC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0043EDE0	2_2_0043EDE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00448DE0	2_2_00448DE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00407DA0	2_2_00407DA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00432E33	2_2_00432E33
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00448ED0	2_2_00448ED0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00447ED0	2_2_00447ED0

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Code function: String function: 00B5B860 appears 155 times
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Code function: String function: 00B17C00 appears 52 times
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Code function: String function: 00B4AA00 appears 96 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 0040CB10 appears 45 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 0041D970 appears 155 times

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2344 -s 304

Source: SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe

Static PE information: invalid certificate

Source: SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe

Static PE information: Section: .data ZLIB complexity 0.9910878413865546

Source: classification engine

Classification label: mal100.troj.evad.winEXE@4/5@11/1

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 2_2_00428230 CoCreateInstance,

2_2_00428230

Source: C:\Windows\SysWOW64\WerFault.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess2344

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\d9b73e22-d3d2-43e7-8ab5-5d4ff479326c

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Command line argument: MZx	0_2_00B120C7
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Command line argument: MZx	0_2_00B120C7
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Command line argument: MZx	0_2_00B120C7

Source: SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2344 -s 304
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dpapi.dll	Jump to behavior

Source: SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe

Static PE information: real checksum: 0x996ee should be: 0x96adf

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Code function: 0_2_00B120C7 push eax; ret	0_2_00B12599
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Code function: 0_2_00B17212 push ecx; ret	0_2_00B17225
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Code function: 0_2_00B5373A push eax; retf	0_2_00B5373F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0041584A push eax; retf	2_2_0041584F

Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe

API coverage: 1.2 %

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 4476

Thread sleep time: -30000s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe

Code function: 0_2_00B2A69A FindFirstFileExW,

0_2_00B2A69A

Source: Amcache.hve.5.dr	Binary or memory string: VMware
Source: Amcache.hve.5.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.5.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.5.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.5.dr	Binary or memory string: VMware20,1hbin@
Source: MSBuild.exe, 00000002.00000002.1262852391.0000000001678000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWa4
Source: Amcache.hve.5.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.5.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.5.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: MSBuild.exe, 00000002.00000002.1262852391.0000000001678000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.5.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: MSBuild.exe, 00000002.00000002.1262462902.000000000162C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWh
Source: Amcache.hve.5.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.5.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.5.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.5.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.5.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.5.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.5.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.5.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.5.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.5.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.5.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.5.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.5.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.5.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.5.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.5.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.5.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.5.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.5.dr	Binary or memory string: VMware-42 27 88 19 56 cc 59 1a-97 79 fb 8c bf a1 e2 9d
Source: Amcache.hve.5.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 2_2_004464F0 LdrInitializeThunk,

2_2_004464F0

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe

Code function: 0_2_00B179A8 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00B179A8

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Code function: 0_2_00B120C7 mov edi, dword ptr fs:[00000030h]	0_2_00B120C7
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Code function: 0_2_00B2B227 mov eax, dword ptr fs:[00000030h]	0_2_00B2B227
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Code function: 0_2_00B21677 mov ecx, dword ptr fs:[00000030h]	0_2_00B21677

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe

Code function: 0_2_00B2D826 GetProcessHeap,

0_2_00B2D826

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Code function: 0_2_00B17680 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00B17680
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Code function: 0_2_00B179A8 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00B179A8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Code function: 0_2_00B17B35 SetUnhandledExceptionFilter,	0_2_00B17B35
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Code function: 0_2_00B1DD67 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00B1DD67

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 value starts with: 4D5A

Jump to behavior

LummaC encrypted strings found

Source: SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	String found in binary or memory: licendfilteo.site
Source: SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	String found in binary or memory: clearancek.site
Source: SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	String found in binary or memory: bathdoomgaz.stor
Source: SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	String found in binary or memory: spirittunek.stor
Source: SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	String found in binary or memory: dissapoiznw.stor
Source: SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	String found in binary or memory: studennotediw.stor
Source: SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	String found in binary or memory: mobbipenju.stor
Source: SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	String found in binary or memory: eaglepawnoy.stor
Source: SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	String found in binary or memory: trustterwowqm.shop

Writes to foreign memory regions

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 401000	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 44C000	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 44F000	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 45F000	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 11F3008	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Code function: GetLocaleInfoW,	0_2_00B24100
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	0_2_00B2CC60
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Code function: EnumSystemLocalesW,	0_2_00B2CFE8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Code function: EnumSystemLocalesW,	0_2_00B2CF02
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Code function: EnumSystemLocalesW,	0_2_00B2CF4D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_00B2D073
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Code function: GetLocaleInfoW,	0_2_00B2D2C6
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_00B2D3EF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Code function: GetLocaleInfoW,	0_2_00B2D4F5
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_00B2D5C4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	Code function: EnumSystemLocalesW,	0_2_00B23C56

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe

Code function: 0_2_00B178A2 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00B178A2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Amcache.hve.5.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.5.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.5.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.5.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: Amcache.hve.5.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	311 Process Injection	2 Virtualization/Sandbox Evasion	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 PowerShell	Boot or Logon Initialization Scripts	1 DLL Side-Loading	311 Process Injection	LSASS Memory	41 Security Software Discovery	Remote Desktop Protocol	2 Clipboard Data	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Deobfuscate/Decode Files or Information	Security Account Manager	2 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	3 Obfuscated Files or Information	NTDS	1 File and Directory Discovery	Distributed Component Object Model	Input Capture	113 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Software Packing	LSA Secrets	13 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	100%	Avira	HEUR/AGEN.1361748
SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://player.vimeo.com	0%	URL Reputation	safe
https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7Cd7fb65801182a5f	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/	0%	URL Reputation	safe
https://www.gstatic.cn/recaptcha/	0%	URL Reputation	safe
http://store.steampowered.com/subscriber_agreement/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6	0%	URL Reputation	safe
https://recaptcha.net/recaptcha/;	0%	URL Reputation	safe
https://medal.tv	0%	URL Reputation	safe
https://broadcast.st.dl.eccdnx.com	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1	0%	URL Reputation	safe
https://login.steampowered.com/	0%	URL Reputation	safe
https://store.steampowered.com/legal/	0%	URL Reputation	safe
https://steam.tv/	0%	URL Reputation	safe
https://steamcommunity.com/profiles/76561199724331900	100%	URL Reputation	malware
http://store.steampowered.com/privacy_agreement/	0%	URL Reputation	safe
https://recaptcha.net	0%	URL Reputation	safe
http://upx.sf.net	0%	URL Reputation	safe
https://store.steampowered.com/	0%	URL Reputation	safe
https://lv.queniujq.cn	0%	URL Reputation	safe
https://checkout.steampowered.com/	0%	URL Reputation	safe
https://help.steampowered.com/	0%	URL Reputation	safe
https://api.steampowered.com/	0%	URL Reputation	safe
http://store.steampowered.com/account/cookiepreferences/	0%	URL Reputation	safe
https://store.steampowered.com/;	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
steamcommunity.com	104.102.49.254	true	true	unknown
s-part-0015.t-0009.t-msedge.net	13.107.246.43	true	false	unknown
trustterwowqm.shop	unknown	unknown	true	unknown
eaglepawnoy.store	unknown	unknown	true	unknown
bathdoomgaz.store	unknown	unknown	true	unknown
spirittunek.store	unknown	unknown	true	unknown
licendfilteo.site	unknown	unknown	true	unknown
studennotediw.store	unknown	unknown	true	unknown
mobbipenju.store	unknown	unknown	true	unknown
clearancek.site	unknown	unknown	true	unknown
time.windows.com	unknown	unknown	false	unknown
dissapoiznw.store	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
bathdoomgaz.store	true		unknown
studennotediw.store	true		unknown
trustterwowqm.shop	true		unknown
clearancek.site	true		unknown
dissapoiznw.store	true		unknown
https://steamcommunity.com/profiles/76561199724331900	true	URL Reputation: malware	unknown
spirittunek.store	true		unknown
licendfilteo.site	true		unknown
eaglepawnoy.store	true		unknown
mobbipenju.store	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://player.vimeo.com	MSBuild.exe, 00000002.00000002.1262852391.0000000001678000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1262880442.00000000016AA000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7Cd7fb65801182a5f	MSBuild.exe, 00000002.00000002.1262852391.0000000001678000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/	MSBuild.exe, 00000002.00000002.1262852391.0000000001678000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1262880442.00000000016AA000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com/profiles/76561199724331900%	MSBuild.exe, 00000002.00000002.1262610882.0000000001652000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://community.akamai.steamstatic.com/	MSBuild.exe, 00000002.00000002.1262880442.00000000016AA000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.gstatic.cn/recaptcha/	MSBuild.exe, 00000002.00000002.1262852391.0000000001678000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1262880442.00000000016AA000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://store.steampowered.com/subscriber_agreement/	MSBuild.exe, 00000002.00000002.1262462902.000000000162C000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org	MSBuild.exe, 00000002.00000002.1262462902.000000000162C000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6	MSBuild.exe, 00000002.00000002.1262462902.000000000162C000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://recaptcha.net/recaptcha/;	MSBuild.exe, 00000002.00000002.1262852391.0000000001678000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.youtube.com	MSBuild.exe, 00000002.00000002.1262852391.0000000001678000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1262880442.00000000016AA000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.google.com	MSBuild.exe, 00000002.00000002.1262852391.0000000001678000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1262880442.00000000016AA000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://medal.tv	MSBuild.exe, 00000002.00000002.1262852391.0000000001678000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://broadcast.st.dl.eccdnx.com	MSBuild.exe, 00000002.00000002.1262852391.0000000001678000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1262880442.00000000016AA000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1	MSBuild.exe, 00000002.00000002.1262462902.000000000162C000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://s.ytimg.com;	MSBuild.exe, 00000002.00000002.1262852391.0000000001678000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1262880442.00000000016AA000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://login.steampowered.com/	MSBuild.exe, 00000002.00000002.1262880442.00000000016AA000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/legal/	MSBuild.exe, 00000002.00000002.1262462902.000000000162C000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steam.tv/	MSBuild.exe, 00000002.00000002.1262852391.0000000001678000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1262880442.00000000016AA000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/applications/community/main.js?v=Gu9gs5hf	MSBuild.exe, 00000002.00000002.1262462902.000000000162C000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com/Fn	MSBuild.exe, 00000002.00000002.1262610882.0000000001652000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://store.steampowered.com/privacy_agreement/	MSBuild.exe, 00000002.00000002.1262462902.000000000162C000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/profiles/76561199724331900e	MSBuild.exe, 00000002.00000002.1262610882.0000000001652000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://community.akamai.steamstatic.com/public/javascript/applications/community/manifest.js?v=M7aU	MSBuild.exe, 00000002.00000002.1262462902.000000000162C000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://recaptcha.net	MSBuild.exe, 00000002.00000002.1262852391.0000000001678000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1262880442.00000000016AA000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://upx.sf.net	Amcache.hve.5.dr	false	URL Reputation: safe	unknown
https://store.steampowered.com/	MSBuild.exe, 00000002.00000002.1262880442.00000000016AA000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com	MSBuild.exe, 00000002.00000002.1262462902.000000000162C000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://sketchfab.com	MSBuild.exe, 00000002.00000002.1262852391.0000000001678000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1262880442.00000000016AA000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://lv.queniujq.cn	MSBuild.exe, 00000002.00000002.1262852391.0000000001678000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1262880442.00000000016AA000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.youtube.com/	MSBuild.exe, 00000002.00000002.1262852391.0000000001678000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1262880442.00000000016AA000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://127.0.0.1:27060	MSBuild.exe, 00000002.00000002.1262852391.0000000001678000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1262880442.00000000016AA000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/css/applications/community/main.css?v=2Ih2WOq7ErXY&a	MSBuild.exe, 00000002.00000002.1262610882.0000000001638000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.google.com/recaptcha/	MSBuild.exe, 00000002.00000002.1262852391.0000000001678000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1262880442.00000000016AA000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://checkout.steampowered.com/	MSBuild.exe, 00000002.00000002.1262852391.0000000001678000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1262880442.00000000016AA000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://help.steampowered.com/	MSBuild.exe, 00000002.00000002.1262880442.00000000016AA000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.steampowered.com/	MSBuild.exe, 00000002.00000002.1262880442.00000000016AA000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/re	MSBuild.exe, 00000002.00000002.1262880442.00000000016AA000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://store.steampowered.com/account/cookiepreferences/	MSBuild.exe, 00000002.00000002.1262462902.000000000162C000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/	MSBuild.exe, 00000002.00000002.1262852391.0000000001678000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1262880442.00000000016AA000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/;	MSBuild.exe, 00000002.00000002.1262852391.0000000001678000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.102.49.254	steamcommunity.com	United States		16625	AKAMAI-ASUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1531603
Start date and time:	2024-10-11 12:44:10 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 2s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@4/5@11/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 64% Number of executed functions: 8 Number of non-executed functions: 151
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.190.159.2, 20.190.159.75, 20.190.159.71, 40.126.31.69, 20.190.159.4, 20.190.159.0, 40.126.31.67, 20.190.159.64, 93.184.221.240, 13.95.65.251, 20.42.73.29, 20.12.23.50, 20.242.39.171, 20.109.210.53, 40.69.42.241
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, twc.trafficmanager.net, otelrules.afd.azureedge.net, wu.azureedge.net, login.live.com, bg.apr-52dd2-0503.edgecastdns.net, cs11.wpc.v0cdn.net, onedsblobprdeus15.eastus.cloudapp.azure.com, glb.cws.prod.dcat.dsp.trafficmanager.net, hlb.apr-52dd2-0.edgecastdns.net, sls.update.microsoft.com, wu-b-net.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net, prdv4a.aadg.msidentity.com, ctldl.windowsupdate.com.delivery.microsoft.com, otelrules.azureedge.net, www.tm.v4.a.prd.aadg.akadns.net, wu.ec.azureedge.net, ctldl.windowsupdate.com, login.msa.msidentity.com, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, blobcollector.events.data.trafficmanager.net, azureedge-t-prod.trafficmanager.net, umwatson.events.data.microsoft.com, www.tm.lg.prod.aadmsa.trafficmanager.net
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe

Simulations

Behavior and APIs

Time	Type	Description
06:45:03	API Interceptor	3x Sleep call for process: MSBuild.exe modified
06:45:19	API Interceptor	1x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.102.49.254	http://gtm-cn-j4g3qqvf603.steamproxy1.com/	Get hash	malicious	Unknown	Browse	www.valvesoftware.com/legal.htm

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
steamcommunity.com	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	TtiLyVLw3Q.exe	Get hash	malicious	LummaC	Browse	23.192.247.89
	file.exe	Get hash	malicious	LummaC	Browse	23.192.247.89
	kwVoiAAfGm.exe	Get hash	malicious	LummaC	Browse	23.192.247.89
	nU3dGuezsg.exe	Get hash	malicious	Amadey, Stealc	Browse	23.192.247.89
	file.exe	Get hash	malicious	LummaC	Browse	23.192.247.89
	l0T55kCdTI.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	23.199.218.33
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
s-part-0015.t-0009.t-msedge.net	xlwings.xlam	Get hash	malicious	Hidden Macro 4.0	Browse	13.107.246.43
	btm4e0L3pw.lnk	Get hash	malicious	Numando	Browse	13.107.246.43
	https://clicktime.symantec.com/15tpJCqdM9QTMPCbrFFYy?h=klzqFfVRykrA0KxCmyOSMtGNk2cnn93amKCU2afEZ8c=&u=https://www.tiktok.com/link/v2?aid%3D1988%26lang%3Den%26scene%3Dbio_url%26target%3Dhttps://www.google.ht/url?q%3Dhttps://google%25E3%2580%2582com/amp/s/cli.re/kBNkWr%23a2FyZW4ubWNjcm9ob25AdXJlbmNvLmNvbQ%3D%3D%252F%26opi%3D256371986142%26usg%3DlxfGUQNysmkDx%26source%3Dgmail%26ust%3D2908128326238375%26usg%3DAO2mBxLVnqpOjng75rOWFwZ2mBxLVnqpOqR75	Get hash	malicious	HTMLPhisher	Browse	13.107.246.43
	https://pearl-contol.powerappsportals.com	Get hash	malicious	HTMLPhisher	Browse	13.107.246.43
	http://pub-945293ef7a9047adb26d2ddd47a2d837.r2.dev/cpanel.html	Get hash	malicious	HTMLPhisher	Browse	13.107.246.43
	PRODUCTTS SPECIFICATIONS.shtml	Get hash	malicious	HTMLPhisher	Browse	13.107.246.43
	https://bitfinexinvestment.com/	Get hash	malicious	Unknown	Browse	13.107.246.43
	https://novanutrix.com/vn%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20/	Get hash	malicious	Unknown	Browse	13.107.246.43
	https://u9313450.ct.sendgrid.net/ls/click?upn=u001.ZfA-2BqTl2mXIVteOCc-2BANg-2BtYQAbYWaU-2BKDDWa611GxHig-2BgElXnUy1eAOeNoTI9ToS9WuAxRUdR21lAIsTPE0g-3D-3Dd8kL_bf4JG6rVotaFp8XsYJMcbHq5p6ju5xz6OkJFWJQMhev1YsQkFFV7zJr96yz5256BnjjwP-2FrVNKeomJDukUeXnM2-2FUbrpvrFpNFdN8Hxo-2B8NA1G5PPzQiWnVnq4RPrf4MxseS-2FjeJBGe3OOYXNXxDmns1gfYeFwrIC6tXtQ3KJv23PKABAyqpBB-2FnsXl7BropPMbry14s3UYpaAeg1aJih0NQeQpVSOm5MBDYOXEHCyJCtLrpoW6SuZeJlGeeWyYAhbotSAdFsjwH5JN5fjIYp-2BMzHm9VPykPI2oeKmW91mIcQqO5YJ1dVv925b7N0T1v	Get hash	malicious	Unknown	Browse	13.107.246.43
	https://1drv.ms/o/c/e6ccafb0b1aa23aa/ErAFgONHz7JMjKMGZiNY1B8BzX_hsp6NES_6N9-YPDqBow?e=ZhzETj	Get hash	malicious	HTMLPhisher	Browse	13.107.246.43

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AKAMAI-ASUS	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	TtiLyVLw3Q.exe	Get hash	malicious	LummaC	Browse	23.192.247.89
	na.elf	Get hash	malicious	Mirai	Browse	23.64.233.20
	file.exe	Get hash	malicious	LummaC	Browse	23.192.247.89
	na.elf	Get hash	malicious	Mirai	Browse	23.36.242.170
	kwVoiAAfGm.exe	Get hash	malicious	LummaC	Browse	23.192.247.89
	na.elf	Get hash	malicious	Mirai	Browse	184.86.165.80
	file.exe	Get hash	malicious	LummaC	Browse	23.192.247.89
	l0T55kCdTI.exe	Get hash	malicious	LummaC	Browse	104.102.49.254

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	https://skarinbroekmanvanvliets.taplink.ws/	Get hash	malicious	HTMLPhisher	Browse	13.107.246.43
	https://crs-auth.23001.ls.firstsource.life/auth	Get hash	malicious	Unknown	Browse	13.107.246.43
	https://acr1-br.com/	Get hash	malicious	HTMLPhisher	Browse	13.107.246.43
	Play_VM-Now(Gracehealthmi)CLQD-68d4d7d5ab7d9dd5e551e3b0c7ea5fc5.html	Get hash	malicious	Unknown	Browse	13.107.246.43
	https://mkoirelandie.blob.core.windows.net/madelinelarkin/mkoprojects.html	Get hash	malicious	HTMLPhisher	Browse	13.107.246.43
	TtiLyVLw3Q.exe	Get hash	malicious	LummaC	Browse	13.107.246.43
	kwVoiAAfGm.exe	Get hash	malicious	LummaC	Browse	13.107.246.43
	https://orsag.ru/js/mL8g0GjivX/index.php	Get hash	malicious	Unknown	Browse	13.107.246.43
	https://samedaygroup.co.uk	Get hash	malicious	Unknown	Browse	13.107.246.43
	Order0958490.vbe	Get hash	malicious	AgentTesla	Browse	13.107.246.43
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	TtiLyVLw3Q.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	7hmGbJQzp5.xlam	Get hash	malicious	Hidden Macro 4.0	Browse	104.102.49.254
	xlwings.xlam	Get hash	malicious	Hidden Macro 4.0	Browse	104.102.49.254
	PI-4009832-2024.xlam.xlsx	Get hash	malicious	Unknown	Browse	104.102.49.254
	kwVoiAAfGm.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	l0T55kCdTI.exe	Get hash	malicious	LummaC	Browse	104.102.49.254

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_SecuriteInfo.com_b92fa3286418a257638aa7d482edfd8a2355b3e4_46392f91_2648e0d9-60b4-4514-be5b-eb7779eaa269\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.7522631412006037
Encrypted:	false
SSDEEP:	192:5YfNlpYaGa0BU/V3Oju1zuiFeZ24IO8pOG:22amBU/AjczuiFeY4IO8X
MD5:	35C03F6AD6F29581B694452E073E7F23
SHA1:	2A070BF0F0F4C832F2199FD36F317C44E7AC8BF9
SHA-256:	C7ACBD9A92F1A189F3FBED46CE1F798568282A76E5DF8489A3D7301385083A29
SHA-512:	04C8138E74536E398763163E65D8BD34E597D77AEDB10FA8587F434FD9EC397FB6B958EC0FB12EAE56320B97B4AB0E87166A401DD1541B7DCC4494CF775C3E47
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.3.1.1.7.1.0.3.6.6.3.0.5.1.2.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.3.1.1.7.1.0.4.0.5.3.6.7.6.9.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.2.6.4.8.e.0.d.9.-.6.0.b.4.-.4.5.1.4.-.b.e.5.b.-.e.b.7.7.7.9.e.a.a.2.6.9.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.c.7.5.2.0.e.c.0.-.9.d.0.9.-.4.3.6.f.-.8.e.4.7.-.2.6.0.c.7.2.a.0.7.3.a.b.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.S.e.c.u.r.i.t.e.I.n.f.o...c.o.m...T.r.o.j.a.n...I.n.j.e.c.t.5...1.0.2.4.0...3.0.6.5.5...1.8.3.9.4...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.9.2.8.-.0.0.0.1.-.0.0.1.4.-.b.e.e.6.-.9.9.a.0.c.a.1.b.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.a.9.6.8.4.5.f.4.d.2.1.4.f.8.b.9.e.6.7.f.2.4.2.a.c.5.a.0.5.7.b.0.0.0.0.0.f.f.f.f.!.0.0.0.0.3.b.8.c.f.3.f.7.f.d.7.6.8.c.1.e.e.7.7.2.e.8.8.7.9.f.a.2.a.e.9.f.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5FAF.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Fri Oct 11 10:45:03 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	35914
Entropy (8bit):	1.7063022087047715
Encrypted:	false
SSDEEP:	96:5L8/8Jk7ly3mAYi6v65z01sqMbqii73vINotwXX+Ywn5ihGm/5BWIkWIYUIWXyrL:+kJai6f6q5iOPtw+VJ+cdWRpNd
MD5:	3BE9067208F82C75D9C8042700365542
SHA1:	A6DE9D5F35B32DD86BDA7D12C28C28966DF774E4
SHA-256:	D85A6880DBCE43E092BF46D536ED876642488C04B842C68725DDCD06B50FDF2F
SHA-512:	5F01E85A149EAC7769F31507741A9CA561A63426743AF9CEE911E855DDA5E966A10C9A1D250A10050576A6C6CED78D647CA3E42270D12825EFBE81E76A996645
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... ..........g........................X...........................T.......8...........T...............Z.......................................................................................................eJ......x.......GenuineIntel............T.......(......g.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5FFE.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8554
Entropy (8bit):	3.699670291582373
Encrypted:	false
SSDEEP:	192:R6l7wVeJKl46g126YNQSU9xwgmfjN8prA89bEMsfhOsm:R6lXJ56z6YKSU9Wgmf5EEffh8
MD5:	DD5D548A7B33C71121CCFFE025189748
SHA1:	C5D50F5403AED9014388A1E42223F839A9FC157D
SHA-256:	91404DDD05B06DB19AC5034AAC99A67A9F308CAAF5477A539D5E7239AD681520
SHA-512:	2724FFA17F9F915AB3D25DB5C76F4B8FA3BDAF19872895AF290EC1202C53C733F07F76791E3A9D8A4EFF09D839460BE9E698B74D6D8388F43B2BDF0850CA2172
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.2.3.4.4.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER602E.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4919
Entropy (8bit):	4.560880726670733
Encrypted:	false
SSDEEP:	48:cvIwWl8zsfJg77aI9H8WpW8VYJYm8M4J6PBEF6g+q8vvBcFG0gAw0hdd:uIjfBI7h17VBJxKGF9nhdd
MD5:	F5A474F1DCBDA29308C3F84F495DB22D
SHA1:	10AC38EBC801BF42BF4D76028FC1FD64112325B9
SHA-256:	21409ED8AFA8E179971603BF7F26C8471F08B25AAC41EF1550900DC349D0DC68
SHA-512:	6D9D4DC93B0048D5409B49CF46217EAAB6304397C56618C69E6D5EC3D672E5A7AB1D8DA4AE660679473FB5EFBCFF96C71A16459704AF4009DA35FFCB5BD84162
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="538667" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.416949000890448
Encrypted:	false
SSDEEP:	6144:8cifpi6ceLPL9skLmb0moSWSPtaJG8nAgex285i2MMhA20X4WABlGuNT5+:Ri58oSWIZBk2MM6AFBho
MD5:	77792CF0930C0E52A07935C3400C496B
SHA1:	974220E74E86B628820C9234033B6B489C142F7C
SHA-256:	CD5C9F8335FC10FBD5387BD7A8DA571DD6733649289028AC48ABAFC3B2871B04
SHA-512:	43818069B32C679C6ACA1B2477EF063E0A302DC5DEDC574F392B3ED9994FAE9815F845C958BFBE0A8B4CA0DDEE98D06DF087140342B1376273C6AED1F063DAB1
Malicious:	false
Reputation:	low
Preview:	regfE...E....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm....................................................................................................................................................................................................................................................................................................................................................fY.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.73070509553981
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe
File size:	594'320 bytes
MD5:	42c90b202519b4b05086d06918a69ef3
SHA1:	3b8cf3f7fd768c1ee772e8879fa2ae9f9c1715ed
SHA256:	1ac2fb6ee7406ea7e1ae3fa3eb32d8fdbd74df230cae8a2194a49dd81748afb0
SHA512:	5ba13b4c66156b6e6344478a77c7cc104f4d7b652e80765bdc2d3ab8f10d6127503ee2db7ec7ac74ea96075cf9702579fa4e853085e34f24c1f32bbfd14ef809
SSDEEP:	12288:plM58XTjomxB7IywBXeXsMLs5FydSHz/ldtI1gyN2+TbpL2BYAscsGYBBA:85QIywBvfYEjnyN2YbpL+YfUr
TLSH:	CBC4F142B5C4C033E873253107F4DAB66E3D7AB10A916DCF27959BAE0F613C1E72166A
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........7\U.V2..V2..V2..$1..V2..$7.dV2..$6..V2...1..V2...6..V2..$3..V2..V3..V2...7..V2...;..V2...0..V2.Rich.V2........................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x406fb7
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x6708DDC7 [Fri Oct 11 08:11:51 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	123e239a3e28f0916ec222eaf58ca968

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=Microsoft Code Signing PCA 2010, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	19/10/2023 21:51:12 16/10/2024 21:51:12
Subject Chain	CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
Version:	3
Thumbprint MD5:	2169E18183DAF704160A117E905BFDA4
Thumbprint SHA-1:	CB9C4FBEA1D87D2D468AC5A9CAAB0163F6AD8401
Thumbprint SHA-256:	C4405F06DFB035F3AD360D29D27D434E004E054B6FB18FA3A5566A9F9AFA8296
Serial:	3300000557CF90DDC7D1C0888C000000000557

Entrypoint Preview

Instruction
call 00007F01F8B9F528h
jmp 00007F01F8B9EA6Fh
push ebp
mov ebp, esp
mov eax, dword ptr [ebp+08h]
push esi
mov ecx, dword ptr [eax+3Ch]
add ecx, eax
movzx eax, word ptr [ecx+14h]
lea edx, dword ptr [ecx+18h]
add edx, eax
movzx eax, word ptr [ecx+06h]
imul esi, eax, 28h
add esi, edx
cmp edx, esi
je 00007F01F8B9EC0Bh
mov ecx, dword ptr [ebp+0Ch]
cmp ecx, dword ptr [edx+0Ch]
jc 00007F01F8B9EBFCh
mov eax, dword ptr [edx+08h]
add eax, dword ptr [edx+0Ch]
cmp ecx, eax
jc 00007F01F8B9EBFEh
add edx, 28h
cmp edx, esi
jne 00007F01F8B9EBDCh
xor eax, eax
pop esi
pop ebp
ret
mov eax, edx
jmp 00007F01F8B9EBEBh
push esi
call 00007F01F8B9F82Fh
test eax, eax
je 00007F01F8B9EC12h
mov eax, dword ptr fs:[00000018h]
mov esi, 004876D0h
mov edx, dword ptr [eax+04h]
jmp 00007F01F8B9EBF6h
cmp edx, eax
je 00007F01F8B9EC02h
xor eax, eax
mov ecx, edx
lock cmpxchg dword ptr [esi], ecx
test eax, eax
jne 00007F01F8B9EBE2h
xor al, al
pop esi
ret
mov al, 01h
pop esi
ret
push ebp
mov ebp, esp
cmp dword ptr [ebp+08h], 00000000h
jne 00007F01F8B9EBF9h
mov byte ptr [004876D4h], 00000001h
call 00007F01F8B9EEB5h
call 00007F01F8BA1DE2h
test al, al
jne 00007F01F8B9EBF6h
xor al, al
pop ebp
ret
call 00007F01F8BAAF0Dh
test al, al
jne 00007F01F8B9EBFCh
push 00000000h
call 00007F01F8BA1DE9h
pop ecx
jmp 00007F01F8B9EBDBh
mov al, 01h
pop ebp
ret
push ebp
mov ebp, esp
cmp byte ptr [004876D5h], 00000000h
je 00007F01F8B9EBF6h
mov al, 01h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2c9b8	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x8b000	0x128	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x8c2c8	0x4ec8
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x89000	0x1c18	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x2ac50	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x2ab90	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x23000	0x134	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x219a8	0x21a00	255307f59d12bab4a133b06e7f8074db	False	0.5768253368959108	data	6.647175164232626	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x23000	0xa0aa	0xa200	f5ef3670ef0cfccdac457c8b52948870	False	0.43074845679012347	data	4.925090049529944	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x2e000	0x5a2f4	0x59400	8218b4e4ff3c429bfc992277675a96a6	False	0.9910878413865546	DOS executable (block device driver \377\377\377\377)	7.992975592127498	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x89000	0x1c18	0x1e00	6a15b0a147b503d5f2a841d5db72f3b5	False	0.7153645833333333	data	6.368861308139213	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.rsrc	0x8b000	0x128	0x200	280e730e6635daad14b7c44cb711eb59	False	0.291015625	data	1.5902449505057812	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
MUI	0x8b060	0xc8	data	English	United States	0.535

Imports

DLL

Import

USER32.dll

ShowWindow

KERNEL32.dll

LoadLibraryExW, CreateFileW, GetConsoleWindow, TlsGetValue, MultiByteToWideChar, GetStringTypeW, WideCharToMultiByte, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionEx, DeleteCriticalSection, EncodePointer, DecodePointer, LCMapStringEx, GetCPInfo, IsProcessorFeaturePresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, GetStartupInfoW, GetModuleHandleW, HeapSize, RaiseException, RtlUnwind, GetLastError, SetLastError, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsSetValue, TlsFree, FreeLibrary, GetProcAddress, WriteConsoleW, GetStdHandle, WriteFile, GetModuleFileNameW, ExitProcess, GetModuleHandleExW, HeapAlloc, HeapFree, LCMapStringW, GetLocaleInfoW, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, GetFileType, CloseHandle, FlushFileBuffers, GetConsoleOutputCP, GetConsoleMode, ReadFile, GetFileSizeEx, SetFilePointerEx, ReadConsoleW, HeapReAlloc, FindClose, FindFirstFileExW, FindNextFileW, IsValidCodePage, GetACP, GetOEMCP, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetStdHandle, GetProcessHeap

