Edit tour

Windows Analysis Report
antispam_connect_eu.exe

Overview

General Information

Sample name:	antispam_connect_eu.exe
Analysis ID:	1533404
MD5:	ba115c337d529887f22c0c2ac398ab2d
SHA1:	517a916a794161deabf13ff2cd45956b8b918eb4
SHA256:	8f14a21c1956fcadda8457f75c21bfd37cb5b5dd5cd184b5f455e1904599c620
Tags:	exeuser-Racco42
Infos:

Detection

SystemBC

Score:	68
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Suricata IDS alerts for network traffic

Yara detected SystemBC

AI detected suspicious sample

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Detected potential crypto function

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

Program does not show much activity (idle)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

antispam_connect_eu.exe (PID: 4816 cmdline: "C:\Users\user\Desktop\antispam_connect_eu.exe" MD5: BA115C337D529887F22C0C2AC398AB2D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
SystemBC	SystemBC is a proxy malware leveraging SOCKS5. Based on screenshots used in ads on a underground marketplace, Proofpoint decided to call it SystemBC.SystemBC has been observed occasionally, but more pronounced since June 2019. First samples goes back to October 2018.	No Attribution	https://asec.ahnlab.com/en/33600/ https://blog.reversinglabs.com/blog/code-reuse-across-packers-and-dll-loaders https://blog.talosintelligence.com/2022/08/modernloader-delivers-multiple-stealers.html https://blogs.vmware.com/security/2023/06/8base-ransomware-a-heavy-hitting-player.html https://cloud.google.com/blog/topics/threat-intelligence/unc4393-goes-gently-into-silentnight	https://malpedia.caad.fkie.fraunhofer.de/details/win.systembc

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000001.00000002.3439574414.00000000063C0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_SystemBC	Yara detected SystemBC	Joe Security