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-11T12:45:04.015375+0200	2056174	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (trustterwowqm .shop)	1	192.168.2.7	49704	1.1.1.1	53	UDP
2024-10-11T12:45:04.047374+0200	2056485	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store)	1	192.168.2.7	62038	1.1.1.1	53	UDP
2024-10-11T12:45:04.058186+0200	2056483	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store)	1	192.168.2.7	65121	1.1.1.1	53	UDP
2024-10-11T12:45:04.068391+0200	2056481	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store)	1	192.168.2.7	49782	1.1.1.1	53	UDP
2024-10-11T12:45:04.080638+0200	2056479	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store)	1	192.168.2.7	60844	1.1.1.1	53	UDP
2024-10-11T12:45:04.093445+0200	2056477	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store)	1	192.168.2.7	52393	1.1.1.1	53	UDP
2024-10-11T12:45:04.104734+0200	2056475	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store)	1	192.168.2.7	62015	1.1.1.1	53	UDP
2024-10-11T12:45:04.117435+0200	2056473	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site)	1	192.168.2.7	51188	1.1.1.1	53	UDP
2024-10-11T12:45:04.131266+0200	2056471	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site)	1	192.168.2.7	52711	1.1.1.1	53	UDP
2024-10-11T12:45:05.475751+0200	2858666	ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup	1	192.168.2.7	49699	104.102.49.254	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 11, 2024 12:44:58.347037077 CEST	49671	443	192.168.2.7	204.79.197.203
Oct 11, 2024 12:44:59.549460888 CEST	49671	443	192.168.2.7	204.79.197.203
Oct 11, 2024 12:44:59.877588987 CEST	49674	443	192.168.2.7	104.98.116.138
Oct 11, 2024 12:44:59.879156113 CEST	49675	443	192.168.2.7	104.98.116.138
Oct 11, 2024 12:44:59.971292019 CEST	49672	443	192.168.2.7	104.98.116.138
Oct 11, 2024 12:45:01.955605984 CEST	49671	443	192.168.2.7	204.79.197.203
Oct 11, 2024 12:45:04.156168938 CEST	49699	443	192.168.2.7	104.102.49.254
Oct 11, 2024 12:45:04.156223059 CEST	443	49699	104.102.49.254	192.168.2.7
Oct 11, 2024 12:45:04.156300068 CEST	49699	443	192.168.2.7	104.102.49.254
Oct 11, 2024 12:45:04.159478903 CEST	49699	443	192.168.2.7	104.102.49.254
Oct 11, 2024 12:45:04.159495115 CEST	443	49699	104.102.49.254	192.168.2.7
Oct 11, 2024 12:45:04.854799032 CEST	443	49699	104.102.49.254	192.168.2.7
Oct 11, 2024 12:45:04.854876995 CEST	49699	443	192.168.2.7	104.102.49.254
Oct 11, 2024 12:45:04.858150005 CEST	49699	443	192.168.2.7	104.102.49.254
Oct 11, 2024 12:45:04.858163118 CEST	443	49699	104.102.49.254	192.168.2.7
Oct 11, 2024 12:45:04.858433008 CEST	443	49699	104.102.49.254	192.168.2.7
Oct 11, 2024 12:45:04.908749104 CEST	49699	443	192.168.2.7	104.102.49.254
Oct 11, 2024 12:45:05.049665928 CEST	49699	443	192.168.2.7	104.102.49.254
Oct 11, 2024 12:45:05.091412067 CEST	443	49699	104.102.49.254	192.168.2.7
Oct 11, 2024 12:45:05.475739956 CEST	443	49699	104.102.49.254	192.168.2.7
Oct 11, 2024 12:45:05.475795031 CEST	443	49699	104.102.49.254	192.168.2.7
Oct 11, 2024 12:45:05.475831032 CEST	443	49699	104.102.49.254	192.168.2.7
Oct 11, 2024 12:45:05.475838900 CEST	49699	443	192.168.2.7	104.102.49.254
Oct 11, 2024 12:45:05.475848913 CEST	443	49699	104.102.49.254	192.168.2.7
Oct 11, 2024 12:45:05.475877047 CEST	443	49699	104.102.49.254	192.168.2.7
Oct 11, 2024 12:45:05.475888014 CEST	49699	443	192.168.2.7	104.102.49.254
Oct 11, 2024 12:45:05.475893974 CEST	443	49699	104.102.49.254	192.168.2.7
Oct 11, 2024 12:45:05.475909948 CEST	49699	443	192.168.2.7	104.102.49.254
Oct 11, 2024 12:45:05.475941896 CEST	49699	443	192.168.2.7	104.102.49.254
Oct 11, 2024 12:45:05.475941896 CEST	49699	443	192.168.2.7	104.102.49.254
Oct 11, 2024 12:45:05.596034050 CEST	443	49699	104.102.49.254	192.168.2.7
Oct 11, 2024 12:45:05.596075058 CEST	443	49699	104.102.49.254	192.168.2.7
Oct 11, 2024 12:45:05.596111059 CEST	443	49699	104.102.49.254	192.168.2.7
Oct 11, 2024 12:45:05.596112967 CEST	49699	443	192.168.2.7	104.102.49.254
Oct 11, 2024 12:45:05.596172094 CEST	49699	443	192.168.2.7	104.102.49.254
Oct 11, 2024 12:45:05.701081991 CEST	49699	443	192.168.2.7	104.102.49.254
Oct 11, 2024 12:45:05.701119900 CEST	443	49699	104.102.49.254	192.168.2.7
Oct 11, 2024 12:45:05.701137066 CEST	49699	443	192.168.2.7	104.102.49.254
Oct 11, 2024 12:45:05.701143980 CEST	443	49699	104.102.49.254	192.168.2.7
Oct 11, 2024 12:45:05.971766949 CEST	49677	443	192.168.2.7	20.50.201.200
Oct 11, 2024 12:45:06.350976944 CEST	49677	443	192.168.2.7	20.50.201.200
Oct 11, 2024 12:45:06.768148899 CEST	49671	443	192.168.2.7	204.79.197.203
Oct 11, 2024 12:45:07.096355915 CEST	49677	443	192.168.2.7	20.50.201.200
Oct 11, 2024 12:45:08.596240997 CEST	49677	443	192.168.2.7	20.50.201.200
Oct 11, 2024 12:45:09.486881018 CEST	49674	443	192.168.2.7	104.98.116.138
Oct 11, 2024 12:45:09.486900091 CEST	49675	443	192.168.2.7	104.98.116.138
Oct 11, 2024 12:45:09.582082987 CEST	49672	443	192.168.2.7	104.98.116.138
Oct 11, 2024 12:45:11.580846071 CEST	49677	443	192.168.2.7	20.50.201.200
Oct 11, 2024 12:45:11.996468067 CEST	443	49698	104.98.116.138	192.168.2.7
Oct 11, 2024 12:45:11.996671915 CEST	49698	443	192.168.2.7	104.98.116.138
Oct 11, 2024 12:45:13.016916990 CEST	49707	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:13.017002106 CEST	443	49707	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:13.017096043 CEST	49707	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:13.017529011 CEST	49707	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:13.017560959 CEST	443	49707	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:13.674386024 CEST	443	49707	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:13.674496889 CEST	49707	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:13.677937031 CEST	49707	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:13.677974939 CEST	443	49707	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:13.678414106 CEST	443	49707	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:13.688136101 CEST	49707	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:13.735398054 CEST	443	49707	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:13.789433956 CEST	443	49707	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:13.789489031 CEST	443	49707	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:13.789534092 CEST	443	49707	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:13.789598942 CEST	49707	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:13.789598942 CEST	49707	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:13.789649010 CEST	443	49707	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:13.789724112 CEST	49707	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:13.872569084 CEST	443	49707	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:13.872608900 CEST	443	49707	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:13.872807026 CEST	49707	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:13.872836113 CEST	443	49707	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:13.872889996 CEST	49707	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:13.873116970 CEST	443	49707	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:13.873135090 CEST	443	49707	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:13.873203993 CEST	49707	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:13.873210907 CEST	443	49707	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:13.873254061 CEST	49707	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:13.957957983 CEST	443	49707	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:13.957986116 CEST	443	49707	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:13.958189964 CEST	49707	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:13.958209038 CEST	443	49707	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:13.958225012 CEST	443	49707	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:13.958245039 CEST	443	49707	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:13.958388090 CEST	49707	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:13.958393097 CEST	443	49707	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:13.958430052 CEST	49707	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:13.958458900 CEST	49707	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:13.959320068 CEST	443	49707	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:13.959335089 CEST	443	49707	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:13.959422112 CEST	49707	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:13.959428072 CEST	443	49707	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:13.959475040 CEST	49707	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:13.959933043 CEST	443	49707	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:13.959947109 CEST	443	49707	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:13.960026026 CEST	49707	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:13.960031986 CEST	443	49707	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:13.960072994 CEST	49707	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:14.044420958 CEST	443	49707	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:14.044446945 CEST	443	49707	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:14.044512987 CEST	49707	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:14.044527054 CEST	443	49707	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:14.044581890 CEST	49707	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:14.045150995 CEST	443	49707	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:14.045166016 CEST	443	49707	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:14.045238018 CEST	49707	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:14.045244932 CEST	443	49707	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:14.045306921 CEST	49707	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:14.045808077 CEST	443	49707	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:14.045820951 CEST	443	49707	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:14.045902967 CEST	49707	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:14.045907974 CEST	443	49707	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:14.045977116 CEST	49707	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:14.046161890 CEST	443	49707	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:14.046180964 CEST	443	49707	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:14.046257973 CEST	49707	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:14.046262980 CEST	443	49707	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:14.046307087 CEST	49707	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:14.047027111 CEST	443	49707	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:14.047040939 CEST	443	49707	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:14.047142029 CEST	49707	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:14.047147036 CEST	443	49707	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:14.047189951 CEST	49707	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:14.047650099 CEST	443	49707	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:14.047665119 CEST	443	49707	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:14.047729969 CEST	49707	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:14.047735929 CEST	443	49707	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:14.047745943 CEST	443	49707	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:14.047806978 CEST	49707	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:14.047813892 CEST	443	49707	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:14.047823906 CEST	443	49707	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:14.047863960 CEST	49707	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:14.048062086 CEST	49707	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:14.048072100 CEST	443	49707	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:14.048088074 CEST	49707	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:14.048094988 CEST	443	49707	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:14.096065044 CEST	49708	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:14.096084118 CEST	443	49708	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:14.096174955 CEST	49708	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:14.098391056 CEST	49709	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:14.098437071 CEST	443	49709	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:14.098498106 CEST	49709	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:14.099617004 CEST	49710	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:14.099633932 CEST	443	49710	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:14.099699020 CEST	49710	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:14.100438118 CEST	49708	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:14.100454092 CEST	443	49708	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:14.101150990 CEST	49711	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:14.101161957 CEST	443	49711	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:14.101249933 CEST	49711	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:14.101696968 CEST	49709	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:14.101716995 CEST	443	49709	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:14.101816893 CEST	49710	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:14.101824999 CEST	443	49710	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:14.101886988 CEST	49711	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:14.101897001 CEST	443	49711	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:14.103015900 CEST	49712	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:14.103071928 CEST	443	49712	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:14.103147984 CEST	49712	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:14.103404045 CEST	49712	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:14.103410959 CEST	443	49712	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:16.377618074 CEST	49671	443	192.168.2.7	204.79.197.203
Oct 11, 2024 12:45:16.799750090 CEST	443	49711	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:16.800257921 CEST	49711	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:16.800280094 CEST	443	49711	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:16.800772905 CEST	49711	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:16.800777912 CEST	443	49711	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:16.802795887 CEST	443	49709	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:16.803067923 CEST	49709	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:16.803102970 CEST	443	49709	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:16.803414106 CEST	49709	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:16.803420067 CEST	443	49709	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:16.807322025 CEST	443	49712	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:16.807564974 CEST	49712	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:16.807575941 CEST	443	49712	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:16.807892084 CEST	49712	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:16.807898045 CEST	443	49712	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:16.809083939 CEST	443	49710	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:16.809087038 CEST	443	49708	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:16.809341908 CEST	49710	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:16.809354067 CEST	443	49710	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:16.809444904 CEST	49708	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:16.809459925 CEST	443	49708	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:16.809793949 CEST	49710	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:16.809797049 CEST	443	49710	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:16.809817076 CEST	49708	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:16.809822083 CEST	443	49708	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:16.899624109 CEST	443	49711	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:16.899646997 CEST	443	49711	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:16.899693012 CEST	443	49711	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:16.899699926 CEST	49711	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:16.899740934 CEST	49711	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:16.900018930 CEST	49711	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:16.900033951 CEST	443	49711	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:16.900048018 CEST	49711	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:16.900053024 CEST	443	49711	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:16.903209925 CEST	49714	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:16.903237104 CEST	443	49714	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:16.903307915 CEST	49714	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:16.903460979 CEST	49714	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:16.903467894 CEST	443	49714	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:16.904735088 CEST	443	49712	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:16.904795885 CEST	443	49712	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:16.904859066 CEST	49712	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:16.904964924 CEST	49712	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:16.904979944 CEST	443	49712	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:16.904993057 CEST	49712	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:16.904998064 CEST	443	49712	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:16.907026052 CEST	49715	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:16.907044888 CEST	443	49715	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:16.907114983 CEST	49715	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:16.907222033 CEST	49715	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:16.907229900 CEST	443	49715	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:16.908344030 CEST	443	49710	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:16.908379078 CEST	443	49710	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:16.908418894 CEST	49710	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:16.908442974 CEST	443	49710	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:16.908540964 CEST	49710	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:16.908551931 CEST	443	49710	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:16.908560991 CEST	49710	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:16.908714056 CEST	443	49710	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:16.908745050 CEST	443	49710	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:16.908802032 CEST	49710	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:16.910243034 CEST	49716	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:16.910311937 CEST	443	49716	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:16.910402060 CEST	49716	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:16.910507917 CEST	49716	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:16.910532951 CEST	443	49716	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:16.911102057 CEST	443	49709	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:16.911169052 CEST	443	49709	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:16.911211014 CEST	49709	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:16.911282063 CEST	49709	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:16.911294937 CEST	443	49709	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:16.911307096 CEST	49709	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:16.911312103 CEST	443	49709	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:16.911920071 CEST	443	49708	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:16.911947966 CEST	443	49708	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:16.911987066 CEST	49708	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:16.911997080 CEST	443	49708	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:16.912012100 CEST	443	49708	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:16.912034988 CEST	49708	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:16.912061930 CEST	49708	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:16.912187099 CEST	49708	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:16.912190914 CEST	443	49708	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:16.912209034 CEST	49708	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:16.912213087 CEST	443	49708	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:16.913219929 CEST	49717	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:16.913253069 CEST	443	49717	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:16.913305044 CEST	49717	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:16.913425922 CEST	49717	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:16.913435936 CEST	443	49717	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:16.913983107 CEST	49718	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:16.913990021 CEST	443	49718	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:16.914047956 CEST	49718	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:16.914177895 CEST	49718	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:16.914190054 CEST	443	49718	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:17.533999920 CEST	49677	443	192.168.2.7	20.50.201.200
Oct 11, 2024 12:45:17.541152000 CEST	443	49715	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:17.547377110 CEST	443	49718	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:17.548857927 CEST	49715	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:17.548868895 CEST	443	49715	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:17.549220085 CEST	443	49716	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:17.557737112 CEST	49715	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:17.557744026 CEST	443	49715	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:17.562365055 CEST	49718	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:17.562395096 CEST	443	49718	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:17.562787056 CEST	49718	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:17.562792063 CEST	443	49718	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:17.566943884 CEST	49716	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:17.566992998 CEST	443	49716	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:17.570374012 CEST	443	49717	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:17.571531057 CEST	49716	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:17.571544886 CEST	443	49716	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:17.572463989 CEST	443	49714	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:17.580051899 CEST	49717	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:17.580081940 CEST	443	49717	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:17.580630064 CEST	49717	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:17.580634117 CEST	443	49717	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:17.584764004 CEST	49714	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:17.584779978 CEST	443	49714	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:17.585314035 CEST	49714	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:17.585323095 CEST	443	49714	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:17.659430981 CEST	443	49718	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:17.659506083 CEST	443	49718	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:17.659687042 CEST	49718	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:17.660640955 CEST	443	49715	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:17.660801888 CEST	443	49715	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:17.660860062 CEST	49715	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:17.667423010 CEST	49718	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:17.667423964 CEST	49718	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:17.667475939 CEST	443	49718	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:17.667489052 CEST	443	49718	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:17.669214964 CEST	443	49716	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:17.669430971 CEST	443	49716	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:17.669504881 CEST	49716	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:17.672938108 CEST	49715	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:17.672938108 CEST	49715	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:17.672952890 CEST	443	49715	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:17.672960997 CEST	443	49715	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:17.673547983 CEST	49716	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:17.673547983 CEST	49716	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:17.673589945 CEST	443	49716	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:17.673614025 CEST	443	49716	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:17.676808119 CEST	49721	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:17.676848888 CEST	443	49721	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:17.676937103 CEST	49721	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:17.678479910 CEST	49722	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:17.678479910 CEST	49721	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:17.678491116 CEST	443	49722	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:17.678507090 CEST	443	49721	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:17.678592920 CEST	49722	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:17.678694963 CEST	49722	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:17.678703070 CEST	443	49722	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:17.684259892 CEST	443	49717	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:17.684416056 CEST	443	49717	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:17.684487104 CEST	49717	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:17.687925100 CEST	49723	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:17.687963009 CEST	443	49723	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:17.688033104 CEST	49723	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:17.688163996 CEST	49717	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:17.688177109 CEST	443	49717	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:17.695612907 CEST	49723	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:17.695641041 CEST	443	49723	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:17.696953058 CEST	49724	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:17.697040081 CEST	443	49724	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:17.697149992 CEST	49724	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:17.697253942 CEST	49724	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:17.697277069 CEST	443	49724	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:17.704675913 CEST	443	49714	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:17.704735041 CEST	443	49714	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:17.704792976 CEST	49714	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:17.704991102 CEST	49714	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:17.704991102 CEST	49714	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:17.705002069 CEST	443	49714	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:17.705009937 CEST	443	49714	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:17.708587885 CEST	49725	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:17.708683014 CEST	443	49725	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:17.708808899 CEST	49725	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:17.709059000 CEST	49725	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:17.709086895 CEST	443	49725	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:18.314445019 CEST	443	49721	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:18.315464973 CEST	49721	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:18.315490007 CEST	443	49721	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:18.316076040 CEST	49721	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:18.316082954 CEST	443	49721	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:18.321633101 CEST	443	49722	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:18.322252035 CEST	49722	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:18.322266102 CEST	443	49722	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:18.322948933 CEST	49722	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:18.322953939 CEST	443	49722	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:18.347904921 CEST	443	49723	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:18.348294973 CEST	49723	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:18.348324060 CEST	443	49723	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:18.348686934 CEST	49723	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:18.348694086 CEST	443	49723	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:18.381727934 CEST	443	49724	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:18.382481098 CEST	49724	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:18.382508039 CEST	443	49724	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:18.382837057 CEST	49724	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:18.382843971 CEST	443	49724	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:18.383573055 CEST	443	49725	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:18.384054899 CEST	49725	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:18.384092093 CEST	443	49725	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:18.384386063 CEST	49725	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:18.384393930 CEST	443	49725	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:18.414406061 CEST	443	49721	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:18.414473057 CEST	443	49721	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:18.414545059 CEST	49721	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:18.414832115 CEST	49721	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:18.414843082 CEST	443	49721	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:18.414855003 CEST	49721	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:18.414860010 CEST	443	49721	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:18.418425083 CEST	49726	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:18.418467045 CEST	443	49726	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:18.418541908 CEST	49726	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:18.418777943 CEST	49726	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:18.418792963 CEST	443	49726	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:18.422813892 CEST	443	49722	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:18.422871113 CEST	443	49722	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:18.422925949 CEST	49722	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:18.423088074 CEST	49722	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:18.423094034 CEST	443	49722	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:18.423154116 CEST	49722	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:18.423157930 CEST	443	49722	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:18.426412106 CEST	49727	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:18.426460028 CEST	443	49727	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:18.426537991 CEST	49727	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:18.427392006 CEST	49727	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:18.427403927 CEST	443	49727	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:18.448604107 CEST	443	49723	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:18.448687077 CEST	443	49723	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:18.448745012 CEST	49723	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:18.448975086 CEST	49723	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:18.448997974 CEST	443	49723	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:18.449012995 CEST	49723	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:18.449018955 CEST	443	49723	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:18.453134060 CEST	49728	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:18.453175068 CEST	443	49728	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:18.453238964 CEST	49728	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:18.454797983 CEST	49728	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:18.454818010 CEST	443	49728	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:18.487157106 CEST	443	49724	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:18.487215042 CEST	443	49724	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:18.487301111 CEST	49724	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:18.487622976 CEST	49724	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:18.487634897 CEST	443	49724	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:18.487658978 CEST	49724	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:18.487663984 CEST	443	49724	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:18.490628004 CEST	49729	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:18.490668058 CEST	443	49729	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:18.490770102 CEST	49729	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:18.490993977 CEST	49729	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:18.491003036 CEST	443	49729	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:18.492279053 CEST	443	49725	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:18.492321014 CEST	443	49725	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:18.492391109 CEST	49725	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:18.492510080 CEST	49725	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:18.492527962 CEST	443	49725	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:18.492541075 CEST	49725	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:18.492547035 CEST	443	49725	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:18.497766972 CEST	49730	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:18.497781038 CEST	443	49730	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:18.497865915 CEST	49730	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:18.498025894 CEST	49730	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:18.498033047 CEST	443	49730	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:19.068695068 CEST	443	49726	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:19.069824934 CEST	49726	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:19.069852114 CEST	443	49726	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:19.070581913 CEST	49726	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:19.070586920 CEST	443	49726	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:19.074146986 CEST	443	49727	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:19.074496984 CEST	49727	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:19.074568987 CEST	443	49727	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:19.074906111 CEST	49727	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:19.074922085 CEST	443	49727	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:19.136974096 CEST	443	49730	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:19.138221025 CEST	49730	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:19.138241053 CEST	443	49730	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:19.139497995 CEST	49730	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:19.139508963 CEST	443	49730	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:19.144939899 CEST	443	49728	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:19.145606041 CEST	443	49729	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:19.145637035 CEST	49728	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:19.145658970 CEST	443	49728	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:19.146382093 CEST	49728	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:19.146389961 CEST	443	49728	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:19.146931887 CEST	49729	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:19.146946907 CEST	443	49729	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:19.147422075 CEST	49729	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:19.147429943 CEST	443	49729	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:19.169480085 CEST	443	49726	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:19.169544935 CEST	443	49726	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:19.169606924 CEST	49726	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:19.169743061 CEST	49726	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:19.169764996 CEST	443	49726	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:19.169775009 CEST	49726	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:19.169780970 CEST	443	49726	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:19.173217058 CEST	49732	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:19.173304081 CEST	443	49732	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:19.173401117 CEST	49732	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:19.173532963 CEST	49732	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:19.173574924 CEST	443	49732	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:19.175487041 CEST	443	49727	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:19.175642014 CEST	443	49727	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:19.175717115 CEST	49727	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:19.175766945 CEST	49727	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:19.175766945 CEST	49727	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:19.175797939 CEST	443	49727	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:19.175821066 CEST	443	49727	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:19.178173065 CEST	49733	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:19.178205967 CEST	443	49733	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:19.178272963 CEST	49733	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:19.178498030 CEST	49733	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:19.178508043 CEST	443	49733	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:19.236597061 CEST	443	49730	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:19.236654043 CEST	443	49730	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:19.236942053 CEST	49730	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:19.237152100 CEST	49730	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:19.237170935 CEST	443	49730	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:19.237184048 CEST	49730	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:19.237194061 CEST	443	49730	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:19.240462065 CEST	49734	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:19.240498066 CEST	443	49734	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:19.240569115 CEST	49734	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:19.240793943 CEST	49734	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:19.240808964 CEST	443	49734	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:19.247282028 CEST	443	49729	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:19.247343063 CEST	443	49729	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:19.247399092 CEST	49729	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:19.247608900 CEST	49729	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:19.247620106 CEST	443	49729	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:19.247631073 CEST	49729	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:19.247637987 CEST	443	49729	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:19.248064041 CEST	443	49728	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:19.248136044 CEST	443	49728	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:19.248183012 CEST	49728	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:19.248260021 CEST	49728	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:19.248270988 CEST	443	49728	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:19.248281956 CEST	49728	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:19.248286009 CEST	443	49728	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:19.249789000 CEST	49735	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:19.249815941 CEST	443	49735	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:19.249902964 CEST	49735	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:19.250001907 CEST	49735	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:19.250013113 CEST	443	49735	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:19.250569105 CEST	49736	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:19.250596046 CEST	443	49736	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:19.250708103 CEST	49736	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:19.250842094 CEST	49736	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:19.250850916 CEST	443	49736	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:19.815526009 CEST	443	49733	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:19.816629887 CEST	49733	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:19.816649914 CEST	443	49733	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:19.830275059 CEST	49733	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:19.830301046 CEST	443	49733	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:19.839869022 CEST	443	49732	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:19.842010975 CEST	49732	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:19.842036963 CEST	443	49732	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:19.842400074 CEST	49732	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:19.842406034 CEST	443	49732	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:19.884125948 CEST	443	49735	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:19.902328968 CEST	49735	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:19.902348042 CEST	443	49735	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:19.902939081 CEST	49735	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:19.902942896 CEST	443	49735	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:19.909621000 CEST	443	49734	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:19.914743900 CEST	49734	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:19.914767981 CEST	443	49734	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:19.915327072 CEST	49734	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:19.915335894 CEST	443	49734	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:19.923820019 CEST	443	49736	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:19.925641060 CEST	443	49733	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:19.925782919 CEST	443	49733	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:19.925852060 CEST	49733	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:19.928318977 CEST	49736	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:19.928318977 CEST	49736	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:19.928333998 CEST	443	49736	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:19.928348064 CEST	443	49736	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:19.929140091 CEST	49733	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:19.929140091 CEST	49733	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:19.929184914 CEST	443	49733	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:19.929209948 CEST	443	49733	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:19.935334921 CEST	49739	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:19.935359001 CEST	443	49739	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:19.935441017 CEST	49739	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:19.936508894 CEST	49739	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:19.936527967 CEST	443	49739	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:19.946144104 CEST	443	49732	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:19.946199894 CEST	443	49732	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:19.946265936 CEST	49732	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:19.946434975 CEST	49732	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:19.946448088 CEST	443	49732	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:19.946459055 CEST	49732	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:19.946463108 CEST	443	49732	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:19.948231936 CEST	49740	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:19.948246956 CEST	443	49740	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:19.948299885 CEST	49740	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:19.948430061 CEST	49740	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:19.948437929 CEST	443	49740	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:19.998501062 CEST	443	49735	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:19.998651028 CEST	443	49735	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:19.998729944 CEST	49735	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:19.998903990 CEST	49735	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:19.998954058 CEST	443	49735	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:19.998985052 CEST	49735	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:19.999000072 CEST	443	49735	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:20.001946926 CEST	49741	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:20.002047062 CEST	443	49741	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:20.002161980 CEST	49741	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:20.002341986 CEST	49741	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:20.002377987 CEST	443	49741	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:20.014808893 CEST	443	49734	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:20.014868021 CEST	443	49734	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:20.014933109 CEST	49734	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:20.015100002 CEST	49734	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:20.015121937 CEST	443	49734	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:20.015136003 CEST	49734	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:20.015141964 CEST	443	49734	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:20.017894030 CEST	49742	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:20.017940044 CEST	443	49742	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:20.018198967 CEST	49742	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:20.018333912 CEST	49742	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:20.018372059 CEST	443	49742	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:20.029678106 CEST	443	49736	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:20.029851913 CEST	443	49736	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:20.029930115 CEST	49736	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:20.031917095 CEST	49736	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:20.031917095 CEST	49736	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:20.031938076 CEST	443	49736	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:20.031950951 CEST	443	49736	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:20.036638975 CEST	49743	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:20.036670923 CEST	443	49743	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:20.036762953 CEST	49743	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:20.036946058 CEST	49743	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:20.036961079 CEST	443	49743	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:20.573474884 CEST	443	49739	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:20.576924086 CEST	49739	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:20.576951981 CEST	443	49739	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:20.577373981 CEST	49739	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:20.577378035 CEST	443	49739	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:20.579160929 CEST	49698	443	192.168.2.7	104.98.116.138
Oct 11, 2024 12:45:20.583965063 CEST	443	49698	104.98.116.138	192.168.2.7
Oct 11, 2024 12:45:20.596971035 CEST	443	49740	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:20.604434013 CEST	49740	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:20.604494095 CEST	443	49740	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:20.604979038 CEST	49740	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:20.604993105 CEST	443	49740	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:20.614943027 CEST	49745	443	192.168.2.7	104.98.116.138
Oct 11, 2024 12:45:20.615036964 CEST	443	49745	104.98.116.138	192.168.2.7
Oct 11, 2024 12:45:20.615113974 CEST	49745	443	192.168.2.7	104.98.116.138
Oct 11, 2024 12:45:20.616223097 CEST	49745	443	192.168.2.7	104.98.116.138
Oct 11, 2024 12:45:20.616251945 CEST	443	49745	104.98.116.138	192.168.2.7
Oct 11, 2024 12:45:20.654990911 CEST	443	49742	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:20.657136917 CEST	49742	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:20.657152891 CEST	443	49742	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:20.657579899 CEST	49742	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:20.657583952 CEST	443	49742	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:20.665513992 CEST	443	49741	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:20.667937994 CEST	49741	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:20.667946100 CEST	443	49741	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:20.668622971 CEST	49741	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:20.668627024 CEST	443	49741	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:20.673130035 CEST	443	49739	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:20.673188925 CEST	443	49739	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:20.673234940 CEST	49739	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:20.674643040 CEST	49739	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:20.674643040 CEST	49739	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:20.674659014 CEST	443	49739	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:20.674671888 CEST	443	49739	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:20.689755917 CEST	49746	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:20.689802885 CEST	443	49746	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:20.689857006 CEST	49746	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:20.700548887 CEST	49746	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:20.700581074 CEST	443	49746	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:20.703336954 CEST	443	49743	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:20.703948021 CEST	443	49740	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:20.704021931 CEST	443	49740	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:20.704102039 CEST	49740	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:20.710412979 CEST	49743	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:20.710428953 CEST	443	49743	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:20.713915110 CEST	49743	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:20.713927984 CEST	443	49743	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:20.715038061 CEST	49740	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:20.715065956 CEST	443	49740	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:20.727210045 CEST	49747	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:20.727302074 CEST	443	49747	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:20.727561951 CEST	49747	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:20.727561951 CEST	49747	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:20.727638960 CEST	443	49747	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:20.759684086 CEST	443	49742	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:20.759746075 CEST	443	49742	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:20.759908915 CEST	49742	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:20.760056973 CEST	49742	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:20.760083914 CEST	443	49742	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:20.760097980 CEST	49742	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:20.760104895 CEST	443	49742	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:20.762582064 CEST	49748	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:20.762619972 CEST	443	49748	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:20.762690067 CEST	49748	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:20.762836933 CEST	49748	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:20.762841940 CEST	443	49748	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:20.768532991 CEST	443	49741	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:20.768594980 CEST	443	49741	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:20.768655062 CEST	49741	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:20.768754959 CEST	49741	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:20.768754959 CEST	49741	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:20.768774033 CEST	443	49741	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:20.768795967 CEST	443	49741	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:20.771612883 CEST	49749	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:20.771655083 CEST	443	49749	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:20.771713018 CEST	49749	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:20.772089958 CEST	49749	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:20.772104025 CEST	443	49749	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:20.812937021 CEST	443	49743	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:20.813018084 CEST	443	49743	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:20.813144922 CEST	49743	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:20.813222885 CEST	49743	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:20.813240051 CEST	443	49743	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:20.813278913 CEST	49743	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:20.813283920 CEST	443	49743	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:20.816466093 CEST	49750	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:20.816509962 CEST	443	49750	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:20.816567898 CEST	49750	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:20.816761971 CEST	49750	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:20.816772938 CEST	443	49750	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:21.348839045 CEST	443	49746	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:21.351341009 CEST	49746	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:21.351358891 CEST	443	49746	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:21.352478981 CEST	49746	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:21.352483034 CEST	443	49746	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:21.394146919 CEST	443	49747	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:21.394635916 CEST	49747	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:21.394660950 CEST	443	49747	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:21.395127058 CEST	49747	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:21.395133018 CEST	443	49747	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:21.423949003 CEST	443	49748	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:21.424555063 CEST	49748	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:21.424572945 CEST	443	49748	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:21.425163984 CEST	49748	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:21.425168991 CEST	443	49748	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:21.432986975 CEST	443	49749	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:21.433378935 CEST	49749	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:21.433393002 CEST	443	49749	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:21.433871984 CEST	49749	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:21.433876038 CEST	443	49749	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:21.450229883 CEST	443	49746	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:21.450297117 CEST	443	49746	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:21.450365067 CEST	49746	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:21.450505972 CEST	49746	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:21.450551987 CEST	443	49746	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:21.450582027 CEST	49746	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:21.450598955 CEST	443	49746	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:21.454190969 CEST	443	49750	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:21.454543114 CEST	49751	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:21.454571009 CEST	443	49751	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:21.454629898 CEST	49751	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:21.454971075 CEST	49751	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:21.454984903 CEST	443	49751	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:21.455549002 CEST	49750	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:21.455600977 CEST	443	49750	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:21.456156015 CEST	49750	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:21.456168890 CEST	443	49750	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:21.498210907 CEST	443	49747	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:21.498295069 CEST	443	49747	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:21.498348951 CEST	49747	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:21.498763084 CEST	49747	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:21.498780966 CEST	443	49747	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:21.498795986 CEST	49747	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:21.498802900 CEST	443	49747	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:21.503207922 CEST	49752	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:21.503258944 CEST	443	49752	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:21.503333092 CEST	49752	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:21.503509045 CEST	49752	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:21.503521919 CEST	443	49752	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:21.527301073 CEST	443	49748	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:21.527362108 CEST	443	49748	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:21.527405024 CEST	49748	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:21.527621984 CEST	49748	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:21.527642012 CEST	443	49748	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:21.527657032 CEST	49748	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:21.527662992 CEST	443	49748	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:21.532428026 CEST	49753	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:21.532469988 CEST	443	49753	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:21.532524109 CEST	49753	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:21.532933950 CEST	49753	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:21.532948017 CEST	443	49753	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:21.538064957 CEST	443	49749	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:21.538125038 CEST	443	49749	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:21.538168907 CEST	49749	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:21.538822889 CEST	49749	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:21.538835049 CEST	443	49749	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:21.538851976 CEST	49749	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:21.538856983 CEST	443	49749	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:21.541855097 CEST	49754	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:21.541866064 CEST	443	49754	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:21.541913986 CEST	49754	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:21.542088032 CEST	49754	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:21.542095900 CEST	443	49754	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:21.569087982 CEST	443	49750	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:21.569261074 CEST	443	49750	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:21.569323063 CEST	49750	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:21.569590092 CEST	49750	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:21.569612980 CEST	443	49750	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:21.569636106 CEST	49750	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:21.569648027 CEST	443	49750	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:21.574029922 CEST	49755	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:21.574119091 CEST	443	49755	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:21.574208021 CEST	49755	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:21.574346066 CEST	49755	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:21.574381113 CEST	443	49755	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:22.105760098 CEST	443	49751	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:22.106839895 CEST	49751	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:22.106861115 CEST	443	49751	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:22.107403040 CEST	49751	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:22.107407093 CEST	443	49751	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:22.166270018 CEST	443	49752	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:22.167108059 CEST	49752	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:22.167145967 CEST	443	49752	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:22.167659044 CEST	49752	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:22.167665005 CEST	443	49752	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:22.178603888 CEST	443	49753	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:22.179013014 CEST	49753	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:22.179055929 CEST	443	49753	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:22.179945946 CEST	49753	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:22.179960012 CEST	443	49753	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:22.202512980 CEST	443	49754	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:22.203071117 CEST	49754	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:22.203093052 CEST	443	49754	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:22.205488920 CEST	443	49751	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:22.205523968 CEST	49754	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:22.205532074 CEST	443	49754	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:22.205549955 CEST	443	49751	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:22.205779076 CEST	49751	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:22.205832958 CEST	49751	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:22.205832958 CEST	49751	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:22.205847979 CEST	443	49751	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:22.205857038 CEST	443	49751	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:22.211402893 CEST	49756	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:22.211425066 CEST	443	49756	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:22.211719990 CEST	49756	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:22.211719990 CEST	49756	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:22.211786985 CEST	443	49756	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:22.237032890 CEST	443	49755	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:22.240122080 CEST	49755	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:22.240122080 CEST	49755	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:22.240155935 CEST	443	49755	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:22.240175962 CEST	443	49755	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:22.279958963 CEST	443	49753	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:22.280014038 CEST	443	49753	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:22.280344009 CEST	49753	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:22.280344009 CEST	49753	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:22.283102036 CEST	49753	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:22.283123970 CEST	443	49753	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:22.283565044 CEST	49757	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:22.283602953 CEST	443	49757	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:22.287096977 CEST	49757	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:22.287096977 CEST	49757	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:22.287128925 CEST	443	49757	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:22.302350998 CEST	443	49752	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:22.302409887 CEST	443	49752	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:22.302498102 CEST	49752	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:22.302726030 CEST	49752	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:22.302726030 CEST	49752	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:22.302742958 CEST	443	49752	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:22.302753925 CEST	443	49752	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:22.306224108 CEST	443	49754	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:22.306315899 CEST	49758	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:22.306349039 CEST	443	49758	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:22.306369066 CEST	443	49754	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:22.306441069 CEST	49754	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:22.306448936 CEST	49758	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:22.306543112 CEST	49754	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:22.306543112 CEST	49754	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:22.306556940 CEST	443	49754	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:22.306570053 CEST	443	49754	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:22.307137012 CEST	49758	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:22.307147980 CEST	443	49758	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:22.311134100 CEST	49759	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:22.311208010 CEST	443	49759	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:22.312823057 CEST	49759	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:22.312823057 CEST	49759	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:22.312851906 CEST	443	49759	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:22.340682983 CEST	443	49755	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:22.340837002 CEST	443	49755	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:22.341041088 CEST	49755	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:22.341041088 CEST	49755	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:22.341159105 CEST	49755	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:22.341178894 CEST	443	49755	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:22.344454050 CEST	49760	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:22.344475031 CEST	443	49760	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:22.344593048 CEST	49760	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:22.344746113 CEST	49760	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:22.344755888 CEST	443	49760	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:22.863301039 CEST	443	49756	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:22.863939047 CEST	49756	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:22.863950968 CEST	443	49756	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:22.864598036 CEST	49756	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:22.864605904 CEST	443	49756	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:22.947932959 CEST	443	49757	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:22.949142933 CEST	49757	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:22.949142933 CEST	49757	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:22.949171066 CEST	443	49757	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:22.949188948 CEST	443	49757	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:22.954994917 CEST	443	49758	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:22.957300901 CEST	49758	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:22.957300901 CEST	49758	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:22.957310915 CEST	443	49758	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:22.957326889 CEST	443	49758	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:22.957637072 CEST	443	49759	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:22.958008051 CEST	49759	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:22.958017111 CEST	443	49759	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:22.958452940 CEST	49759	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:22.958457947 CEST	443	49759	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:22.963021994 CEST	443	49756	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:22.963082075 CEST	443	49756	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:22.963140011 CEST	49756	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:22.963300943 CEST	49756	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:22.963315010 CEST	443	49756	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:22.963325024 CEST	49756	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:22.963330984 CEST	443	49756	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:22.967096090 CEST	49761	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:22.967135906 CEST	443	49761	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:22.967420101 CEST	49761	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:22.967421055 CEST	49761	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:22.967453003 CEST	443	49761	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:22.981827021 CEST	443	49760	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:22.982264996 CEST	49760	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:22.982270002 CEST	443	49760	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:22.982726097 CEST	49760	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:22.982729912 CEST	443	49760	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:23.054941893 CEST	443	49757	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:23.055011988 CEST	443	49757	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:23.055094957 CEST	49757	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:23.055439949 CEST	49757	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:23.055459023 CEST	443	49757	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:23.055818081 CEST	49757	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:23.055829048 CEST	443	49757	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:23.058610916 CEST	49762	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:23.058610916 CEST	443	49758	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:23.058641911 CEST	443	49762	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:23.058686018 CEST	443	49758	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:23.058701992 CEST	49762	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:23.058744907 CEST	49758	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:23.058800936 CEST	443	49759	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:23.058912992 CEST	49762	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:23.058933020 CEST	443	49762	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:23.058968067 CEST	443	49759	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:23.059016943 CEST	49759	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:23.059102058 CEST	49758	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:23.059102058 CEST	49758	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:23.059108019 CEST	443	49758	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:23.059114933 CEST	443	49758	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:23.059248924 CEST	49759	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:23.059262991 CEST	443	49759	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:23.059274912 CEST	49759	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:23.059279919 CEST	443	49759	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:23.061785936 CEST	49763	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:23.061801910 CEST	443	49763	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:23.061858892 CEST	49764	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:23.061897039 CEST	49763	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:23.061897993 CEST	443	49764	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:23.061956882 CEST	49764	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:23.062028885 CEST	49763	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:23.062038898 CEST	443	49763	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:23.062114000 CEST	49764	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:23.062120914 CEST	443	49764	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:23.080954075 CEST	443	49760	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:23.081022024 CEST	443	49760	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:23.083117962 CEST	49760	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:23.083117962 CEST	49760	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:23.083117962 CEST	49760	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:23.084292889 CEST	49765	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:23.084321976 CEST	443	49765	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:23.084407091 CEST	49765	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:23.084574938 CEST	49765	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:23.084599018 CEST	443	49765	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:23.393246889 CEST	49760	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:23.393268108 CEST	443	49760	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:23.616233110 CEST	443	49761	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:23.617319107 CEST	49761	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:23.617336035 CEST	443	49761	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:23.617830992 CEST	49761	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:23.617835999 CEST	443	49761	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:23.701519966 CEST	443	49764	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:23.703425884 CEST	443	49763	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:23.703687906 CEST	49764	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:23.703731060 CEST	443	49764	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:23.704332113 CEST	49764	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:23.704344034 CEST	443	49764	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:23.704869986 CEST	49763	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:23.704891920 CEST	443	49763	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:23.705377102 CEST	49763	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:23.705383062 CEST	443	49763	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:23.717308998 CEST	443	49761	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:23.717369080 CEST	443	49761	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:23.717675924 CEST	49761	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:23.717675924 CEST	49761	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:23.717736006 CEST	49761	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:23.717747927 CEST	443	49761	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:23.721484900 CEST	49766	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:23.721539974 CEST	443	49766	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:23.721682072 CEST	49766	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:23.721860886 CEST	49766	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:23.721889973 CEST	443	49766	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:23.724123955 CEST	443	49765	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:23.724586964 CEST	49765	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:23.724601984 CEST	443	49765	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:23.727123022 CEST	49765	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:23.727133036 CEST	443	49765	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:23.733409882 CEST	443	49762	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:23.734067917 CEST	49762	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:23.734082937 CEST	443	49762	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:23.734441996 CEST	49762	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:23.734446049 CEST	443	49762	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:23.800074100 CEST	443	49764	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:23.800218105 CEST	443	49764	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:23.800689936 CEST	49764	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:23.800745964 CEST	49764	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:23.800772905 CEST	443	49764	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:23.800813913 CEST	49764	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:23.800829887 CEST	443	49764	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:23.801678896 CEST	443	49763	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:23.801831007 CEST	443	49763	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:23.801979065 CEST	49763	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:23.802248001 CEST	49763	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:23.802248001 CEST	49763	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:23.802263021 CEST	443	49763	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:23.802270889 CEST	443	49763	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:23.805038929 CEST	49767	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:23.805079937 CEST	443	49767	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:23.805213928 CEST	49767	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:23.805530071 CEST	49767	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:23.805560112 CEST	443	49767	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:23.805880070 CEST	49768	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:23.805912018 CEST	443	49768	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:23.806009054 CEST	49768	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:23.806143045 CEST	49768	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:23.806154013 CEST	443	49768	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:23.822515965 CEST	443	49765	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:23.822688103 CEST	443	49765	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:23.823251963 CEST	49765	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:23.823365927 CEST	49765	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:23.823367119 CEST	49765	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:23.823431015 CEST	443	49765	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:23.823458910 CEST	443	49765	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:23.825959921 CEST	49769	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:23.825995922 CEST	443	49769	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:23.826141119 CEST	49769	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:23.826251030 CEST	49769	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:23.826261997 CEST	443	49769	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:23.838757992 CEST	443	49762	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:23.838810921 CEST	443	49762	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:23.839008093 CEST	49762	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:23.839008093 CEST	49762	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:23.839107037 CEST	49762	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:23.839121103 CEST	443	49762	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:23.841347933 CEST	49770	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:23.841377974 CEST	443	49770	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:23.841613054 CEST	49770	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:23.841767073 CEST	49770	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:23.841779947 CEST	443	49770	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:24.358077049 CEST	443	49766	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:24.359119892 CEST	49766	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:24.359146118 CEST	443	49766	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:24.359707117 CEST	49766	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:24.359711885 CEST	443	49766	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:24.446008921 CEST	443	49768	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:24.447113037 CEST	49768	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:24.447130919 CEST	443	49768	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:24.447299957 CEST	49768	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:24.447304964 CEST	443	49768	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:24.459260941 CEST	443	49766	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:24.459332943 CEST	443	49766	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:24.459935904 CEST	49766	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:24.459969997 CEST	49766	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:24.459969997 CEST	49766	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:24.459988117 CEST	443	49766	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:24.459996939 CEST	443	49766	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:24.463116884 CEST	49771	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:24.463156939 CEST	443	49771	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:24.463323116 CEST	49771	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:24.463412046 CEST	49771	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:24.463424921 CEST	443	49771	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:24.475277901 CEST	443	49769	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:24.475632906 CEST	443	49767	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:24.475936890 CEST	49769	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:24.475964069 CEST	443	49769	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:24.476543903 CEST	49769	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:24.476547956 CEST	49767	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:24.476550102 CEST	443	49769	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:24.476573944 CEST	443	49767	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:24.476773024 CEST	49767	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:24.476779938 CEST	443	49767	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:24.514941931 CEST	443	49770	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:24.515639067 CEST	49770	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:24.515667915 CEST	443	49770	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:24.516916037 CEST	49770	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:24.516927958 CEST	443	49770	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:24.546987057 CEST	443	49768	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:24.547154903 CEST	443	49768	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:24.547316074 CEST	49768	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:24.547457933 CEST	49768	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:24.547475100 CEST	443	49768	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:24.548361063 CEST	49768	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:24.548368931 CEST	443	49768	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:24.551636934 CEST	49772	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:24.551685095 CEST	443	49772	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:24.555197001 CEST	49772	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:24.555531979 CEST	49772	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:24.555546999 CEST	443	49772	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:24.577702045 CEST	443	49769	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:24.577769041 CEST	443	49769	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:24.577846050 CEST	49769	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:24.578078032 CEST	49769	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:24.578078032 CEST	49769	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:24.578099012 CEST	443	49769	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:24.578111887 CEST	443	49769	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:24.579541922 CEST	443	49767	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:24.579582930 CEST	443	49767	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:24.579632044 CEST	49767	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:24.579848051 CEST	49767	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:24.579864025 CEST	443	49767	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:24.579876900 CEST	49767	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:24.579883099 CEST	443	49767	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:24.581568956 CEST	49773	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:24.581608057 CEST	443	49773	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:24.581685066 CEST	49773	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:24.582014084 CEST	49773	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:24.582026005 CEST	443	49773	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:24.582055092 CEST	49774	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:24.582062006 CEST	443	49774	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:24.582118988 CEST	49774	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:24.582214117 CEST	49774	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:24.582221985 CEST	443	49774	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:24.622176886 CEST	443	49770	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:24.622236967 CEST	443	49770	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:24.622410059 CEST	49770	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:24.622526884 CEST	49770	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:24.622538090 CEST	443	49770	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:24.622553110 CEST	49770	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:24.622558117 CEST	443	49770	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:24.625343084 CEST	49775	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:24.625377893 CEST	443	49775	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:24.625560999 CEST	49775	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:24.625719070 CEST	49775	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:24.625730038 CEST	443	49775	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:25.114135027 CEST	443	49771	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:25.115084887 CEST	49771	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:25.115104914 CEST	443	49771	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:25.115624905 CEST	49771	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:25.115628958 CEST	443	49771	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:25.191874027 CEST	443	49772	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:25.192382097 CEST	49772	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:25.192403078 CEST	443	49772	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:25.192835093 CEST	49772	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:25.192838907 CEST	443	49772	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:25.217720985 CEST	443	49771	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:25.217782974 CEST	443	49771	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:25.217834949 CEST	49771	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:25.217988968 CEST	49771	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:25.218003035 CEST	443	49771	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:25.218054056 CEST	49771	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:25.218059063 CEST	443	49771	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:25.220350027 CEST	443	49774	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:25.220815897 CEST	49774	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:25.220846891 CEST	443	49774	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:25.220995903 CEST	49776	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:25.221035957 CEST	443	49776	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:25.221095085 CEST	49776	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:25.221235037 CEST	49774	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:25.221240997 CEST	443	49774	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:25.221410036 CEST	49776	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:25.221421003 CEST	443	49776	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:25.225950003 CEST	443	49773	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:25.226393938 CEST	49773	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:25.226417065 CEST	443	49773	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:25.226831913 CEST	49773	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:25.226836920 CEST	443	49773	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:25.261781931 CEST	443	49775	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:25.262141943 CEST	49775	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:25.262208939 CEST	443	49775	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:25.262526989 CEST	49775	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:25.262542009 CEST	443	49775	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:25.293103933 CEST	443	49772	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:25.293256044 CEST	443	49772	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:25.293325901 CEST	49772	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:25.293380022 CEST	49772	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:25.293380022 CEST	49772	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:25.293416023 CEST	443	49772	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:25.293437958 CEST	443	49772	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:25.295736074 CEST	49777	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:25.295809031 CEST	443	49777	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:25.295892954 CEST	49777	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:25.296011925 CEST	49777	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:25.296031952 CEST	443	49777	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:25.323611021 CEST	443	49774	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:25.323760033 CEST	443	49774	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:25.323916912 CEST	49774	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:25.323918104 CEST	49774	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:25.323918104 CEST	49774	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:25.325042963 CEST	443	49773	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:25.325196981 CEST	443	49773	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:25.325373888 CEST	49773	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:25.325624943 CEST	49773	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:25.325624943 CEST	49773	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:25.325669050 CEST	443	49773	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:25.325695992 CEST	443	49773	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:25.326257944 CEST	49778	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:25.326311111 CEST	443	49778	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:25.326416969 CEST	49778	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:25.327080965 CEST	49778	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:25.327117920 CEST	443	49778	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:25.327565908 CEST	49779	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:25.327661037 CEST	443	49779	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:25.327739000 CEST	49779	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:25.327860117 CEST	49779	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:25.327888966 CEST	443	49779	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:25.361862898 CEST	443	49775	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:25.361923933 CEST	443	49775	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:25.362062931 CEST	49775	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:25.362195015 CEST	49775	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:25.362195015 CEST	49775	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:25.362225056 CEST	443	49775	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:25.362250090 CEST	443	49775	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:25.364011049 CEST	49780	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:25.364049911 CEST	443	49780	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:25.364104033 CEST	49780	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:25.364202976 CEST	49780	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:25.364217043 CEST	443	49780	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:25.627614975 CEST	49774	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:25.627650023 CEST	443	49774	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:25.852229118 CEST	443	49776	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:25.852900982 CEST	49776	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:25.852931976 CEST	443	49776	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:25.853508949 CEST	49776	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:25.853513956 CEST	443	49776	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:25.932347059 CEST	443	49777	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:25.933041096 CEST	49777	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:25.933062077 CEST	443	49777	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:25.933640957 CEST	49777	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:25.933646917 CEST	443	49777	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:25.951598883 CEST	443	49776	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:25.951669931 CEST	443	49776	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:25.951723099 CEST	49776	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:25.951883078 CEST	49776	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:25.951900005 CEST	443	49776	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:25.951919079 CEST	49776	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:25.951925039 CEST	443	49776	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:25.954902887 CEST	49781	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:25.954936028 CEST	443	49781	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:25.955060959 CEST	49781	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:25.955214024 CEST	49781	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:25.955225945 CEST	443	49781	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:25.958641052 CEST	443	49778	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:25.959117889 CEST	49778	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:25.959141016 CEST	443	49778	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:25.959731102 CEST	49778	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:25.959736109 CEST	443	49778	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:25.961714029 CEST	443	49779	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:25.962168932 CEST	49779	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:25.962177992 CEST	443	49779	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:25.962697029 CEST	49779	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:25.962699890 CEST	443	49779	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:26.003405094 CEST	443	49780	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:26.003912926 CEST	49780	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:26.003957987 CEST	443	49780	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:26.004345894 CEST	49780	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:26.004352093 CEST	443	49780	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:26.031492949 CEST	443	49777	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:26.031562090 CEST	443	49777	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:26.031614065 CEST	49777	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:26.031815052 CEST	49777	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:26.031833887 CEST	443	49777	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:26.031845093 CEST	49777	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:26.031852007 CEST	443	49777	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:26.035449028 CEST	49782	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:26.035485029 CEST	443	49782	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:26.035932064 CEST	49782	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:26.036115885 CEST	49782	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:26.036128044 CEST	443	49782	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:26.057961941 CEST	443	49778	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:26.058048964 CEST	443	49778	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:26.058105946 CEST	49778	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:26.058226109 CEST	49778	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:26.058233976 CEST	443	49778	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:26.058264971 CEST	49778	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:26.058269024 CEST	443	49778	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:26.060825109 CEST	443	49779	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:26.060898066 CEST	443	49779	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:26.061021090 CEST	49779	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:26.061184883 CEST	49779	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:26.061207056 CEST	443	49779	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:26.061218977 CEST	49779	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:26.061224937 CEST	443	49779	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:26.061245918 CEST	49783	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:26.061295033 CEST	443	49783	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:26.061372995 CEST	49783	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:26.061685085 CEST	49783	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:26.061700106 CEST	443	49783	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:26.063877106 CEST	49784	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:26.063915014 CEST	443	49784	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:26.063990116 CEST	49784	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:26.064291000 CEST	49784	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:26.064307928 CEST	443	49784	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:26.103795052 CEST	443	49780	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:26.103857040 CEST	443	49780	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:26.104038000 CEST	49780	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:26.104080915 CEST	49780	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:26.104082108 CEST	49780	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:26.104099989 CEST	443	49780	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:26.104109049 CEST	443	49780	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:26.107404947 CEST	49785	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:26.107510090 CEST	443	49785	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:26.107636929 CEST	49785	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:26.107834101 CEST	49785	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:26.107871056 CEST	443	49785	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:26.585577011 CEST	443	49781	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:26.587683916 CEST	49781	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:26.587707043 CEST	443	49781	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:26.588335991 CEST	49781	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:26.588346958 CEST	443	49781	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:26.686588049 CEST	443	49781	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:26.686743975 CEST	443	49781	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:26.686845064 CEST	49781	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:26.687089920 CEST	49781	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:26.687134981 CEST	443	49781	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:26.687166929 CEST	49781	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:26.687177896 CEST	443	49781	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:26.690541029 CEST	49786	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:26.690620899 CEST	443	49786	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:26.690721035 CEST	49786	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:26.690963030 CEST	443	49782	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:26.690975904 CEST	49786	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:26.691006899 CEST	443	49786	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:26.691417933 CEST	49782	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:26.691438913 CEST	443	49782	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:26.691999912 CEST	49782	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:26.692012072 CEST	443	49782	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:26.732090950 CEST	443	49783	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:26.735603094 CEST	49783	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:26.735641003 CEST	443	49783	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:26.736172915 CEST	49783	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:26.736180067 CEST	443	49783	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:26.741612911 CEST	443	49784	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:26.743774891 CEST	49784	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:26.743864059 CEST	443	49784	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:26.744196892 CEST	49784	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:26.744213104 CEST	443	49784	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:26.771946907 CEST	443	49785	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:26.775532961 CEST	49785	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:26.775578022 CEST	443	49785	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:26.776093960 CEST	49785	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:26.776107073 CEST	443	49785	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:26.791901112 CEST	443	49782	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:26.792051077 CEST	443	49782	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:26.792169094 CEST	49782	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:26.792435884 CEST	49782	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:26.792476892 CEST	443	49782	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:26.792505026 CEST	49782	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:26.792521000 CEST	443	49782	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:26.795399904 CEST	49787	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:26.795497894 CEST	443	49787	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:26.795603037 CEST	49787	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:26.795895100 CEST	49787	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:26.795932055 CEST	443	49787	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:26.836889982 CEST	443	49783	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:26.837038040 CEST	443	49783	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:26.837122917 CEST	49783	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:26.837392092 CEST	49783	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:26.837413073 CEST	443	49783	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:26.837421894 CEST	49783	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:26.837426901 CEST	443	49783	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:26.840564966 CEST	49788	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:26.840615034 CEST	443	49788	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:26.840704918 CEST	49788	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:26.840873003 CEST	49788	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:26.840892076 CEST	443	49788	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:26.846486092 CEST	443	49784	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:26.846633911 CEST	443	49784	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:26.846731901 CEST	49784	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:26.846900940 CEST	49784	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:26.846900940 CEST	49784	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:26.846946955 CEST	443	49784	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:26.846973896 CEST	443	49784	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:26.849437952 CEST	49789	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:26.849472046 CEST	443	49789	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:26.849558115 CEST	49789	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:26.849694967 CEST	49789	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:26.849703074 CEST	443	49789	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:26.876538038 CEST	443	49785	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:26.876609087 CEST	443	49785	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:26.876732111 CEST	49785	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:26.876902103 CEST	49785	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:26.876938105 CEST	443	49785	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:26.876966953 CEST	49785	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:26.876981974 CEST	443	49785	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:26.879441977 CEST	49790	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:26.879456997 CEST	443	49790	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:26.879549026 CEST	49790	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:26.879695892 CEST	49790	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:26.879707098 CEST	443	49790	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:27.354160070 CEST	443	49786	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:27.354800940 CEST	49786	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:27.354870081 CEST	443	49786	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:27.355253935 CEST	49786	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:27.355266094 CEST	443	49786	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:27.455245972 CEST	443	49786	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:27.455311060 CEST	443	49786	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:27.455404997 CEST	49786	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:27.455559015 CEST	49786	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:27.455574036 CEST	443	49786	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:27.455584049 CEST	49786	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:27.455589056 CEST	443	49786	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:27.458306074 CEST	49791	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:27.458348036 CEST	443	49791	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:27.458445072 CEST	49791	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:27.458574057 CEST	49791	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:27.458586931 CEST	443	49791	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:27.464217901 CEST	443	49787	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:27.467475891 CEST	49787	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:27.467554092 CEST	443	49787	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:27.468036890 CEST	49787	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:27.468041897 CEST	443	49787	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:27.478456974 CEST	443	49788	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:27.483469963 CEST	49788	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:27.483494043 CEST	443	49788	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:27.484018087 CEST	49788	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:27.484021902 CEST	443	49788	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:27.519989967 CEST	443	49789	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:27.532219887 CEST	49789	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:27.532247066 CEST	443	49789	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:27.532819986 CEST	49789	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:27.532825947 CEST	443	49789	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:27.548084974 CEST	443	49790	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:27.549679995 CEST	49790	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:27.549696922 CEST	443	49790	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:27.550267935 CEST	49790	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:27.550273895 CEST	443	49790	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:27.570467949 CEST	443	49787	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:27.570578098 CEST	443	49787	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:27.570688009 CEST	49787	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:27.570833921 CEST	49787	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:27.570833921 CEST	49787	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:27.570873022 CEST	443	49787	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:27.570897102 CEST	443	49787	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:27.573874950 CEST	49792	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:27.573909998 CEST	443	49792	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:27.574002981 CEST	49792	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:27.574198961 CEST	49792	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:27.574218035 CEST	443	49792	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:27.579683065 CEST	443	49788	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:27.579829931 CEST	443	49788	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:27.579893112 CEST	49788	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:27.580048084 CEST	49788	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:27.580065012 CEST	443	49788	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:27.580077887 CEST	49788	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:27.580084085 CEST	443	49788	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:27.582554102 CEST	49793	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:27.582597971 CEST	443	49793	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:27.582670927 CEST	49793	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:27.582964897 CEST	49793	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:27.582978964 CEST	443	49793	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:27.631728888 CEST	443	49789	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:27.631885052 CEST	443	49789	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:27.631939888 CEST	49789	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:27.631968975 CEST	49789	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:27.631987095 CEST	443	49789	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:27.631999016 CEST	49789	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:27.632004023 CEST	443	49789	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:27.634792089 CEST	49794	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:27.634830952 CEST	443	49794	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:27.634903908 CEST	49794	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:27.635251999 CEST	49794	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:27.635267019 CEST	443	49794	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:27.663866997 CEST	443	49790	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:27.663930893 CEST	443	49790	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:27.663989067 CEST	49790	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:27.664140940 CEST	49790	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:27.664150953 CEST	443	49790	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:27.664161921 CEST	49790	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:27.664165974 CEST	443	49790	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:27.666709900 CEST	49795	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:27.666735888 CEST	443	49795	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:27.666970015 CEST	49795	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:27.667202950 CEST	49795	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:27.667212009 CEST	443	49795	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:28.146298885 CEST	443	49791	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:28.151226997 CEST	49791	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:28.151257038 CEST	443	49791	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:28.152587891 CEST	49791	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:28.152592897 CEST	443	49791	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:28.225090981 CEST	443	49793	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:28.225759983 CEST	49793	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:28.225790024 CEST	443	49793	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:28.226202965 CEST	49793	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:28.226211071 CEST	443	49793	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:28.235178947 CEST	443	49792	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:28.235687017 CEST	49792	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:28.235701084 CEST	443	49792	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:28.236387014 CEST	49792	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:28.236391068 CEST	443	49792	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:28.248622894 CEST	443	49791	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:28.248645067 CEST	443	49791	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:28.248702049 CEST	49791	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:28.248730898 CEST	443	49791	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:28.248867035 CEST	49791	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:28.248876095 CEST	443	49791	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:28.248891115 CEST	49791	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:28.248904943 CEST	443	49791	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:28.253762960 CEST	49796	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:28.253810883 CEST	443	49796	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:28.253879070 CEST	49796	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:28.253983974 CEST	49796	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:28.253997087 CEST	443	49796	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:28.297799110 CEST	443	49794	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:28.298459053 CEST	49794	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:28.298480988 CEST	443	49794	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:28.298906088 CEST	49794	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:28.298911095 CEST	443	49794	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:28.300996065 CEST	443	49795	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:28.301342010 CEST	49795	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:28.301354885 CEST	443	49795	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:28.301707983 CEST	49795	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:28.301712036 CEST	443	49795	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:28.325942993 CEST	443	49793	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:28.326088905 CEST	443	49793	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:28.326169968 CEST	49793	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:28.326214075 CEST	49793	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:28.326231956 CEST	443	49793	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:28.326241970 CEST	49793	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:28.326246977 CEST	443	49793	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:28.328845978 CEST	49797	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:28.328891993 CEST	443	49797	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:28.328979969 CEST	49797	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:28.329134941 CEST	49797	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:28.329152107 CEST	443	49797	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:28.339575052 CEST	443	49792	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:28.339636087 CEST	443	49792	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:28.339684010 CEST	49792	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:28.339823961 CEST	49792	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:28.339839935 CEST	443	49792	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:28.339854956 CEST	49792	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:28.339860916 CEST	443	49792	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:28.342363119 CEST	49798	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:28.342379093 CEST	443	49798	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:28.342473984 CEST	49798	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:28.342641115 CEST	49798	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:28.342648983 CEST	443	49798	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:28.407424927 CEST	443	49794	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:28.407447100 CEST	443	49794	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:28.407519102 CEST	443	49794	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:28.407674074 CEST	49794	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:28.407937050 CEST	49794	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:28.407949924 CEST	443	49794	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:28.407964945 CEST	49794	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:28.407969952 CEST	443	49794	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:28.410685062 CEST	49799	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:28.410732985 CEST	443	49799	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:28.410825014 CEST	49799	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:28.411003113 CEST	49799	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:28.411012888 CEST	443	49799	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:28.572684050 CEST	443	49795	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:28.572711945 CEST	443	49795	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:28.572770119 CEST	443	49795	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:28.572848082 CEST	49795	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:28.572884083 CEST	49795	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:28.573180914 CEST	49795	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:28.573193073 CEST	443	49795	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:28.573203087 CEST	49795	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:28.573208094 CEST	443	49795	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:28.576474905 CEST	49800	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:28.576523066 CEST	443	49800	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:28.576616049 CEST	49800	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:28.576863050 CEST	49800	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:28.576877117 CEST	443	49800	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:29.119729042 CEST	443	49799	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:29.120229006 CEST	443	49796	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:29.120254040 CEST	49799	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:29.120309114 CEST	443	49799	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:29.120656013 CEST	49799	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:29.120670080 CEST	443	49799	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:29.120831013 CEST	49796	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:29.120846987 CEST	443	49796	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:29.121117115 CEST	49796	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:29.121128082 CEST	443	49796	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:29.124430895 CEST	443	49798	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:29.124685049 CEST	49798	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:29.124747038 CEST	443	49798	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:29.124948025 CEST	49798	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:29.124964952 CEST	443	49798	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:29.126580954 CEST	443	49797	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:29.126796007 CEST	49797	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:29.126826048 CEST	443	49797	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:29.127059937 CEST	49797	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:29.127073050 CEST	443	49797	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:29.211796999 CEST	443	49800	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:29.217502117 CEST	49800	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:29.217538118 CEST	443	49800	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:29.218729973 CEST	443	49799	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:29.218903065 CEST	443	49799	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:29.218965054 CEST	49799	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:29.221940041 CEST	443	49796	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:29.221961975 CEST	443	49796	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:29.222009897 CEST	49796	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:29.222032070 CEST	443	49796	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:29.222090006 CEST	443	49796	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:29.222129107 CEST	49796	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:29.222331047 CEST	49800	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:29.222347021 CEST	443	49800	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:29.222765923 CEST	49799	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:29.222785950 CEST	443	49799	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:29.222798109 CEST	49799	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:29.222804070 CEST	443	49799	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:29.223570108 CEST	443	49798	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:29.223737001 CEST	443	49798	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:29.223799944 CEST	49798	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:29.224440098 CEST	49798	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:29.224462986 CEST	443	49798	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:29.224474907 CEST	49798	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:29.224479914 CEST	443	49798	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:29.225606918 CEST	49796	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:29.225622892 CEST	443	49796	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:29.225634098 CEST	49796	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:29.225639105 CEST	443	49796	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:29.228485107 CEST	49801	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:29.228565931 CEST	443	49801	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:29.228637934 CEST	49801	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:29.228692055 CEST	49803	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:29.228696108 CEST	49802	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:29.228717089 CEST	443	49802	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:29.228730917 CEST	443	49803	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:29.228768110 CEST	49802	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:29.228787899 CEST	49803	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:29.228904009 CEST	49803	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:29.228912115 CEST	49802	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:29.228913069 CEST	443	49803	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:29.228941917 CEST	443	49797	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:29.228944063 CEST	443	49802	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:29.228981972 CEST	49801	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:29.229007006 CEST	443	49801	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:29.229043961 CEST	443	49797	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:29.229094982 CEST	49797	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:29.229183912 CEST	49797	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:29.229188919 CEST	443	49797	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:29.229218960 CEST	49797	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:29.229222059 CEST	443	49797	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:29.231134892 CEST	49804	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:29.231168985 CEST	443	49804	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:29.231223106 CEST	49804	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:29.231338024 CEST	49804	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:29.231348991 CEST	443	49804	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:29.318154097 CEST	443	49800	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:29.318223953 CEST	443	49800	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:29.318423986 CEST	49800	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:29.318756104 CEST	49800	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:29.318777084 CEST	443	49800	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:29.318788052 CEST	49800	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:29.318793058 CEST	443	49800	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:29.322294950 CEST	49805	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:29.322349072 CEST	443	49805	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:29.322455883 CEST	49805	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:29.322643995 CEST	49805	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:29.322658062 CEST	443	49805	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:29.440391064 CEST	49677	443	192.168.2.7	20.50.201.200
Oct 11, 2024 12:45:29.879076958 CEST	443	49802	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:29.879745007 CEST	49802	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:29.879781008 CEST	443	49802	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:29.880188942 CEST	49802	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:29.880194902 CEST	443	49802	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:29.898247957 CEST	443	49801	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:29.898749113 CEST	49801	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:29.898766041 CEST	443	49801	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:29.899116039 CEST	49801	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:29.899122000 CEST	443	49801	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:29.900130033 CEST	443	49804	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:29.900409937 CEST	49804	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:29.900490999 CEST	443	49804	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:29.900696993 CEST	49804	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:29.900712967 CEST	443	49804	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:29.906750917 CEST	443	49803	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:29.907072067 CEST	49803	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:29.907103062 CEST	443	49803	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:29.907351017 CEST	49803	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:29.907355070 CEST	443	49803	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:29.980689049 CEST	443	49802	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:29.980853081 CEST	443	49802	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:29.980952978 CEST	49802	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:29.981179953 CEST	49802	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:29.981208086 CEST	443	49802	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:29.981224060 CEST	49802	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:29.981230974 CEST	443	49802	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:29.984509945 CEST	49806	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:29.984565973 CEST	443	49806	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:29.984654903 CEST	49806	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:29.984836102 CEST	49806	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:29.984858990 CEST	443	49806	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:29.997139931 CEST	443	49805	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:29.997622967 CEST	49805	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:29.997649908 CEST	443	49805	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:29.998070955 CEST	49805	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:29.998080015 CEST	443	49805	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:29.999876976 CEST	443	49801	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:30.000092030 CEST	443	49801	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:30.000159979 CEST	49801	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:30.000219107 CEST	49801	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:30.000236988 CEST	443	49801	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:30.000246048 CEST	49801	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:30.000250101 CEST	443	49801	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:30.003001928 CEST	49807	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:30.003112078 CEST	443	49807	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:30.003201008 CEST	49807	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:30.003351927 CEST	49807	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:30.003398895 CEST	443	49807	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:30.006263018 CEST	443	49804	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:30.006422043 CEST	443	49804	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:30.006503105 CEST	49804	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:30.006550074 CEST	49804	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:30.006551027 CEST	49804	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:30.006575108 CEST	443	49804	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:30.006597042 CEST	443	49804	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:30.008507967 CEST	49808	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:30.008594036 CEST	443	49808	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:30.008690119 CEST	49808	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:30.008810043 CEST	49808	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:30.008832932 CEST	443	49808	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:30.010622025 CEST	443	49803	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:30.010782003 CEST	443	49803	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:30.010843039 CEST	49803	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:30.010875940 CEST	49803	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:30.010890961 CEST	443	49803	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:30.010900021 CEST	49803	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:30.010904074 CEST	443	49803	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:30.012721062 CEST	49809	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:30.012811899 CEST	443	49809	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:30.012902021 CEST	49809	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:30.013020039 CEST	49809	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:30.013041973 CEST	443	49809	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:30.103630066 CEST	443	49805	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:30.105451107 CEST	443	49805	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:30.105559111 CEST	49805	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:30.105609894 CEST	49805	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:30.105639935 CEST	443	49805	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:30.105654955 CEST	49805	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:30.105664015 CEST	443	49805	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:30.108639956 CEST	49810	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:30.108675957 CEST	443	49810	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:30.108756065 CEST	49810	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:30.108908892 CEST	49810	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:30.108918905 CEST	443	49810	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:30.663266897 CEST	443	49806	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:30.663984060 CEST	49806	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:30.664025068 CEST	443	49806	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:30.664560080 CEST	49806	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:30.664567947 CEST	443	49806	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:30.674746037 CEST	443	49809	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:30.675349951 CEST	49809	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:30.675374985 CEST	443	49809	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:30.675654888 CEST	49809	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:30.675662041 CEST	443	49809	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:30.678483009 CEST	443	49807	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:30.678848028 CEST	49807	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:30.678874969 CEST	443	49807	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:30.679176092 CEST	49807	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:30.679182053 CEST	443	49807	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:30.684021950 CEST	443	49808	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:30.684473991 CEST	49808	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:30.684499025 CEST	443	49808	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:30.684922934 CEST	49808	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:30.684930086 CEST	443	49808	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:30.764786005 CEST	443	49806	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:30.764892101 CEST	443	49806	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:30.764976978 CEST	49806	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:30.765194893 CEST	49806	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:30.765229940 CEST	443	49806	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:30.765249968 CEST	49806	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:30.765259027 CEST	443	49806	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:30.768837929 CEST	49811	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:30.768888950 CEST	443	49811	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:30.768960953 CEST	49811	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:30.769149065 CEST	49811	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:30.769160986 CEST	443	49811	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:30.778193951 CEST	443	49809	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:30.778264046 CEST	443	49809	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:30.778347969 CEST	443	49809	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:30.778361082 CEST	49809	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:30.778412104 CEST	49809	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:30.778755903 CEST	49809	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:30.778781891 CEST	443	49809	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:30.778799057 CEST	49809	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:30.778805017 CEST	443	49809	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:30.782598972 CEST	49812	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:30.782649040 CEST	443	49812	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:30.782747984 CEST	49812	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:30.782955885 CEST	49812	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:30.782967091 CEST	443	49812	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:30.783217907 CEST	443	49807	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:30.783262968 CEST	443	49810	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:30.783277035 CEST	443	49807	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:30.783328056 CEST	443	49807	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:30.783334017 CEST	49807	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:30.783376932 CEST	49807	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:30.783548117 CEST	49807	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:30.783565044 CEST	443	49807	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:30.783579111 CEST	49807	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:30.783585072 CEST	443	49807	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:30.783727884 CEST	49810	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:30.783750057 CEST	443	49810	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:30.784343004 CEST	49810	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:30.784348965 CEST	443	49810	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:30.786976099 CEST	49813	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:30.787017107 CEST	443	49813	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:30.787098885 CEST	49813	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:30.787266016 CEST	49813	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:30.787276983 CEST	443	49813	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:30.788609028 CEST	443	49808	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:30.788834095 CEST	443	49808	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:30.788917065 CEST	49808	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:30.788949013 CEST	49808	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:30.788961887 CEST	443	49808	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:30.788974047 CEST	49808	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:30.788980007 CEST	443	49808	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:30.791162968 CEST	49814	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:30.791172028 CEST	443	49814	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:30.791249037 CEST	49814	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:30.791379929 CEST	49814	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:30.791392088 CEST	443	49814	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:30.888856888 CEST	443	49810	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:30.888936043 CEST	443	49810	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:30.889076948 CEST	49810	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:30.889391899 CEST	49810	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:30.889442921 CEST	443	49810	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:30.889468908 CEST	49810	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:30.889478922 CEST	443	49810	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:30.892746925 CEST	49815	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:30.892796993 CEST	443	49815	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:30.892900944 CEST	49815	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:30.893078089 CEST	49815	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:30.893090010 CEST	443	49815	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:31.410442114 CEST	443	49811	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:31.411408901 CEST	49811	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:31.411498070 CEST	443	49811	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:31.411864996 CEST	49811	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:31.411878109 CEST	443	49811	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:31.419540882 CEST	443	49812	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:31.420053959 CEST	49812	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:31.420075893 CEST	443	49812	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:31.420363903 CEST	49812	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:31.420367956 CEST	443	49812	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:31.425157070 CEST	443	49813	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:31.425549030 CEST	49813	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:31.425582886 CEST	443	49813	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:31.425615072 CEST	443	49814	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:31.425873995 CEST	49813	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:31.425879955 CEST	443	49813	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:31.425899029 CEST	49814	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:31.425905943 CEST	443	49814	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:31.426426888 CEST	49814	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:31.426430941 CEST	443	49814	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:31.510788918 CEST	443	49811	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:31.510883093 CEST	443	49811	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:31.511085033 CEST	49811	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:31.511590004 CEST	49811	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:31.511609077 CEST	443	49811	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:31.511619091 CEST	49811	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:31.511626959 CEST	443	49811	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:31.515533924 CEST	49816	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:31.515588999 CEST	443	49816	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:31.515707970 CEST	49816	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:31.515880108 CEST	49816	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:31.515899897 CEST	443	49816	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:31.519745111 CEST	443	49812	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:31.519798994 CEST	443	49812	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:31.519941092 CEST	49812	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:31.520176888 CEST	49812	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:31.520194054 CEST	443	49812	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:31.520209074 CEST	49812	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:31.520214081 CEST	443	49812	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:31.523253918 CEST	49817	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:31.523291111 CEST	443	49817	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:31.523370981 CEST	49817	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:31.523529053 CEST	49817	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:31.523539066 CEST	443	49817	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:31.524879932 CEST	443	49814	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:31.525342941 CEST	443	49814	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:31.525386095 CEST	443	49813	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:31.525403976 CEST	49814	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:31.525415897 CEST	443	49813	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:31.525458097 CEST	443	49813	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:31.525474072 CEST	49813	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:31.525525093 CEST	49813	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:31.525563955 CEST	49814	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:31.525580883 CEST	443	49814	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:31.525597095 CEST	49814	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:31.525602102 CEST	443	49814	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:31.525623083 CEST	49813	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:31.525625944 CEST	443	49813	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:31.525639057 CEST	49813	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:31.525641918 CEST	443	49813	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:31.528042078 CEST	49818	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:31.528053999 CEST	443	49818	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:31.528130054 CEST	49818	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:31.528250933 CEST	49818	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:31.528259993 CEST	443	49818	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:31.528390884 CEST	49819	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:31.528430939 CEST	443	49819	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:31.528491020 CEST	49819	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:31.528578043 CEST	49819	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:31.528592110 CEST	443	49819	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:31.535749912 CEST	443	49815	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:31.536252975 CEST	49815	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:31.536284924 CEST	443	49815	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:31.536871910 CEST	49815	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:31.536885977 CEST	443	49815	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:31.636013985 CEST	443	49815	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:31.636090040 CEST	443	49815	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:31.636269093 CEST	49815	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:31.644603014 CEST	49815	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:31.644639015 CEST	443	49815	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:31.644656897 CEST	49815	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:31.644664049 CEST	443	49815	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:31.648430109 CEST	49820	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:31.648530960 CEST	443	49820	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:31.648644924 CEST	49820	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:31.648819923 CEST	49820	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:31.648858070 CEST	443	49820	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:32.159742117 CEST	443	49817	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:32.160854101 CEST	49817	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:32.160887003 CEST	443	49817	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:32.161585093 CEST	49817	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:32.161591053 CEST	443	49817	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:32.176069021 CEST	443	49818	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:32.176806927 CEST	49818	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:32.176816940 CEST	443	49818	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:32.177403927 CEST	49818	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:32.177408934 CEST	443	49818	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:32.192011118 CEST	443	49816	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:32.192616940 CEST	49816	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:32.192647934 CEST	443	49816	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:32.193243027 CEST	49816	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:32.193248987 CEST	443	49816	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:32.202708006 CEST	443	49819	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:32.211005926 CEST	49819	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:32.211020947 CEST	443	49819	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:32.211575985 CEST	49819	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:32.211581945 CEST	443	49819	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:32.259849072 CEST	443	49817	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:32.259949923 CEST	443	49817	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:32.260042906 CEST	443	49817	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:32.260173082 CEST	49817	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:32.260237932 CEST	49817	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:32.260540962 CEST	49817	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:32.260561943 CEST	443	49817	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:32.260574102 CEST	49817	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:32.260580063 CEST	443	49817	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:32.263868093 CEST	49821	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:32.263911009 CEST	443	49821	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:32.264009953 CEST	49821	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:32.264192104 CEST	49821	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:32.264206886 CEST	443	49821	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:32.277597904 CEST	443	49818	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:32.278342962 CEST	443	49818	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:32.278400898 CEST	443	49818	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:32.278431892 CEST	49818	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:32.278485060 CEST	49818	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:32.278572083 CEST	49818	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:32.278613091 CEST	443	49818	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:32.278640985 CEST	49818	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:32.278655052 CEST	443	49818	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:32.281492949 CEST	49822	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:32.281537056 CEST	443	49822	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:32.281615973 CEST	49822	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:32.281759024 CEST	49822	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:32.281769991 CEST	443	49822	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:32.284332991 CEST	443	49820	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:32.284764051 CEST	49820	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:32.284806967 CEST	443	49820	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:32.285259962 CEST	49820	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:32.285268068 CEST	443	49820	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:32.297346115 CEST	443	49816	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:32.297519922 CEST	443	49816	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:32.297700882 CEST	49816	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:32.297702074 CEST	49816	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:32.297702074 CEST	49816	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:32.300275087 CEST	49823	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:32.300379038 CEST	443	49823	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:32.300463915 CEST	49823	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:32.300571918 CEST	49823	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:32.300592899 CEST	443	49823	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:32.313258886 CEST	443	49819	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:32.313535929 CEST	443	49819	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:32.313625097 CEST	49819	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:32.314428091 CEST	49819	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:32.314480066 CEST	443	49819	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:32.314512014 CEST	49819	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:32.314528942 CEST	443	49819	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:32.318176031 CEST	49824	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:32.318219900 CEST	443	49824	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:32.318301916 CEST	49824	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:32.318445921 CEST	49824	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:32.318461895 CEST	443	49824	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:32.518321037 CEST	49816	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:32.518368959 CEST	443	49816	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:33.444576025 CEST	443	49820	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:33.444655895 CEST	443	49820	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:33.444714069 CEST	49820	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:33.444895029 CEST	49820	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:33.444921017 CEST	443	49820	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:33.444936037 CEST	49820	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:33.444941998 CEST	443	49820	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:33.447978020 CEST	49825	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:33.448023081 CEST	443	49825	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:33.448122025 CEST	49825	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:33.448319912 CEST	49825	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:33.448329926 CEST	443	49825	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:33.639514923 CEST	443	49822	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:33.639947891 CEST	49822	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:33.639969110 CEST	443	49822	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:33.640389919 CEST	49822	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:33.640396118 CEST	443	49822	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:33.640731096 CEST	443	49824	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:33.641045094 CEST	49824	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:33.641072035 CEST	443	49824	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:33.641410112 CEST	49824	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:33.641417027 CEST	443	49824	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:33.641480923 CEST	443	49823	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:33.641716957 CEST	49823	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:33.641726971 CEST	443	49823	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:33.642069101 CEST	49823	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:33.642072916 CEST	443	49823	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:33.649472952 CEST	443	49821	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:33.649781942 CEST	49821	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:33.649801016 CEST	443	49821	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:33.650158882 CEST	49821	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:33.650165081 CEST	443	49821	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:33.740268946 CEST	443	49822	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:33.740434885 CEST	443	49822	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:33.740490913 CEST	49822	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:33.740554094 CEST	49822	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:33.740577936 CEST	443	49822	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:33.740592003 CEST	49822	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:33.740597963 CEST	443	49822	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:33.741684914 CEST	443	49824	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:33.742198944 CEST	443	49824	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:33.742252111 CEST	49824	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:33.743067980 CEST	49826	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:33.743103027 CEST	443	49826	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:33.743103027 CEST	49824	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:33.743129015 CEST	443	49824	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:33.743139982 CEST	49824	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:33.743145943 CEST	443	49824	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:33.743160009 CEST	49826	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:33.743803978 CEST	49826	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:33.743819952 CEST	443	49826	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:33.743885040 CEST	443	49823	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:33.744106054 CEST	443	49823	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:33.744153023 CEST	49823	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:33.744158030 CEST	443	49823	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:33.744198084 CEST	49823	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:33.744452000 CEST	49823	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:33.744456053 CEST	443	49823	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:33.746618986 CEST	49827	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:33.746638060 CEST	443	49827	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:33.746685028 CEST	49827	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:33.747227907 CEST	49828	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:33.747273922 CEST	443	49828	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:33.747333050 CEST	49828	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:33.747550011 CEST	49828	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:33.747564077 CEST	443	49828	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:33.747627020 CEST	49827	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:33.747637987 CEST	443	49827	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:33.754717112 CEST	443	49821	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:33.754792929 CEST	443	49821	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:33.754839897 CEST	49821	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:33.754895926 CEST	49821	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:33.754913092 CEST	443	49821	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:33.754925966 CEST	49821	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:33.754933119 CEST	443	49821	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:33.756947994 CEST	49829	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:33.756983042 CEST	443	49829	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:33.757040977 CEST	49829	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:33.757145882 CEST	49829	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:33.757157087 CEST	443	49829	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:34.088821888 CEST	443	49825	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:34.089333057 CEST	49825	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:34.089360952 CEST	443	49825	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:34.089909077 CEST	49825	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:34.089917898 CEST	443	49825	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:34.190380096 CEST	443	49825	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:34.190552950 CEST	443	49825	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:34.190608025 CEST	49825	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:34.190890074 CEST	49825	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:34.190908909 CEST	443	49825	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:34.190921068 CEST	49825	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:34.190924883 CEST	443	49825	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:34.194202900 CEST	49830	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:34.194298983 CEST	443	49830	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:34.194371939 CEST	49830	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:34.194614887 CEST	49830	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:34.194650888 CEST	443	49830	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:34.385788918 CEST	443	49827	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:34.386563063 CEST	49827	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:34.386648893 CEST	443	49827	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:34.386892080 CEST	49827	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:34.386904955 CEST	443	49827	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:34.391362906 CEST	443	49828	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:34.391936064 CEST	49828	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:34.391936064 CEST	49828	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:34.391972065 CEST	443	49828	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:34.391995907 CEST	443	49828	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:34.402359009 CEST	443	49829	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:34.402812958 CEST	49829	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:34.402868986 CEST	443	49829	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:34.402991056 CEST	49829	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:34.403002977 CEST	443	49829	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:34.407175064 CEST	443	49826	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:34.407407045 CEST	49826	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:34.407429934 CEST	443	49826	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:34.407648087 CEST	49826	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:34.407653093 CEST	443	49826	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:34.486011028 CEST	443	49827	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:34.486087084 CEST	443	49827	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:34.486203909 CEST	443	49827	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:34.486351013 CEST	49827	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:34.486351013 CEST	49827	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:34.486551046 CEST	49827	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:34.486612082 CEST	443	49827	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:34.486650944 CEST	49827	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:34.486668110 CEST	443	49827	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:34.489583969 CEST	49831	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:34.489644051 CEST	443	49831	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:34.489725113 CEST	49831	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:34.489878893 CEST	49831	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:34.489897966 CEST	443	49831	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:34.490664005 CEST	443	49828	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:34.490803957 CEST	443	49828	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:34.490853071 CEST	49828	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:34.490888119 CEST	49828	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:34.490888119 CEST	49828	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:34.490906000 CEST	443	49828	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:34.490919113 CEST	443	49828	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:34.492614985 CEST	49832	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:34.492662907 CEST	443	49832	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:34.492728949 CEST	49832	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:34.492831945 CEST	49832	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:34.492846012 CEST	443	49832	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:34.500994921 CEST	443	49829	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:34.501138926 CEST	443	49829	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:34.501197100 CEST	49829	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:34.501230001 CEST	49829	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:34.501247883 CEST	443	49829	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:34.501260996 CEST	49829	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:34.501266956 CEST	443	49829	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:34.503009081 CEST	49833	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:34.503034115 CEST	443	49833	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:34.503094912 CEST	49833	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:34.503201008 CEST	49833	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:34.503211975 CEST	443	49833	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:34.510823965 CEST	443	49826	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:34.510992050 CEST	443	49826	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:34.511059046 CEST	49826	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:34.511086941 CEST	49826	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:34.511100054 CEST	443	49826	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:34.511110067 CEST	49826	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:34.511115074 CEST	443	49826	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:34.512878895 CEST	49834	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:34.512892962 CEST	443	49834	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:34.512958050 CEST	49834	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:34.513055086 CEST	49834	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:34.513065100 CEST	443	49834	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:34.879704952 CEST	443	49830	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:34.880597115 CEST	49830	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:34.880675077 CEST	443	49830	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:34.881048918 CEST	49830	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:34.881062984 CEST	443	49830	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:34.981362104 CEST	443	49830	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:34.981440067 CEST	443	49830	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:34.981801033 CEST	49830	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:34.981801033 CEST	49830	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:34.981801033 CEST	49830	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:34.984488010 CEST	49835	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:34.984534025 CEST	443	49835	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:34.984607935 CEST	49835	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:34.984743118 CEST	49835	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:34.984755039 CEST	443	49835	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:35.147833109 CEST	443	49834	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:35.148572922 CEST	49834	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:35.148624897 CEST	443	49834	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:35.148895979 CEST	49834	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:35.148901939 CEST	443	49834	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:35.149979115 CEST	443	49831	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:35.150240898 CEST	49831	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:35.150314093 CEST	443	49831	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:35.150522947 CEST	49831	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:35.150532961 CEST	443	49831	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:35.166188955 CEST	443	49832	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:35.166675091 CEST	49832	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:35.166697025 CEST	443	49832	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:35.167085886 CEST	49832	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:35.167093992 CEST	443	49832	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:35.169358969 CEST	443	49833	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:35.169804096 CEST	49833	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:35.169825077 CEST	443	49833	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:35.170198917 CEST	49833	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:35.170205116 CEST	443	49833	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:35.246701956 CEST	443	49834	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:35.246898890 CEST	443	49834	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:35.246978045 CEST	49834	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:35.247021914 CEST	49834	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:35.247042894 CEST	443	49834	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:35.247056961 CEST	49834	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:35.247061968 CEST	443	49834	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:35.250081062 CEST	49836	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:35.250111103 CEST	443	49836	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:35.250186920 CEST	49836	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:35.250328064 CEST	49836	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:35.250334978 CEST	443	49836	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:35.251123905 CEST	443	49831	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:35.251149893 CEST	443	49831	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:35.251193047 CEST	443	49831	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:35.251195908 CEST	49831	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:35.251240969 CEST	49831	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:35.251421928 CEST	49831	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:35.251446009 CEST	443	49831	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:35.251461983 CEST	49831	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:35.251468897 CEST	443	49831	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:35.253860950 CEST	49837	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:35.253906012 CEST	443	49837	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:35.254035950 CEST	49837	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:35.254187107 CEST	49837	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:35.254199028 CEST	443	49837	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:35.271907091 CEST	443	49832	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:35.272187948 CEST	443	49832	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:35.272253990 CEST	49832	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:35.272289991 CEST	49832	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:35.272304058 CEST	443	49832	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:35.272316933 CEST	49832	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:35.272321939 CEST	443	49832	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:35.273257971 CEST	443	49833	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:35.273519039 CEST	443	49833	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:35.273598909 CEST	49833	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:35.273829937 CEST	49833	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:35.273847103 CEST	443	49833	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:35.273859978 CEST	49833	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:35.273864031 CEST	443	49833	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:35.275137901 CEST	49838	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:35.275190115 CEST	443	49838	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:35.275264025 CEST	49838	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:35.275414944 CEST	49838	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:35.275428057 CEST	443	49838	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:35.275846958 CEST	49839	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:35.275859118 CEST	443	49839	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:35.275911093 CEST	49839	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:35.276036024 CEST	49839	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:35.276041985 CEST	443	49839	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:35.283951044 CEST	49830	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:35.283978939 CEST	443	49830	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:35.618777037 CEST	443	49835	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:35.619448900 CEST	49835	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:35.619472980 CEST	443	49835	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:35.619919062 CEST	49835	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:35.619926929 CEST	443	49835	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:35.718472958 CEST	443	49835	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:35.718585014 CEST	443	49835	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:35.718637943 CEST	443	49835	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:35.718666077 CEST	49835	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:35.718710899 CEST	49835	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:35.718945026 CEST	49835	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:35.718960047 CEST	443	49835	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:35.718972921 CEST	49835	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:35.718976974 CEST	443	49835	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:35.721961975 CEST	49840	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:35.722004890 CEST	443	49840	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:35.722083092 CEST	49840	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:35.722217083 CEST	49840	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:35.722228050 CEST	443	49840	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:35.891153097 CEST	443	49836	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:35.891347885 CEST	443	49837	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:35.891592026 CEST	49836	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:35.891606092 CEST	443	49836	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:35.891942024 CEST	49837	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:35.891978025 CEST	443	49837	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:35.892081976 CEST	49836	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:35.892086029 CEST	443	49836	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:35.892474890 CEST	49837	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:35.892482996 CEST	443	49837	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:35.939589024 CEST	443	49838	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:35.940155983 CEST	49838	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:35.940181017 CEST	443	49838	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:35.940767050 CEST	49838	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:35.940772057 CEST	443	49838	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:35.966319084 CEST	443	49839	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:35.966854095 CEST	49839	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:35.966865063 CEST	443	49839	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:35.967300892 CEST	49839	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:35.967304945 CEST	443	49839	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:35.989862919 CEST	443	49837	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:35.989907026 CEST	443	49836	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:35.989965916 CEST	443	49837	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:35.990016937 CEST	443	49837	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:35.990025997 CEST	49837	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:35.990072012 CEST	49837	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:35.990159988 CEST	443	49836	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:35.990209103 CEST	49836	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:35.990250111 CEST	49836	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:35.990264893 CEST	443	49836	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:35.990279913 CEST	49836	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:35.990284920 CEST	443	49836	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:35.990286112 CEST	49837	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:35.990309000 CEST	443	49837	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:35.990341902 CEST	49837	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:35.990348101 CEST	443	49837	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:35.993170977 CEST	49841	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:35.993231058 CEST	443	49841	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:35.993300915 CEST	49841	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:35.994223118 CEST	49842	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:35.994237900 CEST	443	49842	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:35.994292974 CEST	49842	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:35.994410992 CEST	49841	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:35.994436026 CEST	443	49841	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:35.994508982 CEST	49842	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:35.994518995 CEST	443	49842	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:36.042747974 CEST	443	49838	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:36.042829990 CEST	443	49838	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:36.042886972 CEST	49838	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:36.043041945 CEST	49838	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:36.043055058 CEST	443	49838	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:36.043066025 CEST	49838	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:36.043071032 CEST	443	49838	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:36.045579910 CEST	49843	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:36.045631886 CEST	443	49843	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:36.045706987 CEST	49843	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:36.045844078 CEST	49843	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:36.045856953 CEST	443	49843	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:36.070812941 CEST	443	49839	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:36.071342945 CEST	443	49839	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:36.071405888 CEST	443	49839	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:36.071408987 CEST	49839	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:36.071459055 CEST	49839	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:36.071502924 CEST	49839	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:36.071516037 CEST	443	49839	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:36.071525097 CEST	49839	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:36.071530104 CEST	443	49839	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:36.074753046 CEST	49844	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:36.074796915 CEST	443	49844	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:36.074862957 CEST	49844	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:36.074986935 CEST	49844	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:36.074995995 CEST	443	49844	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:36.399085045 CEST	443	49840	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:36.399679899 CEST	49840	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:36.399712086 CEST	443	49840	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:36.400136948 CEST	49840	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:36.400145054 CEST	443	49840	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:36.503962040 CEST	443	49840	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:36.504715919 CEST	443	49840	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:36.504897118 CEST	49840	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:36.504898071 CEST	49840	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:36.504898071 CEST	49840	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:36.507714987 CEST	49845	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:36.507776976 CEST	443	49845	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:36.507854939 CEST	49845	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:36.507994890 CEST	49845	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:36.508012056 CEST	443	49845	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:36.634392023 CEST	443	49842	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:36.635127068 CEST	49842	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:36.635183096 CEST	443	49842	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:36.635510921 CEST	49842	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:36.635524035 CEST	443	49842	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:36.639010906 CEST	443	49841	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:36.639353037 CEST	49841	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:36.639374971 CEST	443	49841	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:36.639705896 CEST	49841	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:36.639713049 CEST	443	49841	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:36.714503050 CEST	443	49843	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:36.715364933 CEST	49843	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:36.715420961 CEST	443	49843	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:36.715722084 CEST	49843	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:36.715730906 CEST	443	49843	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:36.718221903 CEST	443	49844	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:36.718600035 CEST	49844	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:36.718626022 CEST	443	49844	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:36.718940020 CEST	49844	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:36.718945980 CEST	443	49844	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:36.732877016 CEST	443	49842	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:36.734288931 CEST	443	49842	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:36.734469891 CEST	49842	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:36.734471083 CEST	49842	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:36.734471083 CEST	49842	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:36.737210989 CEST	49846	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:36.737255096 CEST	443	49846	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:36.737330914 CEST	49846	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:36.737452030 CEST	443	49841	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:36.737469912 CEST	49846	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:36.737482071 CEST	443	49846	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:36.737581968 CEST	443	49841	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:36.737632036 CEST	49841	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:36.737641096 CEST	443	49841	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:36.737690926 CEST	49841	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:36.737721920 CEST	49841	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:36.737746000 CEST	443	49841	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:36.737761974 CEST	49841	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:36.737770081 CEST	443	49841	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:36.739644051 CEST	49847	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:36.739681005 CEST	443	49847	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:36.739748955 CEST	49847	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:36.739927053 CEST	49847	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:36.739936113 CEST	443	49847	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:36.815212965 CEST	49840	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:36.815269947 CEST	443	49840	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:36.819123983 CEST	443	49844	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:36.819190025 CEST	443	49844	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:36.819253922 CEST	49844	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:36.819456100 CEST	49844	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:36.819482088 CEST	443	49844	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:36.819497108 CEST	49844	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:36.819504023 CEST	443	49844	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:36.819622993 CEST	443	49843	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:36.819668055 CEST	443	49843	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:36.819717884 CEST	49843	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:36.819720984 CEST	443	49843	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:36.819780111 CEST	49843	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:36.819876909 CEST	49843	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:36.819900990 CEST	443	49843	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:36.819926023 CEST	49843	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:36.819941044 CEST	443	49843	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:36.822647095 CEST	49848	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:36.822721958 CEST	49849	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:36.822732925 CEST	443	49848	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:36.822761059 CEST	443	49849	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:36.822807074 CEST	49848	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:36.822832108 CEST	49849	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:36.822966099 CEST	49849	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:36.822978020 CEST	443	49849	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:36.822995901 CEST	49848	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:36.823013067 CEST	443	49848	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:37.049590111 CEST	49842	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:37.049670935 CEST	443	49842	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:37.171868086 CEST	443	49845	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:37.172452927 CEST	49845	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:37.172513962 CEST	443	49845	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:37.172873020 CEST	49845	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:37.172885895 CEST	443	49845	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:37.276648045 CEST	443	49845	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:37.276834965 CEST	443	49845	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:37.276910067 CEST	49845	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:37.277158976 CEST	49845	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:37.277187109 CEST	443	49845	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:37.277199984 CEST	49845	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:37.277205944 CEST	443	49845	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:37.280755997 CEST	49850	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:37.280805111 CEST	443	49850	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:37.280873060 CEST	49850	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:37.281050920 CEST	49850	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:37.281070948 CEST	443	49850	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:37.378220081 CEST	443	49846	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:37.378901958 CEST	49846	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:37.378945112 CEST	443	49846	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:37.379524946 CEST	49846	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:37.379540920 CEST	443	49846	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:37.408119917 CEST	443	49847	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:37.408755064 CEST	49847	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:37.408783913 CEST	443	49847	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:37.409131050 CEST	49847	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:37.409137011 CEST	443	49847	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:37.479851961 CEST	443	49846	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:37.480011940 CEST	443	49846	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:37.480154037 CEST	49846	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:37.488655090 CEST	443	49849	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:37.497621059 CEST	443	49848	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:37.499476910 CEST	49846	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:37.499506950 CEST	443	49846	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:37.499521971 CEST	49846	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:37.499528885 CEST	443	49846	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:37.500973940 CEST	49849	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:37.500999928 CEST	443	49849	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:37.501712084 CEST	49849	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:37.501724005 CEST	443	49849	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:37.502142906 CEST	49848	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:37.502199888 CEST	443	49848	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:37.502681971 CEST	49848	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:37.502696037 CEST	443	49848	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:37.505064011 CEST	49851	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:37.505121946 CEST	443	49851	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:37.505224943 CEST	49851	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:37.505527973 CEST	49851	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:37.505553961 CEST	443	49851	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:37.510826111 CEST	443	49847	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:37.510977030 CEST	443	49847	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:37.511027098 CEST	49847	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:37.511030912 CEST	443	49847	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:37.511090040 CEST	49847	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:37.511147976 CEST	49847	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:37.511163950 CEST	443	49847	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:37.511178970 CEST	49847	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:37.511183977 CEST	443	49847	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:37.517837048 CEST	49852	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:37.517863989 CEST	443	49852	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:37.517946005 CEST	49852	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:37.518125057 CEST	49852	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:37.518135071 CEST	443	49852	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:37.601604939 CEST	443	49849	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:37.602195024 CEST	443	49849	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:37.602255106 CEST	49849	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:37.602293968 CEST	49849	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:37.602310896 CEST	443	49849	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:37.603966951 CEST	443	49848	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:37.603991032 CEST	443	49848	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:37.604036093 CEST	49848	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:37.604039907 CEST	443	49848	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:37.604077101 CEST	49848	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:37.604397058 CEST	49848	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:37.604413033 CEST	443	49848	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:37.604424953 CEST	49848	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:37.604432106 CEST	443	49848	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:37.609488010 CEST	49853	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:37.609528065 CEST	443	49853	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:37.609591961 CEST	49853	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:37.610447884 CEST	49854	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:37.610456944 CEST	443	49854	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:37.610502958 CEST	49854	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:37.610704899 CEST	49853	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:37.610714912 CEST	443	49853	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:37.610785007 CEST	49854	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:37.610790968 CEST	443	49854	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:37.929567099 CEST	443	49850	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:37.934588909 CEST	49850	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:37.934614897 CEST	443	49850	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:37.935158968 CEST	49850	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:37.935163021 CEST	443	49850	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:38.033862114 CEST	443	49850	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:38.033915043 CEST	443	49850	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:38.033972025 CEST	49850	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:38.053042889 CEST	49850	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:38.053065062 CEST	443	49850	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:38.053077936 CEST	49850	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:38.053082943 CEST	443	49850	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:38.056695938 CEST	49855	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:38.056729078 CEST	443	49855	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:38.056803942 CEST	49855	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:38.056956053 CEST	49855	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:38.056967974 CEST	443	49855	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:38.185036898 CEST	443	49851	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:38.192229033 CEST	49851	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:38.192251921 CEST	443	49851	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:38.193135977 CEST	49851	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:38.193140984 CEST	443	49851	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:38.195837021 CEST	443	49852	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:38.196273088 CEST	49852	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:38.196288109 CEST	443	49852	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:38.196877956 CEST	49852	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:38.196882010 CEST	443	49852	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:38.287933111 CEST	443	49851	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:38.287988901 CEST	443	49851	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:38.288033009 CEST	49851	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:38.288276911 CEST	49851	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:38.288290024 CEST	443	49851	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:38.288304090 CEST	49851	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:38.288310051 CEST	443	49851	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:38.291635036 CEST	49856	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:38.291651011 CEST	443	49856	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:38.291719913 CEST	49856	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:38.292073011 CEST	49856	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:38.292081118 CEST	443	49856	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:38.296082020 CEST	443	49854	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:38.296524048 CEST	49854	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:38.296550989 CEST	443	49854	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:38.297017097 CEST	49854	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:38.297022104 CEST	443	49854	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:38.300242901 CEST	443	49852	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:38.301656008 CEST	443	49852	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:38.301722050 CEST	49852	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:38.301748037 CEST	49852	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:38.301759958 CEST	443	49852	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:38.301770926 CEST	49852	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:38.301775932 CEST	443	49852	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:38.304281950 CEST	49857	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:38.304320097 CEST	443	49857	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:38.304385900 CEST	49857	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:38.304538965 CEST	49857	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:38.304549932 CEST	443	49857	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:38.321917057 CEST	443	49853	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:38.322429895 CEST	49853	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:38.322459936 CEST	443	49853	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:38.322801113 CEST	49853	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:38.322808981 CEST	443	49853	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:38.402590990 CEST	443	49854	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:38.402695894 CEST	443	49854	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:38.402755976 CEST	49854	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:38.402937889 CEST	49854	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:38.402956009 CEST	443	49854	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:38.402970076 CEST	49854	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:38.402975082 CEST	443	49854	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:38.406122923 CEST	49858	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:38.406163931 CEST	443	49858	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:38.406240940 CEST	49858	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:38.406424046 CEST	49858	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:38.406434059 CEST	443	49858	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:38.421941996 CEST	443	49853	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:38.421964884 CEST	443	49853	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:38.421998024 CEST	443	49853	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:38.422039986 CEST	49853	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:38.422187090 CEST	49853	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:38.422214031 CEST	49853	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:38.422214031 CEST	49853	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:38.422226906 CEST	443	49853	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:38.422236919 CEST	443	49853	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:38.424886942 CEST	49859	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:38.424901962 CEST	443	49859	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:38.424968004 CEST	49859	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:38.425127983 CEST	49859	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:38.425137043 CEST	443	49859	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:38.733371019 CEST	443	49855	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:38.734338999 CEST	49855	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:38.734366894 CEST	443	49855	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:38.734909058 CEST	49855	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:38.734920025 CEST	443	49855	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:38.833832026 CEST	443	49855	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:38.833899975 CEST	443	49855	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:38.833949089 CEST	49855	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:38.833962917 CEST	443	49855	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:38.834008932 CEST	49855	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:38.836321115 CEST	49855	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:38.836344957 CEST	443	49855	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:38.836359024 CEST	49855	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:38.836364985 CEST	443	49855	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:38.848722935 CEST	49860	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:38.848757029 CEST	443	49860	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:38.848846912 CEST	49860	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:38.849071026 CEST	49860	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:38.849080086 CEST	443	49860	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:38.952852964 CEST	443	49857	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:38.953732967 CEST	49857	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:38.953768969 CEST	443	49857	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:38.954435110 CEST	49857	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:38.954448938 CEST	443	49857	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:38.958631992 CEST	443	49856	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:38.959041119 CEST	49856	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:38.959074974 CEST	443	49856	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:38.959527016 CEST	49856	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:38.959532022 CEST	443	49856	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:39.048726082 CEST	443	49858	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:39.049438953 CEST	49858	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:39.049467087 CEST	443	49858	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:39.050523043 CEST	49858	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:39.050537109 CEST	443	49858	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:39.054276943 CEST	443	49857	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:39.054361105 CEST	443	49857	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:39.054415941 CEST	49857	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:39.054642916 CEST	49857	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:39.054662943 CEST	443	49857	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:39.054680109 CEST	49857	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:39.054686069 CEST	443	49857	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:39.058228970 CEST	49861	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:39.058326960 CEST	443	49861	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:39.058444977 CEST	49861	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:39.058635950 CEST	49861	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:39.058662891 CEST	443	49861	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:39.060818911 CEST	443	49859	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:39.061230898 CEST	49859	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:39.061252117 CEST	443	49859	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:39.061691046 CEST	49859	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:39.061695099 CEST	443	49859	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:39.061748981 CEST	443	49856	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:39.062093973 CEST	443	49856	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:39.062164068 CEST	49856	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:39.062200069 CEST	49856	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:39.062213898 CEST	443	49856	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:39.062228918 CEST	49856	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:39.062232971 CEST	443	49856	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:39.064641953 CEST	49862	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:39.064663887 CEST	443	49862	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:39.064755917 CEST	49862	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:39.064897060 CEST	49862	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:39.064913988 CEST	443	49862	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:39.149974108 CEST	443	49858	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:39.150139093 CEST	443	49858	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:39.150219917 CEST	49858	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:39.150585890 CEST	49858	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:39.150604963 CEST	443	49858	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:39.150660992 CEST	49858	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:39.150666952 CEST	443	49858	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:39.154119968 CEST	49863	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:39.154181957 CEST	443	49863	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:39.154270887 CEST	49863	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:39.154464006 CEST	49863	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:39.154479980 CEST	443	49863	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:39.163327932 CEST	443	49859	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:39.163795948 CEST	443	49859	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:39.163861990 CEST	49859	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:39.163952112 CEST	49859	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:39.163970947 CEST	443	49859	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:39.163983107 CEST	49859	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:39.163989067 CEST	443	49859	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:39.167534113 CEST	49864	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:39.167607069 CEST	443	49864	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:39.167710066 CEST	49864	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:39.167881966 CEST	49864	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:39.167892933 CEST	443	49864	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:39.498893976 CEST	443	49860	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:39.499667883 CEST	49860	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:39.499691963 CEST	443	49860	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:39.500225067 CEST	49860	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:39.500230074 CEST	443	49860	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:39.600042105 CEST	443	49860	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:39.600585938 CEST	443	49860	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:39.600837946 CEST	49860	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:39.600837946 CEST	49860	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:39.600837946 CEST	49860	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:39.604537010 CEST	49865	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:39.604607105 CEST	443	49865	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:39.604746103 CEST	49865	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:39.604979038 CEST	49865	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:39.604994059 CEST	443	49865	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:39.696854115 CEST	443	49861	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:39.697735071 CEST	49861	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:39.697765112 CEST	443	49861	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:39.698153019 CEST	49861	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:39.698165894 CEST	443	49861	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:39.705966949 CEST	443	49862	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:39.706474066 CEST	49862	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:39.706497908 CEST	443	49862	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:39.706986904 CEST	49862	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:39.707000971 CEST	443	49862	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:39.796370983 CEST	443	49861	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:39.796541929 CEST	443	49861	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:39.796746016 CEST	49861	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:39.796905994 CEST	49861	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:39.796926975 CEST	443	49861	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:39.796940088 CEST	49861	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:39.796946049 CEST	443	49861	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:39.800000906 CEST	49866	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:39.800107002 CEST	443	49866	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:39.800206900 CEST	49866	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:39.800354004 CEST	49866	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:39.800378084 CEST	443	49866	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:39.805160046 CEST	443	49862	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:39.805497885 CEST	443	49862	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:39.805547953 CEST	49862	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:39.805591106 CEST	49862	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:39.805598974 CEST	443	49862	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:39.805609941 CEST	49862	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:39.805614948 CEST	443	49862	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:39.805636883 CEST	443	49864	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:39.806083918 CEST	49864	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:39.806098938 CEST	443	49864	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:39.806585073 CEST	49864	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:39.806590080 CEST	443	49864	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:39.808115005 CEST	49867	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:39.808140993 CEST	443	49867	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:39.808206081 CEST	49867	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:39.808319092 CEST	49867	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:39.808326006 CEST	443	49867	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:39.817327023 CEST	443	49863	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:39.817747116 CEST	49863	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:39.817776918 CEST	443	49863	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:39.818305969 CEST	49863	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:39.818311930 CEST	443	49863	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:39.905716896 CEST	443	49864	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:39.905781031 CEST	443	49864	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:39.905908108 CEST	49864	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:39.906320095 CEST	49864	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:39.906320095 CEST	49864	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:39.906333923 CEST	443	49864	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:39.906342030 CEST	443	49864	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:39.908937931 CEST	49860	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:39.908958912 CEST	443	49860	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:39.909960985 CEST	49868	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:39.910008907 CEST	443	49868	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:39.910077095 CEST	49868	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:39.910248041 CEST	49868	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:39.910258055 CEST	443	49868	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:39.921581030 CEST	443	49863	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:39.921607971 CEST	443	49863	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:39.921648979 CEST	443	49863	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:39.921669006 CEST	49863	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:39.921818018 CEST	49863	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:39.921865940 CEST	49863	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:39.921875000 CEST	443	49863	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:39.921885967 CEST	49863	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:39.921890974 CEST	443	49863	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:39.924067974 CEST	49869	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:39.924107075 CEST	443	49869	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:39.924174070 CEST	49869	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:39.924334049 CEST	49869	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:39.924344063 CEST	443	49869	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:40.240616083 CEST	443	49865	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:40.241527081 CEST	49865	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:40.241596937 CEST	443	49865	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:40.242398977 CEST	49865	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:40.242413998 CEST	443	49865	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:40.338722944 CEST	443	49865	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:40.339075089 CEST	443	49865	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:40.339314938 CEST	49865	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:40.339447975 CEST	49865	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:40.339447975 CEST	49865	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:40.339502096 CEST	443	49865	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:40.339540005 CEST	443	49865	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:40.341942072 CEST	49870	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:40.342037916 CEST	443	49870	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:40.342127085 CEST	49870	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:40.342262983 CEST	49870	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:40.342283964 CEST	443	49870	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:40.442612886 CEST	443	49866	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:40.459770918 CEST	443	49867	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:40.487241983 CEST	49866	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:40.502876043 CEST	49867	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:40.510513067 CEST	49866	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:40.510564089 CEST	443	49866	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:40.511071920 CEST	49866	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:40.511086941 CEST	443	49866	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:40.511460066 CEST	49867	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:40.511482000 CEST	443	49867	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:40.511815071 CEST	49867	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:40.511821985 CEST	443	49867	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:40.588880062 CEST	443	49869	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:40.589561939 CEST	443	49868	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:40.607878923 CEST	443	49866	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:40.607964993 CEST	443	49866	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:40.608181000 CEST	49866	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:40.610837936 CEST	443	49867	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:40.610861063 CEST	443	49867	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:40.610908985 CEST	443	49867	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:40.610934019 CEST	49867	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:40.610970020 CEST	49867	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:40.625047922 CEST	49869	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:40.625071049 CEST	443	49869	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:40.632347107 CEST	49869	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:40.632360935 CEST	443	49869	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:40.643486023 CEST	49868	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:40.658044100 CEST	49868	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:40.658070087 CEST	443	49868	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:40.664927959 CEST	49868	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:40.664940119 CEST	443	49868	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:40.668410063 CEST	49866	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:40.668446064 CEST	443	49866	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:40.668466091 CEST	49866	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:40.668473959 CEST	443	49866	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:40.669770002 CEST	49867	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:40.669811010 CEST	443	49867	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:40.669843912 CEST	49867	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:40.669852018 CEST	443	49867	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:40.673300028 CEST	49871	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:40.673332930 CEST	443	49871	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:40.673393965 CEST	49871	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:40.673532009 CEST	49871	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:40.673541069 CEST	443	49871	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:40.674644947 CEST	49872	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:40.674683094 CEST	443	49872	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:40.674732924 CEST	49872	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:40.675015926 CEST	49872	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:40.675025940 CEST	443	49872	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:40.732819080 CEST	443	49869	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:40.732862949 CEST	443	49869	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:40.732911110 CEST	443	49869	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:40.733000994 CEST	49869	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:40.733167887 CEST	49869	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:40.736804008 CEST	49869	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:40.736829042 CEST	443	49869	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:40.736841917 CEST	49869	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:40.736849070 CEST	443	49869	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:40.764661074 CEST	443	49868	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:40.766035080 CEST	443	49868	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:40.766110897 CEST	443	49868	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:40.766141891 CEST	49868	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:40.766307116 CEST	49868	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:40.792917013 CEST	49868	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:40.792943954 CEST	443	49868	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:40.792956114 CEST	49868	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:40.792962074 CEST	443	49868	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:40.794517040 CEST	49873	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:40.794554949 CEST	443	49873	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:40.794619083 CEST	49873	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:40.795629025 CEST	49873	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:40.795644045 CEST	443	49873	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:40.797175884 CEST	49874	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:40.797189951 CEST	443	49874	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:40.797256947 CEST	49874	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:40.797364950 CEST	49874	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:40.797374010 CEST	443	49874	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:40.986651897 CEST	443	49870	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:40.987493992 CEST	49870	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:40.987519979 CEST	443	49870	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:40.987891912 CEST	49870	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:40.987896919 CEST	443	49870	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:41.090327024 CEST	443	49870	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:41.090421915 CEST	443	49870	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:41.090584040 CEST	49870	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:41.090807915 CEST	49870	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:41.090827942 CEST	443	49870	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:41.090840101 CEST	49870	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:41.090845108 CEST	443	49870	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:41.094434023 CEST	49875	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:41.094484091 CEST	443	49875	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:41.094594002 CEST	49875	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:41.094799042 CEST	49875	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:41.094810009 CEST	443	49875	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:41.325136900 CEST	443	49871	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:41.325700998 CEST	49871	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:41.325721979 CEST	443	49871	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:41.326334000 CEST	49871	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:41.326338053 CEST	443	49871	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:41.362998009 CEST	443	49872	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:41.363435984 CEST	49872	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:41.363466978 CEST	443	49872	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:41.363859892 CEST	49872	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:41.363866091 CEST	443	49872	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:41.428469896 CEST	443	49871	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:41.428706884 CEST	443	49871	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:41.428761959 CEST	443	49871	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:41.428769112 CEST	49871	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:41.428826094 CEST	49871	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:41.428940058 CEST	49871	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:41.428956032 CEST	443	49871	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:41.428971052 CEST	49871	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:41.428976059 CEST	443	49871	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:41.432344913 CEST	49876	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:41.432384014 CEST	443	49876	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:41.432480097 CEST	49876	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:41.432677031 CEST	49876	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:41.432687998 CEST	443	49876	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:41.441133976 CEST	443	49873	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:41.441668034 CEST	49873	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:41.441694021 CEST	443	49873	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:41.442087889 CEST	49873	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:41.442095041 CEST	443	49873	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:41.455584049 CEST	443	49874	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:41.456260920 CEST	49874	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:41.456296921 CEST	443	49874	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:41.456882000 CEST	49874	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:41.456890106 CEST	443	49874	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:41.467170000 CEST	443	49872	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:41.467689991 CEST	443	49872	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:41.467767000 CEST	49872	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:41.467808008 CEST	49872	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:41.467824936 CEST	443	49872	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:41.467837095 CEST	49872	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:41.467844009 CEST	443	49872	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:41.470921040 CEST	49877	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:41.470973969 CEST	443	49877	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:41.471052885 CEST	49877	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:41.471215010 CEST	49877	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:41.471231937 CEST	443	49877	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:41.542588949 CEST	443	49873	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:41.542628050 CEST	443	49873	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:41.542742968 CEST	49873	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:41.542771101 CEST	443	49873	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:41.543042898 CEST	49873	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:41.543051004 CEST	443	49873	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:41.543066978 CEST	49873	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:41.543251991 CEST	443	49873	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:41.543292999 CEST	443	49873	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:41.543332100 CEST	49873	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:41.546205997 CEST	49878	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:41.546236992 CEST	443	49878	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:41.546323061 CEST	49878	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:41.546521902 CEST	49878	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:41.546533108 CEST	443	49878	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:41.556143999 CEST	443	49874	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:41.556173086 CEST	443	49874	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:41.556216955 CEST	443	49874	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:41.556232929 CEST	49874	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:41.556286097 CEST	49874	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:41.556505919 CEST	49874	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:41.556524992 CEST	443	49874	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:41.556539059 CEST	49874	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:41.556544065 CEST	443	49874	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:41.559438944 CEST	49879	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:41.559483051 CEST	443	49879	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:41.559556007 CEST	49879	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:41.559721947 CEST	49879	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:41.559731960 CEST	443	49879	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:41.743169069 CEST	443	49875	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:41.743777990 CEST	49875	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:41.743807077 CEST	443	49875	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:41.744232893 CEST	49875	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:41.744241953 CEST	443	49875	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:41.843615055 CEST	443	49875	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:41.843682051 CEST	443	49875	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:41.843729973 CEST	443	49875	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:41.843864918 CEST	49875	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:41.843864918 CEST	49875	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:41.843972921 CEST	49875	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:41.843993902 CEST	443	49875	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:41.844006062 CEST	49875	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:41.844011068 CEST	443	49875	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:41.846652985 CEST	49880	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:41.846702099 CEST	443	49880	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:41.846788883 CEST	49880	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:41.846920967 CEST	49880	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:41.846931934 CEST	443	49880	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:42.067950964 CEST	443	49876	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:42.068485022 CEST	49876	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:42.068511009 CEST	443	49876	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:42.068947077 CEST	49876	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:42.068952084 CEST	443	49876	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:42.117677927 CEST	443	49877	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:42.118208885 CEST	49877	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:42.118235111 CEST	443	49877	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:42.118578911 CEST	49877	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:42.118582964 CEST	443	49877	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:42.167401075 CEST	443	49876	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:42.167726040 CEST	443	49876	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:42.167810917 CEST	49876	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:42.167841911 CEST	49876	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:42.167841911 CEST	49876	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:42.167857885 CEST	443	49876	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:42.167865992 CEST	443	49876	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:42.170470953 CEST	49881	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:42.170512915 CEST	443	49881	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:42.170593977 CEST	49881	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:42.170734882 CEST	49881	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:42.170746088 CEST	443	49881	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:42.184118986 CEST	443	49878	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:42.184670925 CEST	49878	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:42.184696913 CEST	443	49878	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:42.185092926 CEST	49878	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:42.185097933 CEST	443	49878	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:42.214941025 CEST	443	49879	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:42.215325117 CEST	49879	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:42.215339899 CEST	443	49879	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:42.215773106 CEST	49879	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:42.215775967 CEST	443	49879	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:42.218149900 CEST	443	49877	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:42.218262911 CEST	443	49877	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:42.218312979 CEST	49877	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:42.218394995 CEST	49877	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:42.218411922 CEST	443	49877	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:42.218437910 CEST	49877	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:42.218442917 CEST	443	49877	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:42.221183062 CEST	49882	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:42.221225977 CEST	443	49882	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:42.221290112 CEST	49882	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:42.221461058 CEST	49882	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:42.221471071 CEST	443	49882	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:42.284152985 CEST	443	49878	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:42.284249067 CEST	443	49878	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:42.284306049 CEST	49878	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:42.284432888 CEST	49878	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:42.284449100 CEST	443	49878	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:42.284460068 CEST	49878	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:42.284466028 CEST	443	49878	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:42.288151979 CEST	49883	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:42.288194895 CEST	443	49883	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:42.288258076 CEST	49883	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:42.288435936 CEST	49883	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:42.288448095 CEST	443	49883	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:42.320094109 CEST	443	49879	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:42.320219994 CEST	443	49879	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:42.320266008 CEST	443	49879	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:42.320297956 CEST	49879	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:42.320334911 CEST	49879	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:42.320549965 CEST	49879	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:42.320563078 CEST	443	49879	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:42.320580006 CEST	49879	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:42.320585966 CEST	443	49879	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:42.323313951 CEST	49884	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:42.323369026 CEST	443	49884	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:42.323451996 CEST	49884	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:42.323616028 CEST	49884	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:42.323632002 CEST	443	49884	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:42.484306097 CEST	443	49880	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:42.484817028 CEST	49880	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:42.484860897 CEST	443	49880	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:42.485291004 CEST	49880	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:42.485301971 CEST	443	49880	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:42.588305950 CEST	443	49880	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:42.588789940 CEST	443	49880	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:42.588903904 CEST	49880	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:42.591200113 CEST	49880	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:42.591200113 CEST	49880	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:42.591236115 CEST	443	49880	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:42.591248035 CEST	443	49880	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:42.591820955 CEST	49885	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:42.591921091 CEST	443	49885	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:42.592012882 CEST	49885	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:42.592194080 CEST	49885	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:42.592220068 CEST	443	49885	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:42.834619045 CEST	443	49881	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:42.835282087 CEST	49881	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:42.835304976 CEST	443	49881	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:42.835748911 CEST	49881	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:42.835757971 CEST	443	49881	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:42.859126091 CEST	443	49882	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:42.859745979 CEST	49882	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:42.859755039 CEST	443	49882	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:42.860150099 CEST	49882	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:42.860152960 CEST	443	49882	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:42.938184023 CEST	443	49881	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:42.938776016 CEST	443	49881	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:42.938829899 CEST	443	49881	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:42.938855886 CEST	49881	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:42.938898087 CEST	49881	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:42.938949108 CEST	49881	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:42.938963890 CEST	443	49881	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:42.938975096 CEST	49881	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:42.938978910 CEST	443	49881	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:42.941956043 CEST	49886	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:42.941997051 CEST	443	49886	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:42.942084074 CEST	49886	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:42.942210913 CEST	49886	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:42.942220926 CEST	443	49886	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:42.949635983 CEST	443	49883	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:42.950079918 CEST	49883	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:42.950109959 CEST	443	49883	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:42.950510979 CEST	49883	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:42.950519085 CEST	443	49883	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:42.958405018 CEST	443	49882	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:42.958470106 CEST	443	49882	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:42.958540916 CEST	49882	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:42.965221882 CEST	49882	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:42.965225935 CEST	443	49882	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:42.968357086 CEST	49887	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:42.968413115 CEST	443	49887	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:42.968504906 CEST	49887	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:42.968668938 CEST	49887	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:42.968684912 CEST	443	49887	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:42.969715118 CEST	443	49884	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:42.970048904 CEST	49884	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:42.970063925 CEST	443	49884	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:42.970460892 CEST	49884	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:42.970467091 CEST	443	49884	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:43.048825026 CEST	443	49883	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:43.049061060 CEST	443	49883	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:43.049110889 CEST	49883	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:43.049125910 CEST	443	49883	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:43.049177885 CEST	49883	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:43.049205065 CEST	49883	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:43.049231052 CEST	443	49883	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:43.049241066 CEST	49883	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:43.049247980 CEST	443	49883	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:43.052057028 CEST	49888	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:43.052105904 CEST	443	49888	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:43.052170992 CEST	49888	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:43.052372932 CEST	49888	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:43.052387953 CEST	443	49888	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:43.071727037 CEST	443	49884	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:43.071943998 CEST	443	49884	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:43.072017908 CEST	49884	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:43.072057962 CEST	49884	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:43.072079897 CEST	443	49884	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:43.072094917 CEST	49884	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:43.072102070 CEST	443	49884	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:43.074409008 CEST	49889	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:43.074439049 CEST	443	49889	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:43.074503899 CEST	49889	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:43.074598074 CEST	49889	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:43.074604988 CEST	443	49889	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:43.226337910 CEST	443	49885	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:43.226882935 CEST	49885	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:43.226907969 CEST	443	49885	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:43.227513075 CEST	49885	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:43.227518082 CEST	443	49885	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:43.329252005 CEST	443	49885	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:43.329432011 CEST	443	49885	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:43.329490900 CEST	49885	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:43.329706907 CEST	49885	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:43.329725027 CEST	443	49885	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:43.329736948 CEST	49885	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:43.329742908 CEST	443	49885	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:43.332612991 CEST	49890	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:43.332636118 CEST	443	49890	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:43.332717896 CEST	49890	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:43.332876921 CEST	49890	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:43.332885981 CEST	443	49890	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:43.579969883 CEST	443	49886	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:43.580482960 CEST	49886	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:43.580513954 CEST	443	49886	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:43.581041098 CEST	49886	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:43.581046104 CEST	443	49886	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:43.600140095 CEST	443	49887	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:43.600619078 CEST	49887	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:43.600650072 CEST	443	49887	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:43.601102114 CEST	49887	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:43.601109028 CEST	443	49887	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:43.679472923 CEST	443	49886	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:43.679744005 CEST	443	49886	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:43.679843903 CEST	49886	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:43.679883003 CEST	49886	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:43.679899931 CEST	443	49886	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:43.679909945 CEST	49886	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:43.679914951 CEST	443	49886	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:43.683129072 CEST	49891	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:43.683196068 CEST	443	49891	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:43.683293104 CEST	49891	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:43.683465958 CEST	49891	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:43.683480024 CEST	443	49891	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:43.699733973 CEST	443	49888	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:43.699769020 CEST	443	49887	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:43.700069904 CEST	443	49887	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:43.700160027 CEST	49887	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:43.700187922 CEST	49887	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:43.700201035 CEST	443	49887	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:43.700326920 CEST	49888	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:43.700334072 CEST	443	49888	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:43.700783014 CEST	49888	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:43.700788021 CEST	443	49888	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:43.703130007 CEST	443	49889	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:43.703138113 CEST	49892	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:43.703183889 CEST	443	49892	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:43.703260899 CEST	49892	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:43.703428984 CEST	49892	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:43.703442097 CEST	443	49892	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:43.703545094 CEST	49889	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:43.703557014 CEST	443	49889	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:43.703936100 CEST	49889	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:43.703938961 CEST	443	49889	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:43.800609112 CEST	443	49888	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:43.800755978 CEST	443	49888	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:43.800841093 CEST	49888	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:43.800920963 CEST	49888	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:43.800971985 CEST	443	49888	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:43.801002026 CEST	49888	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:43.801018953 CEST	443	49888	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:43.803466082 CEST	49893	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:43.803512096 CEST	443	49893	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:43.803595066 CEST	49893	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:43.803733110 CEST	49893	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:43.803745031 CEST	443	49893	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:43.808162928 CEST	443	49889	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:43.808238029 CEST	443	49889	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:43.808309078 CEST	49889	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:43.808346033 CEST	443	49889	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:43.808401108 CEST	49889	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:43.808463097 CEST	49889	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:43.808505058 CEST	443	49889	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:43.808535099 CEST	49889	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:43.808551073 CEST	443	49889	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:43.810451984 CEST	49894	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:43.810486078 CEST	443	49894	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:43.810553074 CEST	49894	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:43.810657024 CEST	49894	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:43.810662985 CEST	443	49894	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:44.006270885 CEST	443	49890	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:44.011416912 CEST	49890	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:44.011445999 CEST	443	49890	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:44.012142897 CEST	49890	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:44.012147903 CEST	443	49890	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:44.112997055 CEST	443	49890	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:44.114161015 CEST	443	49890	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:44.114242077 CEST	49890	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:44.114327908 CEST	49890	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:44.114327908 CEST	49890	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:44.114376068 CEST	443	49890	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:44.114403009 CEST	443	49890	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:44.117194891 CEST	49895	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:44.117244005 CEST	443	49895	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:44.117302895 CEST	49895	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:44.117434978 CEST	49895	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:44.117449999 CEST	443	49895	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:44.320466995 CEST	443	49891	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:44.320885897 CEST	49891	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:44.320946932 CEST	443	49891	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:44.321355104 CEST	49891	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:44.321367979 CEST	443	49891	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:44.333586931 CEST	443	49892	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:44.334037066 CEST	49892	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:44.334074974 CEST	443	49892	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:44.334414959 CEST	49892	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:44.334423065 CEST	443	49892	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:44.419289112 CEST	443	49891	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:44.419774055 CEST	443	49891	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:44.419827938 CEST	443	49891	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:44.419845104 CEST	49891	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:44.419878960 CEST	49891	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:44.419922113 CEST	49891	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:44.419948101 CEST	443	49891	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:44.419965029 CEST	49891	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:44.419970989 CEST	443	49891	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:44.422514915 CEST	49896	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:44.422566891 CEST	443	49896	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:44.422643900 CEST	49896	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:44.422785044 CEST	49896	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:44.422795057 CEST	443	49896	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:44.433542967 CEST	443	49892	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:44.433610916 CEST	443	49892	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:44.433783054 CEST	49892	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:44.433783054 CEST	49892	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:44.433783054 CEST	49892	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:44.436206102 CEST	49897	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:44.436243057 CEST	443	49897	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:44.436325073 CEST	49897	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:44.436465025 CEST	49897	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:44.436475992 CEST	443	49897	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:44.438807011 CEST	443	49893	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:44.439174891 CEST	49893	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:44.439202070 CEST	443	49893	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:44.439594030 CEST	49893	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:44.439604998 CEST	443	49893	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:44.444592953 CEST	443	49894	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:44.444866896 CEST	49894	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:44.444885015 CEST	443	49894	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:44.445182085 CEST	49894	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:44.445188999 CEST	443	49894	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:44.538263083 CEST	443	49893	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:44.538600922 CEST	443	49893	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:44.538671017 CEST	443	49893	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:44.538702011 CEST	49893	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:44.538752079 CEST	49893	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:44.538779974 CEST	49893	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:44.538801908 CEST	443	49893	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:44.538813114 CEST	49893	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:44.538817883 CEST	443	49893	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:44.541629076 CEST	49898	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:44.541666031 CEST	443	49898	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:44.541845083 CEST	49898	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:44.541910887 CEST	49898	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:44.541918993 CEST	443	49898	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:44.544156075 CEST	443	49894	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:44.544341087 CEST	443	49894	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:44.544404030 CEST	49894	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:44.544418097 CEST	49894	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:44.544424057 CEST	443	49894	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:44.544431925 CEST	49894	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:44.544435024 CEST	443	49894	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:44.546133041 CEST	49899	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:44.546164036 CEST	443	49899	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:44.546232939 CEST	49899	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:44.546359062 CEST	49899	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:44.546366930 CEST	443	49899	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:44.659107924 CEST	49892	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:44.659147978 CEST	443	49892	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:44.766444921 CEST	443	49895	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:44.767568111 CEST	49895	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:44.767594099 CEST	443	49895	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:44.767980099 CEST	49895	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:44.767986059 CEST	443	49895	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:44.868603945 CEST	443	49895	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:44.868685007 CEST	443	49895	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:44.868792057 CEST	49895	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:44.868805885 CEST	443	49895	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:44.869012117 CEST	49895	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:44.869052887 CEST	443	49895	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:44.869071007 CEST	49895	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:44.869071007 CEST	49895	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:44.869079113 CEST	443	49895	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:44.869085073 CEST	443	49895	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:44.871618986 CEST	49900	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:44.871669054 CEST	443	49900	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:44.871747971 CEST	49900	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:44.872165918 CEST	49900	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:44.872179985 CEST	443	49900	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:45.070955992 CEST	443	49897	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:45.071702003 CEST	49897	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:45.071738958 CEST	443	49897	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:45.072145939 CEST	49897	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:45.072151899 CEST	443	49897	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:45.091032982 CEST	443	49896	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:45.091538906 CEST	49896	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:45.091602087 CEST	443	49896	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:45.091926098 CEST	49896	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:45.091938972 CEST	443	49896	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:45.170156002 CEST	443	49897	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:45.170173883 CEST	443	49897	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:45.170228958 CEST	443	49897	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:45.170286894 CEST	49897	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:45.170325041 CEST	49897	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:45.170543909 CEST	49897	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:45.170566082 CEST	443	49897	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:45.170581102 CEST	49897	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:45.170587063 CEST	443	49897	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:45.173249960 CEST	49901	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:45.173286915 CEST	443	49901	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:45.173362017 CEST	49901	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:45.173497915 CEST	49901	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:45.173516989 CEST	443	49901	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:45.190777063 CEST	443	49898	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:45.191950083 CEST	49898	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:45.191973925 CEST	443	49898	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:45.192178011 CEST	443	49899	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:45.192632914 CEST	49898	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:45.192641973 CEST	443	49898	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:45.192853928 CEST	49899	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:45.192874908 CEST	443	49899	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:45.193350077 CEST	49899	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:45.193355083 CEST	443	49899	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:45.195276022 CEST	443	49896	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:45.195370913 CEST	443	49896	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:45.195450068 CEST	49896	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:45.195744038 CEST	49896	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:45.195759058 CEST	443	49896	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:45.195772886 CEST	49896	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:45.195777893 CEST	443	49896	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:45.199485064 CEST	49902	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:45.199520111 CEST	443	49902	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:45.199639082 CEST	49902	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:45.199791908 CEST	49902	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:45.199801922 CEST	443	49902	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:45.293814898 CEST	443	49899	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:45.294078112 CEST	443	49899	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:45.294126987 CEST	443	49899	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:45.294132948 CEST	49899	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:45.294178009 CEST	49899	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:45.294637918 CEST	49899	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:45.294651985 CEST	443	49899	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:45.294672012 CEST	49899	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:45.294677019 CEST	443	49899	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:45.297153950 CEST	443	49898	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:45.297205925 CEST	443	49898	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:45.297287941 CEST	49898	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:45.297312021 CEST	443	49898	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:45.297367096 CEST	443	49898	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:45.297422886 CEST	49898	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:45.298562050 CEST	49898	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:45.298584938 CEST	443	49898	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:45.298604965 CEST	49898	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:45.298610926 CEST	443	49898	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:45.299109936 CEST	49903	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:45.299153090 CEST	443	49903	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:45.299252987 CEST	49903	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:45.299396038 CEST	49903	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:45.299407959 CEST	443	49903	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:45.302736044 CEST	49904	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:45.302762032 CEST	443	49904	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:45.302839041 CEST	49904	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:45.302958965 CEST	49904	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:45.302968979 CEST	443	49904	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:45.507214069 CEST	443	49900	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:45.507905960 CEST	49900	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:45.507952929 CEST	443	49900	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:45.508429050 CEST	49900	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:45.508445024 CEST	443	49900	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:45.606370926 CEST	443	49900	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:45.606637001 CEST	443	49900	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:45.606740952 CEST	49900	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:45.607007027 CEST	49900	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:45.607022047 CEST	443	49900	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:45.607047081 CEST	49900	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:45.607052088 CEST	443	49900	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:45.609808922 CEST	49905	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:45.609844923 CEST	443	49905	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:45.610023975 CEST	49905	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:45.610090971 CEST	49905	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:45.610104084 CEST	443	49905	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:45.835186958 CEST	443	49901	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:45.835867882 CEST	49901	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:45.835899115 CEST	443	49901	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:45.836365938 CEST	49901	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:45.836371899 CEST	443	49901	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:45.863136053 CEST	443	49902	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:45.863861084 CEST	49902	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:45.863873959 CEST	443	49902	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:45.864337921 CEST	49902	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:45.864341974 CEST	443	49902	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:45.938487053 CEST	443	49901	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:45.939052105 CEST	443	49901	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:45.939094067 CEST	49901	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:45.939109087 CEST	443	49901	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:45.939126015 CEST	443	49901	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:45.939176083 CEST	49901	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:45.939224958 CEST	49901	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:45.939240932 CEST	443	49901	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:45.939250946 CEST	49901	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:45.939255953 CEST	443	49901	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:45.939737082 CEST	443	49903	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:45.940500021 CEST	49903	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:45.940562010 CEST	443	49903	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:45.940946102 CEST	49903	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:45.940958977 CEST	443	49903	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:45.942761898 CEST	49906	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:45.942873955 CEST	443	49906	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:45.942974091 CEST	49906	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:45.943094015 CEST	49906	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:45.943125010 CEST	443	49906	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:45.963722944 CEST	443	49904	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:45.964083910 CEST	49904	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:45.964106083 CEST	443	49904	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:45.964525938 CEST	49904	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:45.964533091 CEST	443	49904	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:45.967469931 CEST	443	49902	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:45.967580080 CEST	443	49902	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:45.967633009 CEST	49902	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:45.967669010 CEST	49902	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:45.967683077 CEST	443	49902	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:45.967694998 CEST	49902	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:45.967699051 CEST	443	49902	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:45.969949007 CEST	49907	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:45.969984055 CEST	443	49907	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:45.970067024 CEST	49907	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:45.970190048 CEST	49907	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:45.970201969 CEST	443	49907	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:46.039187908 CEST	443	49903	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:46.039258003 CEST	443	49903	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:46.039320946 CEST	49903	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:46.039349079 CEST	443	49903	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:46.039374113 CEST	443	49903	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:46.039446115 CEST	49903	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:46.039621115 CEST	49903	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:46.039635897 CEST	443	49903	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:46.039644957 CEST	49903	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:46.039649963 CEST	443	49903	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:46.042501926 CEST	49908	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:46.042543888 CEST	443	49908	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:46.042644978 CEST	49908	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:46.042774916 CEST	49908	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:46.042783022 CEST	443	49908	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:46.068764925 CEST	443	49904	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:46.068846941 CEST	443	49904	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:46.068897963 CEST	49904	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:46.069108009 CEST	49904	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:46.069128036 CEST	443	49904	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:46.069139957 CEST	49904	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:46.069144964 CEST	443	49904	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:46.072101116 CEST	49909	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:46.072196007 CEST	443	49909	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:46.072300911 CEST	49909	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:46.072451115 CEST	49909	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:46.072484016 CEST	443	49909	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:46.244127989 CEST	443	49905	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:46.244657993 CEST	49905	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:46.244689941 CEST	443	49905	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:46.245129108 CEST	49905	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:46.245134115 CEST	443	49905	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:46.344348907 CEST	443	49905	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:46.344450951 CEST	443	49905	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:46.344506025 CEST	49905	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:46.344532967 CEST	443	49905	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:46.344569921 CEST	443	49905	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:46.344619989 CEST	49905	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:46.344769955 CEST	49905	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:46.344784021 CEST	443	49905	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:46.344794989 CEST	49905	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:46.344799995 CEST	443	49905	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:46.348027945 CEST	49910	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:46.348117113 CEST	443	49910	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:46.348195076 CEST	49910	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:46.348335981 CEST	49910	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:46.348355055 CEST	443	49910	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:46.765486956 CEST	443	49906	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:46.766252995 CEST	49906	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:46.766316891 CEST	443	49906	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:46.766743898 CEST	49906	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:46.766757965 CEST	443	49906	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:46.767309904 CEST	443	49907	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:46.767582893 CEST	49907	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:46.767607927 CEST	443	49907	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:46.767880917 CEST	49907	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:46.767887115 CEST	443	49907	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:46.772274971 CEST	443	49909	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:46.772512913 CEST	49909	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:46.772574902 CEST	443	49909	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:46.772790909 CEST	49909	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:46.772805929 CEST	443	49909	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:46.774317026 CEST	443	49908	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:46.774547100 CEST	49908	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:46.774605989 CEST	443	49908	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:46.774807930 CEST	49908	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:46.774822950 CEST	443	49908	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:46.866677046 CEST	443	49906	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:46.866758108 CEST	443	49906	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:46.866822958 CEST	49906	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:46.867079020 CEST	49906	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:46.867096901 CEST	443	49906	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:46.867151976 CEST	49906	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:46.867156982 CEST	443	49906	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:46.868396997 CEST	443	49907	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:46.868464947 CEST	443	49907	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:46.868519068 CEST	49907	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:46.868545055 CEST	443	49907	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:46.868586063 CEST	443	49907	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:46.868630886 CEST	49907	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:46.868877888 CEST	49907	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:46.868895054 CEST	443	49907	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:46.868905067 CEST	49907	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:46.868910074 CEST	443	49907	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:46.871362925 CEST	49911	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:46.871459961 CEST	443	49911	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:46.871551037 CEST	49911	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:46.872020960 CEST	443	49909	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:46.872198105 CEST	443	49909	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:46.872261047 CEST	49909	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:46.872353077 CEST	49912	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:46.872395039 CEST	443	49912	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:46.872457981 CEST	49912	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:46.872512102 CEST	49911	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:46.872543097 CEST	443	49911	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:46.872613907 CEST	49909	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:46.872639894 CEST	443	49909	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:46.872654915 CEST	49909	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:46.872663021 CEST	443	49909	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:46.874325037 CEST	49913	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:46.874411106 CEST	443	49913	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:46.874490023 CEST	49913	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:46.874528885 CEST	49912	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:46.874545097 CEST	443	49912	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:46.874634981 CEST	49913	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:46.874656916 CEST	443	49913	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:46.876435041 CEST	443	49908	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:46.876595020 CEST	443	49908	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:46.876660109 CEST	49908	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:46.876703024 CEST	49908	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:46.876703024 CEST	49908	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:46.876725912 CEST	443	49908	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:46.876745939 CEST	443	49908	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:46.878351927 CEST	49914	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:46.878372908 CEST	443	49914	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:46.878446102 CEST	49914	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:46.878541946 CEST	49914	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:46.878552914 CEST	443	49914	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:47.227369070 CEST	443	49910	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:47.228240967 CEST	49910	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:47.228282928 CEST	443	49910	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:47.228894949 CEST	49910	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:47.228908062 CEST	443	49910	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:47.327508926 CEST	443	49910	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:47.327558041 CEST	443	49910	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:47.327615976 CEST	443	49910	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:47.327651978 CEST	49910	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:47.327721119 CEST	49910	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:47.327971935 CEST	49910	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:47.328025103 CEST	443	49910	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:47.328063965 CEST	49910	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:47.328080893 CEST	443	49910	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:47.331418037 CEST	49915	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:47.331454992 CEST	443	49915	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:47.331525087 CEST	49915	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:47.331676006 CEST	49915	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:47.331687927 CEST	443	49915	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:47.519263983 CEST	443	49913	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:47.520006895 CEST	49913	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:47.520034075 CEST	443	49913	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:47.520412922 CEST	49913	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:47.520427942 CEST	443	49913	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:47.521965981 CEST	443	49914	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:47.522409916 CEST	49914	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:47.522444010 CEST	443	49914	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:47.522871017 CEST	49914	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:47.522881985 CEST	443	49914	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:47.523834944 CEST	443	49912	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:47.524198055 CEST	49912	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:47.524218082 CEST	443	49912	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:47.524749041 CEST	49912	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:47.524755955 CEST	443	49912	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:47.527832031 CEST	443	49911	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:47.528167963 CEST	49911	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:47.528225899 CEST	443	49911	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:47.528513908 CEST	49911	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:47.528527975 CEST	443	49911	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:47.619184971 CEST	443	49913	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:47.619256020 CEST	443	49913	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:47.619416952 CEST	443	49913	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:47.619421005 CEST	49913	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:47.619481087 CEST	49913	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:47.619600058 CEST	49913	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:47.619627953 CEST	443	49913	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:47.619649887 CEST	49913	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:47.619656086 CEST	443	49913	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:47.620511055 CEST	443	49914	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:47.620884895 CEST	443	49914	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:47.620954990 CEST	49914	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:47.621112108 CEST	49914	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:47.621115923 CEST	443	49914	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:47.621145010 CEST	49914	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:47.621149063 CEST	443	49914	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:47.624152899 CEST	49916	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:47.624191999 CEST	443	49916	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:47.624272108 CEST	49916	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:47.624449968 CEST	49916	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:47.624463081 CEST	443	49916	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:47.624985933 CEST	49917	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:47.625076056 CEST	443	49917	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:47.625161886 CEST	49917	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:47.625520945 CEST	49917	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:47.625555038 CEST	443	49917	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:47.626765013 CEST	443	49912	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:47.626864910 CEST	443	49912	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:47.626909018 CEST	49912	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:47.626972914 CEST	49912	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:47.626991987 CEST	443	49912	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:47.627002001 CEST	49912	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:47.627006054 CEST	443	49912	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:47.628680944 CEST	443	49911	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:47.628829002 CEST	443	49911	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:47.628894091 CEST	49911	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:47.629138947 CEST	49911	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:47.629177094 CEST	443	49911	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:47.629210949 CEST	49911	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:47.629225016 CEST	443	49911	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:47.631198883 CEST	49918	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:47.631223917 CEST	443	49918	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:47.631299973 CEST	49918	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:47.631454945 CEST	49918	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:47.631490946 CEST	443	49918	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:47.632296085 CEST	49919	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:47.632303953 CEST	443	49919	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:47.632360935 CEST	49919	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:47.632529020 CEST	49919	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:47.632541895 CEST	443	49919	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:47.980870008 CEST	443	49915	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:47.981451988 CEST	49915	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:47.981473923 CEST	443	49915	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:47.982223988 CEST	49915	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:47.982228994 CEST	443	49915	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:48.084713936 CEST	443	49915	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:48.084784985 CEST	443	49915	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:48.084870100 CEST	49915	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:48.084888935 CEST	443	49915	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:48.084912062 CEST	443	49915	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:48.085022926 CEST	49915	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:48.085263968 CEST	49915	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:48.085279942 CEST	443	49915	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:48.085290909 CEST	49915	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:48.085295916 CEST	443	49915	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:48.088563919 CEST	49920	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:48.088679075 CEST	443	49920	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:48.088782072 CEST	49920	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:48.088958979 CEST	49920	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:48.088994026 CEST	443	49920	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:48.264682055 CEST	443	49917	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:48.265310049 CEST	49917	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:48.265373945 CEST	443	49917	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:48.265978098 CEST	49917	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:48.265991926 CEST	443	49917	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:48.272011042 CEST	443	49916	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:48.272408009 CEST	49916	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:48.272437096 CEST	443	49916	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:48.272975922 CEST	49916	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:48.272979975 CEST	443	49916	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:48.287822962 CEST	443	49918	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:48.288237095 CEST	49918	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:48.288252115 CEST	443	49918	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:48.288579941 CEST	49918	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:48.288589954 CEST	443	49918	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:48.308523893 CEST	443	49919	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:48.308959961 CEST	49919	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:48.308979034 CEST	443	49919	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:48.309617043 CEST	49919	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:48.309621096 CEST	443	49919	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:48.364886999 CEST	443	49917	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:48.365210056 CEST	443	49917	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:48.365294933 CEST	49917	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:48.365398884 CEST	49917	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:48.365463018 CEST	443	49917	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:48.365498066 CEST	49917	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:48.365514040 CEST	443	49917	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:48.368585110 CEST	49921	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:48.368618965 CEST	443	49921	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:48.368715048 CEST	49921	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:48.368922949 CEST	49921	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:48.368937969 CEST	443	49921	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:48.373164892 CEST	443	49916	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:48.373352051 CEST	443	49916	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:48.373421907 CEST	49916	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:48.373450994 CEST	49916	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:48.373471975 CEST	443	49916	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:48.373486042 CEST	49916	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:48.373491049 CEST	443	49916	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:48.375479937 CEST	49922	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:48.375488043 CEST	443	49922	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:48.375572920 CEST	49922	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:48.375739098 CEST	49922	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:48.375750065 CEST	443	49922	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:48.389377117 CEST	443	49918	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:48.389688969 CEST	443	49918	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:48.389740944 CEST	443	49918	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:48.389755011 CEST	49918	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:48.389806986 CEST	49918	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:48.389862061 CEST	49918	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:48.389884949 CEST	443	49918	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:48.389933109 CEST	49918	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:48.389945030 CEST	443	49918	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:48.392096043 CEST	49923	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:48.392174959 CEST	443	49923	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:48.392280102 CEST	49923	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:48.392441034 CEST	49923	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:48.392469883 CEST	443	49923	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:48.411148071 CEST	443	49919	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:48.411364079 CEST	443	49919	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:48.411441088 CEST	49919	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:48.411498070 CEST	49919	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:48.411504030 CEST	443	49919	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:48.411511898 CEST	49919	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:48.411515951 CEST	443	49919	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:48.413847923 CEST	49924	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:48.413883924 CEST	443	49924	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:48.413961887 CEST	49924	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:48.414113045 CEST	49924	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:48.414127111 CEST	443	49924	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:48.766817093 CEST	443	49920	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:48.767436981 CEST	49920	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:48.767518044 CEST	443	49920	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:48.768234968 CEST	49920	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:48.768248081 CEST	443	49920	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:48.873119116 CEST	443	49920	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:48.873346090 CEST	443	49920	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:48.873550892 CEST	49920	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:48.873697996 CEST	49920	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:48.873719931 CEST	443	49920	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:48.873732090 CEST	49920	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:48.873739004 CEST	443	49920	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:48.877448082 CEST	49925	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:48.877496958 CEST	443	49925	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:48.877615929 CEST	49925	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:48.877896070 CEST	49925	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:48.877907991 CEST	443	49925	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:49.006226063 CEST	443	49921	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:49.006822109 CEST	49921	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:49.006839037 CEST	443	49921	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:49.007483959 CEST	49921	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:49.007489920 CEST	443	49921	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:49.033229113 CEST	443	49923	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:49.033869982 CEST	49923	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:49.033900976 CEST	443	49923	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:49.035765886 CEST	443	49922	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:49.038835049 CEST	49923	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:49.038851976 CEST	443	49923	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:49.039516926 CEST	49922	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:49.039541006 CEST	443	49922	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:49.040039062 CEST	49922	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:49.040046930 CEST	443	49922	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:49.080477953 CEST	443	49924	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:49.081069946 CEST	49924	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:49.081147909 CEST	443	49924	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:49.081500053 CEST	49924	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:49.081515074 CEST	443	49924	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:49.105370998 CEST	443	49921	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:49.105402946 CEST	443	49921	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:49.105460882 CEST	443	49921	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:49.105489969 CEST	49921	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:49.105541945 CEST	49921	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:49.105837107 CEST	49921	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:49.105855942 CEST	443	49921	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:49.105890989 CEST	49921	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:49.105896950 CEST	443	49921	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:49.109405994 CEST	49926	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:49.109441996 CEST	443	49926	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:49.109524012 CEST	49926	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:49.109708071 CEST	49926	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:49.109724045 CEST	443	49926	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:49.135056973 CEST	443	49923	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:49.135464907 CEST	443	49923	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:49.135526896 CEST	443	49923	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:49.135545015 CEST	49923	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:49.135596991 CEST	49923	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:49.135636091 CEST	49923	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:49.135675907 CEST	443	49923	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:49.135703087 CEST	49923	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:49.135719061 CEST	443	49923	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:49.138284922 CEST	49927	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:49.138370991 CEST	443	49927	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:49.138475895 CEST	49927	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:49.138586044 CEST	49927	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:49.138617992 CEST	443	49927	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:49.141801119 CEST	443	49922	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:49.142105103 CEST	443	49922	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:49.142167091 CEST	49922	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:49.142210007 CEST	49922	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:49.142229080 CEST	443	49922	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:49.142263889 CEST	49922	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:49.142268896 CEST	443	49922	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:49.144315004 CEST	49928	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:49.144403934 CEST	443	49928	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:49.144486904 CEST	49928	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:49.144599915 CEST	49928	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:49.144639015 CEST	443	49928	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:49.182821035 CEST	443	49924	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:49.183003902 CEST	443	49924	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:49.183113098 CEST	49924	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:49.202687979 CEST	49924	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:49.202712059 CEST	443	49924	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:49.205302954 CEST	49929	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:49.205336094 CEST	443	49929	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:49.205409050 CEST	49929	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:49.205552101 CEST	49929	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:49.205564976 CEST	443	49929	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:49.559231997 CEST	443	49925	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:49.559667110 CEST	49925	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:49.559710026 CEST	443	49925	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:49.560092926 CEST	49925	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:49.560108900 CEST	443	49925	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:49.676789999 CEST	443	49925	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:49.677110910 CEST	443	49925	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:49.677186966 CEST	49925	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:49.677243948 CEST	49925	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:49.677267075 CEST	443	49925	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:49.677278042 CEST	49925	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:49.677284956 CEST	443	49925	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:49.679682970 CEST	49930	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:49.679719925 CEST	443	49930	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:49.679791927 CEST	49930	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:49.679913998 CEST	49930	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:49.679922104 CEST	443	49930	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:49.775988102 CEST	443	49926	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:49.776488066 CEST	49926	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:49.776519060 CEST	443	49926	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:49.776925087 CEST	49926	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:49.776936054 CEST	443	49926	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:49.788163900 CEST	443	49928	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:49.788923025 CEST	49928	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:49.788980961 CEST	443	49928	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:49.789315939 CEST	49928	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:49.789330006 CEST	443	49928	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:49.789367914 CEST	443	49927	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:49.789783001 CEST	49927	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:49.789864063 CEST	443	49927	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:49.790096045 CEST	49927	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:49.790110111 CEST	443	49927	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:49.856923103 CEST	443	49929	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:49.857378006 CEST	49929	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:49.857403994 CEST	443	49929	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:49.857774973 CEST	49929	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:49.857781887 CEST	443	49929	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:49.880352974 CEST	443	49926	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:49.880530119 CEST	443	49926	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:49.880608082 CEST	49926	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:49.880671978 CEST	49926	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:49.880701065 CEST	443	49926	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:49.880712986 CEST	49926	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:49.880719900 CEST	443	49926	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:49.883105993 CEST	49931	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:49.883210897 CEST	443	49931	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:49.883296967 CEST	49931	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:49.883537054 CEST	49931	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:49.883567095 CEST	443	49931	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:49.889820099 CEST	443	49928	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:49.889974117 CEST	443	49928	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:49.890044928 CEST	49928	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:49.890089035 CEST	49928	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:49.890089989 CEST	49928	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:49.890113115 CEST	443	49928	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:49.890135050 CEST	443	49928	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:49.891755104 CEST	49932	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:49.891844988 CEST	443	49932	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:49.891927958 CEST	49932	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:49.891937017 CEST	443	49927	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:49.892002106 CEST	443	49927	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:49.892016888 CEST	49932	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:49.892040014 CEST	443	49932	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:49.892050028 CEST	49927	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:49.892055988 CEST	443	49927	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:49.892097950 CEST	49927	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:49.892117977 CEST	49927	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:49.892141104 CEST	443	49927	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:49.892153025 CEST	49927	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:49.892159939 CEST	443	49927	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:49.893744946 CEST	49933	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:49.893835068 CEST	443	49933	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:49.893927097 CEST	49933	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:49.894015074 CEST	49933	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:49.894046068 CEST	443	49933	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:49.957439899 CEST	443	49929	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:49.957500935 CEST	443	49929	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:49.957562923 CEST	49929	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:49.957587957 CEST	443	49929	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:49.957609892 CEST	443	49929	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:49.957660913 CEST	49929	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:49.957806110 CEST	49929	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:49.957818985 CEST	443	49929	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:49.957828045 CEST	49929	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:49.957838058 CEST	443	49929	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:49.960083008 CEST	49934	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:49.960191011 CEST	443	49934	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:49.960278988 CEST	49934	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:49.960424900 CEST	49934	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:49.960443974 CEST	443	49934	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:50.329808950 CEST	443	49930	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:50.330305099 CEST	49930	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:50.330322981 CEST	443	49930	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:50.330780983 CEST	49930	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:50.330785990 CEST	443	49930	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:50.432003975 CEST	443	49930	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:50.432183027 CEST	443	49930	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:50.432287931 CEST	49930	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:50.432403088 CEST	49930	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:50.432420969 CEST	443	49930	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:50.432430983 CEST	49930	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:50.432435989 CEST	443	49930	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:50.435331106 CEST	49935	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:50.435456991 CEST	443	49935	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:50.435559988 CEST	49935	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:50.435719013 CEST	49935	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:50.435754061 CEST	443	49935	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:50.523827076 CEST	443	49931	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:50.526917934 CEST	49931	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:50.526984930 CEST	443	49931	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:50.527314901 CEST	49931	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:50.527331114 CEST	443	49931	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:50.531538010 CEST	443	49932	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:50.531965017 CEST	49932	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:50.532027960 CEST	443	49932	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:50.532296896 CEST	49932	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:50.532311916 CEST	443	49932	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:50.558460951 CEST	443	49933	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:50.558902025 CEST	49933	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:50.558974981 CEST	443	49933	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:50.559247971 CEST	49933	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:50.559262037 CEST	443	49933	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:50.607088089 CEST	443	49934	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:50.607624054 CEST	49934	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:50.607726097 CEST	443	49934	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:50.608211040 CEST	49934	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:50.608233929 CEST	443	49934	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:50.624224901 CEST	443	49931	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:50.624294043 CEST	443	49931	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:50.624360085 CEST	49931	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:50.624414921 CEST	443	49931	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:50.624449968 CEST	443	49931	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:50.624505997 CEST	49931	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:50.624566078 CEST	49931	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:50.624600887 CEST	443	49931	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:50.624625921 CEST	49931	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:50.624640942 CEST	443	49931	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:50.627656937 CEST	49936	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:50.627748966 CEST	443	49936	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:50.627829075 CEST	49936	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:50.627938032 CEST	49936	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:50.627968073 CEST	443	49936	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:50.630141020 CEST	443	49932	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:50.630665064 CEST	443	49932	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:50.630768061 CEST	49932	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:50.630842924 CEST	49932	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:50.630842924 CEST	49932	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:50.630889893 CEST	443	49932	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:50.630923986 CEST	443	49932	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:50.633174896 CEST	49937	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:50.633215904 CEST	443	49937	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:50.633275032 CEST	49937	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:50.633438110 CEST	49937	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:50.633459091 CEST	443	49937	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:50.676037073 CEST	443	49933	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:50.676202059 CEST	443	49933	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:50.676276922 CEST	49933	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:50.676430941 CEST	49933	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:50.676477909 CEST	443	49933	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:50.676506996 CEST	49933	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:50.676522970 CEST	443	49933	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:50.679024935 CEST	49938	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:50.679085016 CEST	443	49938	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:50.679173946 CEST	49938	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:50.679347038 CEST	49938	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:50.679404974 CEST	443	49938	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:50.706012011 CEST	443	49934	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:50.706208944 CEST	443	49934	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:50.706289053 CEST	49934	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:50.706327915 CEST	49934	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:50.706327915 CEST	49934	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:50.706346989 CEST	443	49934	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:50.706367016 CEST	443	49934	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:50.708894014 CEST	49939	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:50.709002972 CEST	443	49939	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:50.709114075 CEST	49939	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:50.709264994 CEST	49939	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:50.709301949 CEST	443	49939	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:51.117286921 CEST	443	49935	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:51.117901087 CEST	49935	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:51.117952108 CEST	443	49935	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:51.118443012 CEST	49935	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:51.118458033 CEST	443	49935	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:51.221510887 CEST	443	49935	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:51.221633911 CEST	443	49935	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:51.221678019 CEST	443	49935	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:51.221699953 CEST	49935	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:51.221769094 CEST	49935	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:51.221887112 CEST	49935	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:51.221887112 CEST	49935	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:51.221934080 CEST	443	49935	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:51.221961975 CEST	443	49935	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:51.225061893 CEST	49940	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:51.225090027 CEST	443	49940	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:51.225147963 CEST	49940	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:51.225321054 CEST	49940	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:51.225334883 CEST	443	49940	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:51.279645920 CEST	443	49936	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:51.280242920 CEST	49936	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:51.280313969 CEST	443	49936	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:51.280709028 CEST	49936	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:51.280725002 CEST	443	49936	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:51.304178953 CEST	443	49937	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:51.304606915 CEST	49937	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:51.304650068 CEST	443	49937	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:51.305203915 CEST	49937	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:51.305213928 CEST	443	49937	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:51.321892023 CEST	443	49938	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:51.322216034 CEST	49938	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:51.322227001 CEST	443	49938	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:51.322726011 CEST	49938	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:51.322731018 CEST	443	49938	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:51.361072063 CEST	443	49939	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:51.361603022 CEST	49939	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:51.361666918 CEST	443	49939	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:51.362226009 CEST	49939	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:51.362240076 CEST	443	49939	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:51.381807089 CEST	443	49936	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:51.382395029 CEST	443	49936	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:51.382467985 CEST	49936	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:51.389202118 CEST	49936	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:51.389225960 CEST	443	49936	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:51.389240980 CEST	49936	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:51.389249086 CEST	443	49936	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:51.391640902 CEST	49941	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:51.391735077 CEST	443	49941	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:51.391848087 CEST	49941	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:51.391952991 CEST	49941	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:51.391984940 CEST	443	49941	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:51.407067060 CEST	443	49937	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:51.407236099 CEST	443	49937	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:51.407342911 CEST	49937	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:51.407444954 CEST	49937	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:51.407444954 CEST	49937	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:51.407489061 CEST	443	49937	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:51.407516003 CEST	443	49937	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:51.409554005 CEST	49942	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:51.409583092 CEST	443	49942	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:51.409658909 CEST	49942	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:51.409766912 CEST	49942	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:51.409790039 CEST	443	49942	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:51.425862074 CEST	443	49938	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:51.426022053 CEST	443	49938	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:51.426124096 CEST	49938	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:51.426161051 CEST	49938	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:51.426182985 CEST	443	49938	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:51.426208019 CEST	49938	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:51.426222086 CEST	443	49938	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:51.428133011 CEST	49943	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:51.428159952 CEST	443	49943	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:51.428236008 CEST	49943	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:51.428339958 CEST	49943	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:51.428354979 CEST	443	49943	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:51.463159084 CEST	443	49939	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:51.463571072 CEST	443	49939	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:51.463820934 CEST	49939	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:51.463820934 CEST	49939	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:51.463820934 CEST	49939	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:51.466113091 CEST	49944	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:51.466201067 CEST	443	49944	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:51.466312885 CEST	49944	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:51.466428995 CEST	49944	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:51.466450930 CEST	443	49944	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:51.768387079 CEST	49939	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:51.768423080 CEST	443	49939	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:51.866393089 CEST	443	49940	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:51.915354013 CEST	49940	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:51.933970928 CEST	49940	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:51.933988094 CEST	443	49940	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:51.934581995 CEST	49940	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:51.934593916 CEST	443	49940	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:52.030985117 CEST	443	49940	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:52.031666040 CEST	443	49940	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:52.031728983 CEST	49940	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:52.031821966 CEST	49940	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:52.031841993 CEST	443	49940	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:52.031857014 CEST	49940	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:52.031862974 CEST	443	49940	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:52.041486979 CEST	443	49941	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:52.054115057 CEST	49941	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:52.054174900 CEST	443	49941	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:52.058970928 CEST	443	49942	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:52.062206030 CEST	49941	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:52.062220097 CEST	443	49941	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:52.066878080 CEST	49942	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:52.066907883 CEST	443	49942	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:52.075344086 CEST	49942	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:52.075354099 CEST	443	49942	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:52.093022108 CEST	49945	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:52.093117952 CEST	443	49945	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:52.093211889 CEST	49945	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:52.097347021 CEST	49945	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:52.097382069 CEST	443	49945	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:52.109755993 CEST	443	49943	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:52.110877037 CEST	49943	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:52.110896111 CEST	443	49943	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:52.111527920 CEST	49943	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:52.111537933 CEST	443	49943	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:52.124660969 CEST	443	49944	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:52.127696037 CEST	49944	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:52.127758026 CEST	443	49944	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:52.135852098 CEST	49944	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:52.135868073 CEST	443	49944	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:52.159382105 CEST	443	49941	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:52.159485102 CEST	443	49941	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:52.159657001 CEST	49941	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:52.159739971 CEST	49941	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:52.159739971 CEST	49941	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:52.159785032 CEST	443	49941	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:52.159816027 CEST	443	49941	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:52.176261902 CEST	443	49942	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:52.176419973 CEST	443	49942	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:52.176589012 CEST	49942	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:52.179913044 CEST	49942	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:52.179934978 CEST	443	49942	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:52.184514046 CEST	49946	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:52.184604883 CEST	443	49946	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:52.184696913 CEST	49946	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:52.184978008 CEST	49946	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:52.185028076 CEST	443	49946	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:52.185722113 CEST	49947	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:52.185785055 CEST	443	49947	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:52.185859919 CEST	49947	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:52.185990095 CEST	49947	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:52.186019897 CEST	443	49947	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:52.216029882 CEST	443	49943	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:52.216111898 CEST	443	49943	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:52.216161966 CEST	49943	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:52.216181993 CEST	443	49943	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:52.216228962 CEST	443	49943	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:52.216270924 CEST	49943	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:52.223592043 CEST	49943	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:52.223614931 CEST	443	49943	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:52.223628998 CEST	49943	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:52.223634958 CEST	443	49943	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:52.225738049 CEST	49948	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:52.225769997 CEST	443	49948	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:52.225841999 CEST	49948	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:52.225958109 CEST	49948	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:52.225964069 CEST	443	49948	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:52.235949039 CEST	443	49944	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:52.236105919 CEST	443	49944	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:52.236176968 CEST	49944	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:52.236691952 CEST	49944	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:52.236726046 CEST	443	49944	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:52.236752987 CEST	49944	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:52.236767054 CEST	443	49944	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:52.238933086 CEST	49949	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:52.239022970 CEST	443	49949	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:52.239097118 CEST	49949	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:52.239221096 CEST	49949	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:52.239244938 CEST	443	49949	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:52.757179022 CEST	443	49945	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:52.757872105 CEST	49945	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:52.757905006 CEST	443	49945	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:52.758408070 CEST	49945	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:52.758414984 CEST	443	49945	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:52.826184988 CEST	443	49946	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:52.827050924 CEST	49946	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:52.827090025 CEST	443	49946	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:52.827501059 CEST	49946	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:52.827512980 CEST	443	49946	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:52.858792067 CEST	443	49945	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:52.858836889 CEST	443	49945	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:52.858896017 CEST	443	49945	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:52.859014034 CEST	49945	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:52.859014034 CEST	49945	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:52.859148979 CEST	49945	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:52.859148979 CEST	49945	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:52.859185934 CEST	443	49945	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:52.859210968 CEST	443	49945	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:52.862318993 CEST	49950	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:52.862411022 CEST	443	49950	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:52.862494946 CEST	49950	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:52.862617016 CEST	49950	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:52.862648010 CEST	443	49950	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:52.867258072 CEST	443	49947	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:52.867578983 CEST	49947	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:52.867640018 CEST	443	49947	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:52.867991924 CEST	49947	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:52.868005991 CEST	443	49947	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:52.890944958 CEST	443	49948	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:52.891372919 CEST	49948	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:52.891397953 CEST	443	49948	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:52.891916990 CEST	49948	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:52.891927004 CEST	443	49948	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:52.909781933 CEST	443	49949	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:52.910204887 CEST	49949	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:52.910232067 CEST	443	49949	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:52.910733938 CEST	49949	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:52.910746098 CEST	443	49949	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:52.925414085 CEST	443	49946	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:52.925549984 CEST	443	49946	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:52.925607920 CEST	49946	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:52.925687075 CEST	49946	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:52.925710917 CEST	443	49946	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:52.925734043 CEST	49946	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:52.925749063 CEST	443	49946	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:52.929408073 CEST	49951	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:52.929441929 CEST	443	49951	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:52.929523945 CEST	49951	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:52.929704905 CEST	49951	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:52.929718018 CEST	443	49951	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:52.972863913 CEST	443	49947	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:52.972933054 CEST	443	49947	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:52.973022938 CEST	49947	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:52.973046064 CEST	443	49947	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:52.973074913 CEST	443	49947	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:52.973256111 CEST	49947	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:52.973256111 CEST	49947	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:52.973256111 CEST	49947	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:52.976922989 CEST	49952	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:52.976943970 CEST	443	49952	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:52.977030993 CEST	49952	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:52.977176905 CEST	49952	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:52.977190018 CEST	443	49952	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:52.994226933 CEST	443	49948	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:52.994388103 CEST	443	49948	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:52.994579077 CEST	49948	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:52.994579077 CEST	49948	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:52.994579077 CEST	49948	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:52.996335030 CEST	49953	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:52.996378899 CEST	443	49953	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:52.996454954 CEST	49953	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:52.996589899 CEST	49953	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:52.996609926 CEST	443	49953	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:53.013093948 CEST	443	49949	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:53.013292074 CEST	443	49949	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:53.013469934 CEST	49949	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:53.013470888 CEST	49949	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:53.013470888 CEST	49949	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:53.015887022 CEST	49954	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:53.015913963 CEST	443	49954	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:53.016002893 CEST	49954	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:53.016146898 CEST	49954	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:53.016172886 CEST	443	49954	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:53.190442085 CEST	49947	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:53.190507889 CEST	443	49947	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:53.299686909 CEST	49948	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:53.299731970 CEST	443	49948	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:53.315313101 CEST	49949	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:53.315355062 CEST	443	49949	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:53.514713049 CEST	443	49950	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:53.515444040 CEST	49950	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:53.515501976 CEST	443	49950	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:53.516180038 CEST	49950	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:53.516194105 CEST	443	49950	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:53.586050987 CEST	443	49951	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:53.586683035 CEST	49951	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:53.586709023 CEST	443	49951	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:53.587332964 CEST	49951	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:53.587352991 CEST	443	49951	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:53.614691019 CEST	443	49950	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:53.615041971 CEST	443	49950	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:53.615256071 CEST	49950	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:53.615256071 CEST	49950	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:53.615256071 CEST	49950	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:53.618746996 CEST	49955	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:53.618789911 CEST	443	49955	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:53.618881941 CEST	49955	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:53.619041920 CEST	49955	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:53.619055986 CEST	443	49955	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:53.637934923 CEST	443	49953	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:53.647452116 CEST	49953	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:53.647478104 CEST	443	49953	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:53.648323059 CEST	49953	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:53.648334026 CEST	443	49953	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:53.675081015 CEST	443	49954	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:53.675769091 CEST	49954	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:53.675781965 CEST	443	49954	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:53.676476002 CEST	49954	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:53.676485062 CEST	443	49954	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:53.685746908 CEST	443	49951	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:53.686034918 CEST	443	49951	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:53.686137915 CEST	49951	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:53.686145067 CEST	443	49951	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:53.686316013 CEST	49951	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:53.686316013 CEST	49951	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:53.686316013 CEST	49951	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:53.689773083 CEST	49956	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:53.689824104 CEST	443	49956	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:53.689913034 CEST	49956	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:53.690078020 CEST	49956	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:53.690095901 CEST	443	49956	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:53.744014978 CEST	443	49953	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:53.744168043 CEST	443	49953	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:53.744407892 CEST	49953	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:53.744446039 CEST	49953	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:53.744479895 CEST	443	49953	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:53.744503975 CEST	49953	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:53.744519949 CEST	443	49953	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:53.748152018 CEST	49957	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:53.748260021 CEST	443	49957	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:53.748373032 CEST	49957	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:53.748568058 CEST	49957	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:53.748603106 CEST	443	49957	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:53.776067019 CEST	443	49954	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:53.776122093 CEST	443	49954	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:53.776243925 CEST	443	49954	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:53.776328087 CEST	49954	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:53.776328087 CEST	49954	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:53.776519060 CEST	49954	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:53.776537895 CEST	443	49954	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:53.776560068 CEST	49954	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:53.776570082 CEST	443	49954	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:53.779683113 CEST	49958	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:53.779709101 CEST	443	49958	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:53.779803991 CEST	49958	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:53.779994011 CEST	49958	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:53.780020952 CEST	443	49958	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:53.924735069 CEST	49950	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:53.924798012 CEST	443	49950	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:53.938929081 CEST	443	49952	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:53.939718008 CEST	49952	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:53.939759016 CEST	443	49952	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:53.940148115 CEST	49952	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:53.940172911 CEST	443	49952	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:53.987215996 CEST	49951	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:53.987248898 CEST	443	49951	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:54.044425011 CEST	443	49952	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:54.044593096 CEST	443	49952	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:54.045001984 CEST	49952	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:54.045001984 CEST	49952	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:54.045056105 CEST	49952	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:54.045072079 CEST	443	49952	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:54.048623085 CEST	49959	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:54.048713923 CEST	443	49959	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:54.048814058 CEST	49959	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:54.049040079 CEST	49959	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:54.049072027 CEST	443	49959	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:54.255919933 CEST	443	49955	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:54.256594896 CEST	49955	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:54.256628036 CEST	443	49955	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:54.257138014 CEST	49955	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:54.257143974 CEST	443	49955	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:54.332930088 CEST	443	49956	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:54.333841085 CEST	49956	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:54.333879948 CEST	443	49956	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:54.334738016 CEST	49956	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:54.334744930 CEST	443	49956	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:54.356303930 CEST	443	49955	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:54.356378078 CEST	443	49955	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:54.356426954 CEST	49955	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:54.365941048 CEST	49955	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:54.365957022 CEST	443	49955	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:54.374939919 CEST	49960	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:54.374968052 CEST	443	49960	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:54.375030041 CEST	49960	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:54.375873089 CEST	49960	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:54.375885963 CEST	443	49960	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:54.384572029 CEST	443	49957	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:54.384960890 CEST	49957	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:54.385026932 CEST	443	49957	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:54.385438919 CEST	49957	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:54.385452986 CEST	443	49957	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:54.419828892 CEST	443	49958	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:54.420376062 CEST	49958	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:54.420393944 CEST	443	49958	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:54.420800924 CEST	49958	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:54.420810938 CEST	443	49958	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:54.431726933 CEST	443	49956	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:54.431781054 CEST	443	49956	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:54.431837082 CEST	49956	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:54.431870937 CEST	443	49956	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:54.432229042 CEST	49956	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:54.432249069 CEST	443	49956	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:54.432259083 CEST	49956	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:54.432570934 CEST	443	49956	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:54.432715893 CEST	443	49956	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:54.432765961 CEST	49956	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:54.437432051 CEST	49961	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:54.437525034 CEST	443	49961	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:54.437604904 CEST	49961	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:54.438391924 CEST	49961	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:54.438430071 CEST	443	49961	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:54.484160900 CEST	443	49957	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:54.484220982 CEST	443	49957	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:54.484277010 CEST	49957	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:54.484302998 CEST	443	49957	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:54.484733105 CEST	443	49957	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:54.484803915 CEST	49957	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:54.486512899 CEST	49957	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:54.486543894 CEST	443	49957	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:54.486572027 CEST	49957	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:54.486584902 CEST	443	49957	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:54.489406109 CEST	49962	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:54.489504099 CEST	443	49962	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:54.489696980 CEST	49962	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:54.489772081 CEST	49962	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:54.489792109 CEST	443	49962	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:54.517581940 CEST	443	49958	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:54.517651081 CEST	443	49958	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:54.517843008 CEST	49958	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:54.517908096 CEST	443	49958	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:54.518286943 CEST	443	49958	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:54.518580914 CEST	49958	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:54.589432955 CEST	49958	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:54.589432955 CEST	49958	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:54.589497089 CEST	443	49958	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:54.589531898 CEST	443	49958	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:54.689126015 CEST	443	49959	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:54.737335920 CEST	49959	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:54.818876982 CEST	49959	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:54.818941116 CEST	443	49959	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:54.819303036 CEST	49959	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:54.819320917 CEST	443	49959	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:54.832464933 CEST	49963	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:54.832492113 CEST	443	49963	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:54.832560062 CEST	49963	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:54.832736969 CEST	49963	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:54.832751989 CEST	443	49963	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:54.914722919 CEST	443	49959	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:54.914772987 CEST	443	49959	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:54.914908886 CEST	443	49959	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:54.914946079 CEST	49959	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:54.915008068 CEST	49959	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:54.915141106 CEST	49959	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:54.915195942 CEST	443	49959	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:54.915294886 CEST	49959	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:54.915309906 CEST	443	49959	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:54.918144941 CEST	49964	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:54.918195009 CEST	443	49964	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:54.918282032 CEST	49964	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:54.918459892 CEST	49964	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:54.918482065 CEST	443	49964	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:55.015093088 CEST	443	49960	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:55.015883923 CEST	49960	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:55.015902042 CEST	443	49960	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:55.016238928 CEST	49960	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:55.016243935 CEST	443	49960	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:55.115252972 CEST	443	49960	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:55.115319014 CEST	443	49960	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:55.115396023 CEST	49960	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:55.115724087 CEST	49960	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:55.115724087 CEST	49960	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:55.115741968 CEST	443	49960	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:55.115750074 CEST	443	49960	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:55.118901968 CEST	49965	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:55.118957996 CEST	443	49965	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:55.119052887 CEST	49965	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:55.119229078 CEST	49965	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:55.119246960 CEST	443	49965	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:55.126403093 CEST	443	49961	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:55.126945972 CEST	49961	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:55.127022982 CEST	443	49961	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:55.127288103 CEST	49961	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:55.127304077 CEST	443	49961	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:55.132754087 CEST	443	49962	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:55.133064032 CEST	49962	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:55.133080006 CEST	443	49962	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:55.133375883 CEST	49962	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:55.133387089 CEST	443	49962	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:55.225614071 CEST	443	49961	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:55.225776911 CEST	443	49961	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:55.225878000 CEST	49961	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:55.226294994 CEST	49961	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:55.226294994 CEST	49961	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:55.226320982 CEST	443	49961	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:55.226336002 CEST	443	49961	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:55.229098082 CEST	49966	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:55.229151011 CEST	443	49966	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:55.229243994 CEST	49966	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:55.229397058 CEST	49966	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:55.229408979 CEST	443	49966	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:55.232289076 CEST	443	49962	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:55.232455969 CEST	443	49962	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:55.232518911 CEST	49962	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:55.232553005 CEST	49962	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:55.232562065 CEST	443	49962	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:55.232578039 CEST	49962	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:55.232584000 CEST	443	49962	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:55.234421015 CEST	49967	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:55.234473944 CEST	443	49967	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:55.234555960 CEST	49967	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:55.234664917 CEST	49967	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:55.234677076 CEST	443	49967	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:55.465745926 CEST	443	49963	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:55.466283083 CEST	49963	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:55.466300964 CEST	443	49963	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:55.466748953 CEST	49963	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:55.466753006 CEST	443	49963	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:55.582075119 CEST	443	49963	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:55.582237005 CEST	443	49963	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:55.582504988 CEST	49963	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:55.582751989 CEST	49963	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:55.582751989 CEST	49963	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:55.582778931 CEST	443	49963	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:55.582791090 CEST	443	49963	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:55.585470915 CEST	49968	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:55.585560083 CEST	443	49968	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:55.585659981 CEST	49968	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:55.585813046 CEST	49968	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:55.585836887 CEST	443	49968	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:55.602552891 CEST	443	49964	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:55.603075027 CEST	49964	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:55.603102922 CEST	443	49964	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:55.603610039 CEST	49964	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:55.603621006 CEST	443	49964	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:55.707748890 CEST	443	49964	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:55.707803965 CEST	443	49964	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:55.707937956 CEST	443	49964	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:55.707978010 CEST	49964	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:55.708003044 CEST	49964	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:55.708116055 CEST	49964	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:55.708134890 CEST	443	49964	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:55.708152056 CEST	49964	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:55.708161116 CEST	443	49964	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:55.710788012 CEST	49969	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:55.710839033 CEST	443	49969	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:55.710912943 CEST	49969	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:55.711042881 CEST	49969	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:55.711054087 CEST	443	49969	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:55.765827894 CEST	443	49965	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:55.766530991 CEST	49965	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:55.766591072 CEST	443	49965	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:55.767023087 CEST	49965	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:55.767035961 CEST	443	49965	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:55.867270947 CEST	443	49965	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:55.867341995 CEST	443	49965	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:55.867508888 CEST	443	49965	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:55.867588043 CEST	49965	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:55.867832899 CEST	49965	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:55.867832899 CEST	49965	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:55.867832899 CEST	49965	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:55.871193886 CEST	49970	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:55.871248007 CEST	443	49970	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:55.871351957 CEST	49970	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:55.871526003 CEST	49970	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:55.871539116 CEST	443	49970	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:55.890161037 CEST	443	49967	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:55.890594006 CEST	49967	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:55.890621901 CEST	443	49967	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:55.891141891 CEST	49967	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:55.891155005 CEST	443	49967	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:55.900919914 CEST	443	49966	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:55.901352882 CEST	49966	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:55.901390076 CEST	443	49966	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:55.901607990 CEST	49966	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:55.901623011 CEST	443	49966	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:55.992567062 CEST	443	49967	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:55.992618084 CEST	443	49967	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:55.992667913 CEST	49967	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:55.992688894 CEST	443	49967	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:55.992753983 CEST	443	49967	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:55.992800951 CEST	49967	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:55.993021965 CEST	49967	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:55.993036032 CEST	443	49967	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:55.993052959 CEST	49967	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:55.993058920 CEST	443	49967	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:55.996009111 CEST	49971	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:55.996093988 CEST	443	49971	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:55.996196032 CEST	49971	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:55.996346951 CEST	49971	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:55.996368885 CEST	443	49971	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:56.009984016 CEST	443	49966	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:56.010066032 CEST	443	49966	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:56.010107994 CEST	443	49966	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:56.010171890 CEST	49966	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:56.010257006 CEST	443	49966	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:56.010305882 CEST	49966	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:56.010328054 CEST	49966	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:56.095025063 CEST	443	49966	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:56.095176935 CEST	443	49966	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:56.095206022 CEST	49966	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:56.095273972 CEST	49966	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:56.095350981 CEST	49966	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:56.095415115 CEST	443	49966	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:56.095455885 CEST	49966	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:56.095472097 CEST	443	49966	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:56.098484993 CEST	49972	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:56.098567963 CEST	443	49972	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:56.098658085 CEST	49972	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:56.098839998 CEST	49972	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:56.098869085 CEST	443	49972	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:56.174736977 CEST	49965	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:56.174784899 CEST	443	49965	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:56.245702028 CEST	443	49968	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:56.246659994 CEST	49968	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:56.246721029 CEST	443	49968	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:56.247231960 CEST	49968	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:56.247283936 CEST	443	49968	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:56.352252007 CEST	443	49969	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:56.352797031 CEST	49969	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:56.352858067 CEST	443	49969	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:56.353215933 CEST	49969	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:56.353230000 CEST	443	49969	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:56.353267908 CEST	443	49968	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:56.353337049 CEST	443	49968	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:56.353379011 CEST	443	49968	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:56.353429079 CEST	49968	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:56.353499889 CEST	443	49968	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:56.353543043 CEST	49968	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:56.353588104 CEST	49968	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:56.440829039 CEST	443	49968	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:56.440890074 CEST	443	49968	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:56.441025972 CEST	49968	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:56.441025972 CEST	49968	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:56.441040993 CEST	443	49968	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:56.441095114 CEST	49968	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:56.441138029 CEST	49968	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:56.441138029 CEST	49968	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:56.441180944 CEST	443	49968	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:56.441215038 CEST	443	49968	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:56.443968058 CEST	49973	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:56.444001913 CEST	443	49973	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:56.444082975 CEST	49973	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:56.444196939 CEST	49973	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:56.444210052 CEST	443	49973	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:56.451421022 CEST	443	49969	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:56.451472998 CEST	443	49969	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:56.451555014 CEST	49969	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:56.451580048 CEST	443	49969	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:56.451617956 CEST	443	49969	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:56.451636076 CEST	49969	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:56.451668978 CEST	49969	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:56.451668978 CEST	49969	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:56.451708078 CEST	443	49969	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:56.453952074 CEST	49974	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:56.453965902 CEST	443	49974	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:56.454035044 CEST	49974	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:56.454144001 CEST	49974	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:56.454153061 CEST	443	49974	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:56.531686068 CEST	443	49970	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:56.532196045 CEST	49970	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:56.532238960 CEST	443	49970	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:56.532737970 CEST	49970	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:56.532747984 CEST	443	49970	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:56.630801916 CEST	443	49970	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:56.630852938 CEST	443	49970	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:56.630989075 CEST	443	49970	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:56.631067991 CEST	49970	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:56.631067991 CEST	49970	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:56.631299973 CEST	49970	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:56.631300926 CEST	49970	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:56.631328106 CEST	443	49970	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:56.631350040 CEST	443	49970	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:56.634120941 CEST	49975	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:56.634207964 CEST	443	49975	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:56.634304047 CEST	49975	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:56.634443998 CEST	49975	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:56.634480953 CEST	443	49975	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:56.640373945 CEST	443	49971	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:56.640727997 CEST	49971	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:56.640786886 CEST	443	49971	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:56.641144991 CEST	49971	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:56.641160011 CEST	443	49971	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:56.738692999 CEST	443	49971	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:56.739245892 CEST	443	49971	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:56.739518881 CEST	49971	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:56.739520073 CEST	49971	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:56.739520073 CEST	49971	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:56.742119074 CEST	49976	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:56.742213964 CEST	443	49976	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:56.742311001 CEST	49976	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:56.742445946 CEST	49976	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:56.742477894 CEST	443	49976	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:56.752829075 CEST	49969	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:56.752854109 CEST	443	49969	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:56.764214039 CEST	443	49972	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:56.764729023 CEST	49972	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:56.764786959 CEST	443	49972	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:56.765064955 CEST	49972	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:56.765078068 CEST	443	49972	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:56.864749908 CEST	443	49972	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:56.864912033 CEST	443	49972	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:56.865132093 CEST	49972	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:56.865221024 CEST	49972	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:56.865221024 CEST	49972	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:56.865266085 CEST	443	49972	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:56.865293026 CEST	443	49972	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:56.868261099 CEST	49977	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:56.868308067 CEST	443	49977	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:56.868401051 CEST	49977	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:56.868534088 CEST	49977	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:56.868546009 CEST	443	49977	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:57.049666882 CEST	49971	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:57.049735069 CEST	443	49971	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:57.126888990 CEST	443	49973	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:57.127437115 CEST	49973	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:57.127454996 CEST	443	49973	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:57.127955914 CEST	49973	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:57.127959967 CEST	443	49973	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:57.231172085 CEST	443	49973	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:57.231859922 CEST	443	49973	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:57.232135057 CEST	49973	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:57.232135057 CEST	49973	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:57.232135057 CEST	49973	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:57.235467911 CEST	49978	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:57.235519886 CEST	443	49978	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:57.235605955 CEST	49978	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:57.235783100 CEST	49978	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:57.235800982 CEST	443	49978	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:57.280818939 CEST	443	49975	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:57.281656027 CEST	49975	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:57.281732082 CEST	443	49975	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:57.282152891 CEST	49975	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:57.282166958 CEST	443	49975	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:57.378914118 CEST	443	49975	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:57.379010916 CEST	443	49975	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:57.379065037 CEST	49975	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:57.379127979 CEST	443	49975	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:57.379168034 CEST	443	49975	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:57.379230976 CEST	49975	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:57.379303932 CEST	49975	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:57.379339933 CEST	443	49975	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:57.379365921 CEST	49975	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:57.379379988 CEST	443	49975	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:57.382500887 CEST	49979	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:57.382591963 CEST	443	49979	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:57.382668018 CEST	49979	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:57.382873058 CEST	49979	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:57.382905006 CEST	443	49979	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:57.521913052 CEST	443	49977	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:57.522521019 CEST	49977	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:57.522550106 CEST	443	49977	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:57.523152113 CEST	49977	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:57.523163080 CEST	443	49977	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:57.534048080 CEST	49973	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:57.534075975 CEST	443	49973	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:57.623847961 CEST	443	49977	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:57.623908997 CEST	443	49977	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:57.623961926 CEST	49977	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:57.624281883 CEST	49977	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:57.624305010 CEST	443	49977	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:57.624319077 CEST	49977	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:57.624326944 CEST	443	49977	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:57.903254032 CEST	443	49978	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:57.903796911 CEST	49978	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:57.903820038 CEST	443	49978	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:57.904506922 CEST	49978	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:57.904520035 CEST	443	49978	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:58.007527113 CEST	443	49978	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:58.007822037 CEST	443	49978	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:58.008017063 CEST	49978	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:58.008017063 CEST	49978	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:58.008017063 CEST	49978	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:58.091214895 CEST	443	49979	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:58.091686010 CEST	49979	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:58.091707945 CEST	443	49979	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:58.092164993 CEST	49979	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:58.092170000 CEST	443	49979	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:58.196244955 CEST	443	49979	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:58.196299076 CEST	443	49979	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:58.196352959 CEST	49979	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:58.203531027 CEST	49979	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:58.203551054 CEST	443	49979	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:58.203567028 CEST	49979	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:58.203573942 CEST	443	49979	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:58.221559048 CEST	49978	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:58.221594095 CEST	443	49978	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:59.036350965 CEST	443	49974	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:59.036767960 CEST	49974	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:59.036787033 CEST	443	49974	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:59.037239075 CEST	49974	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:59.037245989 CEST	443	49974	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:59.139075041 CEST	443	49974	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:59.139297962 CEST	443	49974	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:59.139350891 CEST	49974	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:59.139381886 CEST	49974	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:59.139400959 CEST	443	49974	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:59.139413118 CEST	49974	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:59.139417887 CEST	443	49974	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:59.141768932 CEST	443	49976	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:59.142155886 CEST	49976	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:59.142174006 CEST	443	49976	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:59.142585039 CEST	49976	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:59.142592907 CEST	443	49976	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:59.245373964 CEST	443	49976	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:59.245431900 CEST	443	49976	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:59.245486021 CEST	49976	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:59.245763063 CEST	49976	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:59.245763063 CEST	49976	443	192.168.2.7	13.107.246.43
Oct 11, 2024 12:45:59.245779991 CEST	443	49976	13.107.246.43	192.168.2.7
Oct 11, 2024 12:45:59.245791912 CEST	443	49976	13.107.246.43	192.168.2.7
Oct 11, 2024 12:46:03.362112999 CEST	443	49745	104.98.116.138	192.168.2.7
Oct 11, 2024 12:46:03.362237930 CEST	49745	443	192.168.2.7	104.98.116.138