Suricata Signatures

ET MALWARE Win32/SystemBC CnC Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-14T17:22:16.598482+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49719	157.20.182.233	443	TCP
2024-10-14T17:22:16.705514+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49720	157.20.182.233	443	TCP
2024-10-14T17:22:16.814903+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49721	157.20.182.233	443	TCP
2024-10-14T17:22:16.924157+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49722	157.20.182.233	443	TCP
2024-10-14T17:22:17.033527+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49723	157.20.182.233	443	TCP
2024-10-14T17:22:17.142759+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49724	157.20.182.233	443	TCP
2024-10-14T17:22:17.252183+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49725	157.20.182.233	443	TCP
2024-10-14T17:22:17.361897+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49726	157.20.182.233	443	TCP
2024-10-14T17:22:17.471332+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49727	157.20.182.233	443	TCP
2024-10-14T17:22:17.580509+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49728	157.20.182.233	443	TCP
2024-10-14T17:22:17.690106+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49729	157.20.182.233	443	TCP
2024-10-14T17:22:17.800110+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49730	157.20.182.233	443	TCP
2024-10-14T17:22:17.908810+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49731	157.20.182.233	443	TCP
2024-10-14T17:22:18.018181+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49737	157.20.182.233	443	TCP
2024-10-14T17:22:18.127805+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49738	157.20.182.233	443	TCP
2024-10-14T17:22:18.236725+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49739	157.20.182.233	443	TCP
2024-10-14T17:22:18.350370+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49740	157.20.182.233	443	TCP
2024-10-14T17:22:18.465921+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49741	157.20.182.233	443	TCP
2024-10-14T17:22:18.581033+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49742	157.20.182.233	443	TCP
2024-10-14T17:22:18.694666+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49743	157.20.182.233	443	TCP
2024-10-14T17:22:18.812932+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49744	157.20.182.233	443	TCP
2024-10-14T17:22:18.943371+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49745	157.20.182.233	443	TCP
2024-10-14T17:22:19.080076+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49749	157.20.182.233	443	TCP
2024-10-14T17:22:19.192506+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49752	157.20.182.233	443	TCP
2024-10-14T17:22:19.299430+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49753	157.20.182.233	443	TCP
2024-10-14T17:22:19.408709+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49754	157.20.182.233	443	TCP
2024-10-14T17:22:19.518526+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49755	157.20.182.233	443	TCP
2024-10-14T17:22:19.627404+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49756	157.20.182.233	443	TCP
2024-10-14T17:22:19.737588+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49757	157.20.182.233	443	TCP
2024-10-14T17:22:19.847084+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49758	157.20.182.233	443	TCP
2024-10-14T17:22:19.955471+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49764	157.20.182.233	443	TCP
2024-10-14T17:22:20.064843+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49765	157.20.182.233	443	TCP
2024-10-14T17:22:20.174087+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49766	157.20.182.233	443	TCP
2024-10-14T17:22:20.283459+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49767	157.20.182.233	443	TCP
2024-10-14T17:22:20.392910+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49768	157.20.182.233	443	TCP
2024-10-14T17:22:20.502264+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49769	157.20.182.233	443	TCP
2024-10-14T17:22:20.611579+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49771	157.20.182.233	443	TCP
2024-10-14T17:22:20.720963+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49774	157.20.182.233	443	TCP
2024-10-14T17:22:20.830491+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49777	157.20.182.233	443	TCP
2024-10-14T17:22:20.939529+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49779	157.20.182.233	443	TCP
2024-10-14T17:22:21.049408+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49780	157.20.182.233	443	TCP
2024-10-14T17:22:21.158647+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49781	157.20.182.233	443	TCP
2024-10-14T17:22:21.267672+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49782	157.20.182.233	443	TCP
2024-10-14T17:22:21.377598+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49783	157.20.182.233	443	TCP
2024-10-14T17:22:21.495119+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49786	157.20.182.233	443	TCP
2024-10-14T17:22:21.640098+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49787	157.20.182.233	443	TCP
2024-10-14T17:22:21.753009+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49791	157.20.182.233	443	TCP
2024-10-14T17:22:21.861548+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49792	157.20.182.233	443	TCP
2024-10-14T17:22:21.970952+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49793	157.20.182.233	443	TCP
2024-10-14T17:22:22.082384+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49794	157.20.182.233	443	TCP
2024-10-14T17:22:22.191181+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49795	157.20.182.233	443	TCP
2024-10-14T17:22:22.299277+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49797	157.20.182.233	443	TCP
2024-10-14T17:22:22.408466+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49799	157.20.182.233	443	TCP
2024-10-14T17:22:22.518052+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49800	157.20.182.233	443	TCP
2024-10-14T17:22:22.627122+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49804	157.20.182.233	443	TCP
2024-10-14T17:22:22.736733+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49805	157.20.182.233	443	TCP
2024-10-14T17:22:22.846090+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49806	157.20.182.233	443	TCP
2024-10-14T17:22:22.955374+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49807	157.20.182.233	443	TCP
2024-10-14T17:22:23.064599+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49808	157.20.182.233	443	TCP
2024-10-14T17:22:23.174029+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49810	157.20.182.233	443	TCP
2024-10-14T17:22:23.283568+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49812	157.20.182.233	443	TCP
2024-10-14T17:22:23.392780+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49815	157.20.182.233	443	TCP
2024-10-14T17:22:23.502347+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49817	157.20.182.233	443	TCP
2024-10-14T17:22:23.611661+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49818	157.20.182.233	443	TCP
2024-10-14T17:22:23.721132+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49819	157.20.182.233	443	TCP
2024-10-14T17:22:23.830361+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49820	157.20.182.233	443	TCP
2024-10-14T17:22:23.939940+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49822	157.20.182.233	443	TCP
2024-10-14T17:22:24.049060+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49824	157.20.182.233	443	TCP
2024-10-14T17:22:24.158277+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49826	157.20.182.233	443	TCP
2024-10-14T17:22:24.268092+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49829	157.20.182.233	443	TCP
2024-10-14T17:22:24.377469+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49830	157.20.182.233	443	TCP
2024-10-14T17:22:24.486816+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49831	157.20.182.233	443	TCP
2024-10-14T17:22:24.595906+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49832	157.20.182.233	443	TCP
2024-10-14T17:22:24.705300+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49833	157.20.182.233	443	TCP
2024-10-14T17:22:24.814623+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49836	157.20.182.233	443	TCP
2024-10-14T17:22:24.924140+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49837	157.20.182.233	443	TCP
2024-10-14T17:22:25.033286+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49840	157.20.182.233	443	TCP
2024-10-14T17:22:25.142938+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49842	157.20.182.233	443	TCP
2024-10-14T17:22:25.252193+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49843	157.20.182.233	443	TCP
2024-10-14T17:22:25.361405+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49844	157.20.182.233	443	TCP
2024-10-14T17:22:25.470973+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49845	157.20.182.233	443	TCP
2024-10-14T17:22:25.580456+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49848	157.20.182.233	443	TCP
2024-10-14T17:22:25.689516+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49850	157.20.182.233	443	TCP
2024-10-14T17:22:25.799265+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49851	157.20.182.233	443	TCP
2024-10-14T17:22:25.908254+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49854	157.20.182.233	443	TCP
2024-10-14T17:22:26.017965+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49855	157.20.182.233	443	TCP
2024-10-14T17:22:26.127087+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49856	157.20.182.233	443	TCP
2024-10-14T17:22:26.236818+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49857	157.20.182.233	443	TCP
2024-10-14T17:22:26.345981+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49858	157.20.182.233	443	TCP
2024-10-14T17:22:26.455203+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49861	157.20.182.233	443	TCP
2024-10-14T17:22:26.564735+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49863	157.20.182.233	443	TCP
2024-10-14T17:22:26.674223+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49866	157.20.182.233	443	TCP
2024-10-14T17:22:26.783598+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49867	157.20.182.233	443	TCP
2024-10-14T17:22:26.892856+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49868	157.20.182.233	443	TCP
2024-10-14T17:22:27.002062+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49869	157.20.182.233	443	TCP
2024-10-14T17:22:27.111650+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49870	157.20.182.233	443	TCP
2024-10-14T17:22:27.220984+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49872	157.20.182.233	443	TCP
2024-10-14T17:22:27.330335+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49875	157.20.182.233	443	TCP
2024-10-14T17:22:27.439944+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49876	157.20.182.233	443	TCP
2024-10-14T17:22:27.549102+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49879	157.20.182.233	443	TCP
2024-10-14T17:22:27.672094+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49880	157.20.182.233	443	TCP
2024-10-14T17:22:27.783882+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49881	157.20.182.233	443	TCP
2024-10-14T17:22:27.892837+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49882	157.20.182.233	443	TCP
2024-10-14T17:22:28.002422+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49885	157.20.182.233	443	TCP
2024-10-14T17:22:28.112223+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49887	157.20.182.233	443	TCP
2024-10-14T17:22:28.224135+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49888	157.20.182.233	443	TCP
2024-10-14T17:22:28.373956+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49890	157.20.182.233	443	TCP
2024-10-14T17:22:28.501470+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49892	157.20.182.233	443	TCP
2024-10-14T17:22:28.635629+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49893	157.20.182.233	443	TCP
2024-10-14T17:22:28.752339+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49894	157.20.182.233	443	TCP
2024-10-14T17:22:28.861947+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49897	157.20.182.233	443	TCP
2024-10-14T17:22:28.970966+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49899	157.20.182.233	443	TCP
2024-10-14T17:22:29.080130+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49901	157.20.182.233	443	TCP
2024-10-14T17:22:29.189386+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49903	157.20.182.233	443	TCP
2024-10-14T17:22:29.299612+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49904	157.20.182.233	443	TCP
2024-10-14T17:22:29.408784+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49906	157.20.182.233	443	TCP
2024-10-14T17:22:29.517929+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49907	157.20.182.233	443	TCP
2024-10-14T17:22:29.627083+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49909	157.20.182.233	443	TCP
2024-10-14T17:22:29.736706+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49911	157.20.182.233	443	TCP
2024-10-14T17:22:29.845824+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49913	157.20.182.233	443	TCP
2024-10-14T17:22:29.955335+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49915	157.20.182.233	443	TCP
2024-10-14T17:22:30.081493+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49917	157.20.182.233	443	TCP
2024-10-14T17:22:30.190925+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49919	157.20.182.233	443	TCP
2024-10-14T17:22:30.299479+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49920	157.20.182.233	443	TCP
2024-10-14T17:22:30.408597+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49922	157.20.182.233	443	TCP
2024-10-14T17:22:30.517421+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49924	157.20.182.233	443	TCP
2024-10-14T17:22:30.627133+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49926	157.20.182.233	443	TCP
2024-10-14T17:22:30.765305+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49928	157.20.182.233	443	TCP
2024-10-14T17:22:30.877034+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49930	157.20.182.233	443	TCP
2024-10-14T17:22:31.024808+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49931	157.20.182.233	443	TCP
2024-10-14T17:22:31.138993+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49932	157.20.182.233	443	TCP
2024-10-14T17:22:31.260874+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49933	157.20.182.233	443	TCP
2024-10-14T17:22:31.376898+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49936	157.20.182.233	443	TCP
2024-10-14T17:22:31.486363+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49940	157.20.182.233	443	TCP
2024-10-14T17:22:31.595649+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49942	157.20.182.233	443	TCP
2024-10-14T17:22:31.705833+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49943	157.20.182.233	443	TCP
2024-10-14T17:22:31.814570+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49944	157.20.182.233	443	TCP
2024-10-14T17:22:31.924218+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49945	157.20.182.233	443	TCP
2024-10-14T17:22:32.033619+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49946	157.20.182.233	443	TCP
2024-10-14T17:22:32.143355+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49948	157.20.182.233	443	TCP
2024-10-14T17:22:32.252816+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49950	157.20.182.233	443	TCP
2024-10-14T17:22:32.361800+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49953	157.20.182.233	443	TCP
2024-10-14T17:22:32.471055+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49955	157.20.182.233	443	TCP
2024-10-14T17:22:32.580221+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49956	157.20.182.233	443	TCP
2024-10-14T17:22:32.690000+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49957	157.20.182.233	443	TCP
2024-10-14T17:22:32.799093+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49958	157.20.182.233	443	TCP
2024-10-14T17:22:32.909013+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49959	157.20.182.233	443	TCP
2024-10-14T17:22:33.033094+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49962	157.20.182.233	443	TCP
2024-10-14T17:22:33.142510+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49965	157.20.182.233	443	TCP
2024-10-14T17:22:33.252087+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49967	157.20.182.233	443	TCP
2024-10-14T17:22:33.361516+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49968	157.20.182.233	443	TCP
2024-10-14T17:22:33.470852+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49969	157.20.182.233	443	TCP
2024-10-14T17:22:33.580111+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49970	157.20.182.233	443	TCP
2024-10-14T17:22:33.690414+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49971	157.20.182.233	443	TCP
2024-10-14T17:22:33.799621+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49974	157.20.182.233	443	TCP
2024-10-14T17:22:33.908129+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49977	157.20.182.233	443	TCP
2024-10-14T17:22:34.019037+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49978	157.20.182.233	443	TCP
2024-10-14T17:22:34.127253+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49980	157.20.182.233	443	TCP
2024-10-14T17:22:34.239509+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49981	157.20.182.233	443	TCP
2024-10-14T17:22:34.345737+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49982	157.20.182.233	443	TCP
2024-10-14T17:22:34.455702+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49983	157.20.182.233	443	TCP
2024-10-14T17:22:34.564525+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49985	157.20.182.233	443	TCP
2024-10-14T17:22:34.673826+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49988	157.20.182.233	443	TCP
2024-10-14T17:22:34.783312+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49991	157.20.182.233	443	TCP
2024-10-14T17:22:34.892684+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49993	157.20.182.233	443	TCP
2024-10-14T17:22:35.002163+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49994	157.20.182.233	443	TCP
2024-10-14T17:22:35.111680+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49995	157.20.182.233	443	TCP
2024-10-14T17:22:35.220738+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49996	157.20.182.233	443	TCP
2024-10-14T17:22:35.330449+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49997	157.20.182.233	443	TCP
2024-10-14T17:22:35.440068+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	49999	157.20.182.233	443	TCP
2024-10-14T17:22:35.549135+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50003	157.20.182.233	443	TCP
2024-10-14T17:22:35.658893+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50004	157.20.182.233	443	TCP
2024-10-14T17:22:35.768343+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50006	157.20.182.233	443	TCP
2024-10-14T17:22:35.877450+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50007	157.20.182.233	443	TCP
2024-10-14T17:22:35.987213+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50008	157.20.182.233	443	TCP
2024-10-14T17:22:36.095862+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50009	157.20.182.233	443	TCP
2024-10-14T17:22:36.205056+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50011	157.20.182.233	443	TCP
2024-10-14T17:22:36.314417+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50015	157.20.182.233	443	TCP
2024-10-14T17:22:36.424479+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50016	157.20.182.233	443	TCP
2024-10-14T17:22:36.533670+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50018	157.20.182.233	443	TCP
2024-10-14T17:22:36.643631+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50019	157.20.182.233	443	TCP
2024-10-14T17:22:36.752112+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50020	157.20.182.233	443	TCP
2024-10-14T17:22:36.861814+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50021	157.20.182.233	443	TCP
2024-10-14T17:22:36.971143+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50022	157.20.182.233	443	TCP
2024-10-14T17:22:37.080394+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50025	157.20.182.233	443	TCP
2024-10-14T17:22:37.189779+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50028	157.20.182.233	443	TCP
2024-10-14T17:22:37.299072+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50030	157.20.182.233	443	TCP
2024-10-14T17:22:37.411375+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50031	157.20.182.233	443	TCP
2024-10-14T17:22:37.518356+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50032	157.20.182.233	443	TCP
2024-10-14T17:22:37.627250+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50033	157.20.182.233	443	TCP
2024-10-14T17:22:37.736399+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50034	157.20.182.233	443	TCP
2024-10-14T17:22:37.845680+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50037	157.20.182.233	443	TCP
2024-10-14T17:22:38.064790+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50041	157.20.182.233	443	TCP
2024-10-14T17:22:38.174416+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50043	157.20.182.233	443	TCP
2024-10-14T17:22:38.283502+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50044	157.20.182.233	443	TCP
2024-10-14T17:22:38.392861+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50045	157.20.182.233	443	TCP
2024-10-14T17:22:38.502550+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50046	157.20.182.233	443	TCP
2024-10-14T17:22:38.611631+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50047	157.20.182.233	443	TCP
2024-10-14T17:22:38.720943+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50049	157.20.182.233	443	TCP
2024-10-14T17:22:38.830234+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50053	157.20.182.233	443	TCP
2024-10-14T17:22:38.939679+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50055	157.20.182.233	443	TCP
2024-10-14T17:22:39.049160+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50056	157.20.182.233	443	TCP
2024-10-14T17:22:39.158512+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50057	157.20.182.233	443	TCP
2024-10-14T17:22:39.267741+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50058	157.20.182.233	443	TCP
2024-10-14T17:22:39.377471+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50059	157.20.182.233	443	TCP
2024-10-14T17:22:39.506727+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50060	157.20.182.233	443	TCP
2024-10-14T17:22:39.611576+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50065	157.20.182.233	443	TCP
2024-10-14T17:22:39.721054+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50067	157.20.182.233	443	TCP
2024-10-14T17:22:39.830296+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50068	157.20.182.233	443	TCP
2024-10-14T17:22:39.939815+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50069	157.20.182.233	443	TCP
2024-10-14T17:22:40.049421+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50070	157.20.182.233	443	TCP
2024-10-14T17:22:40.158395+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50071	157.20.182.233	443	TCP
2024-10-14T17:22:40.267805+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50072	157.20.182.233	443	TCP
2024-10-14T17:22:40.376965+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50077	157.20.182.233	443	TCP
2024-10-14T17:22:40.486621+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50079	157.20.182.233	443	TCP
2024-10-14T17:22:40.596031+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50080	157.20.182.233	443	TCP
2024-10-14T17:22:40.705395+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50081	157.20.182.233	443	TCP
2024-10-14T17:22:40.827873+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50082	157.20.182.233	443	TCP
2024-10-14T17:22:40.939564+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50083	157.20.182.233	443	TCP
2024-10-14T17:22:41.049189+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50084	157.20.182.233	443	TCP
2024-10-14T17:22:41.158484+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50085	157.20.182.233	443	TCP
2024-10-14T17:22:41.267803+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50090	157.20.182.233	443	TCP
2024-10-14T17:22:41.377011+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50092	157.20.182.233	443	TCP
2024-10-14T17:22:41.499332+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50093	157.20.182.233	443	TCP
2024-10-14T17:22:41.611739+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50094	157.20.182.233	443	TCP
2024-10-14T17:22:41.720827+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50095	157.20.182.233	443	TCP
2024-10-14T17:22:41.830568+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50096	157.20.182.233	443	TCP
2024-10-14T17:22:41.939904+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50097	157.20.182.233	443	TCP
2024-10-14T17:22:42.048964+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50102	157.20.182.233	443	TCP
2024-10-14T17:22:42.158312+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50104	157.20.182.233	443	TCP
2024-10-14T17:22:42.268034+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50105	157.20.182.233	443	TCP
2024-10-14T17:22:42.377242+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50106	157.20.182.233	443	TCP
2024-10-14T17:22:42.486621+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50107	157.20.182.233	443	TCP
2024-10-14T17:22:42.595949+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50108	157.20.182.233	443	TCP
2024-10-14T17:22:42.705804+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50109	157.20.182.233	443	TCP
2024-10-14T17:22:42.814657+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50114	157.20.182.233	443	TCP
2024-10-14T17:22:42.924087+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50116	157.20.182.233	443	TCP
2024-10-14T17:22:43.033844+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50117	157.20.182.233	443	TCP
2024-10-14T17:22:43.142867+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50118	157.20.182.233	443	TCP
2024-10-14T17:22:43.252316+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50119	157.20.182.233	443	TCP