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 11, 2024 12:45:04.015374899 CEST	49704	53	192.168.2.7	1.1.1.1
Oct 11, 2024 12:45:04.026238918 CEST	53	49704	1.1.1.1	192.168.2.7
Oct 11, 2024 12:45:04.047374010 CEST	62038	53	192.168.2.7	1.1.1.1
Oct 11, 2024 12:45:04.056188107 CEST	53	62038	1.1.1.1	192.168.2.7
Oct 11, 2024 12:45:04.058186054 CEST	65121	53	192.168.2.7	1.1.1.1
Oct 11, 2024 12:45:04.067217112 CEST	53	65121	1.1.1.1	192.168.2.7
Oct 11, 2024 12:45:04.068391085 CEST	49782	53	192.168.2.7	1.1.1.1
Oct 11, 2024 12:45:04.078283072 CEST	53	49782	1.1.1.1	192.168.2.7
Oct 11, 2024 12:45:04.080637932 CEST	60844	53	192.168.2.7	1.1.1.1
Oct 11, 2024 12:45:04.089601994 CEST	53	60844	1.1.1.1	192.168.2.7
Oct 11, 2024 12:45:04.093445063 CEST	52393	53	192.168.2.7	1.1.1.1
Oct 11, 2024 12:45:04.102252007 CEST	53	52393	1.1.1.1	192.168.2.7
Oct 11, 2024 12:45:04.104733944 CEST	62015	53	192.168.2.7	1.1.1.1
Oct 11, 2024 12:45:04.115052938 CEST	53	62015	1.1.1.1	192.168.2.7
Oct 11, 2024 12:45:04.117434978 CEST	51188	53	192.168.2.7	1.1.1.1
Oct 11, 2024 12:45:04.128868103 CEST	53	51188	1.1.1.1	192.168.2.7
Oct 11, 2024 12:45:04.131266117 CEST	52711	53	192.168.2.7	1.1.1.1
Oct 11, 2024 12:45:04.140947104 CEST	53	52711	1.1.1.1	192.168.2.7
Oct 11, 2024 12:45:04.143779993 CEST	49428	53	192.168.2.7	1.1.1.1
Oct 11, 2024 12:45:04.150743008 CEST	53	49428	1.1.1.1	192.168.2.7
Oct 11, 2024 12:45:11.058876991 CEST	53682	53	192.168.2.7	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 11, 2024 12:45:04.015374899 CEST	192.168.2.7	1.1.1.1	0x2746	Standard query (0)	trustterwowqm.shop	A (IP address)	IN (0x0001)	false
Oct 11, 2024 12:45:04.047374010 CEST	192.168.2.7	1.1.1.1	0xec3e	Standard query (0)	mobbipenju.store	A (IP address)	IN (0x0001)	false
Oct 11, 2024 12:45:04.058186054 CEST	192.168.2.7	1.1.1.1	0x7c69	Standard query (0)	eaglepawnoy.store	A (IP address)	IN (0x0001)	false
Oct 11, 2024 12:45:04.068391085 CEST	192.168.2.7	1.1.1.1	0x3151	Standard query (0)	dissapoiznw.store	A (IP address)	IN (0x0001)	false
Oct 11, 2024 12:45:04.080637932 CEST	192.168.2.7	1.1.1.1	0xafd8	Standard query (0)	studennotediw.store	A (IP address)	IN (0x0001)	false
Oct 11, 2024 12:45:04.093445063 CEST	192.168.2.7	1.1.1.1	0xa2c1	Standard query (0)	bathdoomgaz.store	A (IP address)	IN (0x0001)	false
Oct 11, 2024 12:45:04.104733944 CEST	192.168.2.7	1.1.1.1	0x28d1	Standard query (0)	spirittunek.store	A (IP address)	IN (0x0001)	false
Oct 11, 2024 12:45:04.117434978 CEST	192.168.2.7	1.1.1.1	0xd824	Standard query (0)	licendfilteo.site	A (IP address)	IN (0x0001)	false
Oct 11, 2024 12:45:04.131266117 CEST	192.168.2.7	1.1.1.1	0x9b45	Standard query (0)	clearancek.site	A (IP address)	IN (0x0001)	false
Oct 11, 2024 12:45:04.143779993 CEST	192.168.2.7	1.1.1.1	0x8a6c	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false
Oct 11, 2024 12:45:11.058876991 CEST	192.168.2.7	1.1.1.1	0x638e	Standard query (0)	time.windows.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 11, 2024 12:45:04.026238918 CEST	1.1.1.1	192.168.2.7	0x2746	Name error (3)	trustterwowqm.shop	none	none	A (IP address)	IN (0x0001)	false
Oct 11, 2024 12:45:04.056188107 CEST	1.1.1.1	192.168.2.7	0xec3e	Name error (3)	mobbipenju.store	none	none	A (IP address)	IN (0x0001)	false
Oct 11, 2024 12:45:04.067217112 CEST	1.1.1.1	192.168.2.7	0x7c69	Name error (3)	eaglepawnoy.store	none	none	A (IP address)	IN (0x0001)	false
Oct 11, 2024 12:45:04.078283072 CEST	1.1.1.1	192.168.2.7	0x3151	Name error (3)	dissapoiznw.store	none	none	A (IP address)	IN (0x0001)	false
Oct 11, 2024 12:45:04.089601994 CEST	1.1.1.1	192.168.2.7	0xafd8	Name error (3)	studennotediw.store	none	none	A (IP address)	IN (0x0001)	false
Oct 11, 2024 12:45:04.102252007 CEST	1.1.1.1	192.168.2.7	0xa2c1	Name error (3)	bathdoomgaz.store	none	none	A (IP address)	IN (0x0001)	false
Oct 11, 2024 12:45:04.115052938 CEST	1.1.1.1	192.168.2.7	0x28d1	Name error (3)	spirittunek.store	none	none	A (IP address)	IN (0x0001)	false
Oct 11, 2024 12:45:04.128868103 CEST	1.1.1.1	192.168.2.7	0xd824	Name error (3)	licendfilteo.site	none	none	A (IP address)	IN (0x0001)	false
Oct 11, 2024 12:45:04.140947104 CEST	1.1.1.1	192.168.2.7	0x9b45	Name error (3)	clearancek.site	none	none	A (IP address)	IN (0x0001)	false
Oct 11, 2024 12:45:04.150743008 CEST	1.1.1.1	192.168.2.7	0x8a6c	No error (0)	steamcommunity.com		104.102.49.254	A (IP address)	IN (0x0001)	false
Oct 11, 2024 12:45:11.273389101 CEST	1.1.1.1	192.168.2.7	0x638e	No error (0)	time.windows.com	twc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 11, 2024 12:45:13.004998922 CEST	1.1.1.1	192.168.2.7	0x2f4a	No error (0)	shed.dual-low.s-part-0015.t-0009.t-msedge.net	s-part-0015.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 11, 2024 12:45:13.004998922 CEST	1.1.1.1	192.168.2.7	0x2f4a	No error (0)	s-part-0015.t-0009.t-msedge.net		13.107.246.43	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