2024-10-14T17:22:43.361807+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50120	157.20.182.233	443	TCP
2024-10-14T17:22:43.471238+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50121	157.20.182.233	443	TCP
2024-10-14T17:22:43.581615+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50124	157.20.182.233	443	TCP
2024-10-14T17:22:43.690252+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50127	157.20.182.233	443	TCP
2024-10-14T17:22:43.799098+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50129	157.20.182.233	443	TCP
2024-10-14T17:22:43.908404+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50130	157.20.182.233	443	TCP
2024-10-14T17:22:44.017884+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50131	157.20.182.233	443	TCP
2024-10-14T17:22:44.127411+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50132	157.20.182.233	443	TCP
2024-10-14T17:22:44.236458+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50133	157.20.182.233	443	TCP
2024-10-14T17:22:44.345836+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50134	157.20.182.233	443	TCP
2024-10-14T17:22:44.455394+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50139	157.20.182.233	443	TCP
2024-10-14T17:22:44.564588+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50141	157.20.182.233	443	TCP
2024-10-14T17:22:44.674372+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50142	157.20.182.233	443	TCP
2024-10-14T17:22:44.783406+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50143	157.20.182.233	443	TCP
2024-10-14T17:22:44.893934+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50144	157.20.182.233	443	TCP
2024-10-14T17:22:45.002376+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50145	157.20.182.233	443	TCP
2024-10-14T17:22:45.112618+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50146	157.20.182.233	443	TCP
2024-10-14T17:22:45.221440+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50147	157.20.182.233	443	TCP
2024-10-14T17:22:45.330444+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50148	157.20.182.233	443	TCP
2024-10-14T17:22:45.439414+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50154	157.20.182.233	443	TCP
2024-10-14T17:22:45.549360+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50155	157.20.182.233	443	TCP
2024-10-14T17:22:45.658734+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50156	157.20.182.233	443	TCP
2024-10-14T17:22:45.768006+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50157	157.20.182.233	443	TCP
2024-10-14T17:22:45.877194+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50158	157.20.182.233	443	TCP
2024-10-14T17:22:45.986472+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50159	157.20.182.233	443	TCP
2024-10-14T17:22:46.095774+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50160	157.20.182.233	443	TCP
2024-10-14T17:22:46.205301+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50162	157.20.182.233	443	TCP
2024-10-14T17:22:46.314694+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50167	157.20.182.233	443	TCP
2024-10-14T17:22:46.424195+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50168	157.20.182.233	443	TCP
2024-10-14T17:22:46.533355+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50169	157.20.182.233	443	TCP
2024-10-14T17:22:46.642928+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50170	157.20.182.233	443	TCP
2024-10-14T17:22:46.752212+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50171	157.20.182.233	443	TCP
2024-10-14T17:22:46.861404+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50172	157.20.182.233	443	TCP
2024-10-14T17:22:46.970771+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50173	157.20.182.233	443	TCP
2024-10-14T17:22:47.080147+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50179	157.20.182.233	443	TCP
2024-10-14T17:22:47.189473+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50180	157.20.182.233	443	TCP
2024-10-14T17:22:47.299026+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50181	157.20.182.233	443	TCP
2024-10-14T17:22:47.408345+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50182	157.20.182.233	443	TCP
2024-10-14T17:22:47.626950+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50184	157.20.182.233	443	TCP
2024-10-14T17:22:47.736495+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50185	157.20.182.233	443	TCP
2024-10-14T17:22:47.845746+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50187	157.20.182.233	443	TCP
2024-10-14T17:22:48.174039+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50194	157.20.182.233	443	TCP
2024-10-14T17:22:48.283408+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50195	157.20.182.233	443	TCP
2024-10-14T17:22:48.393104+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50196	157.20.182.233	443	TCP
2024-10-14T17:22:48.502322+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50197	157.20.182.233	443	TCP
2024-10-14T17:22:48.611473+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50198	157.20.182.233	443	TCP
2024-10-14T17:22:48.721068+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50199	157.20.182.233	443	TCP
2024-10-14T17:22:48.830388+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50200	157.20.182.233	443	TCP
2024-10-14T17:22:48.939432+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50201	157.20.182.233	443	TCP
2024-10-14T17:22:49.049470+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50202	157.20.182.233	443	TCP
2024-10-14T17:22:49.158538+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50203	157.20.182.233	443	TCP
2024-10-14T17:22:49.267751+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50207	157.20.182.233	443	TCP
2024-10-14T17:22:49.377252+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50210	157.20.182.233	443	TCP
2024-10-14T17:22:49.486395+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50211	157.20.182.233	443	TCP
2024-10-14T17:22:49.705335+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50213	157.20.182.233	443	TCP
2024-10-14T17:22:49.814574+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50214	157.20.182.233	443	TCP
2024-10-14T17:22:49.924038+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50215	157.20.182.233	443	TCP
2024-10-14T17:22:50.033298+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50218	157.20.182.233	443	TCP
2024-10-14T17:22:50.142948+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50222	157.20.182.233	443	TCP
2024-10-14T17:22:50.361496+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50224	157.20.182.233	443	TCP
2024-10-14T17:22:50.471034+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50225	157.20.182.233	443	TCP
2024-10-14T17:22:50.580376+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50226	157.20.182.233	443	TCP
2024-10-14T17:22:50.689761+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50227	157.20.182.233	443	TCP
2024-10-14T17:22:50.798928+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50229	157.20.182.233	443	TCP
2024-10-14T17:22:50.908170+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50233	157.20.182.233	443	TCP
2024-10-14T17:22:51.018126+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50235	157.20.182.233	443	TCP
2024-10-14T17:22:51.127169+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50236	157.20.182.233	443	TCP
2024-10-14T17:22:51.236922+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50237	157.20.182.233	443	TCP
2024-10-14T17:22:51.455545+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50239	157.20.182.233	443	TCP
2024-10-14T17:22:51.564908+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50240	157.20.182.233	443	TCP
2024-10-14T17:22:51.674072+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50243	157.20.182.233	443	TCP
2024-10-14T17:22:51.788437+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50246	157.20.182.233	443	TCP
2024-10-14T17:22:51.892943+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50248	157.20.182.233	443	TCP
2024-10-14T17:22:52.002162+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50249	157.20.182.233	443	TCP
2024-10-14T17:22:52.111409+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50250	157.20.182.233	443	TCP
2024-10-14T17:22:52.424393+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50253	157.20.182.233	443	TCP
2024-10-14T17:22:52.533481+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50258	157.20.182.233	443	TCP
2024-10-14T17:22:52.642933+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50259	157.20.182.233	443	TCP
2024-10-14T17:22:52.752298+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50261	157.20.182.233	443	TCP
2024-10-14T17:22:52.846535+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50262	157.20.182.233	443	TCP
2024-10-14T17:22:52.940290+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50263	157.20.182.233	443	TCP
2024-10-14T17:22:53.127149+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50265	157.20.182.233	443	TCP
2024-10-14T17:22:53.221238+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50266	157.20.182.233	443	TCP
2024-10-14T17:22:53.314699+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50268	157.20.182.233	443	TCP
2024-10-14T17:22:53.408504+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50271	157.20.182.233	443	TCP
2024-10-14T17:22:53.502944+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50274	157.20.182.233	443	TCP
2024-10-14T17:22:53.596197+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50275	157.20.182.233	443	TCP
2024-10-14T17:22:53.689952+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50276	157.20.182.233	443	TCP
2024-10-14T17:22:53.783841+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50277	157.20.182.233	443	TCP
2024-10-14T17:22:53.885007+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50278	157.20.182.233	443	TCP
2024-10-14T17:22:53.986683+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50279	157.20.182.233	443	TCP
2024-10-14T17:22:54.174281+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50284	157.20.182.233	443	TCP
2024-10-14T17:22:54.267819+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50287	157.20.182.233	443	TCP
2024-10-14T17:22:54.361597+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50288	157.20.182.233	443	TCP
2024-10-14T17:22:54.455419+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50289	157.20.182.233	443	TCP
2024-10-14T17:22:54.549684+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50290	157.20.182.233	443	TCP
2024-10-14T17:22:54.642770+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50291	157.20.182.233	443	TCP
2024-10-14T17:22:54.736685+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50292	157.20.182.233	443	TCP
2024-10-14T17:22:54.830481+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50293	157.20.182.233	443	TCP
2024-10-14T17:22:54.924098+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50295	157.20.182.233	443	TCP
2024-10-14T17:22:55.018345+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50298	157.20.182.233	443	TCP
2024-10-14T17:22:55.111742+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50301	157.20.182.233	443	TCP
2024-10-14T17:22:55.205865+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50302	157.20.182.233	443	TCP
2024-10-14T17:22:55.299104+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50303	157.20.182.233	443	TCP
2024-10-14T17:22:55.392788+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50304	157.20.182.233	443	TCP
2024-10-14T17:22:55.486634+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50305	157.20.182.233	443	TCP
2024-10-14T17:22:55.674538+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50307	157.20.182.233	443	TCP
2024-10-14T17:22:55.767846+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50309	157.20.182.233	443	TCP
2024-10-14T17:22:55.862149+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50313	157.20.182.233	443	TCP
2024-10-14T17:22:55.962084+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50315	157.20.182.233	443	TCP
2024-10-14T17:22:56.049136+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50316	157.20.182.233	443	TCP
2024-10-14T17:22:56.145892+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50317	157.20.182.233	443	TCP
2024-10-14T17:22:56.236612+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50318	157.20.182.233	443	TCP
2024-10-14T17:22:56.330141+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50319	157.20.182.233	443	TCP
2024-10-14T17:22:56.424079+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50320	157.20.182.233	443	TCP
2024-10-14T17:22:56.518590+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50321	157.20.182.233	443	TCP
2024-10-14T17:22:56.611509+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50324	157.20.182.233	443	TCP
2024-10-14T17:22:56.705379+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50328	157.20.182.233	443	TCP
2024-10-14T17:22:56.799016+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50329	157.20.182.233	443	TCP
2024-10-14T17:22:56.893719+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50330	157.20.182.233	443	TCP