steamcommunity.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49699	104.102.49.254	443	3712	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-11 10:45:05 UTC	219	OUT	GET /profiles/76561199724331900 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: steamcommunity.com
2024-10-11 10:45:05 UTC	1870	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.akamai.steamstatic.com/ https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq. [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Fri, 11 Oct 2024 10:45:05 GMT Content-Length: 25489 Connection: close Set-Cookie: sessionid=e18c921cc996c1e73cbf0ac7; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7Cd7fb65801182a5f50a3169fe2a0b7ef0; Path=/; Secure; HttpOnly; SameSite=None
2024-10-11 10:45:05 UTC	14514	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0d 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0d 0a 09 09 3c Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><
2024-10-11 10:45:05 UTC	10975	IN	Data Raw: 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 70 6f 70 75 70 5f 6d 65 6e 75 5f 69 74 65 6d 20 74 69 67 68 74 22 20 68 72 65 66 3d 22 3f 6c 3d 74 68 61 69 22 20 6f 6e 63 6c 69 63 6b 3d 22 43 68 61 6e 67 65 4c 61 6e 67 75 61 67 65 28 20 27 74 68 61 69 27 20 29 3b 20 72 65 74 75 72 6e 20 66 61 6c 73 65 3b 22 3e e0 b9 84 e0 b8 97 e0 b8 a2 20 28 54 68 61 69 29 3c 2f 61 3e 0d 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 70 6f 70 75 70 5f 6d 65 6e 75 5f 69 74 65 6d 20 74 69 67 68 74 22 20 68 72 65 66 3d 22 3f 6c 3d 62 75 6c 67 61 72 69 61 6e 22 20 6f 6e 63 6c 69 63 6b 3d 22 43 68 61 6e 67 65 4c 61 6e 67 75 61 67 65 28 20 27 62 75 6c 67 61 72 69 61 6e 27 20 29 3b 20 72 65 74 75 72 6e 20 66 61 Data Ascii: <a class="popup_menu_item tight" href="?l=thai" onclick="ChangeLanguage( 'thai' ); return false;"> (Thai)</a><a class="popup_menu_item tight" href="?l=bulgarian" onclick="ChangeLanguage( 'bulgarian' ); return fa

Target ID:	0
Start time:	06:45:02
Start date:	11/10/2024
Path:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe"
Imagebase:	0xb10000
File size:	594'320 bytes
MD5 hash:	42C90B202519B4B05086D06918A69EF3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	06:45:03
Start date:	11/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Imagebase:	0xee0000
File size:	262'432 bytes
MD5 hash:	8FDF47E0FF70C40ED3A17014AEEA4232
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	06:45:03
Start date:	11/10/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 2344 -s 304
Imagebase:	0x850000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	0.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	19.2%
Total number of Nodes:	99
Total number of Limit Nodes:	2

Executed Functions

Function 00B120C7 Relevance: 7.5, APIs: 2, Strings: 2, Instructions: 451
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00B12631: _strlen.LIBCMT ref: 00B12649

_strlen.LIBCMT ref: 00B124E8
VirtualProtect.KERNELBASE(00B968F0,000004E4,00000040,?,00B3AABC,00000000,IOanz UZA891nNAIUsy U(Ahy8*! ), ref: 00B1253F

Strings

MZx, xrefs: 00B12551, 00B1255D, 00B12562
IOanz UZA891nNAIUsy U(Ahy8*! , xrefs: 00B120DA

Memory Dump Source

Source File: 00000000.00000002.1411851329.0000000000B11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.1411828549.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411876776.0000000000B33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411940991.0000000000B96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411956972.0000000000B97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1412053295.0000000000B99000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_SecuriteInfo.jbxd

Similarity

API ID: _strlen$ProtectVirtual
String ID: IOanz UZA891nNAIUsy U(Ahy8*! $MZx
API String ID: 1598219167-2632814837
Opcode ID: b731f5724d4a663677e2395cb4e4c7d261c354c15218f481234ed0d8d6926225
Instruction ID: 62a969162fbd1999ae41819de62ff988c0290625af96c66c7e87e8395d9e1c30
Opcode Fuzzy Hash: b731f5724d4a663677e2395cb4e4c7d261c354c15218f481234ed0d8d6926225
Instruction Fuzzy Hash: F9C1E137920A0A46D70CA778D8913EAB6DAE799330FD04376B926DB3E0D7394D91D284

Non-executed Functions

Function 00B5DBB0 Relevance: 20.7, Strings: 15, Instructions: 1988COMMON

Download Yara Rule

Strings

lcba, xrefs: 00B5E8E4
efgh, xrefs: 00B5E6F0
lkji, xrefs: 00B5E91B
p, xrefs: 00B5F031
`onm, xrefs: 00B5E910
,/.!, xrefs: 00B5E6C4
(+*-, xrefs: 00B5E6B9
@GFE, xrefs: 00B5E947
8;:=, xrefs: 00B5E6E5
$'&9, xrefs: 00B5E6DA
0325, xrefs: 00B5E6FB
pwvu, xrefs: 00B5E8C3
,, xrefs: 00B5EC87
4, xrefs: 00B5E824
yz{|, xrefs: 00B5E6CF

Memory Dump Source

Source File: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.1411828549.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411851329.0000000000B11000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411876776.0000000000B33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411940991.0000000000B96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411956972.0000000000B97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1412053295.0000000000B99000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: $'&9$(+*-$,$,/.!$0325$4$8;:=$@GFE$`onm$efgh$lcba$lkji$p$pwvu$yz{|
API String ID: 0-4284672935
Opcode ID: 17a9da9fb198ce4cff53889ca9a74bbfb73063c59ecad7ce56909eb832305105
Instruction ID: c0897b731d320508acae39e6968351b5bc990089404cfb2ddd600d2332c2e2a2
Opcode Fuzzy Hash: 17a9da9fb198ce4cff53889ca9a74bbfb73063c59ecad7ce56909eb832305105
Instruction Fuzzy Hash: 88F287705083819BD734CF54D884BABBBE1FF96306F1849ADE8C99B292D7359908CB53

Function 00B6D580 Relevance: 11.5, Strings: 9, Instructions: 256
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

W7JI, xrefs: 00B6D5F3
7S.U, xrefs: 00B6D624
2C!E, xrefs: 00B6D608
A3W5, xrefs: 00B6D5EC
=G!Y, xrefs: 00B6D60F
4[&], xrefs: 00B6D616
8O?A, xrefs: 00B6D601
;_(Q, xrefs: 00B6D61D
0W4i, xrefs: 00B6D62B

Memory Dump Source

Source File: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.1411828549.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411851329.0000000000B11000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411876776.0000000000B33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411940991.0000000000B96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411956972.0000000000B97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1412053295.0000000000B99000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: 0W4i$2C!E$4[&]$7S.U$8O?A$;_(Q$=G!Y$A3W5$W7JI
API String ID: 0-83756894
Opcode ID: c1abe5d969104e4faaeeb94a57dcd0a77674fd740321b7385ce3fa244a949eb5
Instruction ID: d8acfb0d0a3fafebe4c3fdac2108c7e4ffdd4d9e73636b2e3a6a1da0dabf13fa
Opcode Fuzzy Hash: c1abe5d969104e4faaeeb94a57dcd0a77674fd740321b7385ce3fa244a949eb5
Instruction Fuzzy Hash: 7281AFB4E002069BDB10CF95C951BBEB7F1FF16305F244188E855AB351E338AE51CBA6