2024-10-14T17:22:56.986851+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50331	157.20.182.233	443	TCP
2024-10-14T17:22:57.080453+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50332	157.20.182.233	443	TCP
2024-10-14T17:22:57.174075+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50333	157.20.182.233	443	TCP
2024-10-14T17:22:57.267782+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50334	157.20.182.233	443	TCP
2024-10-14T17:22:57.361372+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50336	157.20.182.233	443	TCP
2024-10-14T17:22:57.455015+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50340	157.20.182.233	443	TCP
2024-10-14T17:22:57.548813+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50342	157.20.182.233	443	TCP
2024-10-14T17:22:57.642929+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50343	157.20.182.233	443	TCP
2024-10-14T17:22:57.736708+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50344	157.20.182.233	443	TCP
2024-10-14T17:22:57.814674+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50345	157.20.182.233	443	TCP
2024-10-14T17:22:57.892663+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50346	157.20.182.233	443	TCP
2024-10-14T17:22:57.971053+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50347	157.20.182.233	443	TCP
2024-10-14T17:22:58.049105+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50348	157.20.182.233	443	TCP
2024-10-14T17:22:58.127203+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50350	157.20.182.233	443	TCP
2024-10-14T17:22:58.205480+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50352	157.20.182.233	443	TCP
2024-10-14T17:22:58.283603+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50356	157.20.182.233	443	TCP
2024-10-14T17:22:58.361784+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50357	157.20.182.233	443	TCP
2024-10-14T17:22:58.439595+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50358	157.20.182.233	443	TCP
2024-10-14T17:22:58.517736+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50359	157.20.182.233	443	TCP
2024-10-14T17:22:58.595907+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50361	157.20.182.233	443	TCP
2024-10-14T17:22:58.686739+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50362	157.20.182.233	443	TCP
2024-10-14T17:22:58.768010+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50363	157.20.182.233	443	TCP
2024-10-14T17:22:58.846128+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50364	157.20.182.233	443	TCP
2024-10-14T17:22:58.923909+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50365	157.20.182.233	443	TCP
2024-10-14T17:22:59.002886+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50367	157.20.182.233	443	TCP
2024-10-14T17:22:59.158573+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50372	157.20.182.233	443	TCP
2024-10-14T17:22:59.236803+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50373	157.20.182.233	443	TCP
2024-10-14T17:22:59.314772+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50375	157.20.182.233	443	TCP
2024-10-14T17:22:59.392797+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50376	157.20.182.233	443	TCP
2024-10-14T17:22:59.471604+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50377	157.20.182.233	443	TCP
2024-10-14T17:22:59.548825+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50378	157.20.182.233	443	TCP
2024-10-14T17:22:59.627144+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50379	157.20.182.233	443	TCP
2024-10-14T17:22:59.705357+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50380	157.20.182.233	443	TCP
2024-10-14T17:22:59.784025+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50381	157.20.182.233	443	TCP
2024-10-14T17:22:59.862442+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50384	157.20.182.233	443	TCP
2024-10-14T17:22:59.939541+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50385	157.20.182.233	443	TCP
2024-10-14T17:23:00.018322+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50388	157.20.182.233	443	TCP
2024-10-14T17:23:00.174179+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50391	157.20.182.233	443	TCP
2024-10-14T17:23:00.251964+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50392	157.20.182.233	443	TCP
2024-10-14T17:23:00.330176+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50393	157.20.182.233	443	TCP
2024-10-14T17:23:00.408416+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50394	157.20.182.233	443	TCP
2024-10-14T17:23:00.486687+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50395	157.20.182.233	443	TCP
2024-10-14T17:23:00.642941+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50397	157.20.182.233	443	TCP
2024-10-14T17:23:00.720871+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50399	157.20.182.233	443	TCP
2024-10-14T17:23:00.799243+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50403	157.20.182.233	443	TCP
2024-10-14T17:23:00.877232+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50404	157.20.182.233	443	TCP
2024-10-14T17:23:00.955263+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50405	157.20.182.233	443	TCP
2024-10-14T17:23:01.033372+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50406	157.20.182.233	443	TCP
2024-10-14T17:23:01.111665+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50407	157.20.182.233	443	TCP
2024-10-14T17:23:01.189765+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50408	157.20.182.233	443	TCP
2024-10-14T17:23:01.267542+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50409	157.20.182.233	443	TCP
2024-10-14T17:23:01.345934+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50410	157.20.182.233	443	TCP
2024-10-14T17:23:01.424176+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50411	157.20.182.233	443	TCP
2024-10-14T17:23:01.502319+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50412	157.20.182.233	443	TCP
2024-10-14T17:23:01.580316+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50413	157.20.182.233	443	TCP
2024-10-14T17:23:01.658164+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50414	157.20.182.233	443	TCP
2024-10-14T17:23:01.736580+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50415	157.20.182.233	443	TCP
2024-10-14T17:23:01.815414+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50416	157.20.182.233	443	TCP
2024-10-14T17:23:01.892986+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50417	157.20.182.233	443	TCP
2024-10-14T17:23:02.049125+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50419	157.20.182.233	443	TCP
2024-10-14T17:23:02.127211+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50420	157.20.182.233	443	TCP
2024-10-14T17:23:02.220927+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50421	157.20.182.233	443	TCP
2024-10-14T17:23:02.651982+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50423	157.20.182.233	443	TCP
2024-10-14T17:23:02.731228+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50424	157.20.182.233	443	TCP
2024-10-14T17:23:02.826083+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50425	157.20.182.233	443	TCP
2024-10-14T17:23:02.892701+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50426	157.20.182.233	443	TCP
2024-10-14T17:23:02.970983+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50427	157.20.182.233	443	TCP
2024-10-14T17:23:03.049373+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50428	157.20.182.233	443	TCP
2024-10-14T17:23:03.127471+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50429	157.20.182.233	443	TCP
2024-10-14T17:23:03.205311+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50430	157.20.182.233	443	TCP
2024-10-14T17:23:03.439717+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50433	157.20.182.233	443	TCP
2024-10-14T17:23:03.517764+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50434	157.20.182.233	443	TCP
2024-10-14T17:23:03.595997+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50435	157.20.182.233	443	TCP
2024-10-14T17:23:03.658415+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50436	157.20.182.233	443	TCP
2024-10-14T17:23:03.720974+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50437	157.20.182.233	443	TCP
2024-10-14T17:23:03.784358+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50438	157.20.182.233	443	TCP
2024-10-14T17:23:03.861722+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50439	157.20.182.233	443	TCP
2024-10-14T17:23:03.924450+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50440	157.20.182.233	443	TCP
2024-10-14T17:23:03.986277+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50441	157.20.182.233	443	TCP
2024-10-14T17:23:04.048830+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50442	157.20.182.233	443	TCP
2024-10-14T17:23:04.111197+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50443	157.20.182.233	443	TCP
2024-10-14T17:23:04.174004+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50444	157.20.182.233	443	TCP
2024-10-14T17:23:04.236582+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50445	157.20.182.233	443	TCP
2024-10-14T17:23:04.299004+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50446	157.20.182.233	443	TCP
2024-10-14T17:23:04.361418+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50447	157.20.182.233	443	TCP
2024-10-14T17:23:04.423732+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50448	157.20.182.233	443	TCP
2024-10-14T17:23:04.489339+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50449	157.20.182.233	443	TCP
2024-10-14T17:23:04.564530+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50450	157.20.182.233	443	TCP
2024-10-14T17:23:04.627252+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50451	157.20.182.233	443	TCP
2024-10-14T17:23:04.689785+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50452	157.20.182.233	443	TCP
2024-10-14T17:23:04.752114+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50453	157.20.182.233	443	TCP
2024-10-14T17:23:04.818566+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50454	157.20.182.233	443	TCP
2024-10-14T17:23:04.894726+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50455	157.20.182.233	443	TCP
2024-10-14T17:23:04.955495+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50456	157.20.182.233	443	TCP
2024-10-14T17:23:05.017791+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50457	157.20.182.233	443	TCP
2024-10-14T17:23:05.080278+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50458	157.20.182.233	443	TCP
2024-10-14T17:23:05.142714+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50459	157.20.182.233	443	TCP
2024-10-14T17:23:05.205282+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50460	157.20.182.233	443	TCP
2024-10-14T17:23:05.267738+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50461	157.20.182.233	443	TCP
2024-10-14T17:23:05.330093+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50462	157.20.182.233	443	TCP
2024-10-14T17:23:05.392510+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50463	157.20.182.233	443	TCP
2024-10-14T17:23:05.455076+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50464	157.20.182.233	443	TCP
2024-10-14T17:23:05.521257+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50465	157.20.182.233	443	TCP
2024-10-14T17:23:05.580273+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50466	157.20.182.233	443	TCP
2024-10-14T17:23:05.642859+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50467	157.20.182.233	443	TCP
2024-10-14T17:23:05.705238+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50468	157.20.182.233	443	TCP
2024-10-14T17:23:05.767633+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50469	157.20.182.233	443	TCP
2024-10-14T17:23:05.830604+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50470	157.20.182.233	443	TCP
2024-10-14T17:23:05.893462+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50471	157.20.182.233	443	TCP
2024-10-14T17:23:05.955787+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50472	157.20.182.233	443	TCP
2024-10-14T17:23:06.018462+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50473	157.20.182.233	443	TCP
2024-10-14T17:23:06.142631+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50475	157.20.182.233	443	TCP
2024-10-14T17:23:06.205836+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50476	157.20.182.233	443	TCP
2024-10-14T17:23:06.267718+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50477	157.20.182.233	443	TCP
2024-10-14T17:23:06.330725+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50478	157.20.182.233	443	TCP
2024-10-14T17:23:06.392941+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50479	157.20.182.233	443	TCP
2024-10-14T17:23:06.455081+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50480	157.20.182.233	443	TCP
2024-10-14T17:23:06.517975+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50481	157.20.182.233	443	TCP
2024-10-14T17:23:06.580499+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50482	157.20.182.233	443	TCP
2024-10-14T17:23:06.643100+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50483	157.20.182.233	443	TCP