Function 00B2E095 Relevance: 10.2, APIs: 1, Strings: 4, Instructions: 1436COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 00B2E279

Strings

1#SNAN, xrefs: 00B2E1A1
1#INF, xrefs: 00B2E1CB
1#IND, xrefs: 00B2E19A
1#QNAN, xrefs: 00B2E1A8

Memory Dump Source

Source File: 00000000.00000002.1411851329.0000000000B11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.1411828549.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411876776.0000000000B33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411940991.0000000000B96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411956972.0000000000B97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1412053295.0000000000B99000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_SecuriteInfo.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 21b2dd63b4ff45bf6ff0912d8a5ca4af661d2bb32c6ace35c1f8bcd92d042609
Instruction ID: 35806fc24ec9a73831b0a83d10f1b1efd2413de2dbbaee39fcd81e85ad81bfe3
Opcode Fuzzy Hash: 21b2dd63b4ff45bf6ff0912d8a5ca4af661d2bb32c6ace35c1f8bcd92d042609
Instruction Fuzzy Hash: 14D22971E082298FDB65CE29ED807EAB7F5EB44305F1445EAD81DE7240E778AE818F41

Function 00B2D3EF Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,00B2D70D,00000002,00000000,?,?,?,00B2D70D,?,00000000), ref: 00B2D488
GetLocaleInfoW.KERNEL32(?,20001004,00B2D70D,00000002,00000000,?,?,?,00B2D70D,?,00000000), ref: 00B2D4B1
GetACP.KERNEL32(?,?,00B2D70D,?,00000000), ref: 00B2D4C6

Strings

OCP, xrefs: 00B2D443
ACP, xrefs: 00B2D40D

Memory Dump Source

Source File: 00000000.00000002.1411851329.0000000000B11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.1411828549.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411876776.0000000000B33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411940991.0000000000B96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411956972.0000000000B97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1412053295.0000000000B99000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_SecuriteInfo.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: e812894c4408ad09286cdd78d9ae240181d9be9dd8887356e1ddfa4f453b3cf2
Instruction ID: 7566ce09084967da77ea02a64badf424a5a0a0624069d483424cc4fafa6abd70
Opcode Fuzzy Hash: e812894c4408ad09286cdd78d9ae240181d9be9dd8887356e1ddfa4f453b3cf2
Instruction Fuzzy Hash: 2E21B662600121A6D734BF14E901B9B72E6EF54F64BA685E4E92ED7314E732FE40C350

Function 00B2D5C4 Relevance: 7.7, APIs: 5, Instructions: 183COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00B25A35: GetLastError.KERNEL32(?,00000000,00B2066F,?,?,?,?,00000003,00B1CB1B,?,?,?,?,00000000), ref: 00B25A39
Part of subcall function 00B25A35: SetLastError.KERNEL32(00000000,?,?,?,00000003,00B1CB1B,?,?,?,?,00000000), ref: 00B25ADB

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 00B2D6D0
IsValidCodePage.KERNEL32(00000000), ref: 00B2D719
IsValidLocale.KERNEL32(?,00000001), ref: 00B2D728
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 00B2D770
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 00B2D78F

Memory Dump Source

Source File: 00000000.00000002.1411851329.0000000000B11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.1411828549.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411876776.0000000000B33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411940991.0000000000B96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411956972.0000000000B97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1412053295.0000000000B99000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_SecuriteInfo.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID:
API String ID: 415426439-0
Opcode ID: a4bd0f5c52f827a0e7dfc8390e8ee609e352edb12cabe201de9490c288ba9502
Instruction ID: 3fbdb7cc25ba448ed5b7bf5a1d74a1d3ffd7b125316f0775e5d4c960c03cb4f5
Opcode Fuzzy Hash: a4bd0f5c52f827a0e7dfc8390e8ee609e352edb12cabe201de9490c288ba9502
Instruction Fuzzy Hash: 02515171A00225AFDB11DFA4EC81BAE77F8EF18700F1445A9A50DEB190EB709945CB61

Function 00B2CC60 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 251COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00B25A35: GetLastError.KERNEL32(?,00000000,00B2066F,?,?,?,?,00000003,00B1CB1B,?,?,?,?,00000000), ref: 00B25A39
Part of subcall function 00B25A35: SetLastError.KERNEL32(00000000,?,?,?,00000003,00B1CB1B,?,?,?,?,00000000), ref: 00B25ADB

GetACP.KERNEL32(?,?,?,?,?,?,00B21F91,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 00B2CD21
IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,00B21F91,?,?,?,00000055,?,-00000050,?,?), ref: 00B2CD4C
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 00B2CEAF

Strings

utf8, xrefs: 00B2CE1E

Memory Dump Source

Source File: 00000000.00000002.1411851329.0000000000B11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.1411828549.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411876776.0000000000B33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411940991.0000000000B96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411956972.0000000000B97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1412053295.0000000000B99000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_SecuriteInfo.jbxd

Similarity

API ID: ErrorLast$CodeInfoLocalePageValid
String ID: utf8
API String ID: 607553120-905460609
Opcode ID: cc5d03b542a9bb6c348832911a95a6e79a9d034503faf404399fdd42e3c725ce
Instruction ID: 07349f8080cdfea11bd580ba23e31005f19cb2865b4dbe158347ef8403ad128b
Opcode Fuzzy Hash: cc5d03b542a9bb6c348832911a95a6e79a9d034503faf404399fdd42e3c725ce
Instruction Fuzzy Hash: 0171E671A00626AAD724BB38EC46BAF7BE8EF14740F1544BAF50DD7181EB74ED40C691

Function 00B3F18D Relevance: 7.2, Strings: 5, Instructions: 909COMMON

Download Yara Rule

Strings

0, xrefs: 00B3FD70
0, xrefs: 00B403B8
i, xrefs: 00B40816
@, xrefs: 00B40924
0, xrefs: 00B3FCC1

Memory Dump Source

Source File: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.1411828549.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411851329.0000000000B11000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411876776.0000000000B33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411940991.0000000000B96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411956972.0000000000B97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1412053295.0000000000B99000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: 0$0$0$@$i
API String ID: 0-3124195287
Opcode ID: 71f3d092406bf2b1da397f9251c19992cfeb9473183140990b6d77d2ed173c24
Instruction ID: 33f87a906db387174236ff0a64877e3d959a0b25865d1e9af681d1a3da11a5df
Opcode Fuzzy Hash: 71f3d092406bf2b1da397f9251c19992cfeb9473183140990b6d77d2ed173c24
Instruction Fuzzy Hash: 0A72E171A1C3528FD318DE28C49072ABBE1EFC8304F1889ADE9D997391D674DE45DB82

Function 00B3F2ED Relevance: 6.7, Strings: 5, Instructions: 453COMMON

Download Yara Rule

Strings

0, xrefs: 00B3F613
gfff, xrefs: 00B40104
gfff, xrefs: 00B4004B
-, xrefs: 00B40015
gfff, xrefs: 00B400B9

Memory Dump Source

Source File: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.1411828549.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411851329.0000000000B11000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411876776.0000000000B33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411940991.0000000000B96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411956972.0000000000B97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1412053295.0000000000B99000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: -$0$gfff$gfff$gfff
API String ID: 0-1217629319
Opcode ID: e70ea6af7df4099828697e47c503092b59018ffd614456e3a52484d2297035ff
Instruction ID: 281d30e12d068e5f49ce20d6fad6f78a3cc090b8a0103e912d2beb3548dc6a69
Opcode Fuzzy Hash: e70ea6af7df4099828697e47c503092b59018ffd614456e3a52484d2297035ff
Instruction Fuzzy Hash: 48F1D171A183518FD318DE2CC49036AFBE2EBC9314F198A6DE9C5CB392D274D945DB82

Function 00B4D950 Relevance: 6.7, Strings: 5, Instructions: 409COMMON

Download Yara Rule

Strings

d`df, xrefs: 00B4D962
q-s, xrefs: 00B4DA4A
vLyB, xrefs: 00B4DCF3, 00B4DCFB
JpzN, xrefs: 00B4DCBD
\W, xrefs: 00B4DB04

Memory Dump Source

Source File: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.1411828549.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411851329.0000000000B11000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411876776.0000000000B33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411940991.0000000000B96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411956972.0000000000B97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1412053295.0000000000B99000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: JpzN$\W$d`df$vLyB$q-s
API String ID: 0-2943124228
Opcode ID: c0123f9ddd81bde4ead67e13c59693835463b28b846828819b093025ea9eb232
Instruction ID: e492c1d5012638856b2e9c1a6896191ace6e6ce51f40346b5574df2a960bca4b
Opcode Fuzzy Hash: c0123f9ddd81bde4ead67e13c59693835463b28b846828819b093025ea9eb232
Instruction Fuzzy Hash: 2AD1797050C3808BD711DF18D490A2EBBE5EFA6744F180DACE4D58B362D335DA49EBA6

Function 00B5FF88 Relevance: 6.5, Strings: 5, Instructions: 258COMMON

Download Yara Rule

Strings

H~, xrefs: 00B5FFED
-{4y, xrefs: 00B60193, 00B6019B
KC, xrefs: 00B5FFE5
zC, xrefs: 00B5FFDD
k$i, xrefs: 00B60271, 00B60275

Memory Dump Source

Source File: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.1411828549.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411851329.0000000000B11000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411876776.0000000000B33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411940991.0000000000B96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411956972.0000000000B97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1412053295.0000000000B99000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: k$i$-{4y$H~$KC$zC
API String ID: 0-1198185020
Opcode ID: cb060303c5a1a0c4baba74594868201dd970643a30ef342180b2144766bb590c
Instruction ID: 903cbf2045c324eaab182bb6149e040fd10b2c182796ac39dd5c23e073081a4e
Opcode Fuzzy Hash: cb060303c5a1a0c4baba74594868201dd970643a30ef342180b2144766bb590c
Instruction Fuzzy Hash: C38186B05183409BD710AF19C891B2BB7F0EFA6754F048A8CF4D59B391E339D941CBA6

Function 00B24843 Relevance: 6.3, APIs: 4, Instructions: 337COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00B248D0

Memory Dump Source

Source File: 00000000.00000002.1411851329.0000000000B11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.1411828549.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411876776.0000000000B33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411940991.0000000000B96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411956972.0000000000B97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1412053295.0000000000B99000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_SecuriteInfo.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 462f0b52736df5e81f8a3c5a382989fc7a2c67e9f4e470126fa22cf96ee34469
Instruction ID: c335a9b24df891a8a2148bf731a0b153d5abd83e118f9da267f8dc988d4fd8df
Opcode Fuzzy Hash: 462f0b52736df5e81f8a3c5a382989fc7a2c67e9f4e470126fa22cf96ee34469
Instruction Fuzzy Hash: 3AB14632D002659FDB15CF68D881BEEBBE5EF5A300F1581EAE809AB641D334DD41CBA0

Function 00B179A8 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 00B179B4
IsDebuggerPresent.KERNEL32 ref: 00B17A80
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00B17A99
UnhandledExceptionFilter.KERNEL32(?), ref: 00B17AA3

Memory Dump Source

Source File: 00000000.00000002.1411851329.0000000000B11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.1411828549.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411876776.0000000000B33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411940991.0000000000B96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411956972.0000000000B97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1412053295.0000000000B99000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_SecuriteInfo.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 1cd755060885b964ac2553f6d778f7aad228fa3126637fbb503a30753036b012
Instruction ID: 3361136063f5c8b1e32c2a76404a3b26f8a32deb0df511c663b7d4b6ab39492c
Opcode Fuzzy Hash: 1cd755060885b964ac2553f6d778f7aad228fa3126637fbb503a30753036b012
Instruction Fuzzy Hash: 9831E3B5D452189ADB20DFA4D949BCEBBF8AF08700F5041EAE50CAB250EB749B858F45

Function 00B862A0 Relevance: 5.3, Strings: 4, Instructions: 348COMMON

Download Yara Rule

Strings

, xrefs: 00B865D6, 00B8672F, 00B86703, 00B865B3, 00B865BB, 00B8670B
oD, xrefs: 00B86534
kD, xrefs: 00B86521
P, xrefs: 00B86446

Memory Dump Source

Source File: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.1411828549.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411851329.0000000000B11000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411876776.0000000000B33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411940991.0000000000B96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411956972.0000000000B97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1412053295.0000000000B99000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: P$kD$oD$
API String ID: 0-1115615460
Opcode ID: ed1cfad7e5831a2e1b48057f332d66576bd6f5d84c9fae2d0d95bb32115eec55
Instruction ID: a14310d1912c8b6234dc25fc214c57175db9ec1bc2dc7466eeae8d2ce8f6d783
Opcode Fuzzy Hash: ed1cfad7e5831a2e1b48057f332d66576bd6f5d84c9fae2d0d95bb32115eec55
Instruction Fuzzy Hash: 2DC113729083618FC715DE28D89071EB7E1EBC1318F158A6CE8A5AB3A5DB75DC05C7C2

Function 00B60AFA Relevance: 5.2, Strings: 4, Instructions: 209COMMON

Download Yara Rule

Strings

I}, xrefs: 00B60B56
v}, xrefs: 00B60B4F
I}, xrefs: 00B60D41
~, xrefs: 00B60B5D

Memory Dump Source

Source File: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.1411828549.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411851329.0000000000B11000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411876776.0000000000B33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411940991.0000000000B96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411956972.0000000000B97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1412053295.0000000000B99000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: I}$I}$v}$~
API String ID: 0-1535326304
Opcode ID: 18d941ddf0c7df2a2020a84959c7baed37afdcccf923d2de2c574be5e132557b
Instruction ID: 482c633f44119c8d06b6a9090013d0a2c2e26f733ca3b11b363319b8ed406264
Opcode Fuzzy Hash: 18d941ddf0c7df2a2020a84959c7baed37afdcccf923d2de2c574be5e132557b
Instruction Fuzzy Hash: 0B619EB09112568BDB20DF95CC91B7FBBB1FF56344F184988E8916F392D3389841CBA5

Function 00B8465A Relevance: 5.1, Strings: 4, Instructions: 142COMMON

Download Yara Rule

Strings

@, xrefs: 00B8480D
, xrefs: 00B84876, 00B84853, 00B8485B
US, xrefs: 00B84662
Q_, xrefs: 00B8466A

Memory Dump Source

Source File: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.1411828549.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411851329.0000000000B11000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411876776.0000000000B33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411940991.0000000000B96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411956972.0000000000B97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1412053295.0000000000B99000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: @$Q_$US$
API String ID: 0-1387636662
Opcode ID: b84bd2cad6fc919d03a3147de07ecc8b5f863db2d204b0a85fdfcd1955775bcd
Instruction ID: eb304e63e7d775774708241c67b0ab73d7f7e5e643ed7927b9fd089952fba724
Opcode Fuzzy Hash: b84bd2cad6fc919d03a3147de07ecc8b5f863db2d204b0a85fdfcd1955775bcd
Instruction Fuzzy Hash: 824186B44183829BD714EF14C490A2BBBF0FF86748F54895CF4C9AB2A1E335D945CB5A

Function 00B2D073 Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 00B25A35: GetLastError.KERNEL32(?,00000000,00B2066F,?,?,?,?,00000003,00B1CB1B,?,?,?,?,00000000), ref: 00B25A39
Part of subcall function 00B25A35: SetLastError.KERNEL32(00000000,?,?,?,00000003,00B1CB1B,?,?,?,?,00000000), ref: 00B25ADB

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00B2D0C7
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00B2D111
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00B2D1D7

Memory Dump Source

Source File: 00000000.00000002.1411851329.0000000000B11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.1411828549.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411876776.0000000000B33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411940991.0000000000B96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411956972.0000000000B97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1412053295.0000000000B99000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_SecuriteInfo.jbxd

Similarity

API ID: InfoLocale$ErrorLast
String ID:
API String ID: 661929714-0
Opcode ID: af52403e43918dc1e819ee58bb594b5eb4fddf67a69ab4077231ad1bfcf68c98
Instruction ID: 2715dc5c2c9130c28c118226e2f4a302ae027d4dc3a967ae0c9670131d65939f
Opcode Fuzzy Hash: af52403e43918dc1e819ee58bb594b5eb4fddf67a69ab4077231ad1bfcf68c98
Instruction Fuzzy Hash: 16619071550227DFEB28EF28ED82BAA73E8EF04301F2441F9E909D6585EB74D991CB50

Function 00B1DD67 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 00B1DE5F
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 00B1DE69
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,00000000), ref: 00B1DE76

Memory Dump Source

Source File: 00000000.00000002.1411851329.0000000000B11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.1411828549.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411876776.0000000000B33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411940991.0000000000B96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411956972.0000000000B97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1412053295.0000000000B99000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_SecuriteInfo.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 3998ee6e2ee12e4de33d3440a36eff89215d67bc4eb239a770fd46f829c00bf7
Instruction ID: 51bcac188783ef910c9817f545030c602b0f1610c3b14b2e5ab815dd892d19c4
Opcode Fuzzy Hash: 3998ee6e2ee12e4de33d3440a36eff89215d67bc4eb239a770fd46f829c00bf7
Instruction Fuzzy Hash: 8B31C4759412189BCB25DF68D9897CDBBF4BF08710F5041EAE41CA7250EB749BC18F44

Function 00B46630 Relevance: 4.1, Strings: 3, Instructions: 379COMMON

Download Yara Rule

Strings

IEND, xrefs: 00B46A7D
), xrefs: 00B466AD
), xrefs: 00B466B7

Memory Dump Source

Source File: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.1411828549.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411851329.0000000000B11000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411876776.0000000000B33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411940991.0000000000B96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411956972.0000000000B97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1412053295.0000000000B99000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: )$)$IEND
API String ID: 0-588110143
Opcode ID: e3af02e7cd14337d65bc99edb6bb6da9af78cbb27c27db32bd75912408caa374
Instruction ID: da3822968a5f44cbb0aa0653e527c491b282d75019c3725803416c8456316251
Opcode Fuzzy Hash: e3af02e7cd14337d65bc99edb6bb6da9af78cbb27c27db32bd75912408caa374
Instruction Fuzzy Hash: F8E1CE71A08701AFE310CF28C88575ABBE0FB85318F14896DE99997382D375EA15DBD3

Function 00B84706 Relevance: 3.9, Strings: 3, Instructions: 122COMMON

Download Yara Rule

Strings

]oXm, xrefs: 00B8472E
@, xrefs: 00B8480D
, xrefs: 00B84876, 00B84853, 00B8485B

Memory Dump Source

Source File: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.1411828549.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411851329.0000000000B11000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411876776.0000000000B33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411940991.0000000000B96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411956972.0000000000B97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1412053295.0000000000B99000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: @$]oXm$
API String ID: 0-4013158905
Opcode ID: 08b563d773aac84b36ad4809571cbbdf506584426bf330bc6785f7f8a4602933
Instruction ID: 57a74df3b66f9d190bb76e8b0d417c2fe24bbd17eb20abf92e7fd2b3bf707eca
Opcode Fuzzy Hash: 08b563d773aac84b36ad4809571cbbdf506584426bf330bc6785f7f8a4602933
Instruction Fuzzy Hash: E04163B84183828BC714EF14C09062BBBF0FF86358F54895CF4C9AB261E339C985CB5A

Function 00B6D23C Relevance: 3.8, Strings: 3, Instructions: 38COMMON

Download Yara Rule

Strings

Q^\X, xrefs: 00B6D252
KFCI, xrefs: 00B6D26A
UNOc, xrefs: 00B6D24A

Memory Dump Source

Source File: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.1411828549.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411851329.0000000000B11000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411876776.0000000000B33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411940991.0000000000B96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411956972.0000000000B97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1412053295.0000000000B99000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: KFCI$Q^\X$UNOc
API String ID: 0-1593643587
Opcode ID: c1021c8647da17318554d3aa5cff67c87dd53425995099f84c7b189f47ca34d0
Instruction ID: be4a330f48a30d38c5a13ece3fd6add33716baf25a922b3f9ddee05c63166c46
Opcode Fuzzy Hash: c1021c8647da17318554d3aa5cff67c87dd53425995099f84c7b189f47ca34d0
Instruction Fuzzy Hash: 0811DDB1608381ABD3119F95C584A1EFFF0AB96785F50984CFAD857222C379C8818F17

Function 00B206C0 Relevance: 3.4, APIs: 2, Instructions: 449COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1411851329.0000000000B11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.1411828549.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411876776.0000000000B33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411940991.0000000000B96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411956972.0000000000B97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1412053295.0000000000B99000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f987790efbacecca7af44b7cb8213edc3b0491735675372b152ced8ecd133998
Instruction ID: 487803a6cc12b2b934c3a43c65e4f6f58b26ae00d4a39090e0693d183d387c32
Opcode Fuzzy Hash: f987790efbacecca7af44b7cb8213edc3b0491735675372b152ced8ecd133998
Instruction Fuzzy Hash: B3F13F71E112299FDF14DF68D880AAEB7F1FF48314F1582A9E819AB391D730AD45CB90

Function 00B85A10 Relevance: 2.8, Strings: 2, Instructions: 288COMMON

Download Yara Rule

Strings

, xrefs: 00B85A81, 00B85B51, 00B85C65, 00B85B88, 00B85B24, 00B85A54, 00B85A60, 00B85B30, 00B85B93, 00B85C6E
, xrefs: 00B85C24, 00B85BF4, 00B85BFD

Memory Dump Source

Source File: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.1411828549.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411851329.0000000000B11000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411876776.0000000000B33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411940991.0000000000B96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411956972.0000000000B97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1412053295.0000000000B99000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-1425349742
Opcode ID: a72b061ef2fa19078f6f09b4256c813a26286e548eea71359ce8abeef3a1e115
Instruction ID: c38dd913107ec62785581fb25354b481199f2d9019e3ebf1f464d44443adaace
Opcode Fuzzy Hash: a72b061ef2fa19078f6f09b4256c813a26286e548eea71359ce8abeef3a1e115
Instruction Fuzzy Hash: 78A1AF71508741ABDB34EF14C881BABB7E5EB85354F948C6CF885973A2E730E940CB96

Function 00B87FF0 Relevance: 2.7, Strings: 2, Instructions: 228COMMON

Download Yara Rule

Strings

, xrefs: 00B880E6
, xrefs: 00B88046, 00B8815A, 00B88133, 00B88023, 00B8802B, 00B8813B

Memory Dump Source

Source File: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.1411828549.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411851329.0000000000B11000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411876776.0000000000B33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411940991.0000000000B96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411956972.0000000000B97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1412053295.0000000000B99000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-1425349742
Opcode ID: e90198aaeed22a300b19465d833889039e3ddf500042478477c72a525097edc6
Instruction ID: 61e3db692b0184003288b74060aef33857922fe8c908588da5a29923087a27d1
Opcode Fuzzy Hash: e90198aaeed22a300b19465d833889039e3ddf500042478477c72a525097edc6
Instruction Fuzzy Hash: 47719B70608341ABC710FF58D890A2EB7E5FF95710F9888ACF5C58B262DB76E814CB56

Function 00B66EDB Relevance: 2.6, Strings: 2, Instructions: 140COMMON

Download Yara Rule

Strings

6, xrefs: 00B67079
^TPX, xrefs: 00B67001

Memory Dump Source

Source File: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.1411828549.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411851329.0000000000B11000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411876776.0000000000B33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411940991.0000000000B96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411956972.0000000000B97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1412053295.0000000000B99000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: 6$^TPX
API String ID: 0-3674074485
Opcode ID: e2faa7a7b5874149e8eed49c136e69c5cac99755a3b347c5e8b82d654e240883
Instruction ID: 0ffe4aa7cb5dd636eb96471ef62a60413df4bf40620d2b94c6400d98312cafed
Opcode Fuzzy Hash: e2faa7a7b5874149e8eed49c136e69c5cac99755a3b347c5e8b82d654e240883
Instruction Fuzzy Hash: 9B5110B054C3809BD3629F2A949072AFBF2AB92749F64199CE0E14B362C775C445CF57

Function 00B87EC0 Relevance: 2.6, Strings: 2, Instructions: 98COMMON

Download Yara Rule

Strings

, xrefs: 00B87F96, 00B87F73, 00B87F7B
@, xrefs: 00B87F28

Memory Dump Source

Source File: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.1411828549.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411851329.0000000000B11000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411876776.0000000000B33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411940991.0000000000B96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411956972.0000000000B97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1412053295.0000000000B99000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: @$
API String ID: 0-736778079
Opcode ID: 0ac285f3c4d7bf6ff568a0e3d31a6644a2a8a6f4a62bd3ece0da7e21683cf0fc
Instruction ID: 5bcf88d850578ccaf8a2c8629c09d4504382ad47bea1cd38e68017bfcdc150b1
Opcode Fuzzy Hash: 0ac285f3c4d7bf6ff568a0e3d31a6644a2a8a6f4a62bd3ece0da7e21683cf0fc
Instruction Fuzzy Hash: AE3178719083449BC314EF15D881A2BFBF9EF96309F24892CE69897261D735D908CB96

Function 00B4CB70 Relevance: 2.6, Strings: 2, Instructions: 82COMMON

Download Yara Rule

Strings

p, xrefs: 00B4CC01
p, xrefs: 00B4CBD9, 00B4CBB3

Memory Dump Source

Source File: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.1411828549.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411851329.0000000000B11000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411876776.0000000000B33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411940991.0000000000B96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411956972.0000000000B97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1412053295.0000000000B99000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: p$p
API String ID: 0-2001073228
Opcode ID: 9ccebd6029074dcc193b65c5d4f3edf18eb513497d73d4234c938a2efa72fd27
Instruction ID: daa85e16192fd1f4c294fdd05db211d35c7b27429793dbda2ec63181c7a98ee6
Opcode Fuzzy Hash: 9ccebd6029074dcc193b65c5d4f3edf18eb513497d73d4234c938a2efa72fd27
Instruction Fuzzy Hash: 7C311DB0D0024AABDB00CF98D5966AEBFB1FB0A300F144529E654AB751D334AA94CBE5

Function 00B47C41 Relevance: 2.6, Strings: 2, Instructions: 71COMMON

Download Yara Rule

Strings

0, xrefs: 00B47C9F
8, xrefs: 00B47C97

Memory Dump Source

Source File: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.1411828549.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411851329.0000000000B11000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411876776.0000000000B33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411940991.0000000000B96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411956972.0000000000B97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1412053295.0000000000B99000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: 0$8
API String ID: 0-46163386
Opcode ID: 101362e4397cd3868e0d82b2d27283c317da1e6fc92abe76afbb474ffa19d7ef
Instruction ID: 5a281ccf215d78fdda9b67b0e684916ce4daf735190c6c2fc9812bf088ebd8bd
Opcode Fuzzy Hash: 101362e4397cd3868e0d82b2d27283c317da1e6fc92abe76afbb474ffa19d7ef
Instruction Fuzzy Hash: A331D67660D3C58BD315CA68944069AFBE1ABE5314F48499DE8C457342CB74D909CBA3

Function 00B3EEF0 Relevance: 2.5, Strings: 1, Instructions: 1296COMMON

Download Yara Rule

Strings

@, xrefs: 00B40E65

Memory Dump Source

Source File: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.1411828549.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411851329.0000000000B11000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411876776.0000000000B33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411940991.0000000000B96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411956972.0000000000B97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1412053295.0000000000B99000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 0f2fb15fb640a0ac74f7ebf11ae0a00e79eb1ebbcee514835237cce2622ebf17
Instruction ID: 7350ef76bdb26129fa8c7152705f46e61304cf8f428aeaba90617eab0cc91fab
Opcode Fuzzy Hash: 0f2fb15fb640a0ac74f7ebf11ae0a00e79eb1ebbcee514835237cce2622ebf17
Instruction Fuzzy Hash: 6B920531A083518FD714CF28C48066ABBE2EFD4354F188AADE995DB392D374DE85DB81

Function 00B827B0 Relevance: 1.9, Strings: 1, Instructions: 618COMMON

Download Yara Rule

Strings

f, xrefs: 00B8298E

Memory Dump Source

Source File: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.1411828549.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411851329.0000000000B11000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411876776.0000000000B33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411940991.0000000000B96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411956972.0000000000B97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1412053295.0000000000B99000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: f
API String ID: 0-1993550816
Opcode ID: b38e6f6da0f4ee892dc7bd84d3849ea3ee91e3c5acb601456a1049e317f3aa66
Instruction ID: c6b49d98eeb743713c6b1dde5c094944f8edb976c850c632b414a66dff637969
Opcode Fuzzy Hash: b38e6f6da0f4ee892dc7bd84d3849ea3ee91e3c5acb601456a1049e317f3aa66
Instruction Fuzzy Hash: C222AB756083419FC714DF18C890A2BBBE5FF89314F188AACF5959B3A2D335E905CB52

Function 00B29964 Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00B2995F,?,?,00000008,?,?,00B31DD5,00000000), ref: 00B29B91

Memory Dump Source

Source File: 00000000.00000002.1411851329.0000000000B11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.1411828549.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411876776.0000000000B33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411940991.0000000000B96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411956972.0000000000B97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1412053295.0000000000B99000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_SecuriteInfo.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: bda82cdccf9f107e921bdfe0c10cc1054a3ff710b7f01265d7c5116f9c5f050e
Instruction ID: 66f06135e0936034964125eb20836fd346a33ad147a4051725cae0d82d8fa9d6
Opcode Fuzzy Hash: bda82cdccf9f107e921bdfe0c10cc1054a3ff710b7f01265d7c5116f9c5f050e
Instruction Fuzzy Hash: 5AB12A31610619DFD719CF28D48ABA57BE0FF45365F298698E89ECF2A1C335E981CB40

Function 00B1730C Relevance: 1.7, APIs: 1, Instructions: 242COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 00B17322

Memory Dump Source

Source File: 00000000.00000002.1411851329.0000000000B11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.1411828549.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411876776.0000000000B33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411940991.0000000000B96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411956972.0000000000B97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1412053295.0000000000B99000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_SecuriteInfo.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: a72c349f8ae6b19148cff0fb9c34a0639ea084ee0ee3ef0758003e853f24f490
Instruction ID: b5972c706b7a45de0818024c89b4d47eb6b350a4f539f2aa19118796542691e6
Opcode Fuzzy Hash: a72c349f8ae6b19148cff0fb9c34a0639ea084ee0ee3ef0758003e853f24f490
Instruction Fuzzy Hash: 58A18CB19556058FDB18CF68D98269DBBF1FB48314F24816BE429E73A0CB74D980CF90

Function 00B415D0 Relevance: 1.7, Strings: 1, Instructions: 448COMMON

Download Yara Rule

Strings

CD, xrefs: 00B4162E

Memory Dump Source

Source File: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.1411828549.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411851329.0000000000B11000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411876776.0000000000B33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411940991.0000000000B96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411956972.0000000000B97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1412053295.0000000000B99000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: CD
API String ID: 0-3115673787
Opcode ID: 4c0b4b88843fe66386dd9f80ba3723d5ab93d35f761372caa74b535c6bc6894e
Instruction ID: ca4f565835bfca71000246e643de722077957e3015d5d7e71a7acb7bce77bf7e
Opcode Fuzzy Hash: 4c0b4b88843fe66386dd9f80ba3723d5ab93d35f761372caa74b535c6bc6894e
Instruction Fuzzy Hash: 68E1C672E183019BC704CF2DC88065AB7E6EBC8750F258E6DF89897394E774DD459B82

Function 00B66380 Relevance: 1.7, Strings: 1, Instructions: 415COMMON

Download Yara Rule

Strings

TW, xrefs: 00B663A2

Memory Dump Source

Source File: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.1411828549.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411851329.0000000000B11000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411876776.0000000000B33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411940991.0000000000B96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411956972.0000000000B97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1412053295.0000000000B99000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: TW
API String ID: 0-1778470648
Opcode ID: 37e65682408c37040f626a0ca88badc03505eecafd751e2c16e196c146a53e28
Instruction ID: 206ffeadf877d1ec154fd93a686bc1be8e00ec602b699fa1814bd113dcc58773
Opcode Fuzzy Hash: 37e65682408c37040f626a0ca88badc03505eecafd751e2c16e196c146a53e28
Instruction Fuzzy Hash: 91C1AFB1508200ABDB11AF14D882A6BB7F5EF95754F09889CF8C597352E339DD14CBA3

Function 00B2A69A Relevance: 1.6, APIs: 1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1411851329.0000000000B11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.1411828549.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411876776.0000000000B33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411940991.0000000000B96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411956972.0000000000B97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1412053295.0000000000B99000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96f19dbc61c38ed0666366af6e3b39f1ac1e1e306884777644b05e378b99573d
Instruction ID: 373b5ea30865f94d25073418e3cb2230271b57ceaad7d117d036fe6c2a2510fa
Opcode Fuzzy Hash: 96f19dbc61c38ed0666366af6e3b39f1ac1e1e306884777644b05e378b99573d
Instruction Fuzzy Hash: C931D776900229AFCB24DFA8DC89DBBB7BDEB84310F144599F909D7244EA31DE408B54

Function 00B71766 Relevance: 1.6, Strings: 1, Instructions: 336COMMON

Download Yara Rule

Strings

-'.$, xrefs: 00B719A1

Memory Dump Source

Source File: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.1411828549.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411851329.0000000000B11000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411876776.0000000000B33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411940991.0000000000B96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411956972.0000000000B97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1412053295.0000000000B99000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: -'.$
API String ID: 0-2031752551
Opcode ID: 34e3f814482b72035446470293d0cf0e4fa038b8cce2f5f390abddc47372c923
Instruction ID: a737ed221065abe6ca797c024504613412c4f68edf2cc9e14939aef55fcd83dc
Opcode Fuzzy Hash: 34e3f814482b72035446470293d0cf0e4fa038b8cce2f5f390abddc47372c923
Instruction Fuzzy Hash: 6EB14774505B818FD7268F29C090B22FBF1EF56314F18C99DD4EA9BA52C735E806CBA1

Function 00B2D2C6 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 00B25A35: GetLastError.KERNEL32(?,00000000,00B2066F,?,?,?,?,00000003,00B1CB1B,?,?,?,?,00000000), ref: 00B25A39
Part of subcall function 00B25A35: SetLastError.KERNEL32(00000000,?,?,?,00000003,00B1CB1B,?,?,?,?,00000000), ref: 00B25ADB

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00B2D31A

Memory Dump Source

Source File: 00000000.00000002.1411851329.0000000000B11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.1411828549.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411876776.0000000000B33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411940991.0000000000B96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411956972.0000000000B97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1412053295.0000000000B99000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_SecuriteInfo.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 8c717883d75e00247ba1a5ca9b0ca1cfcc7494d792c561138e73a9d5e8bfa325
Instruction ID: 04244608f9ff0c5e70a71fc463668e78dcc363341845aec6a7f442b2fc06b601
Opcode Fuzzy Hash: 8c717883d75e00247ba1a5ca9b0ca1cfcc7494d792c561138e73a9d5e8bfa325
Instruction Fuzzy Hash: E2219572615226ABDB28DF24EC42ABA73ECEF45314B2041BAFD09D7141EB74ED408B56

Function 00B2CF4D Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00B25A35: GetLastError.KERNEL32(?,00000000,00B2066F,?,?,?,?,00000003,00B1CB1B,?,?,?,?,00000000), ref: 00B25A39
Part of subcall function 00B25A35: SetLastError.KERNEL32(00000000,?,?,?,00000003,00B1CB1B,?,?,?,?,00000000), ref: 00B25ADB

EnumSystemLocalesW.KERNEL32(00B2D073,00000001,00000000,?,-00000050,?,00B2D6A4,00000000,?,?,?,00000055,?), ref: 00B2CFBF

Memory Dump Source

Source File: 00000000.00000002.1411851329.0000000000B11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.1411828549.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411876776.0000000000B33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411940991.0000000000B96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411956972.0000000000B97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1412053295.0000000000B99000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_SecuriteInfo.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 04473c01b38485d2e004be5f2ff0911a1a45b7d1f5b433bb7dd776a6b7343837
Instruction ID: 0f58b9bb40a430044c78a7eca7bd2c5c06f24dfb7dab56539ee65d3a9720a310
Opcode Fuzzy Hash: 04473c01b38485d2e004be5f2ff0911a1a45b7d1f5b433bb7dd776a6b7343837
Instruction Fuzzy Hash: 5C1148376047019FDB189F38E8A16BEBBE2FF84758B18442DE98A87A40D775B903C740

Function 00B2D4F5 Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 00B25A35: GetLastError.KERNEL32(?,00000000,00B2066F,?,?,?,?,00000003,00B1CB1B,?,?,?,?,00000000), ref: 00B25A39
Part of subcall function 00B25A35: SetLastError.KERNEL32(00000000,?,?,?,00000003,00B1CB1B,?,?,?,?,00000000), ref: 00B25ADB

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,00B2D28F,00000000,00000000,?), ref: 00B2D521

Memory Dump Source

Source File: 00000000.00000002.1411851329.0000000000B11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.1411828549.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411876776.0000000000B33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411940991.0000000000B96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411956972.0000000000B97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1412053295.0000000000B99000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_SecuriteInfo.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: afac4063140cdd0c5e835a081bfa1cb8029e6241184e0801d571b307ca3a292b
Instruction ID: efc8a7d9065377168f07866524d8aa9ccb1dfa5a34fe91069ceb3ff0f0df5241
Opcode Fuzzy Hash: afac4063140cdd0c5e835a081bfa1cb8029e6241184e0801d571b307ca3a292b
Instruction Fuzzy Hash: 54F0F9325101317BDB295B28AC45BBF7BE4EB50758F1444A5EC1DA3180DAB4FE41C690

Function 00B2CFE8 Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00B25A35: GetLastError.KERNEL32(?,00000000,00B2066F,?,?,?,?,00000003,00B1CB1B,?,?,?,?,00000000), ref: 00B25A39
Part of subcall function 00B25A35: SetLastError.KERNEL32(00000000,?,?,?,00000003,00B1CB1B,?,?,?,?,00000000), ref: 00B25ADB

EnumSystemLocalesW.KERNEL32(00B2D2C6,00000001,?,?,-00000050,?,00B2D668,-00000050,?,?,?,00000055,?,-00000050,?,?), ref: 00B2D032

Memory Dump Source

Source File: 00000000.00000002.1411851329.0000000000B11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.1411828549.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411876776.0000000000B33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411940991.0000000000B96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411956972.0000000000B97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1412053295.0000000000B99000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_SecuriteInfo.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 920a0f4d3b8b0c791febe97a0bcd5b8852d55e4a87b72a3989f8f2f93e9be1ba
Instruction ID: e6d6aa7ea8cf9e472cef9bd8132e11d46bc40b888e277d4984f10e04f7cad1a5
Opcode Fuzzy Hash: 920a0f4d3b8b0c791febe97a0bcd5b8852d55e4a87b72a3989f8f2f93e9be1ba
Instruction Fuzzy Hash: 08F0F6363003146FDB245F39EC91A7B7BE1EF84768F1584ADF9494B6A0D6B1AC03C650

Function 00B23C56 Relevance: 1.5, APIs: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00B1E0B5: EnterCriticalSection.KERNEL32(-00B97AF0,?,00B20C05,00000000,00B3C488,0000000C,00B20BCC,?,?,00B23BE5,?,?,00B25BD3,00000001,00000364,00000000), ref: 00B1E0C4

EnumSystemLocalesW.KERNEL32(00B23C49,00000001,00B3C5D8,0000000C,00B23FFC,00000000), ref: 00B23C8E

Memory Dump Source

Source File: 00000000.00000002.1411851329.0000000000B11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.1411828549.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411876776.0000000000B33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411940991.0000000000B96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411956972.0000000000B97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1412053295.0000000000B99000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_SecuriteInfo.jbxd

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: 8e4598b2d8943d0e38924d566316681e6a90b28d45cfb86ea3772b6a1446cd3e
Instruction ID: d8cd5c85c6332bc21d377eb72e12bc4bad033b40ac4a650ef2b3dcbb7f27c9ee
Opcode Fuzzy Hash: 8e4598b2d8943d0e38924d566316681e6a90b28d45cfb86ea3772b6a1446cd3e
Instruction Fuzzy Hash: C6F04976A54310DFD704EF98E906B9D77F0FB48B21F1045AAF815AB2E0CBB999408F90

Function 00B2CF02 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00B25A35: GetLastError.KERNEL32(?,00000000,00B2066F,?,?,?,?,00000003,00B1CB1B,?,?,?,?,00000000), ref: 00B25A39
Part of subcall function 00B25A35: SetLastError.KERNEL32(00000000,?,?,?,00000003,00B1CB1B,?,?,?,?,00000000), ref: 00B25ADB

EnumSystemLocalesW.KERNEL32(00B2CE5B,00000001,?,?,?,00B2D6C6,-00000050,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 00B2CF39

Memory Dump Source

Source File: 00000000.00000002.1411851329.0000000000B11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.1411828549.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411876776.0000000000B33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411940991.0000000000B96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411956972.0000000000B97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1412053295.0000000000B99000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_SecuriteInfo.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: c1eb3be2eb4b66cd6bbd1683ac8773f923841be5b0b1268df8e4fcf7d013bcb0
Instruction ID: 1459e29a5f951f75b62cdf175b8181877110a0a9df5bf2fcf1060377b1f7d06b
Opcode Fuzzy Hash: c1eb3be2eb4b66cd6bbd1683ac8773f923841be5b0b1268df8e4fcf7d013bcb0
Instruction Fuzzy Hash: C3F0E53630021597CB14AF7AE98566EBFE5EFC1B54B0B409AEE0D8B291C671DD43C7A0

Function 00B24100 Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,?,?,00B22AF7,?,20001004,00000000,00000002,?,?,00B220F9), ref: 00B24134

Memory Dump Source

Source File: 00000000.00000002.1411851329.0000000000B11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.1411828549.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411876776.0000000000B33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411940991.0000000000B96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411956972.0000000000B97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1412053295.0000000000B99000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_SecuriteInfo.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 475d63fab814c60d9e933fbc7a068759914feb9b59a7ca632cba3608aa86614e
Instruction ID: ef6c360b4d6cc75434cd4482643332e5961985436670229550419c1ad9cffbbb
Opcode Fuzzy Hash: 475d63fab814c60d9e933fbc7a068759914feb9b59a7ca632cba3608aa86614e
Instruction Fuzzy Hash: E4E04F35500238BBCF122F61EC05A9E7FA5FF58B62F144051FC0966160CB358A60AAD1

Function 00B6B071 Relevance: 1.5, Strings: 1, Instructions: 267COMMON

Download Yara Rule

Strings

P, xrefs: 00B6B3AF

Memory Dump Source

Source File: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.1411828549.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411851329.0000000000B11000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411876776.0000000000B33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411940991.0000000000B96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411956972.0000000000B97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1412053295.0000000000B99000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: P
API String ID: 0-3110715001
Opcode ID: 4bfaa7626ea9b600e4b84af23bd05a8ca6e36999e86aa202f38862eca0be855c
Instruction ID: fabc9e666cda2059cc9810974b606b4c72324e3d6417a55e3b3e01a564b92d75
Opcode Fuzzy Hash: 4bfaa7626ea9b600e4b84af23bd05a8ca6e36999e86aa202f38862eca0be855c
Instruction Fuzzy Hash: D8A102719093459BD7109A24C8A0B6FFBF1EF95350F1849ADE699C7352E33CC980CB82

Function 00B48920 Relevance: 1.5, Strings: 1, Instructions: 265COMMON

Download Yara Rule

Strings

,, xrefs: 00B48A56

Memory Dump Source

Source File: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.1411828549.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411851329.0000000000B11000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411876776.0000000000B33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411940991.0000000000B96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411956972.0000000000B97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1412053295.0000000000B99000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: ,
API String ID: 0-3772416878
Opcode ID: 4ab73c068909bf4a579edcd3551088511d35e91c35163eb6544c071a430a9b34
Instruction ID: 8bf02872fff3158b5b834f2795bbe2dc19eff999508f6f2a1d44412e7b67946b
Opcode Fuzzy Hash: 4ab73c068909bf4a579edcd3551088511d35e91c35163eb6544c071a430a9b34
Instruction Fuzzy Hash: EBB127712093819FD321CF18C88061FBBE0AFA9704F444E6DE5D997782D671EA18DBA7

Function 00B3F22A Relevance: 1.5, Strings: 1, Instructions: 264COMMON

Download Yara Rule

Strings

@, xrefs: 00B3F810

Memory Dump Source

Source File: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.1411828549.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411851329.0000000000B11000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411876776.0000000000B33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411940991.0000000000B96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411956972.0000000000B97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1412053295.0000000000B99000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 306e642b51b2512054d38a46158e9f08723d7b25d1953b1fc47caece9ac7f322
Instruction ID: b474c96d79a566eec64bd16dca380ee57feaa12eeaa8f4d239b000f646267087
Opcode Fuzzy Hash: 306e642b51b2512054d38a46158e9f08723d7b25d1953b1fc47caece9ac7f322
Instruction Fuzzy Hash: C4A18971A183518BD318CE18C49476AFBE2EFC4314F288AADE9D957392C7749D49CB82

Function 00B17B35 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00007B41,00B16E2E), ref: 00B17B3A

Memory Dump Source

Source File: 00000000.00000002.1411851329.0000000000B11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.1411828549.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411876776.0000000000B33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411940991.0000000000B96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411956972.0000000000B97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1412053295.0000000000B99000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_SecuriteInfo.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 6525b0af479562750ed4d6469d653c382cb84a8637f18cb868f06ce9b240cc73
Instruction ID: 212128479465c00eba019fe4cd7302815e177f22f19e579249741bca9b36cc41
Opcode Fuzzy Hash: 6525b0af479562750ed4d6469d653c382cb84a8637f18cb868f06ce9b240cc73
Instruction Fuzzy Hash:

Function 00B88510 Relevance: 1.5, Strings: 1, Instructions: 247COMMON

Download Yara Rule

Strings

, xrefs: 00B8856A, 00B88626, 00B88603, 00B88543, 00B8854B, 00B8860B

Memory Dump Source

Source File: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.1411828549.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411851329.0000000000B11000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411876776.0000000000B33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411940991.0000000000B96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411956972.0000000000B97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1412053295.0000000000B99000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3019521637
Opcode ID: 08d3931baa2a9c42408cb6ec1c64e50b571bbd3c3c2ceb0987ed0c3721af9082
Instruction ID: 3b3200cc00a32362e33e58bc81af2bd85b71f54e9112a37e922134e3250c9ec9
Opcode Fuzzy Hash: 08d3931baa2a9c42408cb6ec1c64e50b571bbd3c3c2ceb0987ed0c3721af9082
Instruction Fuzzy Hash: FE81E2356083519BC724AF18C880A2BB3F5FF94710F5989ACF98597361EB31EC50CB82

Function 00B6F3A0 Relevance: 1.5, Strings: 1, Instructions: 237COMMON

Download Yara Rule

Strings

", xrefs: 00B6F664

Memory Dump Source

Source File: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.1411828549.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411851329.0000000000B11000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411876776.0000000000B33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411940991.0000000000B96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411956972.0000000000B97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1412053295.0000000000B99000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: 7e98b4656ee7a597cc4d0ae5467a7c4b97e5a60aa5ade5d03bcc0f57a0d03316
Instruction ID: d3ae3a21cacad43f3ec7ec6ed106169d5c8b19004ac1fdd3902b54340d5e8087
Opcode Fuzzy Hash: 7e98b4656ee7a597cc4d0ae5467a7c4b97e5a60aa5ade5d03bcc0f57a0d03316
Instruction Fuzzy Hash: C071E7326087524BD7248D2DE88023BB6D2ABC6334F2997BEE475CB3E1DA79CC458741

Function 00B85810 Relevance: 1.4, Strings: 1, Instructions: 183COMMON

Download Yara Rule

Strings

, xrefs: 00B858D6, 00B859C0, 00B85993, 00B858B3, 00B858BB, 00B8599B

Memory Dump Source

Source File: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.1411828549.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411851329.0000000000B11000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411876776.0000000000B33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411940991.0000000000B96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411956972.0000000000B97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1412053295.0000000000B99000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3019521637
Opcode ID: caa00a0baa876a8884e4083aa7b8b58c4b77efdead5d9ec54620c567e662e154
Instruction ID: 86b713e2f01f969d693aad30ca71bf0b48e874cd35a0c2be9046e66476d6e44c
Opcode Fuzzy Hash: caa00a0baa876a8884e4083aa7b8b58c4b77efdead5d9ec54620c567e662e154
Instruction Fuzzy Hash: 0E51E534608350EBDB24AA18CCD0B2EB7E5EB85759F548A6CF8D5573A2D732DC00C7A6

Function 00B71AEC Relevance: 1.4, Strings: 1, Instructions: 161COMMON

Download Yara Rule

Strings

2FD>, xrefs: 00B72F80

Memory Dump Source

Source File: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.1411828549.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411851329.0000000000B11000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411876776.0000000000B33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411940991.0000000000B96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411956972.0000000000B97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1412053295.0000000000B99000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: 2FD>
API String ID: 0-1510312430
Opcode ID: 242552adc178d8c3491bf93f30874780fcc0fbb89b54cad1dcff1d541b57b90a
Instruction ID: 47a914e2b291ebf828648877938ca16b4acbf24a07a8d0d1bc8946b736867fe9
Opcode Fuzzy Hash: 242552adc178d8c3491bf93f30874780fcc0fbb89b54cad1dcff1d541b57b90a
Instruction Fuzzy Hash: B3514F705047818EDB268F258450A26FBF1EF17355B28C8CDD8EA9FA43C339E846CB65

Function 00B50A5C Relevance: 1.4, Strings: 1, Instructions: 160COMMON

Download Yara Rule

Strings

2, xrefs: 00B50AF2

Memory Dump Source

Source File: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.1411828549.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411851329.0000000000B11000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411876776.0000000000B33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411940991.0000000000B96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411956972.0000000000B97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1412053295.0000000000B99000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: 2
API String ID: 0-450215437
Opcode ID: e6034f399045d4b6abb2554f6b82214a593dffe65b117c12c080d18cf511f5b9
Instruction ID: 5db1bae82f892adcb053e70ee4790c626740427336b6c0624c15753229105d79
Opcode Fuzzy Hash: e6034f399045d4b6abb2554f6b82214a593dffe65b117c12c080d18cf511f5b9
Instruction Fuzzy Hash: 0851C3759593809AF231AB209852FEFB6E5BFC6304F0408ACF48957243DB369509D767

Function 00B50CEC Relevance: 1.4, Strings: 1, Instructions: 156COMMON

Download Yara Rule

Strings

2, xrefs: 00B50D7B

Memory Dump Source

Source File: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.1411828549.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411851329.0000000000B11000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411876776.0000000000B33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411940991.0000000000B96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411956972.0000000000B97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1412053295.0000000000B99000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: 2
API String ID: 0-450215437
Opcode ID: 15cde75e9d06dabda2588e85d20db4463443109759951a92bfa7a8f5d5147061
Instruction ID: 4d88e29b178d4283595a5705e20063a0c836d16c2cb55a5d3c33d5ce2eb45f64
Opcode Fuzzy Hash: 15cde75e9d06dabda2588e85d20db4463443109759951a92bfa7a8f5d5147061
Instruction Fuzzy Hash: E051B37595A38096F231A7209842FEFB6F6BFD5304F0408ACF48957283DB36A609D763

Function 00B11E49 Relevance: 1.4, Strings: 1, Instructions: 156COMMON

Download Yara Rule

Strings

Z81xbyuAua, xrefs: 00B11F6B

Memory Dump Source

Source File: 00000000.00000002.1411851329.0000000000B11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.1411828549.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411876776.0000000000B33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411940991.0000000000B96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411956972.0000000000B97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1412053295.0000000000B99000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: Z81xbyuAua
API String ID: 0-3121583705
Opcode ID: a65613aa4f85d5d09302ae474c674b54cd5c805be323eac76b66fe39d6dfce85
Instruction ID: 9db0e438f6d4b5df1c00d80b7e703086d89900bbac3956ead45990475c03e497
Opcode Fuzzy Hash: a65613aa4f85d5d09302ae474c674b54cd5c805be323eac76b66fe39d6dfce85
Instruction Fuzzy Hash: 2C41FA77E2052B4BCB0CEEBC84561EABBA5DB45360B54467ADE10DB3D1E2348A42C6D0

Function 00B7233F Relevance: 1.4, Strings: 1, Instructions: 141COMMON

Download Yara Rule

Strings

2FD>, xrefs: 00B72F80

Memory Dump Source

Source File: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.1411828549.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411851329.0000000000B11000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411876776.0000000000B33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411940991.0000000000B96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411956972.0000000000B97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1412053295.0000000000B99000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: 2FD>
API String ID: 0-1510312430
Opcode ID: 482e1bb03dcd7035389772e6bba219ce3904a568faca1742d2efed7deef8c6d7
Instruction ID: 4637eb352d5243f8d6d6306bcd983450a06a30165a745ef3baa6a5f7bc249273
Opcode Fuzzy Hash: 482e1bb03dcd7035389772e6bba219ce3904a568faca1742d2efed7deef8c6d7
Instruction Fuzzy Hash: 36412C705047818EDB268F258050A26FBF1EF17358B24C8CDD8EA9F643C73AE846CB55

Function 00B87BB0 Relevance: 1.4, Strings: 1, Instructions: 131COMMON

Download Yara Rule

Strings

, xrefs: 00B87C0F, 00B87CC6, 00B87CA3, 00B87BE4, 00B87BED, 00B87CAB

Memory Dump Source

Source File: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.1411828549.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411851329.0000000000B11000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411876776.0000000000B33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411940991.0000000000B96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411956972.0000000000B97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1412053295.0000000000B99000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3019521637
Opcode ID: 3f681d420308340ce622b70d3801fe125027f74667fc1b293c25dd6169613fb3
Instruction ID: 8dd9966e8ed89a8d1ecadb64179ff89e5edd66572a9b032498201640f2ff4334
Opcode Fuzzy Hash: 3f681d420308340ce622b70d3801fe125027f74667fc1b293c25dd6169613fb3
Instruction Fuzzy Hash: 4F418F7464C300AFD714AF14D890B2ABBE5EF86719F74886CF58557262D731E800CB5A

Function 00B87D40 Relevance: 1.4, Strings: 1, Instructions: 128COMMON

Download Yara Rule

Strings

, xrefs: 00B87D9F, 00B87E56, 00B87E33, 00B87D74, 00B87D7D, 00B87E3B

Memory Dump Source

Source File: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.1411828549.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411851329.0000000000B11000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411876776.0000000000B33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411940991.0000000000B96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411956972.0000000000B97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1412053295.0000000000B99000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3019521637
Opcode ID: 35ff341fea01c2b82f004fdc622a9334d9847dfee3824cdca80f10c1f8328be7
Instruction ID: cc01362bd6b5796433de250d6cb6aebc9bbd45f496a6e35b8a6a1bcf30a573ef
Opcode Fuzzy Hash: 35ff341fea01c2b82f004fdc622a9334d9847dfee3824cdca80f10c1f8328be7
Instruction Fuzzy Hash: 3541907464C300AFD714AF14D880B2BB7EAEF86719F2488ACF589572A2D731DC10CB5A

Function 00B5BF45 Relevance: 1.4, Strings: 1, Instructions: 108COMMON

Download Yara Rule

Strings

qs, xrefs: 00B5BFAE

Memory Dump Source

Source File: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.1411828549.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411851329.0000000000B11000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411876776.0000000000B33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411940991.0000000000B96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411956972.0000000000B97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1412053295.0000000000B99000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: qs
API String ID: 0-1399850505
Opcode ID: 8aaebf1e4c3640f5f3ce392bc9914373ba4fadcd76e73042caaaaaebe0853f7e
Instruction ID: 4ade9246e5c16164275e576437caad13d0171d851702b3847cdf094e6f18364d
Opcode Fuzzy Hash: 8aaebf1e4c3640f5f3ce392bc9914373ba4fadcd76e73042caaaaaebe0853f7e
Instruction Fuzzy Hash: BE3118B0100B008FC730CF24D991A23B7F1FF19755B145A8CE99A8BAA5E335F844DB55

Function 00B848FA Relevance: 1.3, Strings: 1, Instructions: 81COMMON

Download Yara Rule

Strings

, xrefs: 00B84966, 00B84943, 00B8494B

Memory Dump Source

Source File: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.1411828549.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411851329.0000000000B11000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411876776.0000000000B33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411940991.0000000000B96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411956972.0000000000B97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1412053295.0000000000B99000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3019521637
Opcode ID: 6755f9bab069ea5934903f8183f253ded6f2aca177a558b48b1de12272a79bcd
Instruction ID: 0035796f1ddbd57513575a584d4fb7df1fa8fb09be3cc2806e1995303a5cc121
Opcode Fuzzy Hash: 6755f9bab069ea5934903f8183f253ded6f2aca177a558b48b1de12272a79bcd
Instruction Fuzzy Hash: E521AE74608302AFD724EF08D881B2BB7E5EB85715F64895CF1C2972E2D375E810CB56

Function 00B2D826 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00B2D826

Memory Dump Source

Source File: 00000000.00000002.1411851329.0000000000B11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.1411828549.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411876776.0000000000B33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411940991.0000000000B96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411956972.0000000000B97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1412053295.0000000000B99000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_SecuriteInfo.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 63217b418deb2e8bf530be85ab63294b8d58d88edcfb568f2ad37fd25221456e
Instruction ID: 2f2bb494fca7987313bac6b1610405f4e854142ab957ec3ced3236d4b571740e
Opcode Fuzzy Hash: 63217b418deb2e8bf530be85ab63294b8d58d88edcfb568f2ad37fd25221456e
Instruction Fuzzy Hash: DAA00270702A01CF97508F36AF4970F7BEDAE4AAD1756806AA449D71B0EF348590AF01

Function 00B49F50 Relevance: .8, Instructions: 789COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.1411828549.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411851329.0000000000B11000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411876776.0000000000B33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411940991.0000000000B96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411956972.0000000000B97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1412053295.0000000000B99000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55bdd7183e786f206f49eb0e89a9435e12bd88c65a2001897e8b962e1375b007
Instruction ID: d261369efbf1887fdb92f4ba914254aa5b1e50f85093a49e9cf14431dd812f23
Opcode Fuzzy Hash: 55bdd7183e786f206f49eb0e89a9435e12bd88c65a2001897e8b962e1375b007
Instruction Fuzzy Hash: 1B42E5316487118BD724DF28E8806BEB3E1FFD4315F29896DD986C7281E734AA51EB43

Function 00B62920 Relevance: .7, Instructions: 700COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.1411828549.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411851329.0000000000B11000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411876776.0000000000B33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411940991.0000000000B96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411956972.0000000000B97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1412053295.0000000000B99000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16869c809fe6b9c013eb52f11e203e487ef228a061d05dc0c8baca727ee9c214
Instruction ID: 4acc5a1d514399d5ca8cbd4e08b7f2ce740087288c2cd0d17fa0271a443beaa6
Opcode Fuzzy Hash: 16869c809fe6b9c013eb52f11e203e487ef228a061d05dc0c8baca727ee9c214
Instruction Fuzzy Hash: A672F8B0508B819ED371CF3C8845797BFE5AB1A324F044A9EE0EA8B3D2C7756505CB66

Function 00B49440 Relevance: .7, Instructions: 670COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.1411828549.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411851329.0000000000B11000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411876776.0000000000B33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411940991.0000000000B96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411956972.0000000000B97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1412053295.0000000000B99000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 169fd697c981202875bdf4f7b877c3bbabddd2f5e73f7c32bbe4a1385d044f0b
Instruction ID: 0fed755cb09d70ee386c10cedbc06612b594eb583ea0a6ded8a1569761ddeeac
Opcode Fuzzy Hash: 169fd697c981202875bdf4f7b877c3bbabddd2f5e73f7c32bbe4a1385d044f0b
Instruction Fuzzy Hash: 1E5207709087848FE735CF24C4847A7BBE1EB92314F144DADC5EA06BC2D379AA89E751

Function 00B45290 Relevance: .7, Instructions: 657COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.1411828549.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411851329.0000000000B11000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411876776.0000000000B33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411940991.0000000000B96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411956972.0000000000B97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1412053295.0000000000B99000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e65e6d0ec29a0286690b312841c0ba80701f8bb5ada55794a20425fd9e091869
Instruction ID: 9f53e389db739cafc9e1f2353400887069ddeb31f2ac0dbb9be4be7b2b0cbeeb
Opcode Fuzzy Hash: e65e6d0ec29a0286690b312841c0ba80701f8bb5ada55794a20425fd9e091869
Instruction Fuzzy Hash: 9752C371508B458FCB25CF14C0C06AABBE1FF88314F598AADE8D95B342D774DA89DB81

Function 00B45C90 Relevance: .6, Instructions: 592COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.1411828549.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411851329.0000000000B11000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411876776.0000000000B33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411940991.0000000000B96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411956972.0000000000B97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1412053295.0000000000B99000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b4942d6c5a04db89343f61d2bd896b7a754b8bfa492006bc517a5ac4323522e
Instruction ID: 5e10c775fd23c500e2396c6976381d77e240019e348ed6808439f5cd3b026626
Opcode Fuzzy Hash: 8b4942d6c5a04db89343f61d2bd896b7a754b8bfa492006bc517a5ac4323522e
Instruction Fuzzy Hash: 21321070514B108FC338CE29C59052ABBF2FF46710BA04A6ED6A787B91D736FA44EB15

Function 00B48350 Relevance: .5, Instructions: 504COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.1411828549.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411851329.0000000000B11000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411876776.0000000000B33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411940991.0000000000B96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411956972.0000000000B97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1412053295.0000000000B99000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2ed25ed2ecece428dec3d662da4c49c86df14d0f0cac3c7bd7da9d139c37883
Instruction ID: 72186f3f8306cc8918d8301ab9703f9b49ba9b981c553213fc7bddf78667a0db
Opcode Fuzzy Hash: c2ed25ed2ecece428dec3d662da4c49c86df14d0f0cac3c7bd7da9d139c37883
Instruction Fuzzy Hash: 1502B0356087018FD728CF29C89162FFBE2EFD8300F08896DE4D687751EA35A904CB56

Function 00B6B450 Relevance: .4, Instructions: 380COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.1411828549.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411851329.0000000000B11000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411876776.0000000000B33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411940991.0000000000B96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411956972.0000000000B97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1412053295.0000000000B99000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83d948c1b98276872fbedeb4ae571c7f1df7ffbfed0eb7000220ee8de56deee4
Instruction ID: 2939101df1e9a1dcc292f7eb443f0973e8ee71b8563912ec498bd1860364d61d
Opcode Fuzzy Hash: 83d948c1b98276872fbedeb4ae571c7f1df7ffbfed0eb7000220ee8de56deee4
Instruction Fuzzy Hash: 04B1DF716083059BD714EF28C890A2BB7F6EF95304F1849ACE5C6C7291E339E984CB96

Function 00B72452 Relevance: .4, Instructions: 358COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.1411828549.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411851329.0000000000B11000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411876776.0000000000B33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411940991.0000000000B96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411956972.0000000000B97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1412053295.0000000000B99000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5e5a161c1ab45c4b1e480cfbddb13b76eded34dc1ce46f9e0b718e5efcd9d52
Instruction ID: 2cf088a5d59248c2d9b810360b56b74fd5876386811305f3c46ee7d6ed74327a
Opcode Fuzzy Hash: c5e5a161c1ab45c4b1e480cfbddb13b76eded34dc1ce46f9e0b718e5efcd9d52
Instruction Fuzzy Hash: 58D10AB4800B419FD321AF39C546652BFB0FB06300F548A9DE8EA5B686D335A45ACBD6

Function 00B85DC0 Relevance: .3, Instructions: 330COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.1411828549.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411851329.0000000000B11000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411876776.0000000000B33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411940991.0000000000B96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411956972.0000000000B97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1412053295.0000000000B99000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5adaadb379de4d0ac6695891303286d85bf5796d7f1c210cbcdbab9b523f8b94
Instruction ID: 8da9d7bb8b532f071e5b6997b2cb7da5b12771e5cb2d90c81f4a2b25479cff33
Opcode Fuzzy Hash: 5adaadb379de4d0ac6695891303286d85bf5796d7f1c210cbcdbab9b523f8b94
Instruction Fuzzy Hash: 52A11471A083509BE724AF28DC84B6BB7E5EB84314F0849ACF99497362E731ED04C792

Function 00B2C711 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1411851329.0000000000B11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.1411828549.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411876776.0000000000B33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411940991.0000000000B96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411956972.0000000000B97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1412053295.0000000000B99000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_SecuriteInfo.jbxd

Similarity

API ID: ErrorLastProcess$CurrentFeatureInfoLocalePresentProcessorTerminate
String ID:
API String ID: 3471368781-0
Opcode ID: 6137733a4e98d0fbf1c64009f4be126797ec0407a83f181efadee47b9a1dd0c0
Instruction ID: 4794dbfb2b14cd4cadf159e7a3e591baf0d3aab36c055dd900d3eaa7ab73dbb3
Opcode Fuzzy Hash: 6137733a4e98d0fbf1c64009f4be126797ec0407a83f181efadee47b9a1dd0c0
Instruction Fuzzy Hash: C7B11A315007158BDB389B24EC92BBFB7E8EF45308F5445ADE98BC6680EB75E981CB10

Function 00B1CF34 Relevance: .3, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1411851329.0000000000B11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.1411828549.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411876776.0000000000B33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411940991.0000000000B96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411956972.0000000000B97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1412053295.0000000000B99000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39ad094ebc59df172da474d17cadc63c9464c88e10f5e073336f671a1ca2436e
Instruction ID: 8f83e416a1aee9e191778801e0eb085292580bdb87a1c09596f2b2b99f41696c
Opcode Fuzzy Hash: 39ad094ebc59df172da474d17cadc63c9464c88e10f5e073336f671a1ca2436e
Instruction Fuzzy Hash: E0B1AF70A0060A9ACF24CF68C594AFEBBF2EF48700F90499DE456A7290D731EDC6CB51

Function 00B544BC Relevance: .3, Instructions: 284COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.1411828549.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411851329.0000000000B11000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411876776.0000000000B33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411940991.0000000000B96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411956972.0000000000B97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1412053295.0000000000B99000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d6742bc921a87cbc0d7ecdfc3dd5ce11be376d8912454172b111acada42123f
Instruction ID: 95994d167a5bec5691f8d150e37df205af9fd23b1128b0864312a1be4e88ee30
Opcode Fuzzy Hash: 7d6742bc921a87cbc0d7ecdfc3dd5ce11be376d8912454172b111acada42123f
Instruction Fuzzy Hash: 53C11E74500B508BD325CF24C891B67BBF1FF06309F14899CE99B8BA92E736B849CB54

Function 00B77090 Relevance: .3, Instructions: 277COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.1411828549.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411851329.0000000000B11000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411876776.0000000000B33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411940991.0000000000B96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411956972.0000000000B97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1412053295.0000000000B99000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6242de2c158a3e25abd914ef81a7081ec85dc90910a15599f474a425946f381
Instruction ID: 36635b9729add635c63ee021100901140b5fb47e769259943acd66c08f9e8fcc
Opcode Fuzzy Hash: c6242de2c158a3e25abd914ef81a7081ec85dc90910a15599f474a425946f381
Instruction Fuzzy Hash: F4810737A5999147C318993D4C512BAAAC35FD7330B3EC3AAE9B9DB3E5DD3488025390

Function 00B4331A Relevance: .3, Instructions: 271COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.1411828549.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411851329.0000000000B11000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411876776.0000000000B33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411940991.0000000000B96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411956972.0000000000B97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1412053295.0000000000B99000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9bb0e1251b43261e23572b6fe04e2d9b66b4d052610f955a5f7654400d35fefe
Instruction ID: d3d67fcd6fe31327c0963f7f16c726e377fd904b317e95e09f8e7de3a372fe3e
Opcode Fuzzy Hash: 9bb0e1251b43261e23572b6fe04e2d9b66b4d052610f955a5f7654400d35fefe
Instruction Fuzzy Hash: 0791E8B1A083529BD7258E5494C0326BBD2EFA1B08F1D84EDD8864B342E7B1DF49E742

Function 00B6CAF2 Relevance: .3, Instructions: 256COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.1411828549.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411851329.0000000000B11000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411876776.0000000000B33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411940991.0000000000B96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411956972.0000000000B97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1412053295.0000000000B99000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a435c7ff7e61a266175cc740b2df94f4f0bcffa5dc796596f52e14c951997eae
Instruction ID: 0e7810a5b24a5353784eb9d5af851f7644aee731d28e5d9afd0af78c50671107
Opcode Fuzzy Hash: a435c7ff7e61a266175cc740b2df94f4f0bcffa5dc796596f52e14c951997eae
Instruction Fuzzy Hash: 8E710973A14B154BC7288D3C9C1166AB6D29BC4214F4E837CDD9ADB386EB78ED0187C1

Function 00B75AA0 Relevance: .3, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.1411828549.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411851329.0000000000B11000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411876776.0000000000B33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411940991.0000000000B96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411956972.0000000000B97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1412053295.0000000000B99000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8b4e1efa5495fb8a019b3a8f09c75cd24c53d3083fb3dc6746e68a82280d218
Instruction ID: 81270151c83edfb61dd82c0fa4f54c7678d9be3b5202d3223e39b25db3e8362a
Opcode Fuzzy Hash: e8b4e1efa5495fb8a019b3a8f09c75cd24c53d3083fb3dc6746e68a82280d218
Instruction Fuzzy Hash: 4381E836649E914BD3399E3C8C913796ED28BD2330F2DCBADE4F58B3E5D6A588018351

Function 00B66120 Relevance: .2, Instructions: 242COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.1411828549.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411851329.0000000000B11000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411876776.0000000000B33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411940991.0000000000B96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411956972.0000000000B97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1412053295.0000000000B99000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17b631a1ef9c90cdc196109c47057cb6dd3a7c54a8c9dd28249f1b39c8e723b3
Instruction ID: 2bd6c251fd94a5689ed0a0d7a8c719abc3af3d61819343f2da09919806681390
Opcode Fuzzy Hash: 17b631a1ef9c90cdc196109c47057cb6dd3a7c54a8c9dd28249f1b39c8e723b3
Instruction Fuzzy Hash: 7F51BCB1600204ABDB209B64CC96B7773F4EF86768F148598F985CB391F379E904C766

Function 00B43280 Relevance: .2, Instructions: 223COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.1411828549.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411851329.0000000000B11000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411876776.0000000000B33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411940991.0000000000B96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411956972.0000000000B97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1412053295.0000000000B99000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f99aab2791bd1aba6dfb3b61b9a4968c41f01324f8c9ecb9249fe38aea401d4
Instruction ID: 18aad807b177fc1af10ca4d8f04dc74bae0be35fe8e14acd6597c6de85e9780f
Opcode Fuzzy Hash: 5f99aab2791bd1aba6dfb3b61b9a4968c41f01324f8c9ecb9249fe38aea401d4
Instruction Fuzzy Hash: FF71E3B6A0874287E7298A18D450336FBE2EFF0B14F1D86ADD89A4B341E771CB05E741

Function 00B832C0 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.1411828549.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411851329.0000000000B11000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411876776.0000000000B33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411940991.0000000000B96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411956972.0000000000B97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1412053295.0000000000B99000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 260186d478aae003c652c9c0622f6da14b7ca9a12c80829d925b8ad8623de31d
Instruction ID: 540d9adcf66bcfaf05bd3cdef5f462767271dad5e2f7393fbd109d4581574b93
Opcode Fuzzy Hash: 260186d478aae003c652c9c0622f6da14b7ca9a12c80829d925b8ad8623de31d
Instruction Fuzzy Hash: 8971EF316083409BD711AF19D880B2AF7E6EF95F14F1889ACE5D5873A2D731ED00CB56

Function 00B728F0 Relevance: .2, Instructions: 215COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.1411828549.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411851329.0000000000B11000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411876776.0000000000B33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411940991.0000000000B96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411956972.0000000000B97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1412053295.0000000000B99000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2ecac1f06bdf61436ed265659ed9f52c64cc52bcee91badaf8e5f8c506a0b22
Instruction ID: d8e581a9a4cbc9462a538f5ccdae849eba17b5a94fc27343263dfa3318befa09
Opcode Fuzzy Hash: b2ecac1f06bdf61436ed265659ed9f52c64cc52bcee91badaf8e5f8c506a0b22
Instruction Fuzzy Hash: BE7137B44047818FEB258F29C590A26BFF0EF12310B1885D9D8AA5F74AD335E949CBA1

Function 00B4C2F0 Relevance: .2, Instructions: 214COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.1411828549.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411851329.0000000000B11000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411876776.0000000000B33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411940991.0000000000B96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411956972.0000000000B97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1412053295.0000000000B99000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78f57911bcbd89b49419ee3ef9dd8a7705bfb666a251f11caf1017bd8e3f52b3
Instruction ID: 137eb491471aada4b5489f15d9e735088548c6f0633aacf33c67c1054f19f209
Opcode Fuzzy Hash: 78f57911bcbd89b49419ee3ef9dd8a7705bfb666a251f11caf1017bd8e3f52b3
Instruction Fuzzy Hash: F151473774A6904BC3285D7C5CA22797EC34BD2734B3D83BDA9F18B3E2E99949016251

Function 00B3F40F Relevance: .2, Instructions: 213COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.1411828549.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411851329.0000000000B11000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411876776.0000000000B33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411940991.0000000000B96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411956972.0000000000B97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1412053295.0000000000B99000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 118f1cef26720b4861566893e0de54ebb40160411a9db2ff76e9d22af775da4a
Instruction ID: 41fc3040424d431b6e0c2993e61c12be49f7ffd60133226d4c24caae4f7f4f80
Opcode Fuzzy Hash: 118f1cef26720b4861566893e0de54ebb40160411a9db2ff76e9d22af775da4a
Instruction Fuzzy Hash: 8A71CF31A183518BD718DE18C08472FBBE2EFC4714F2889ADF99997396D770DD849B82

Function 00B75870 Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.1411828549.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411851329.0000000000B11000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411876776.0000000000B33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411940991.0000000000B96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411956972.0000000000B97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1412053295.0000000000B99000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b5a5ab0e6f08e1212459a1051d072897d816136cec1085f020d45d75109a894
Instruction ID: 4735dc934d2a2789cba0691c49400fe4980249a4686eb41446d8a410a8cd9696
Opcode Fuzzy Hash: 1b5a5ab0e6f08e1212459a1051d072897d816136cec1085f020d45d75109a894
Instruction Fuzzy Hash: C5510737A49EC18BC7315E7C4C812A8AA935BD733473DC3BAD9B95B3D1D5A68C028351

Function 00B4CCD1 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.1411828549.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411851329.0000000000B11000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411876776.0000000000B33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411940991.0000000000B96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411956972.0000000000B97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1412053295.0000000000B99000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98426d52609b44d71ace9bc0825109431283409a88027502b5f6118697708dcb
Instruction ID: bc90fd8de3b1069c993bb2bb493bd37460d25225db1aa8622614852ef7325d4a
Opcode Fuzzy Hash: 98426d52609b44d71ace9bc0825109431283409a88027502b5f6118697708dcb
Instruction Fuzzy Hash: BB516AB5D011469FDB01CFA4DA90ABEBFF2EB06305F6400A8E401B7362D731AE14CB66

Function 00B7CCD0 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.1411828549.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411851329.0000000000B11000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411876776.0000000000B33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411940991.0000000000B96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411956972.0000000000B97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1412053295.0000000000B99000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b948dc6add0ed9661d4b398e162f22454a7bbff509f023e817ae62914cd77494
Instruction ID: 80695b804edbe5e53a93a872f8a0bb5b0ebe7f6db740c5ea8fad74fba0c0383d
Opcode Fuzzy Hash: b948dc6add0ed9661d4b398e162f22454a7bbff509f023e817ae62914cd77494
Instruction Fuzzy Hash: 5D514BB15087548FE314DF29D49475BBBE1FB88318F148A2DE4E987391E379DA088B86

Function 00B77390 Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.1411828549.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411851329.0000000000B11000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411876776.0000000000B33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411940991.0000000000B96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411956972.0000000000B97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1412053295.0000000000B99000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b9b159b4f3877c8d9d6b0debf22a3b75361e34386abef763474a0b287f0c785
Instruction ID: 64ff2cba793d240636259be76fefde6c7959b369510086c9954253b6a9491b5c
Opcode Fuzzy Hash: 6b9b159b4f3877c8d9d6b0debf22a3b75361e34386abef763474a0b287f0c785
Instruction Fuzzy Hash: 5251E537A9E5C04AC7155F3C1C852A46E939BB3374B3EC3EAD8B94B3E1DD2688029355

Function 00B82060 Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.1411828549.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411851329.0000000000B11000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411876776.0000000000B33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411940991.0000000000B96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411956972.0000000000B97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1412053295.0000000000B99000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d0570097160aab1b68a550f4511c957a43b2e8abafe0f435217c9cb9528a807
Instruction ID: 0444383a59c611447286ace915abb324854082a298fb1c843eaf9c07b6a4e137
Opcode Fuzzy Hash: 2d0570097160aab1b68a550f4511c957a43b2e8abafe0f435217c9cb9528a807
Instruction Fuzzy Hash: 6F519074609340ABDB24FF54D884A2AF7E6EF95709F2488ACE5C597272D332DC10CB66

Function 00B4B280 Relevance: .2, Instructions: 164COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.1411828549.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411851329.0000000000B11000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411876776.0000000000B33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411940991.0000000000B96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411956972.0000000000B97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1412053295.0000000000B99000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 054442773fa85cc7e7f2bc6a691852260fd407d19e094a4ce9a9a5ee557263b7
Instruction ID: c51df9dfa6c6afb52c06f13c550b9a5aab3e059c1928e5636ba99573983d5a17
Opcode Fuzzy Hash: 054442773fa85cc7e7f2bc6a691852260fd407d19e094a4ce9a9a5ee557263b7
Instruction Fuzzy Hash: 9941337040C2409BD701BF69D584A1EFBE5EF66705F188D8CE2C497222D33AC910AB6B

Function 00B43B20 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.1411828549.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411851329.0000000000B11000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411876776.0000000000B33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411940991.0000000000B96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411956972.0000000000B97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1412053295.0000000000B99000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8bda98c2f30a516d50807ce0b98e746189b08d9b89d3b03278e09447c629b6b2
Instruction ID: 1fee3b020ee45c8621162fe4cc1558329cbc4145793d7aebf6acfdf79ba09d82
Opcode Fuzzy Hash: 8bda98c2f30a516d50807ce0b98e746189b08d9b89d3b03278e09447c629b6b2
Instruction Fuzzy Hash: BD518175A043109FC714DF18C880926BBE1FF89724F1946ACF8999B392D631EF81DB92

Function 00B4F40B Relevance: .1, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.1411828549.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411851329.0000000000B11000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411876776.0000000000B33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411940991.0000000000B96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411956972.0000000000B97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1412053295.0000000000B99000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34b2c5dc47880b26d63c4cac224246904b14b76870b104fed36430456e3dcfb5
Instruction ID: baa5e0fc48464dc49ba85df10b85bac6bfd1933ca35610067aef08d335b13241
Opcode Fuzzy Hash: 34b2c5dc47880b26d63c4cac224246904b14b76870b104fed36430456e3dcfb5
Instruction Fuzzy Hash: EB4129B49112669BDF01CF94CC94BBFBBB1FF06305F144898E811AB392D734A910CBA8

Function 00B4F780 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.1411828549.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411851329.0000000000B11000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411876776.0000000000B33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411940991.0000000000B96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411956972.0000000000B97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1412053295.0000000000B99000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5e34cb232997b27782127b8cd1ef61722e578a9a41e811742eb7c47ee6c68f4
Instruction ID: ab95fe03b9f4171c6cb491770ea952c00f4f5e856824454d66f9acf036272610
Opcode Fuzzy Hash: f5e34cb232997b27782127b8cd1ef61722e578a9a41e811742eb7c47ee6c68f4
Instruction Fuzzy Hash: E5413372B0C3955FD318DE7A889413A7BD3ABC5310F18C67EF4A58B2C4E6348A05E751

Function 00B6BBD3 Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.1411828549.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411851329.0000000000B11000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411876776.0000000000B33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411940991.0000000000B96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411956972.0000000000B97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1412053295.0000000000B99000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b10cf0e7097aa983af4eec26b10cdff308d4fbafdfb15f8fa67f104f1a184b0
Instruction ID: dcd139cbb702865b19199952646c08c377db9f62e1456048764fc4004aa12729
Opcode Fuzzy Hash: 6b10cf0e7097aa983af4eec26b10cdff308d4fbafdfb15f8fa67f104f1a184b0
Instruction Fuzzy Hash: 1241D4B26083419FC714CB28C491A6FB7F2EB99304F194AADF495D7342D738EA45CB52

Function 00B86F00 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.1411828549.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411851329.0000000000B11000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411876776.0000000000B33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411940991.0000000000B96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411956972.0000000000B97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1412053295.0000000000B99000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e225b96c8bf2e769cc8697a4cfbe4e2a1212ad77f5d165699b061e557b09fc9
Instruction ID: 05cbd9da5cdc91760e06dca61d38154b1ef7630533b1f1fd0a20f23fa52601a8
Opcode Fuzzy Hash: 8e225b96c8bf2e769cc8697a4cfbe4e2a1212ad77f5d165699b061e557b09fc9
Instruction Fuzzy Hash: 7A31D032B4D2008FD304EE29DC8165ABBE79FC9328F1DC56DE998D72A5DA39C8018B41

Function 00B73011 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.1411828549.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411851329.0000000000B11000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411876776.0000000000B33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411940991.0000000000B96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411956972.0000000000B97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1412053295.0000000000B99000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d162afb33da07c4bd60f7c483336d076906e7f1409a5580b2f65c4fffe7ae7c
Instruction ID: 1f31985c6e8b222f72287d943119d68808ca84b96c8404af33409e07d23dc9aa
Opcode Fuzzy Hash: 0d162afb33da07c4bd60f7c483336d076906e7f1409a5580b2f65c4fffe7ae7c
Instruction Fuzzy Hash: EF31A4605047818FD7268F298050B22BBE1AF53749F28C4DDD4EA9B693C636D906DB61

Function 00B7E5B0 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.1411828549.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411851329.0000000000B11000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411876776.0000000000B33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411940991.0000000000B96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411956972.0000000000B97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1412053295.0000000000B99000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e41c94bf4b0e2099e2558e9e672031c0a6948b5c6cff94468f528954f99504a0
Instruction ID: 0e70d759e674ec4f0dee1692f77e024dbddf3f54dd07e9047c9a5bdc5660cdfc
Opcode Fuzzy Hash: e41c94bf4b0e2099e2558e9e672031c0a6948b5c6cff94468f528954f99504a0
Instruction Fuzzy Hash: A431F872A0D7144BD7159D38888026AB6D29FDA330F29C7EDED7A4B3D5DA34C8415391

Function 00B4AB00 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.1411828549.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411851329.0000000000B11000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411876776.0000000000B33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411940991.0000000000B96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411956972.0000000000B97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1412053295.0000000000B99000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff721506fae7554bc00bc682493813926a926291962e7d101190d432c5989efe
Instruction ID: dd61657c085b12bbb9c18fffe0cafd1425c7bf5286b9fbf5977391fec40313db
Opcode Fuzzy Hash: ff721506fae7554bc00bc682493813926a926291962e7d101190d432c5989efe
Instruction Fuzzy Hash: 5A313A298896F546D333853D84A046DBFD2AE5612879D42EDDCF14F7C3C5428A86A3E2

Function 00B81C20 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.1411828549.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411851329.0000000000B11000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411876776.0000000000B33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411940991.0000000000B96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411956972.0000000000B97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1412053295.0000000000B99000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba455b42178d8c6815bdc6dc6395f760710097916b5094dc96ff09895023de6e
Instruction ID: 8303a493ff24c8599f83643073dd55c16cb1683e182f1ed3b109d8888f86f89a
Opcode Fuzzy Hash: ba455b42178d8c6815bdc6dc6395f760710097916b5094dc96ff09895023de6e
Instruction Fuzzy Hash: 10314A70509340ABD300EF19D584B1BBBFAEB85744F54CCACE4C88B262D376D816CBA6

Function 00B42A70 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.1411828549.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411851329.0000000000B11000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411876776.0000000000B33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411940991.0000000000B96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411956972.0000000000B97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1412053295.0000000000B99000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 592ae079f84e3206837f27edfef0d756db5bd63b1ae8b67b4edac06f6a01af03
Instruction ID: 9f7922dda41af4670ea4ee3c22484342781e78550ca4be90e7be17c0b354a631
Opcode Fuzzy Hash: 592ae079f84e3206837f27edfef0d756db5bd63b1ae8b67b4edac06f6a01af03
Instruction Fuzzy Hash: C631C8316042009BD7249F19C8C0A2AB7E1EF84314F5889ACFD9ADB352D235DE42FB42

Function 00B6C18D Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.1411828549.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411851329.0000000000B11000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411876776.0000000000B33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411940991.0000000000B96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411956972.0000000000B97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1412053295.0000000000B99000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d31ba30025e973e205b9eb2b84926fbe6cfd1052fcf67400e8907e88fc818d30
Instruction ID: bbecc53e10e6af2816a27fd89e081b4389d5288d7717672084305de7a0712c40
Opcode Fuzzy Hash: d31ba30025e973e205b9eb2b84926fbe6cfd1052fcf67400e8907e88fc818d30
Instruction Fuzzy Hash: 3C218BB09083419BC7149F95C8A122BBBF1FF86391F44994DF8C68B761E379C884CB96

Function 00B5371A Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.1411828549.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411851329.0000000000B11000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411876776.0000000000B33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411940991.0000000000B96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411956972.0000000000B97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1412053295.0000000000B99000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d538187a92fb4ac2440c57b712b554e1d8159c40c43cb23878864ac6b56818ea
Instruction ID: f2676ed7f997e36c5a597bab04c5614cd12309542668c06f9e8c2086352f4fdb
Opcode Fuzzy Hash: d538187a92fb4ac2440c57b712b554e1d8159c40c43cb23878864ac6b56818ea
Instruction Fuzzy Hash: E63178B0A01B118FD725CF24C480B76B7F5EB89709F2489ADD98B87681E730F988CB51

Function 00B84F80 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.1411828549.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411851329.0000000000B11000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411876776.0000000000B33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411940991.0000000000B96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411956972.0000000000B97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1412053295.0000000000B99000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b89c87bf8a49416322561c17cacfa981ac5946f4534b3d23e182106c98db3fcd
Instruction ID: ab062525f593f99cad19a735a6fb2a5ec4b9615d1820a82b4c276b1175b98dfc
Opcode Fuzzy Hash: b89c87bf8a49416322561c17cacfa981ac5946f4534b3d23e182106c98db3fcd
Instruction Fuzzy Hash: 75314B36A046924FDB36CA3C446046DBFA06F5622538A43EEC8A08B3D3DAA5C980C7D4

Function 00B4AC10 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.1411828549.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411851329.0000000000B11000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411876776.0000000000B33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411940991.0000000000B96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411956972.0000000000B97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1412053295.0000000000B99000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b69eb6dab068996dbbd0ac95327138a57af9c260c6bd9e45a0f264d263eb3e6e
Instruction ID: 350c9a3b2e505a0287c295d153e813b6104296041da7ead75b65053874ca8521
Opcode Fuzzy Hash: b69eb6dab068996dbbd0ac95327138a57af9c260c6bd9e45a0f264d263eb3e6e
Instruction Fuzzy Hash: 43113A73A897954B872BC9289C60037FBC5D7F210478DC5BDD5C693386D422ED0DC266

Function 00B69290 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.1411828549.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411851329.0000000000B11000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411876776.0000000000B33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411940991.0000000000B96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411956972.0000000000B97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1412053295.0000000000B99000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10fd84eb35d493625d844e637e1fb177c40288a20f3196d160322e86c00bf206
Instruction ID: 5cefe45f172d4776fd6c841d60ab1a40b59ebe57edfa607cc4f9cff7a0ce8a88
Opcode Fuzzy Hash: 10fd84eb35d493625d844e637e1fb177c40288a20f3196d160322e86c00bf206
Instruction Fuzzy Hash: CC21F8769002698ACB248F55C8002ADB7B0FF16351FA4D4D9D88877380EB399E85DFA9

Function 00B676FE Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.1411828549.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411851329.0000000000B11000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411876776.0000000000B33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411940991.0000000000B96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411956972.0000000000B97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1412053295.0000000000B99000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a4db2e7a7e6a4b6bfbd63caea179ea7f405d1524a8af3c95513a11a8f7ada3b
Instruction ID: ad32e95e2ad941ae52ada6abe55b09cba128a8382359dcd42317c5fd31115b0c
Opcode Fuzzy Hash: 5a4db2e7a7e6a4b6bfbd63caea179ea7f405d1524a8af3c95513a11a8f7ada3b
Instruction Fuzzy Hash: 4711BB7421C2419FD700EF18CC80A3AB7FAEB9A309F645968E0C1C7262E739ED14CB56

Function 00B6D1B0 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.1411828549.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411851329.0000000000B11000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411876776.0000000000B33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411940991.0000000000B96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411956972.0000000000B97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1412053295.0000000000B99000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c51315b3c12bd18b55da43b597f25570391444391c721ad26d4c76662b1ac61
Instruction ID: db04140ff1ba6e10b21a5f051639e9445ec73a8d613572bbd071ccb8d72420c4
Opcode Fuzzy Hash: 9c51315b3c12bd18b55da43b597f25570391444391c721ad26d4c76662b1ac61
Instruction Fuzzy Hash: D4212430A08381ABD354DB16C890A1BBBF2FF86395F999C5CF4C497262D3B9D844CB16

Function 00B52938 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.1411828549.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411851329.0000000000B11000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411876776.0000000000B33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411940991.0000000000B96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411956972.0000000000B97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1412053295.0000000000B99000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b896b6d8164971cb7ba37414f80df5efc22a3a844d39286caadf7c5c62d1198
Instruction ID: 557d01a74a92d590cb16755790afad51ee428ceb70ac78a03cea2d02bd0b2afa
Opcode Fuzzy Hash: 5b896b6d8164971cb7ba37414f80df5efc22a3a844d39286caadf7c5c62d1198
Instruction Fuzzy Hash: E2213470401B508FD3228B34C890B66BBF1FF02305F44099DEA87ABA92C336F809CB54

Function 00B79B90 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.1411828549.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411851329.0000000000B11000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411876776.0000000000B33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411940991.0000000000B96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411956972.0000000000B97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1412053295.0000000000B99000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction ID: a2abe93887edc012a28a270b619e9e1c591ff396ca5a27cd580fd9c670a3c14b
Opcode Fuzzy Hash: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction Fuzzy Hash: 5111E133A491E40EC7168D3C84505A5BFE34BA3635F69C3D9F4BC9B2D2D6228D8A9364

Function 00B6F300 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.1411828549.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411851329.0000000000B11000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411876776.0000000000B33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411940991.0000000000B96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411956972.0000000000B97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1412053295.0000000000B99000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 960e2e00e3628e1f5e3ba26c325b6cc30fadb638be8208b4fd5208f2d766984d
Instruction ID: b940b7b25f7e03082deef049b217bf554f4fe9836ce6eb0cd18c29ca115eb9bd
Opcode Fuzzy Hash: 960e2e00e3628e1f5e3ba26c325b6cc30fadb638be8208b4fd5208f2d766984d
Instruction Fuzzy Hash: 610171F1A0074247EB209E64E5C1B3BB2E8AF94708F1954BCE80557302DB79ED05D69A

Function 00B67428 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.1411828549.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411851329.0000000000B11000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411876776.0000000000B33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411940991.0000000000B96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411956972.0000000000B97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1412053295.0000000000B99000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad1a30c5f86df9b29ac032a507831b123af95fa9cc9c1ef612b51c76bc2b554d
Instruction ID: 84e449624c782673e382dfb03c391a2e239e7f41900e591f6c78c2b37dbbf0ec
Opcode Fuzzy Hash: ad1a30c5f86df9b29ac032a507831b123af95fa9cc9c1ef612b51c76bc2b554d
Instruction Fuzzy Hash: 9311A13151C3199FC710EF14C8C0AAABBE8EF56318F0558ACE88597361EB79E644CB56

Function 00B4D833 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.1411828549.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411851329.0000000000B11000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411876776.0000000000B33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411940991.0000000000B96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411956972.0000000000B97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1412053295.0000000000B99000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7537f5fd8384a83163d866f176097abd77cb40ec27a0881dcf1d300453dad3e
Instruction ID: a2b1377b3b2c4f1d31796c90ae39535b0c6e396a3c1777c531a7e3fa8d5d5ccc
Opcode Fuzzy Hash: d7537f5fd8384a83163d866f176097abd77cb40ec27a0881dcf1d300453dad3e
Instruction Fuzzy Hash: 1C118471E042555BCB05CF54D8803BEB7F7EF9A304F2844A8D045A7352E674AB05D769

Function 00B6D3C4 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.1411828549.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411851329.0000000000B11000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411876776.0000000000B33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411940991.0000000000B96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411956972.0000000000B97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1412053295.0000000000B99000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc9d6f7422685d54ac9c4b229ea6dda6c46a3da1920c7261afbe68902de17981
Instruction ID: a165568a3fae98499db4ef8e31bd3ba1e578798066a4ae879d222d441970bd15
Opcode Fuzzy Hash: cc9d6f7422685d54ac9c4b229ea6dda6c46a3da1920c7261afbe68902de17981
Instruction Fuzzy Hash: FD017C74F016168BCB14CF59C8506AAB3F1FF96320F1591A5E815A73A0EB38AD41CB55

Function 00B50070 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.1411828549.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411851329.0000000000B11000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411876776.0000000000B33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411940991.0000000000B96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411956972.0000000000B97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1412053295.0000000000B99000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0bcc21ab59f3068ab92d7e069a64477687dc0058f8902c272e32a697d861a1d
Instruction ID: c63440f853c9597595619fa4ce77ea6bf8d3953273f841e4d94b7e73d783b460
Opcode Fuzzy Hash: e0bcc21ab59f3068ab92d7e069a64477687dc0058f8902c272e32a697d861a1d
Instruction Fuzzy Hash: 67012173A28921078748DD3DDC1156B7AD15BC5630F19873DB9BAC73D0D634C8458655

Function 00B59960 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.1411828549.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411851329.0000000000B11000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411876776.0000000000B33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411940991.0000000000B96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411956972.0000000000B97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1412053295.0000000000B99000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1feb0ecdb06b802b1560528e9a5af3474081b4572b374f0f40b5c4f3f9bd469
Instruction ID: d2e1dca54e691827ae9c17fde79f5289013cc65409d003875ad7a4834f7f0100
Opcode Fuzzy Hash: c1feb0ecdb06b802b1560528e9a5af3474081b4572b374f0f40b5c4f3f9bd469
Instruction Fuzzy Hash: F0F0A0B2A042109BDB268A559C80B7BFBDCCBCA229F1914E9ED8557102D1629888C2E6