2024-10-14T17:23:06.705577+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50484	157.20.182.233	443	TCP
2024-10-14T17:23:06.767722+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50486	157.20.182.233	443	TCP
2024-10-14T17:23:06.830356+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50487	157.20.182.233	443	TCP
2024-10-14T17:23:06.896176+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50488	157.20.182.233	443	TCP
2024-10-14T17:23:06.956377+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50489	157.20.182.233	443	TCP
2024-10-14T17:23:07.018752+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50490	157.20.182.233	443	TCP
2024-10-14T17:23:07.081271+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50491	157.20.182.233	443	TCP
2024-10-14T17:23:07.180384+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50492	157.20.182.233	443	TCP
2024-10-14T17:23:07.262565+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50493	157.20.182.233	443	TCP
2024-10-14T17:23:07.343359+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50494	157.20.182.233	443	TCP
2024-10-14T17:23:07.470689+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50496	157.20.182.233	443	TCP
2024-10-14T17:23:07.533321+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50497	157.20.182.233	443	TCP
2024-10-14T17:23:07.658451+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50499	157.20.182.233	443	TCP
2024-10-14T17:23:07.720897+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50500	157.20.182.233	443	TCP
2024-10-14T17:23:07.783234+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50501	157.20.182.233	443	TCP
2024-10-14T17:23:07.845854+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50502	157.20.182.233	443	TCP
2024-10-14T17:23:07.908273+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50503	157.20.182.233	443	TCP
2024-10-14T17:23:07.971021+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50504	157.20.182.233	443	TCP
2024-10-14T17:23:08.033353+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50505	157.20.182.233	443	TCP
2024-10-14T17:23:08.095833+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50506	157.20.182.233	443	TCP
2024-10-14T17:23:08.158078+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50507	157.20.182.233	443	TCP
2024-10-14T17:23:08.220489+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50508	157.20.182.233	443	TCP
2024-10-14T17:23:08.283314+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50509	157.20.182.233	443	TCP
2024-10-14T17:23:08.345680+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50510	157.20.182.233	443	TCP
2024-10-14T17:23:08.408658+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50511	157.20.182.233	443	TCP
2024-10-14T17:23:08.533047+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50513	157.20.182.233	443	TCP
2024-10-14T17:23:08.660934+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50515	157.20.182.233	443	TCP
2024-10-14T17:23:08.721518+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50516	157.20.182.233	443	TCP
2024-10-14T17:23:08.784184+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50517	157.20.182.233	443	TCP
2024-10-14T17:23:08.845951+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50518	157.20.182.233	443	TCP
2024-10-14T17:23:08.908542+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50519	157.20.182.233	443	TCP
2024-10-14T17:23:08.971047+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50520	157.20.182.233	443	TCP
2024-10-14T17:23:09.096421+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50522	157.20.182.233	443	TCP
2024-10-14T17:23:09.158476+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50523	157.20.182.233	443	TCP
2024-10-14T17:23:09.205119+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50524	157.20.182.233	443	TCP
2024-10-14T17:23:09.298895+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50526	157.20.182.233	443	TCP
2024-10-14T17:23:09.345730+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50527	157.20.182.233	443	TCP
2024-10-14T17:23:09.392892+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50528	157.20.182.233	443	TCP
2024-10-14T17:23:09.439771+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50529	157.20.182.233	443	TCP
2024-10-14T17:23:09.490525+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50530	157.20.182.233	443	TCP
2024-10-14T17:23:09.548995+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50531	157.20.182.233	443	TCP
2024-10-14T17:23:09.598070+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50532	157.20.182.233	443	TCP
2024-10-14T17:23:09.658425+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50533	157.20.182.233	443	TCP
2024-10-14T17:23:09.705440+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50534	157.20.182.233	443	TCP
2024-10-14T17:23:09.919542+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50536	157.20.182.233	443	TCP
2024-10-14T17:23:09.987545+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50537	157.20.182.233	443	TCP
2024-10-14T17:23:10.038626+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50538	157.20.182.233	443	TCP
2024-10-14T17:23:10.095961+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50539	157.20.182.233	443	TCP
2024-10-14T17:23:10.142960+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50540	157.20.182.233	443	TCP
2024-10-14T17:23:10.189521+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50541	157.20.182.233	443	TCP
2024-10-14T17:23:10.236654+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50542	157.20.182.233	443	TCP
2024-10-14T17:23:10.283296+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50543	157.20.182.233	443	TCP
2024-10-14T17:23:10.330063+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50544	157.20.182.233	443	TCP
2024-10-14T17:23:10.377068+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50545	157.20.182.233	443	TCP
2024-10-14T17:23:10.423605+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50546	157.20.182.233	443	TCP
2024-10-14T17:23:10.471249+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50547	157.20.182.233	443	TCP
2024-10-14T17:23:10.564356+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50549	157.20.182.233	443	TCP
2024-10-14T17:23:10.611418+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50550	157.20.182.233	443	TCP
2024-10-14T17:23:10.658133+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50551	157.20.182.233	443	TCP
2024-10-14T17:23:10.705301+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50552	157.20.182.233	443	TCP
2024-10-14T17:23:10.752168+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50553	157.20.182.233	443	TCP
2024-10-14T17:23:10.799082+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50554	157.20.182.233	443	TCP
2024-10-14T17:23:10.845890+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50555	157.20.182.233	443	TCP
2024-10-14T17:23:10.893007+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50556	157.20.182.233	443	TCP
2024-10-14T17:23:10.940176+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50557	157.20.182.233	443	TCP
2024-10-14T17:23:10.986805+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50558	157.20.182.233	443	TCP
2024-10-14T17:23:11.033510+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50559	157.20.182.233	443	TCP
2024-10-14T17:23:11.080287+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50560	157.20.182.233	443	TCP
2024-10-14T17:23:11.126917+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50561	157.20.182.233	443	TCP
2024-10-14T17:23:11.174251+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50562	157.20.182.233	443	TCP
2024-10-14T17:23:11.221209+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50563	157.20.182.233	443	TCP
2024-10-14T17:23:11.267822+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50564	157.20.182.233	443	TCP
2024-10-14T17:23:11.314583+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50565	157.20.182.233	443	TCP
2024-10-14T17:23:11.361646+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50566	157.20.182.233	443	TCP
2024-10-14T17:23:11.408193+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50567	157.20.182.233	443	TCP
2024-10-14T17:23:11.454903+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50568	157.20.182.233	443	TCP
2024-10-14T17:23:11.502358+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50569	157.20.182.233	443	TCP
2024-10-14T17:23:11.549077+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50570	157.20.182.233	443	TCP
2024-10-14T17:23:11.595825+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50571	157.20.182.233	443	TCP
2024-10-14T17:23:11.642384+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50572	157.20.182.233	443	TCP
2024-10-14T17:23:11.689216+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50573	157.20.182.233	443	TCP
2024-10-14T17:23:11.736024+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50574	157.20.182.233	443	TCP
2024-10-14T17:23:11.782968+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50575	157.20.182.233	443	TCP
2024-10-14T17:23:11.829908+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50576	157.20.182.233	443	TCP
2024-10-14T17:23:11.877844+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50577	157.20.182.233	443	TCP
2024-10-14T17:23:11.924144+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50578	157.20.182.233	443	TCP
2024-10-14T17:23:11.970722+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50579	157.20.182.233	443	TCP
2024-10-14T17:23:12.064357+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50581	157.20.182.233	443	TCP
2024-10-14T17:23:12.111652+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50582	157.20.182.233	443	TCP
2024-10-14T17:23:12.158442+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50583	157.20.182.233	443	TCP
2024-10-14T17:23:12.205460+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50584	157.20.182.233	443	TCP
2024-10-14T17:23:12.345808+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50587	157.20.182.233	443	TCP
2024-10-14T17:23:12.392625+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50588	157.20.182.233	443	TCP
2024-10-14T17:23:12.439415+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50589	157.20.182.233	443	TCP
2024-10-14T17:23:12.486368+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50590	157.20.182.233	443	TCP
2024-10-14T17:23:12.533759+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50591	157.20.182.233	443	TCP
2024-10-14T17:23:12.580400+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50592	157.20.182.233	443	TCP
2024-10-14T17:23:12.627540+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50593	157.20.182.233	443	TCP
2024-10-14T17:23:12.674297+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50594	157.20.182.233	443	TCP
2024-10-14T17:23:12.720686+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50595	157.20.182.233	443	TCP
2024-10-14T17:23:12.767807+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50596	157.20.182.233	443	TCP
2024-10-14T17:23:12.814937+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50597	157.20.182.233	443	TCP
2024-10-14T17:23:12.861456+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50598	157.20.182.233	443	TCP
2024-10-14T17:23:12.908783+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50599	157.20.182.233	443	TCP
2024-10-14T17:23:13.001984+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50601	157.20.182.233	443	TCP
2024-10-14T17:23:13.095986+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50603	157.20.182.233	443	TCP
2024-10-14T17:23:13.142766+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50604	157.20.182.233	443	TCP
2024-10-14T17:23:13.189578+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50605	157.20.182.233	443	TCP
2024-10-14T17:23:13.236838+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50606	157.20.182.233	443	TCP
2024-10-14T17:23:13.283486+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50607	157.20.182.233	443	TCP
2024-10-14T17:23:13.329964+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50608	157.20.182.233	443	TCP
2024-10-14T17:23:13.376680+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50609	157.20.182.233	443	TCP
2024-10-14T17:23:13.423766+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50610	157.20.182.233	443	TCP
2024-10-14T17:23:13.470604+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50611	157.20.182.233	443	TCP
2024-10-14T17:23:13.517378+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50612	157.20.182.233	443	TCP
2024-10-14T17:23:13.565001+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50613	157.20.182.233	443	TCP
2024-10-14T17:23:13.611530+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50614	157.20.182.233	443	TCP
2024-10-14T17:23:13.659012+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50615	157.20.182.233	443	TCP
2024-10-14T17:23:13.752174+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50617	157.20.182.233	443	TCP
2024-10-14T17:23:13.798760+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50618	157.20.182.233	443	TCP