Function 00B84A20 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.1411828549.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411851329.0000000000B11000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411876776.0000000000B33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411940991.0000000000B96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411956972.0000000000B97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1412053295.0000000000B99000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 085a7920e2e5b4e779e34a684b632e4f4ebff8cfa837e5ac39cd2be3ef1db2f6
Instruction ID: 1f7f1842d51845a2283246c7b64d5d0a77aa1720b329512c11e6b55d25469a36
Opcode Fuzzy Hash: 085a7920e2e5b4e779e34a684b632e4f4ebff8cfa837e5ac39cd2be3ef1db2f6
Instruction Fuzzy Hash: FCF0B23850C2819BD309EB58D494A2EFBF5EB96709F55895CE0D597222C235D890CB2A

Function 00B87158 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.1411828549.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411851329.0000000000B11000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411876776.0000000000B33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411940991.0000000000B96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411956972.0000000000B97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1412053295.0000000000B99000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dba64387f099f4ffb45be2b82222d83dc5fb2b584328ce1a123674adc3a9cf20
Instruction ID: c76e4e1a306d8ffc1ef3ce507d57e0635a25f41efac12a34127542aa01a82c99
Opcode Fuzzy Hash: dba64387f099f4ffb45be2b82222d83dc5fb2b584328ce1a123674adc3a9cf20
Instruction Fuzzy Hash: 81F01C3050C240ABC301BF28D58492EFBF1EF4A701F549C5CE1C893622D336E820CBAA

Function 00B2B227 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1411851329.0000000000B11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.1411828549.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411876776.0000000000B33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411940991.0000000000B96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411956972.0000000000B97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1412053295.0000000000B99000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 110e375efb2033e03ce8b70e48f77e8cdc524782d876c586b63fa1f672508759
Instruction ID: 2954179f16a9097078a95c271f1b67b5f476cd4d940376b5cdc9bc69a40ffcf1
Opcode Fuzzy Hash: 110e375efb2033e03ce8b70e48f77e8cdc524782d876c586b63fa1f672508759
Instruction Fuzzy Hash: 59E04632921238EBCB18DB88AA04E8AB7ECEB88B40B114096B509D3100C674DE00CBD0

Function 00B7FC20 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.1411828549.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411851329.0000000000B11000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411876776.0000000000B33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411940991.0000000000B96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411956972.0000000000B97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1412053295.0000000000B99000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4b5204e339133bf84330416a5308528dd9e98d6cb7a6fcb91640552a86da4e7
Instruction ID: 87a3ac8f6f91381a1316c35d78fc0a5d5c4f2a88958b594af59b1f1aa533c79d
Opcode Fuzzy Hash: a4b5204e339133bf84330416a5308528dd9e98d6cb7a6fcb91640552a86da4e7
Instruction Fuzzy Hash: DFD0A52154C326465B748D299400577F7F0EDC7711F45D56EFD95D3144D230DC41C16D

Function 00B21677 Relevance: .0, Instructions: 12COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1411851329.0000000000B11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.1411828549.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411876776.0000000000B33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411940991.0000000000B96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411956972.0000000000B97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1412053295.0000000000B99000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb8bfff79f450fa166f3acab42b743a4fe509eb8232add3922c61a1d69523cd8
Instruction ID: e2709cd75e2c67e2f13ecda52266aea77e4d2235e7d089bc1258427ad12ee9fc
Opcode Fuzzy Hash: eb8bfff79f450fa166f3acab42b743a4fe509eb8232add3922c61a1d69523cd8
Instruction Fuzzy Hash: AFC04C34541BA087CE2A9D18A3717BD33D5E7A2782F981CCCC50A4B652DA1E9C86D651

Function 00B6E773 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.1411828549.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411851329.0000000000B11000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411876776.0000000000B33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411940991.0000000000B96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411956972.0000000000B97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1412053295.0000000000B99000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9bde8e0a18542e65954db997d1931066d1f8d4cb0ee69fd957d26d9737444eaa
Instruction ID: 0bd8d167b1689b0af628a66bd5346e3e582d38a0ef81bc17dcb4d00f07786dc1
Opcode Fuzzy Hash: 9bde8e0a18542e65954db997d1931066d1f8d4cb0ee69fd957d26d9737444eaa
Instruction Fuzzy Hash: 0BB092E5C8A95086E2122E103E024BEB1640A13209F0520B1E80732203A616F31AD0AF

Function 00B53D63 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.1411828549.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411851329.0000000000B11000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411876776.0000000000B33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411940991.0000000000B96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411956972.0000000000B97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1412053295.0000000000B99000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a927264b8af54b329c315b56f05fbf2d8de1dbd38e325cfc03de9a518d2d83b6
Instruction ID: e38d6414860334799ae5cf6b1905a7285e40bceefc75b21e897006f1575e4475
Opcode Fuzzy Hash: a927264b8af54b329c315b56f05fbf2d8de1dbd38e325cfc03de9a518d2d83b6
Instruction Fuzzy Hash: 4CB092E9C0030086D8502B203C42436B06886A320DF4534B0BA0722307A526D618B15B

Function 00B8735B Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.1411828549.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411851329.0000000000B11000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411876776.0000000000B33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411940991.0000000000B96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411956972.0000000000B97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1412053295.0000000000B99000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 005c4ba806c1f729e01d7b345e607bcf037a1a2af418616e2fc01539d0967c76
Instruction ID: 7795c8e62c6c1a2cba6d6766a4d5bb610867df3ac219b3c08ddfb2e365f90ae1
Opcode Fuzzy Hash: 005c4ba806c1f729e01d7b345e607bcf037a1a2af418616e2fc01539d0967c76
Instruction Fuzzy Hash: D2B092B09083409BE644CF04C4A053AF3B5FB87229F00A82CE15AA3152C330E808CF0E

Function 00B87064 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.1411828549.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411851329.0000000000B11000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411876776.0000000000B33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411940991.0000000000B96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411956972.0000000000B97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1412053295.0000000000B99000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e353222c480a1e836f2e88ec6b0f54e01aefb973cbd9e2a65436a63ab80d9507
Instruction ID: 90b20a1011eb729eb64d159c706abf0f2e45b7b0e11e27798d7b31732cf018ce
Opcode Fuzzy Hash: e353222c480a1e836f2e88ec6b0f54e01aefb973cbd9e2a65436a63ab80d9507
Instruction Fuzzy Hash: F7A00225E5C10197C60CCF24A950571E2B95BBF205F513428C005BB852D510D440961C

Function 00B543A6 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.1411828549.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411851329.0000000000B11000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411876776.0000000000B33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411940991.0000000000B96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411956972.0000000000B97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1412053295.0000000000B99000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee70fe1013954b18253420cd7c879e3bafbcdc7016d02e7bb28bbb050ed5ff3e
Instruction ID: eb9c71f61387cf9290d7c446bbbdb1ba1a08eb420cde55b5b5e8e69408f34382
Opcode Fuzzy Hash: ee70fe1013954b18253420cd7c879e3bafbcdc7016d02e7bb28bbb050ed5ff3e
Instruction Fuzzy Hash: C0900224D4830086C2488E409490470E23A564F606E117018850D334924620E500850C

Function 00B52677 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.1411828549.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411851329.0000000000B11000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411876776.0000000000B33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411940991.0000000000B96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411956972.0000000000B97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1412053295.0000000000B99000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0348c40113168c569ecdbaf33ce4c7ca3883923b3352dc9550a20db56e356de0
Instruction ID: 125aa2fd33e84a88d69890093f1abe8245766079576a578208108fcfe1822cf2
Opcode Fuzzy Hash: 0348c40113168c569ecdbaf33ce4c7ca3883923b3352dc9550a20db56e356de0
Instruction Fuzzy Hash: D9900228D582008A8100CE4494A0470F278620B206F1034109008F3012D210E804850C

Function 00B27EAF Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 298
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

, xrefs: 00B28128

Memory Dump Source

Source File: 00000000.00000002.1411851329.0000000000B11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.1411828549.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411876776.0000000000B33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411940991.0000000000B96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411956972.0000000000B97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1412053295.0000000000B99000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3907804496
Opcode ID: 6eabbf855e0b147cc371d22152f1d05df54e5ef0d5b45db01cde565003272fd0
Instruction ID: 579f1d4a2614e291488de1cdfefa8c3f01584506800c2be6963b9b90f6f21903
Opcode Fuzzy Hash: 6eabbf855e0b147cc371d22152f1d05df54e5ef0d5b45db01cde565003272fd0
Instruction Fuzzy Hash: B1B1F370A04265AFDB15DF98E881BAE7BF1EF4D300F1441D9E819AB292CF719D42CB60

Function 00B1A648 Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 00B1A767
___TypeMatch.LIBVCRUNTIME ref: 00B1A875
CallUnexpected.LIBVCRUNTIME ref: 00B1A9E2

Strings

csm, xrefs: 00B1A6F2
csm, xrefs: 00B1A685
csm, xrefs: 00B1A79E

Memory Dump Source

Source File: 00000000.00000002.1411851329.0000000000B11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.1411828549.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411876776.0000000000B33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411940991.0000000000B96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411956972.0000000000B97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1412053295.0000000000B99000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_SecuriteInfo.jbxd

Similarity

API ID: CallMatchTypeUnexpectedtype_info::operator==
String ID: csm$csm$csm
API String ID: 1206542248-393685449
Opcode ID: a1a3a646fa4f50ce2d8a527a4f388ec794cf8f313e465615fd96335e8620b6f0
Instruction ID: eb434defaf1eea90d2696b5f67743210c401d8be794b865c95bc36ff14041e28
Opcode Fuzzy Hash: a1a3a646fa4f50ce2d8a527a4f388ec794cf8f313e465615fd96335e8620b6f0
Instruction Fuzzy Hash: BFB16771802209AFCF15DFA4C8819EEBBF5FF14310B9541AAE8146B256D731EED1CB92

Function 00B23E1F Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,00B23F2C,?,?,00000000,00000000,?,?,00B240DA,00000021,FlsSetValue,00B369C8,00B369D0,00000000), ref: 00B23EE0

Strings

api-ms-, xrefs: 00B23E76
ext-ms-, xrefs: 00B23E8A

Memory Dump Source

Source File: 00000000.00000002.1411851329.0000000000B11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.1411828549.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411876776.0000000000B33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411940991.0000000000B96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411956972.0000000000B97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1412053295.0000000000B99000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_SecuriteInfo.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: b6b164d5f2b353dcc0ad9cb084c91b040de06e63bfb54a9cdf9c758f2b9654ff
Instruction ID: 60ea27bd53f0ca5db118bbded950dc48a87b4594267508f3c24ea5413abd615f
Opcode Fuzzy Hash: b6b164d5f2b353dcc0ad9cb084c91b040de06e63bfb54a9cdf9c758f2b9654ff
Instruction Fuzzy Hash: BC21AB72901121FBCB21AB24FC55A6F37D9DB41F60F260591E919A7291DB38EF04C6F0

Function 00B13CB6 Relevance: 10.5, APIs: 7, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B13CBD
std::_Lockit::_Lockit.LIBCPMT ref: 00B13CC7
int.LIBCPMT ref: 00B13CDE

Part of subcall function 00B116DA: std::_Lockit::_Lockit.LIBCPMT ref: 00B116EB
Part of subcall function 00B116DA: std::_Lockit::~_Lockit.LIBCPMT ref: 00B11705

codecvt.LIBCPMT ref: 00B13D01
std::_Facet_Register.LIBCPMT ref: 00B13D18
std::_Lockit::~_Lockit.LIBCPMT ref: 00B13D38
Concurrency::cancel_current_task.LIBCPMT ref: 00B13D45

Memory Dump Source

Source File: 00000000.00000002.1411851329.0000000000B11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.1411828549.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411876776.0000000000B33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411940991.0000000000B96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411956972.0000000000B97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1412053295.0000000000B99000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_SecuriteInfo.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Registercodecvt
String ID:
API String ID: 2133458128-0
Opcode ID: 5329024b4c0436c03a9d196c8146310f116edc5e3a6c9ffcfaaf626978042fa9
Instruction ID: eac2cb71286126623e5890557a21665018933587b2292e640dd5a6c214989dd4
Opcode Fuzzy Hash: 5329024b4c0436c03a9d196c8146310f116edc5e3a6c9ffcfaaf626978042fa9
Instruction Fuzzy Hash: B701C475954115CBCB05EB64C8556EDB7F1EF84710FA44499F4156B391EF309F818B80

Function 00B16B18 Relevance: 9.2, APIs: 6, Instructions: 175COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000001,?,00000000,00000000,?,?,?,00000001), ref: 00B16B61
MultiByteToWideChar.KERNEL32(00000001,00000001,00000000,?,00000000,00000000), ref: 00B16BCC
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00B16BE9
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 00B16C28
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00B16C87
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 00B16CAA

Memory Dump Source

Source File: 00000000.00000002.1411851329.0000000000B11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.1411828549.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411876776.0000000000B33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411940991.0000000000B96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411956972.0000000000B97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1412053295.0000000000B99000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_SecuriteInfo.jbxd

Similarity

API ID: ByteCharMultiStringWide
String ID:
API String ID: 2829165498-0
Opcode ID: c60cbc0ae1f4d0c23ccbf22fc75fea95db8389922082721cec0ea397195b977d
Instruction ID: 2593cecf476459f0f99fc1926536111400df697d7a924cd4eabff71b0bcc6d06
Opcode Fuzzy Hash: c60cbc0ae1f4d0c23ccbf22fc75fea95db8389922082721cec0ea397195b977d
Instruction Fuzzy Hash: 7351BE7290021AABDB209F64CD85FEF7BE9EF40750F6544A5F904E6290EB349D90CB90

Function 00B153E0 Relevance: 9.1, APIs: 6, Instructions: 65COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B153E7
std::_Lockit::_Lockit.LIBCPMT ref: 00B153F1
int.LIBCPMT ref: 00B15408

Part of subcall function 00B116DA: std::_Lockit::_Lockit.LIBCPMT ref: 00B116EB
Part of subcall function 00B116DA: std::_Lockit::~_Lockit.LIBCPMT ref: 00B11705

std::_Facet_Register.LIBCPMT ref: 00B15442
std::_Lockit::~_Lockit.LIBCPMT ref: 00B15462
Concurrency::cancel_current_task.LIBCPMT ref: 00B1546F

Memory Dump Source

Source File: 00000000.00000002.1411851329.0000000000B11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.1411828549.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411876776.0000000000B33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411940991.0000000000B96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411956972.0000000000B97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1412053295.0000000000B99000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_SecuriteInfo.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Register
String ID:
API String ID: 55977855-0
Opcode ID: f9e13bc9d978db318a40c144cd2837be94011864004bba29edcc9a9a4b46cd37
Instruction ID: 76e27e96357c953839be14c3ec3a3757dd07eb1a9059127f63c1d09927f15710
Opcode Fuzzy Hash: f9e13bc9d978db318a40c144cd2837be94011864004bba29edcc9a9a4b46cd37
Instruction Fuzzy Hash: 0311DF72910614DFCB10AB64C8467EEB7F4EF84720FA40489F515A7391EFB0AE818B90

Function 00B1A2DA Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00B1A2D1,00B184CB,00B17B85), ref: 00B1A2E8
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00B1A2F6
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00B1A30F
SetLastError.KERNEL32(00000000,00B1A2D1,00B184CB,00B17B85), ref: 00B1A361

Memory Dump Source

Source File: 00000000.00000002.1411851329.0000000000B11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.1411828549.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411876776.0000000000B33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411940991.0000000000B96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411956972.0000000000B97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1412053295.0000000000B99000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_SecuriteInfo.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: eaa1b513edae937083534ade635681a744b804ead2d9862dbdc73cf9d28d115b
Instruction ID: 8a2d3a31f1f6a4324f9d452cacfa2729db1cd8a3c604481535e08ba68b837c3f
Opcode Fuzzy Hash: eaa1b513edae937083534ade635681a744b804ead2d9862dbdc73cf9d28d115b
Instruction Fuzzy Hash: B201D83220E7129EA62927747C87BDE2AD6FB1277477002AAF134470E1EF51ED81614A

Function 00B21699 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,1D604168,?,?,00000000,00B32862,000000FF,?,00B21629,00B21759,?,00B215FD,00000000), ref: 00B216CE
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00B216E0
FreeLibrary.KERNEL32(00000000,?,?,00000000,00B32862,000000FF,?,00B21629,00B21759,?,00B215FD,00000000), ref: 00B21702

Strings

mscoree.dll, xrefs: 00B216C7
CorExitProcess, xrefs: 00B216D8

Memory Dump Source

Source File: 00000000.00000002.1411851329.0000000000B11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.1411828549.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411876776.0000000000B33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411940991.0000000000B96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411956972.0000000000B97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1412053295.0000000000B99000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_SecuriteInfo.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: ec9e080f29fb1c3c4c5e923beabc6404632acf894d730e829cf91a6fc98f4844
Instruction ID: 7b0b6726a05d2192021dcc8c522783a14f14fc7fca00bb871faf00a07cb73487
Opcode Fuzzy Hash: ec9e080f29fb1c3c4c5e923beabc6404632acf894d730e829cf91a6fc98f4844
Instruction Fuzzy Hash: C301AD31940629BFDB168F54DC09BAEBBF8FB04B15F144665F812A32A0DFB89900CA90

Function 00B127D8 Relevance: 7.5, APIs: 5, Instructions: 48COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00B127E4
int.LIBCPMT ref: 00B127F7

Part of subcall function 00B116DA: std::_Lockit::_Lockit.LIBCPMT ref: 00B116EB
Part of subcall function 00B116DA: std::_Lockit::~_Lockit.LIBCPMT ref: 00B11705

std::_Facet_Register.LIBCPMT ref: 00B1282A
std::_Lockit::~_Lockit.LIBCPMT ref: 00B12840
Concurrency::cancel_current_task.LIBCPMT ref: 00B1284B

Memory Dump Source

Source File: 00000000.00000002.1411851329.0000000000B11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.1411828549.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411876776.0000000000B33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411940991.0000000000B96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411956972.0000000000B97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1412053295.0000000000B99000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_SecuriteInfo.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: a2cda9f09cb4272cab68137dd68b842409c5d8ed6837921c6583951ed4f1411d
Instruction ID: 091dd7af1d2aaf5549a17ab434978e817fb598293d00f9157cf0eb11fcad1c7f
Opcode Fuzzy Hash: a2cda9f09cb4272cab68137dd68b842409c5d8ed6837921c6583951ed4f1411d
Instruction Fuzzy Hash: E6012632900514EBCF14AB58D8458ED7BF8EF81720B9001D9F906AB291EF30EF81C780

Function 00B13535 Relevance: 7.5, APIs: 5, Instructions: 48COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00B13541
int.LIBCPMT ref: 00B13554

Part of subcall function 00B116DA: std::_Lockit::_Lockit.LIBCPMT ref: 00B116EB
Part of subcall function 00B116DA: std::_Lockit::~_Lockit.LIBCPMT ref: 00B11705

std::_Facet_Register.LIBCPMT ref: 00B13587
std::_Lockit::~_Lockit.LIBCPMT ref: 00B1359D
Concurrency::cancel_current_task.LIBCPMT ref: 00B135A8

Memory Dump Source

Source File: 00000000.00000002.1411851329.0000000000B11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.1411828549.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411876776.0000000000B33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411940991.0000000000B96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411956972.0000000000B97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1412053295.0000000000B99000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_SecuriteInfo.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 1b2eca2825cc3fb4c99c5e42ee1fdd73b2e5ecab4b7d26a57113063be1967103
Instruction ID: b11580ee34ed70025686def26b1704c282a36f87e2019208fe61389c63d9fae5
Opcode Fuzzy Hash: 1b2eca2825cc3fb4c99c5e42ee1fdd73b2e5ecab4b7d26a57113063be1967103
Instruction Fuzzy Hash: FC01F232900114ABCF14AB68D8158EE7BE9EF90B60F9001D9F915AB291FF30EF81C790

Function 00B15163 Relevance: 7.5, APIs: 5, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B1516A
std::_Lockit::_Lockit.LIBCPMT ref: 00B15175
std::_Lockit::~_Lockit.LIBCPMT ref: 00B151E3

Part of subcall function 00B152C6: std::locale::_Locimp::_Locimp.LIBCPMT ref: 00B152DE

std::locale::_Setgloballocale.LIBCPMT ref: 00B15190
_Yarn.LIBCPMT ref: 00B151A6

Memory Dump Source

Source File: 00000000.00000002.1411851329.0000000000B11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.1411828549.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411876776.0000000000B33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411940991.0000000000B96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411956972.0000000000B97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1412053295.0000000000B99000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_SecuriteInfo.jbxd

Similarity

API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_SetgloballocaleYarn
String ID:
API String ID: 1088826258-0
Opcode ID: 91806815e67428ea7c8a10e028a10dfa84df8ea6e719b24646ca23c375d2d5bb
Instruction ID: 7201407b49cc79e6018b5002791a1bf55abb02b3723c53aa37677f466de6ceb8
Opcode Fuzzy Hash: 91806815e67428ea7c8a10e028a10dfa84df8ea6e719b24646ca23c375d2d5bb
Instruction Fuzzy Hash: 5A01BC76641910DBC716AB20C9559BDBBE1FFC4750B640089E80127392DF34AE82CBC1

Function 00B1B422 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,00B1B3D3,00000000,?,00B97A64,?,?,?,00B1B576,00000004,InitializeCriticalSectionEx,00B34C70,InitializeCriticalSectionEx), ref: 00B1B42F
GetLastError.KERNEL32(?,00B1B3D3,00000000,?,00B97A64,?,?,?,00B1B576,00000004,InitializeCriticalSectionEx,00B34C70,InitializeCriticalSectionEx,00000000,?,00B1B32D), ref: 00B1B439
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 00B1B461

Strings

api-ms-, xrefs: 00B1B446

Memory Dump Source

Source File: 00000000.00000002.1411851329.0000000000B11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.1411828549.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411876776.0000000000B33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411940991.0000000000B96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411956972.0000000000B97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1412053295.0000000000B99000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_SecuriteInfo.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: f0c3165c501140a04ed3e78979c1de46816e6b3341f9fe87626cbe3a30bb263a
Instruction ID: 9e647fb935d1c7da6a78f2bc58d9b5dca17bbcbe3649338570e28a426b0c3c57
Opcode Fuzzy Hash: f0c3165c501140a04ed3e78979c1de46816e6b3341f9fe87626cbe3a30bb263a
Instruction Fuzzy Hash: 47E01A35680204BAEF101B60EC06F993ED4EB00F41F608060F90CE91B2DBA5EA908594

Function 00B2604E Relevance: 6.3, APIs: 4, Instructions: 338fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(1D604168,00000000,00000000,771AF550), ref: 00B260B1

Part of subcall function 00B2A105: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,00B291CA,?,00000000,-00000008), ref: 00B2A1B1

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00B2630C
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00B26354
GetLastError.KERNEL32 ref: 00B263F7

Memory Dump Source

Source File: 00000000.00000002.1411851329.0000000000B11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.1411828549.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411876776.0000000000B33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411940991.0000000000B96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411956972.0000000000B97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1412053295.0000000000B99000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_SecuriteInfo.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: c4fc0232a055c92ade0551b7b353b5e68910b7e25cb23706bc1b39aef6a09afa
Instruction ID: 39a43d7671566a2727a3c7974a88725ec84a625762e5acbbbc837495d5dbe7c6
Opcode Fuzzy Hash: c4fc0232a055c92ade0551b7b353b5e68910b7e25cb23706bc1b39aef6a09afa
Instruction Fuzzy Hash: 99D15BB5D042689FCB15CFA8E890AEDBBF5FF09310F1845AAE81AE7351D730A941CB54

Function 00B1A3F1 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00B1A4B8
___AdjustPointer.LIBCMT ref: 00B1A4DB
___AdjustPointer.LIBCMT ref: 00B1A577

Memory Dump Source

Source File: 00000000.00000002.1411851329.0000000000B11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.1411828549.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411876776.0000000000B33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411940991.0000000000B96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411956972.0000000000B97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1412053295.0000000000B99000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_SecuriteInfo.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: bb3885edddc5f86a74e5383eef4b4cd439ad95696f75739727a96a1a487d3ccc
Instruction ID: 4eff8b64dc413e95b24dcbacc7e5c471cbdde1375c3a8764d305963b5d916966
Opcode Fuzzy Hash: bb3885edddc5f86a74e5383eef4b4cd439ad95696f75739727a96a1a487d3ccc
Instruction Fuzzy Hash: F651DE7160A202EFDB258F54D851BFAB7E5EF14710FA044AAE80597291EB30FCC1CB92

Function 00B30E36 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,0000000D,00000001,00000000,00000000,?,00B2F869,00000000,00000001,00000000,771AF550,?,00B2644B,771AF550,00000000,00000000), ref: 00B30E4D
GetLastError.KERNEL32(?,00B2F869,00000000,00000001,00000000,771AF550,?,00B2644B,771AF550,00000000,00000000,771AF550,771AF550,?,00B269D2,00000000), ref: 00B30E59

Part of subcall function 00B30E1F: CloseHandle.KERNEL32(FFFFFFFE,00B30E69,?,00B2F869,00000000,00000001,00000000,771AF550,?,00B2644B,771AF550,00000000,00000000,771AF550,771AF550), ref: 00B30E2F

___initconout.LIBCMT ref: 00B30E69

Part of subcall function 00B30DE1: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00B30E10,00B2F856,771AF550,?,00B2644B,771AF550,00000000,00000000,771AF550), ref: 00B30DF4

WriteConsoleW.KERNEL32(00000000,0000000D,00000001,00000000,?,00B2F869,00000000,00000001,00000000,771AF550,?,00B2644B,771AF550,00000000,00000000,771AF550), ref: 00B30E7E

Memory Dump Source

Source File: 00000000.00000002.1411851329.0000000000B11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.1411828549.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411876776.0000000000B33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411940991.0000000000B96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411956972.0000000000B97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1412053295.0000000000B99000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_SecuriteInfo.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 809d57c47d721c50a49758f9bcad0b676b49a4a02bba337032910320e2a7fb0e
Instruction ID: 7998186cafccffb0726603eeadc2ef0f2ade3393914e244a63505a9af4fd4a32
Opcode Fuzzy Hash: 809d57c47d721c50a49758f9bcad0b676b49a4a02bba337032910320e2a7fb0e
Instruction Fuzzy Hash: 50F09E36510128BBCF166FD5DC18A9E7FA5FF09761F244451FA1996130CA32D920DBA0

Function 00B12CC9 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 126COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 00B12CD0
_strlen.LIBCMT ref: 00B12CE8

Strings

input string: , xrefs: 00B12CE3, 00B12DAE

Memory Dump Source

Source File: 00000000.00000002.1411851329.0000000000B11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.1411828549.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411876776.0000000000B33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411940991.0000000000B96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411956972.0000000000B97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1412053295.0000000000B99000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_SecuriteInfo.jbxd

Similarity

API ID: H_prolog3_catch_strlen
String ID: input string:
API String ID: 3133806014-2984214493
Opcode ID: 6b0c2f4dcc71ab3f987a5637e8a7441111b8339855f6f67b6d4e7dc197415839
Instruction ID: 3bf7724834a53fc74a8b3f6ac59291d08312d62e85862a2c5d4bedae33cb0f08
Opcode Fuzzy Hash: 6b0c2f4dcc71ab3f987a5637e8a7441111b8339855f6f67b6d4e7dc197415839
Instruction Fuzzy Hash: 7241B635A542048FCB14DB68D9C18EC7BF1EB49720B6582E9E414973D2CA319CD2CBA5

Function 00B1A0E0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 00B1A11F
__IsNonwritableInCurrentImage.LIBCMT ref: 00B1A1D3

Strings

csm, xrefs: 00B1A1BD

Memory Dump Source

Source File: 00000000.00000002.1411851329.0000000000B11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.1411828549.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411876776.0000000000B33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411940991.0000000000B96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411956972.0000000000B97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1412053295.0000000000B99000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_SecuriteInfo.jbxd

Similarity

API ID: CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 3480331319-1018135373
Opcode ID: 00fa2bd8dfbf199ec2592ed7a4c3a27fc15de9f02dba7aa4df87652e7688927d
Instruction ID: a4333fe7b5f114fda22355087ef85245e9dc832bcadd9d1922a0571f5c26ae16
Opcode Fuzzy Hash: 00fa2bd8dfbf199ec2592ed7a4c3a27fc15de9f02dba7aa4df87652e7688927d
Instruction Fuzzy Hash: CE41B534A01208ABCF10DF68C885ADEBBF5EF46324F5480D5E8146B392D735FA95CB92

Function 00B1A9ED Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?), ref: 00B1AA12

Strings

RCC, xrefs: 00B1AA2C
MOC, xrefs: 00B1AA24

Memory Dump Source

Source File: 00000000.00000002.1411851329.0000000000B11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.1411828549.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411876776.0000000000B33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411940991.0000000000B96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411956972.0000000000B97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1412053295.0000000000B99000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_SecuriteInfo.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: ce4f660b8f625b73f66aeacdc4be2c4f87f0ac2e0f1387d8190daaf16f1479a7
Instruction ID: c119d0adce3a4a34bd0f2f1f01d081af2811b54f121d9dde33453b1db3b96b5a
Opcode Fuzzy Hash: ce4f660b8f625b73f66aeacdc4be2c4f87f0ac2e0f1387d8190daaf16f1479a7
Instruction Fuzzy Hash: 70413471901209AFCF16DF98D981AEEBBF6FF48300F588099FA04A7211D335A990DB52

Function 00B11605 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00B1160C
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00B11644

Part of subcall function 00B15261: _Yarn.LIBCPMT ref: 00B15280
Part of subcall function 00B15261: _Yarn.LIBCPMT ref: 00B152A4

Strings

bad locale name, xrefs: 00B11652

Memory Dump Source

Source File: 00000000.00000002.1411851329.0000000000B11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.1411828549.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411876776.0000000000B33000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411897458.0000000000B3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411940991.0000000000B96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411956972.0000000000B97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1412053295.0000000000B99000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_SecuriteInfo.jbxd

Similarity

API ID: Yarnstd::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 1908188788-1405518554
Opcode ID: ddd362d8fc61bfbdcc26723c107b98d6d8cbc201b49db323e95a9b3194038f72
Instruction ID: f0240228faef9b08e9b0f7496f6f1529b84f6668a01f76c02e358f58dff039c8
Opcode Fuzzy Hash: ddd362d8fc61bfbdcc26723c107b98d6d8cbc201b49db323e95a9b3194038f72
Instruction Fuzzy Hash: E6F0BD72505B509E83319F6A9481447FBE4BE297107948E6FE1DEC3A11D730A544CBAA

Analysis Process: MSBuild.exePID: 3712, Parent PID: 2344COMMON

Execution Graph

Execution Coverage:	1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	2.3%
Total number of Nodes:	44
Total number of Limit Nodes:	6

Executed Functions

Function 0040D390 Relevance: 6.2, APIs: 4, Instructions: 154
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetInputState.USER32 ref: 0040D3A1
GetCurrentThreadId.KERNEL32 ref: 0040D3B6
GetCurrentProcessId.KERNEL32 ref: 0040D3BC
ExitProcess.KERNEL32 ref: 0040D580

Memory Dump Source

Source File: 00000002.00000002.1261478466.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: CurrentProcess$ExitInputStateThread
String ID:
API String ID: 1029096631-0
Opcode ID: 91b0cbc643e4b4ebeb18023be9ae76da3501924d19314061550aa6d351ab72eb
Instruction ID: 7fe0d86d4b211a0ed1928a564c0dc3b48ff1420feaec6627cd99d8fdc632b15c
Opcode Fuzzy Hash: 91b0cbc643e4b4ebeb18023be9ae76da3501924d19314061550aa6d351ab72eb
Instruction Fuzzy Hash: CE41277480C240ABD301BFA9D544A1EFBF5EF56708F148D2EE5C4A7392D23AD8148B6B

Function 004464F0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 14
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL(00449A1D,005C003F,00000006,?,?,00000018,,?,?), ref: 0044651E

Strings

, xrefs: 004464F0, 0044650C, 0044651A

Memory Dump Source

Source File: 00000002.00000002.1261478466.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-3019521637
Opcode ID: b66ff63dfd389af1bc8afcc0025f999e8b2b47508af02e865142dda64173a8e3
Instruction ID: fb6f357373f259be8b0e83fffc5d2a3912a28e0da7d2036ce94b71e982b3a7e9
Opcode Fuzzy Hash: b66ff63dfd389af1bc8afcc0025f999e8b2b47508af02e865142dda64173a8e3
Instruction Fuzzy Hash: 76E0FE75908316AB9A09CF45C14444EFBE5BFC4714F11CC8DA4D867210D3B0AD46DF82

Function 00446040 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 72
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlReAllocateHeap.NTDLL(?,00000000), ref: 004460C4

Strings

aD, xrefs: 004460CA
;:9, xrefs: 004460B6, 00446093, 0044609B

Memory Dump Source

Source File: 00000002.00000002.1261478466.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: AllocateHeap
String ID: aD$;:9
API String ID: 1279760036-3784982549
Opcode ID: b2b91b6383baed23bd5779aad5e8932164b52d5e1660306671fc792bfb274a1b
Instruction ID: 81d8e38a202773684cb26477d2aab6f794b7f55265c2f37ac0847f9732ca8712
Opcode Fuzzy Hash: b2b91b6383baed23bd5779aad5e8932164b52d5e1660306671fc792bfb274a1b
Instruction Fuzzy Hash: 70119D75508200EBD301EF28E900A1ABBF5AF86B16F05483DE5C58B212E73AD854CB9B

Function 00446709 Relevance: 3.0, APIs: 2, Instructions: 22
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetForegroundWindow.USER32 ref: 00446709
GetForegroundWindow.USER32 ref: 00446720

Memory Dump Source

Source File: 00000002.00000002.1261478466.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: 61e954c21ccda2bc507880c9326b32b816de450e3ecc2bacd25776dc5b00f227
Instruction ID: 906c729b96ff40db5e6bb0cb1f2bfce635365c04e2c32f2be8addff1d813b1a5
Opcode Fuzzy Hash: 61e954c21ccda2bc507880c9326b32b816de450e3ecc2bacd25776dc5b00f227
Instruction Fuzzy Hash: 4ED05EACA12240A7EA04FB37FC1E85B3615E79221E7464838E40686312D636E851C65B

Function 00445C4A Relevance: 1.6, APIs: 1, Instructions: 71
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNEL32(33A03193,00000000,00000800), ref: 00445CD7

Memory Dump Source

Source File: 00000002.00000002.1261478466.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 72bf814f0518dc5835282787a3600c9ebb27de0fde571f4b41e5eadb2c516951
Instruction ID: 1ed73a75136f75e105c7bb7e785e3dfd24c55cc57a7816ce4e470644bd5d90c0
Opcode Fuzzy Hash: 72bf814f0518dc5835282787a3600c9ebb27de0fde571f4b41e5eadb2c516951
Instruction Fuzzy Hash: 7A218C7520C380AFE745CF29E99061BBBE1ABC9205F58C82DF5C987352C238D905DB6A

Function 00443A20 Relevance: 1.5, APIs: 1, Instructions: 36
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(?,00000000,?), ref: 00443A83

Memory Dump Source

Source File: 00000002.00000002.1261478466.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: bbe3c0725eeb12269a4fd9373789c992c7f1f0aafca5c16579677f982f5a7c14
Instruction ID: 208812190be25b9880a5f29952ef9a922b1c788544e9e186d94aa430ee1b0748
Opcode Fuzzy Hash: bbe3c0725eeb12269a4fd9373789c992c7f1f0aafca5c16579677f982f5a7c14
Instruction Fuzzy Hash: 67F0373410C2409BE301EF19D954A0EBBF4EF9A701F14886CE4C89B2A2C335E814CBAB

Function 00443AA0 Relevance: 1.5, APIs: 1, Instructions: 36
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL(?,00000000), ref: 00443B03

Memory Dump Source

Source File: 00000002.00000002.1261478466.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 5c61f5cf0f16499e49ba7738a8fe8bc67c56cab5a0bd252042df475734ab51e5
Instruction ID: 302f255876a8acf85142c7b8a32416b12f9909014dbe577f3d47d642ddc48781
Opcode Fuzzy Hash: 5c61f5cf0f16499e49ba7738a8fe8bc67c56cab5a0bd252042df475734ab51e5
Instruction Fuzzy Hash: 84F04F3450C2509BD701AF18E945A1EFBF5EF56706F454C68F4C4AB261C339DD60CB9A

Non-executed Functions

Function 0042D9A0 Relevance: 14.4, APIs: 1, Strings: 7, Instructions: 396COMMON

Download Yara Rule

Strings

sLlS, xrefs: 0042E5D6
sB, xrefs: 0042E66D
9u9s, xrefs: 0042E183
US, xrefs: 0042E1C3
RB, xrefs: 0042E64C
WJL{, xrefs: 0042E5FA, 0042E604, 0042E464, 0042E46D, 0042E60D, 0042E62F
Dtgr, xrefs: 0042E5C6

Memory Dump Source

Source File: 00000002.00000002.1261478466.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID:
String ID: 9u9s$Dtgr$RB$WJL{$sLlS$sB$US
API String ID: 0-3351958040
Opcode ID: 276c1ab203addd20c735120bb759d55bade8af3356c5969ab96734506833bd0c
Instruction ID: cba3938b4c7428f4d552087925c859a69b1ab55a6ae02eac8884ff4f61b23fd4
Opcode Fuzzy Hash: 276c1ab203addd20c735120bb759d55bade8af3356c5969ab96734506833bd0c
Instruction Fuzzy Hash: B1F167B4508340DFD710AF66E89061BBBF0AF86345F54892EF5848B362D3B9C844CF9A

Function 004396A0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 99clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 004396B0
GetWindowLongW.USER32 ref: 004396D5
GetClipboardData.USER32 ref: 004396E5
GlobalLock.KERNEL32 ref: 004396FE
GlobalUnlock.KERNEL32 ref: 004397EC
CloseClipboard.USER32 ref: 004397F5

Strings

=, xrefs: 00439773

Memory Dump Source

Source File: 00000002.00000002.1261478466.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: Clipboard$Global$CloseDataLockLongOpenUnlockWindow
String ID: =
API String ID: 2832541153-2322244508
Opcode ID: 78c8dc26131ed5dac9393a6ada90e30b4fdfd99cd617a6bba74dde0b2099fdf1
Instruction ID: 322da3c77394848e095178107a49c73a551c132a77b07a9a0bf135f40f579efd
Opcode Fuzzy Hash: 78c8dc26131ed5dac9393a6ada90e30b4fdfd99cd617a6bba74dde0b2099fdf1
Instruction Fuzzy Hash: 4941537551C381CED311AF7C944831EBFE09B96224F044E6DF4E5862D1D3788945C797

Function 00428230 Relevance: 1.7, APIs: 1, Instructions: 242comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(0044DB80,00000000,00000001,0044DB70), ref: 00428259

Memory Dump Source

Source File: 00000002.00000002.1261478466.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: CreateInstance
String ID:
API String ID: 542301482-0
Opcode ID: e7c828e8500b304e47737f2c036b73e87bd74cd8a23869b162ce918d436332e7
Instruction ID: 8b374b447a84a3eb6516e4531b44e52363fa817f3f4265ccba2139a59f939f2f
Opcode Fuzzy Hash: e7c828e8500b304e47737f2c036b73e87bd74cd8a23869b162ce918d436332e7
Instruction Fuzzy Hash: C651EDB07002209BDB20EB64EC92B6B33B4EF81758F54455DF9858B390FB79E801C76A

Function 0043FDBB Relevance: 31.9, APIs: 11, Strings: 7, Instructions: 425memorycomCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(0044DCE0,00000000,00000001,0044DCD0,?), ref: 0043FE41
SysAllocString.OLEAUT32(?), ref: 0043FEC5
CoSetProxyBlanket.OLE32(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0043FF03
SysAllocString.OLEAUT32(?), ref: 0043FF65
SysAllocString.OLEAUT32(?), ref: 00440015
VariantInit.OLEAUT32(6D3F6B39), ref: 0044007E
VariantClear.OLEAUT32(?), ref: 00440123
SysFreeString.OLEAUT32(?), ref: 00440145
SysFreeString.OLEAUT32(?), ref: 0044014E
SysFreeString.OLEAUT32(?), ref: 00440181

Strings

"_kQ, xrefs: 0043FFA8
1[!], xrefs: 0043FFA1
q7bI, xrefs: 0043FF7E
bS3U, xrefs: 0043FFAF
l3u5, xrefs: 0043FF77
hKpM, xrefs: 0043FF85
9k?m, xrefs: 0043FFBD

Memory Dump Source

Source File: 00000002.00000002.1261478466.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: String$AllocFree$Variant$BlanketClearCreateInitInstanceProxy
String ID: "_kQ$1[!]$9k?m$bS3U$hKpM$l3u5$q7bI
API String ID: 2485776651-1023481837
Opcode ID: 3b03e2147dce430a0f8925663908d52cba351bca58096ea1b67891df1644cd7a
Instruction ID: abc33ae36a095545e2bb41dcd0e979c6fcd6de482cd85a6a90bd509a0ecf98e9
Opcode Fuzzy Hash: 3b03e2147dce430a0f8925663908d52cba351bca58096ea1b67891df1644cd7a
Instruction Fuzzy Hash: 1FE16974100B01EFE3208F15C985B16BBF1FF4AB02F148969E59A8BAA1C775F855CF98

Function 004365E8 Relevance: 19.3, APIs: 2, Strings: 9, Instructions: 78COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 004365F4
VariantInit.OLEAUT32 ref: 00436606

Strings

Q, xrefs: 00436627
[, xrefs: 0043664F
_, xrefs: 0043665F
W, xrefs: 0043663F
Y, xrefs: 00436647
], xrefs: 00436657
O, xrefs: 0043661F
U, xrefs: 00436637
S, xrefs: 0043662F

Memory Dump Source

Source File: 00000002.00000002.1261478466.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: Variant$ClearInit
String ID: O$Q$S$U$W$Y$[$]$_
API String ID: 2610073882-3709029455
Opcode ID: bf4df09837cc0999f8912889e458b68c9d6c2582af1171711b600cbe8bd283c9
Instruction ID: 617472aee6f7647b6791f64ddb482ed0964e05965680e50c34387cf75e2fd40f
Opcode Fuzzy Hash: bf4df09837cc0999f8912889e458b68c9d6c2582af1171711b600cbe8bd283c9
Instruction Fuzzy Hash: 8041E970008B81CED721DF38C894756BFE0AB56314F08869DD8EA4F3D6C775A549CB66

Function 004360C9 Relevance: 19.3, APIs: 2, Strings: 9, Instructions: 73COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 004360DA
VariantInit.OLEAUT32 ref: 004360EC

Strings

U, xrefs: 0043611D
[, xrefs: 00436135
O, xrefs: 00436105
S, xrefs: 00436115
], xrefs: 0043613D
Y, xrefs: 0043612D
Q, xrefs: 0043610D
W, xrefs: 00436125
_, xrefs: 00436145

Memory Dump Source

Source File: 00000002.00000002.1261478466.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: Variant$ClearInit
String ID: O$Q$S$U$W$Y$[$]$_
API String ID: 2610073882-3709029455
Opcode ID: f7635afb3bd54eb494f8a0a77bb65c5c2b8a5d4eaa981fde32eb2f6ea89c106d
Instruction ID: 3870ab933f990c28619918e5480d85312f3f30b48fe24ca90a854e860725b9d7
Opcode Fuzzy Hash: f7635afb3bd54eb494f8a0a77bb65c5c2b8a5d4eaa981fde32eb2f6ea89c106d
Instruction Fuzzy Hash: 9C41B474009BC1CEE725DF38C898B46BFA06B56314F088A9DD8E94F296C375A515CB62

Function 00438B2F Relevance: 12.3, APIs: 1, Strings: 6, Instructions: 95COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32 ref: 00438B74

Strings

i, xrefs: 00438B96
}, xrefs: 00438BDE
p, xrefs: 00438BC6
t, xrefs: 00438BD6
d, xrefs: 00438B8E
|, xrefs: 00438BB6

Memory Dump Source

Source File: 00000002.00000002.1261478466.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: InitVariant
String ID: d$i$p$t$|$}
API String ID: 1927566239-2434808017
Opcode ID: 554a65b0e6783a8a587c5d9d5a1a59090ef91d405a8573379fac870fe920457a
Instruction ID: 0b84109ddb38ce271a869d6b766c0ab2b1e4120020a45687ac22dc4c2f8272eb
Opcode Fuzzy Hash: 554a65b0e6783a8a587c5d9d5a1a59090ef91d405a8573379fac870fe920457a
Instruction Fuzzy Hash: FE411870508781CED725CF28C494716BFE0AB66324F08869DD8EA4F397C775E515CBA2

Function 00438417 Relevance: 12.3, APIs: 1, Strings: 6, Instructions: 82COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32 ref: 00438444

Strings

t, xrefs: 004384A6
i, xrefs: 00438466
|, xrefs: 00438486
d, xrefs: 0043845E
p, xrefs: 00438496
}, xrefs: 004384AE

Memory Dump Source

Source File: 00000002.00000002.1261478466.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: InitVariant
String ID: d$i$p$t$|$}
API String ID: 1927566239-2434808017
Opcode ID: 752ed3a4123867835ced7968c358781d81873fa4b79cdbc7d9d63c2e707b67c3
Instruction ID: 90d411813917745457a09f1c6fb0e7b6a5668ded3b473b778bf00fa4b3dd6296
Opcode Fuzzy Hash: 752ed3a4123867835ced7968c358781d81873fa4b79cdbc7d9d63c2e707b67c3
Instruction Fuzzy Hash: 9541D760108781CED721DF2CC484716BFE06B66214F088A8DD8EA4F7D7C375D519CB62

Function 004126B3 Relevance: 9.1, APIs: 1, Strings: 4, Instructions: 301COMMON

Download Yara Rule

Strings

GD, xrefs: 004126C0
tBA, xrefs: 00412AE7
wCA, xrefs: 00412B66
fch%, xrefs: 00412788

Memory Dump Source

Source File: 00000002.00000002.1261478466.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID:
String ID: GD$fch%$tBA$wCA
API String ID: 0-2815851639
Opcode ID: 18b95ce0547799c8335b9632188030b7790c54437027a763add69c76ec3f01d7
Instruction ID: d035267a3a9853f3dfc0ceb4180196f553011948bb1c76c1f0fbabd1dc92564a
Opcode Fuzzy Hash: 18b95ce0547799c8335b9632188030b7790c54437027a763add69c76ec3f01d7
Instruction Fuzzy Hash: F6B158B04093C1CBE7318F149554BEFBBE0BB8A348F140A6EE4C99B242D7799545CB66

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_SecuriteInfo.com_b92fa3286418a257638aa7d482edfd8a2355b3e4_46392f91_2648e0d9-60b4-4514-be5b-eb7779eaa269\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5FAF.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5FFE.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER602E.tmp.xml

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Windows Analysis Report
SecuriteInfo.com.Trojan.Inject5.10240.30655.18394.exe

Function 00B120C7 Relevance: 7.5, APIs: 2, Strings: 2, Instructions: 451
memoryCOMMON

Function 00B6D580 Relevance: 11.5, Strings: 9, Instructions: 256
COMMON