2024-10-14T17:23:13.845903+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50619	157.20.182.233	443	TCP
2024-10-14T17:23:13.893098+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50620	157.20.182.233	443	TCP
2024-10-14T17:23:13.939752+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50621	157.20.182.233	443	TCP
2024-10-14T17:23:13.986528+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50622	157.20.182.233	443	TCP
2024-10-14T17:23:14.033577+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50623	157.20.182.233	443	TCP
2024-10-14T17:23:14.080240+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50624	157.20.182.233	443	TCP
2024-10-14T17:23:14.127148+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50625	157.20.182.233	443	TCP
2024-10-14T17:23:14.221125+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50627	157.20.182.233	443	TCP
2024-10-14T17:23:14.267905+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50628	157.20.182.233	443	TCP
2024-10-14T17:23:14.315191+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50629	157.20.182.233	443	TCP
2024-10-14T17:23:14.362460+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50630	157.20.182.233	443	TCP
2024-10-14T17:23:14.408668+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50631	157.20.182.233	443	TCP
2024-10-14T17:23:14.455008+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50632	157.20.182.233	443	TCP
2024-10-14T17:23:14.549027+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50634	157.20.182.233	443	TCP
2024-10-14T17:23:14.595980+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50635	157.20.182.233	443	TCP
2024-10-14T17:23:14.689825+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50637	157.20.182.233	443	TCP
2024-10-14T17:23:14.736544+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50638	157.20.182.233	443	TCP
2024-10-14T17:23:14.830024+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50640	157.20.182.233	443	TCP
2024-10-14T17:23:14.877087+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50641	157.20.182.233	443	TCP
2024-10-14T17:23:14.923897+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50642	157.20.182.233	443	TCP
2024-10-14T17:23:14.970942+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50643	157.20.182.233	443	TCP
2024-10-14T17:23:15.017721+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50644	157.20.182.233	443	TCP
2024-10-14T17:23:15.064755+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50645	157.20.182.233	443	TCP
2024-10-14T17:23:15.112005+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50646	157.20.182.233	443	TCP
2024-10-14T17:23:15.157938+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50647	157.20.182.233	443	TCP
2024-10-14T17:23:15.189271+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50648	157.20.182.233	443	TCP
2024-10-14T17:23:15.220497+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50649	157.20.182.233	443	TCP
2024-10-14T17:23:15.251852+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50650	157.20.182.233	443	TCP
2024-10-14T17:23:15.330174+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50652	157.20.182.233	443	TCP
2024-10-14T17:23:15.361267+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50653	157.20.182.233	443	TCP
2024-10-14T17:23:15.392307+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50654	157.20.182.233	443	TCP
2024-10-14T17:23:15.454736+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50656	157.20.182.233	443	TCP
2024-10-14T17:23:15.486137+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50657	157.20.182.233	443	TCP
2024-10-14T17:23:15.517451+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50658	157.20.182.233	443	TCP
2024-10-14T17:23:15.611637+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50661	157.20.182.233	443	TCP
2024-10-14T17:23:15.642841+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50662	157.20.182.233	443	TCP
2024-10-14T17:23:15.674019+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50663	157.20.182.233	443	TCP
2024-10-14T17:23:15.705162+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50664	157.20.182.233	443	TCP
2024-10-14T17:23:15.767582+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50666	157.20.182.233	443	TCP
2024-10-14T17:23:15.829935+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50668	157.20.182.233	443	TCP
2024-10-14T17:23:15.861218+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50669	157.20.182.233	443	TCP
2024-10-14T17:23:15.892388+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50670	157.20.182.233	443	TCP
2024-10-14T17:23:15.955123+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50672	157.20.182.233	443	TCP
2024-10-14T17:23:15.986541+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50673	157.20.182.233	443	TCP
2024-10-14T17:23:16.017758+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50674	157.20.182.233	443	TCP
2024-10-14T17:23:16.048952+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50675	157.20.182.233	443	TCP
2024-10-14T17:23:16.111251+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50677	157.20.182.233	443	TCP
2024-10-14T17:23:16.142360+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50678	157.20.182.233	443	TCP
2024-10-14T17:23:16.173614+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50679	157.20.182.233	443	TCP
2024-10-14T17:23:16.205058+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50680	157.20.182.233	443	TCP
2024-10-14T17:23:16.252480+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50681	157.20.182.233	443	TCP
2024-10-14T17:23:16.283472+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50682	157.20.182.233	443	TCP
2024-10-14T17:23:16.314451+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50683	157.20.182.233	443	TCP
2024-10-14T17:23:16.378311+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50685	157.20.182.233	443	TCP
2024-10-14T17:23:16.408302+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50686	157.20.182.233	443	TCP
2024-10-14T17:23:16.439475+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50687	157.20.182.233	443	TCP
2024-10-14T17:23:16.470644+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50688	157.20.182.233	443	TCP
2024-10-14T17:23:16.501945+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50689	157.20.182.233	443	TCP
2024-10-14T17:23:16.533188+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50690	157.20.182.233	443	TCP
2024-10-14T17:23:16.564462+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50691	157.20.182.233	443	TCP
2024-10-14T17:23:16.595568+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50692	157.20.182.233	443	TCP
2024-10-14T17:23:16.627035+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50693	157.20.182.233	443	TCP
2024-10-14T17:23:16.658633+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50694	157.20.182.233	443	TCP
2024-10-14T17:23:16.689912+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50695	157.20.182.233	443	TCP
2024-10-14T17:23:16.720870+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50696	157.20.182.233	443	TCP
2024-10-14T17:23:16.751759+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50697	157.20.182.233	443	TCP
2024-10-14T17:23:16.782963+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50698	157.20.182.233	443	TCP
2024-10-14T17:23:16.845634+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50700	157.20.182.233	443	TCP
2024-10-14T17:23:16.876688+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50701	157.20.182.233	443	TCP
2024-10-14T17:23:16.907897+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50702	157.20.182.233	443	TCP
2024-10-14T17:23:16.939389+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50703	157.20.182.233	443	TCP
2024-10-14T17:23:16.970910+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50704	157.20.182.233	443	TCP
2024-10-14T17:23:17.003292+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50705	157.20.182.233	443	TCP
2024-10-14T17:23:17.033443+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50706	157.20.182.233	443	TCP
2024-10-14T17:23:17.065383+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50707	157.20.182.233	443	TCP
2024-10-14T17:23:17.095920+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50708	157.20.182.233	443	TCP
2024-10-14T17:23:17.126926+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50709	157.20.182.233	443	TCP
2024-10-14T17:23:17.157956+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50710	157.20.182.233	443	TCP
2024-10-14T17:23:17.189305+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50711	157.20.182.233	443	TCP
2024-10-14T17:23:17.220525+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50712	157.20.182.233	443	TCP
2024-10-14T17:23:17.251678+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50713	157.20.182.233	443	TCP
2024-10-14T17:23:17.282984+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50714	157.20.182.233	443	TCP
2024-10-14T17:23:17.314415+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50715	157.20.182.233	443	TCP
2024-10-14T17:23:17.345490+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50716	157.20.182.233	443	TCP
2024-10-14T17:23:17.408230+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50718	157.20.182.233	443	TCP
2024-10-14T17:23:17.470392+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50720	157.20.182.233	443	TCP
2024-10-14T17:23:17.501670+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50721	157.20.182.233	443	TCP
2024-10-14T17:23:17.532861+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50722	157.20.182.233	443	TCP
2024-10-14T17:23:17.564233+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50723	157.20.182.233	443	TCP
2024-10-14T17:23:17.595890+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50724	157.20.182.233	443	TCP
2024-10-14T17:23:17.626849+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50725	157.20.182.233	443	TCP
2024-10-14T17:23:17.660479+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50726	157.20.182.233	443	TCP
2024-10-14T17:23:17.689510+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50727	157.20.182.233	443	TCP
2024-10-14T17:23:17.752183+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50729	157.20.182.233	443	TCP
2024-10-14T17:23:17.783298+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50730	157.20.182.233	443	TCP
2024-10-14T17:23:17.814318+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50731	157.20.182.233	443	TCP
2024-10-14T17:23:17.845733+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50732	157.20.182.233	443	TCP
2024-10-14T17:23:17.876968+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50733	157.20.182.233	443	TCP
2024-10-14T17:23:17.908119+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50734	157.20.182.233	443	TCP
2024-10-14T17:23:17.939631+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50735	157.20.182.233	443	TCP
2024-10-14T17:23:17.970554+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50736	157.20.182.233	443	TCP
2024-10-14T17:23:18.001724+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50737	157.20.182.233	443	TCP
2024-10-14T17:23:18.064810+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50739	157.20.182.233	443	TCP
2024-10-14T17:23:18.095699+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50740	157.20.182.233	443	TCP
2024-10-14T17:23:18.189310+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50743	157.20.182.233	443	TCP
2024-10-14T17:23:18.220606+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50744	157.20.182.233	443	TCP
2024-10-14T17:23:18.251801+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50745	157.20.182.233	443	TCP
2024-10-14T17:23:18.283416+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50746	157.20.182.233	443	TCP
2024-10-14T17:23:18.314378+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50747	157.20.182.233	443	TCP
2024-10-14T17:23:18.345651+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50748	157.20.182.233	443	TCP
2024-10-14T17:23:18.408761+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50750	157.20.182.233	443	TCP
2024-10-14T17:23:18.439717+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50751	157.20.182.233	443	TCP
2024-10-14T17:23:18.470671+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50752	157.20.182.233	443	TCP
2024-10-14T17:23:18.501888+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50753	157.20.182.233	443	TCP
2024-10-14T17:23:18.533035+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50754	157.20.182.233	443	TCP
2024-10-14T17:23:18.564318+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50755	157.20.182.233	443	TCP
2024-10-14T17:23:18.595874+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50756	157.20.182.233	443	TCP
2024-10-14T17:23:18.626913+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50757	157.20.182.233	443	TCP
2024-10-14T17:23:18.689473+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50759	157.20.182.233	443	TCP
2024-10-14T17:23:18.725903+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50760	157.20.182.233	443	TCP
2024-10-14T17:23:18.752226+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50761	157.20.182.233	443	TCP
2024-10-14T17:23:18.783617+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50762	157.20.182.233	443	TCP
2024-10-14T17:23:18.815352+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50763	157.20.182.233	443	TCP
2024-10-14T17:23:18.845998+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50764	157.20.182.233	443	TCP
2024-10-14T17:23:18.908503+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50766	157.20.182.233	443	TCP
2024-10-14T17:23:18.940218+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50767	157.20.182.233	443	TCP
2024-10-14T17:23:18.970739+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50768	157.20.182.233	443	TCP
2024-10-14T17:23:19.002249+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50769	157.20.182.233	443	TCP
2024-10-14T17:23:19.034909+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50770	157.20.182.233	443	TCP
2024-10-14T17:23:19.067132+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50771	157.20.182.233	443	TCP
2024-10-14T17:23:19.096146+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50772	157.20.182.233	443	TCP
2024-10-14T17:23:19.158399+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50774	157.20.182.233	443	TCP
2024-10-14T17:23:19.189513+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50775	157.20.182.233	443	TCP
2024-10-14T17:23:19.221089+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50776	157.20.182.233	443	TCP
2024-10-14T17:23:19.252461+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50777	157.20.182.233	443	TCP
2024-10-14T17:23:19.283379+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50778	157.20.182.233	443	TCP
2024-10-14T17:23:19.346055+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50780	157.20.182.233	443	TCP
2024-10-14T17:23:19.379470+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50781	157.20.182.233	443	TCP
2024-10-14T17:23:19.408754+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50782	157.20.182.233	443	TCP
2024-10-14T17:23:19.440188+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50783	157.20.182.233	443	TCP
2024-10-14T17:23:19.502389+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50785	157.20.182.233	443	TCP
2024-10-14T17:23:19.533538+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50786	157.20.182.233	443	TCP
2024-10-14T17:23:19.596071+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50788	157.20.182.233	443	TCP
2024-10-14T17:23:19.627093+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50789	157.20.182.233	443	TCP
2024-10-14T17:23:19.690179+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50791	157.20.182.233	443	TCP
2024-10-14T17:23:19.721171+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50792	157.20.182.233	443	TCP
2024-10-14T17:23:19.752376+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50793	157.20.182.233	443	TCP
2024-10-14T17:23:19.783708+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50794	157.20.182.233	443	TCP
2024-10-14T17:23:19.814440+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50795	157.20.182.233	443	TCP
2024-10-14T17:23:19.845609+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50796	157.20.182.233	443	TCP
2024-10-14T17:23:19.876945+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50797	157.20.182.233	443	TCP
2024-10-14T17:23:19.908544+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50798	157.20.182.233	443	TCP
2024-10-14T17:23:19.939320+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50799	157.20.182.233	443	TCP
2024-10-14T17:23:19.970883+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50800	157.20.182.233	443	TCP
2024-10-14T17:23:20.001807+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50801	157.20.182.233	443	TCP
2024-10-14T17:23:20.033441+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50802	157.20.182.233	443	TCP
2024-10-14T17:23:20.066524+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50803	157.20.182.233	443	TCP
2024-10-14T17:23:20.119127+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50804	157.20.182.233	443	TCP
2024-10-14T17:23:20.144517+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50805	157.20.182.233	443	TCP
2024-10-14T17:23:20.175262+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50806	157.20.182.233	443	TCP
2024-10-14T17:23:20.205814+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50807	157.20.182.233	443	TCP
2024-10-14T17:23:20.268850+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50809	157.20.182.233	443	TCP
2024-10-14T17:23:20.300115+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50810	157.20.182.233	443	TCP
2024-10-14T17:23:20.330538+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50811	157.20.182.233	443	TCP
2024-10-14T17:23:20.361970+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50812	157.20.182.233	443	TCP
2024-10-14T17:23:20.392620+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50813	157.20.182.233	443	TCP
2024-10-14T17:23:20.423722+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50814	157.20.182.233	443	TCP
2024-10-14T17:23:20.517613+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50817	157.20.182.233	443	TCP
2024-10-14T17:23:20.580292+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50818	157.20.182.233	443	TCP
2024-10-14T17:23:20.670955+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50820	157.20.182.233	443	TCP
2024-10-14T17:23:20.742157+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50822	157.20.182.233	443	TCP
2024-10-14T17:23:20.784835+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50823	157.20.182.233	443	TCP
2024-10-14T17:23:20.818680+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50824	157.20.182.233	443	TCP
2024-10-14T17:23:20.955120+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50826	157.20.182.233	443	TCP
2024-10-14T17:23:21.033606+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50828	157.20.182.233	443	TCP
2024-10-14T17:23:21.064696+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50829	157.20.182.233	443	TCP
2024-10-14T17:23:21.095584+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50830	157.20.182.233	443	TCP
2024-10-14T17:23:21.127605+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50831	157.20.182.233	443	TCP
2024-10-14T17:23:21.158876+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50832	157.20.182.233	443	TCP
2024-10-14T17:23:21.221083+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50834	157.20.182.233	443	TCP
2024-10-14T17:23:21.252349+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50835	157.20.182.233	443	TCP
2024-10-14T17:23:21.283041+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50836	157.20.182.233	443	TCP
2024-10-14T17:23:21.314748+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50837	157.20.182.233	443	TCP
2024-10-14T17:23:21.377113+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50839	157.20.182.233	443	TCP
2024-10-14T17:23:21.408357+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50840	157.20.182.233	443	TCP
2024-10-14T17:23:21.439381+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50841	157.20.182.233	443	TCP
2024-10-14T17:23:21.471364+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50842	157.20.182.233	443	TCP
2024-10-14T17:23:21.502559+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50843	157.20.182.233	443	TCP
2024-10-14T17:23:21.533721+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50844	157.20.182.233	443	TCP
2024-10-14T17:23:21.564917+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50845	157.20.182.233	443	TCP
2024-10-14T17:23:21.596077+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50846	157.20.182.233	443	TCP
2024-10-14T17:23:21.627292+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50847	157.20.182.233	443	TCP
2024-10-14T17:23:21.658568+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50848	157.20.182.233	443	TCP
2024-10-14T17:23:21.690209+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50849	157.20.182.233	443	TCP
2024-10-14T17:23:21.721155+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50850	157.20.182.233	443	TCP
2024-10-14T17:23:21.752703+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50851	157.20.182.233	443	TCP
2024-10-14T17:23:21.783734+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50852	157.20.182.233	443	TCP
2024-10-14T17:23:21.814959+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50853	157.20.182.233	443	TCP
2024-10-14T17:23:21.846475+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50854	157.20.182.233	443	TCP
2024-10-14T17:23:21.877246+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50855	157.20.182.233	443	TCP
2024-10-14T17:23:21.908924+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50856	157.20.182.233	443	TCP
2024-10-14T17:23:21.939682+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50857	157.20.182.233	443	TCP
2024-10-14T17:23:21.971129+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50858	157.20.182.233	443	TCP
2024-10-14T17:23:22.002329+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50859	157.20.182.233	443	TCP
2024-10-14T17:23:22.033597+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50860	157.20.182.233	443	TCP
2024-10-14T17:23:22.096448+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50862	157.20.182.233	443	TCP
2024-10-14T17:23:22.158599+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50864	157.20.182.233	443	TCP
2024-10-14T17:23:22.190113+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50865	157.20.182.233	443	TCP
2024-10-14T17:23:22.221648+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50866	157.20.182.233	443	TCP
2024-10-14T17:23:22.314794+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50869	157.20.182.233	443	TCP
2024-10-14T17:23:22.346157+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50870	157.20.182.233	443	TCP
2024-10-14T17:23:22.377065+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50871	157.20.182.233	443	TCP
2024-10-14T17:23:22.392589+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50872	157.20.182.233	443	TCP
2024-10-14T17:23:22.408257+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50873	157.20.182.233	443	TCP
2024-10-14T17:23:22.423932+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50874	157.20.182.233	443	TCP
2024-10-14T17:23:22.439613+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50875	157.20.182.233	443	TCP
2024-10-14T17:23:22.471199+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50876	157.20.182.233	443	TCP
2024-10-14T17:23:22.502539+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50877	157.20.182.233	443	TCP
2024-10-14T17:23:22.533853+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50878	157.20.182.233	443	TCP
2024-10-14T17:23:22.564926+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50879	157.20.182.233	443	TCP
2024-10-14T17:23:22.596298+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50880	157.20.182.233	443	TCP
2024-10-14T17:23:22.627679+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50881	157.20.182.233	443	TCP
2024-10-14T17:23:22.658739+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50882	157.20.182.233	443	TCP
2024-10-14T17:23:22.690024+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50883	157.20.182.233	443	TCP
2024-10-14T17:23:22.720990+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50884	157.20.182.233	443	TCP
2024-10-14T17:23:22.752520+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50885	157.20.182.233	443	TCP
2024-10-14T17:23:22.767669+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50886	157.20.182.233	443	TCP
2024-10-14T17:23:22.814555+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50889	157.20.182.233	443	TCP
2024-10-14T17:23:22.830010+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50890	157.20.182.233	443	TCP
2024-10-14T17:23:22.845616+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50891	157.20.182.233	443	TCP
2024-10-14T17:23:22.861509+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50892	157.20.182.233	443	TCP
2024-10-14T17:23:22.893109+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50894	157.20.182.233	443	TCP
2024-10-14T17:23:22.939712+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50896	157.20.182.233	443	TCP
2024-10-14T17:23:22.955012+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50897	157.20.182.233	443	TCP
2024-10-14T17:23:22.970453+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50898	157.20.182.233	443	TCP
2024-10-14T17:23:22.986287+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50899	157.20.182.233	443	TCP
2024-10-14T17:23:23.001807+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50900	157.20.182.233	443	TCP
2024-10-14T17:23:23.017569+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50901	157.20.182.233	443	TCP
2024-10-14T17:23:23.048681+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50903	157.20.182.233	443	TCP
2024-10-14T17:23:23.085478+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50904	157.20.182.233	443	TCP
2024-10-14T17:23:23.128373+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50905	157.20.182.233	443	TCP
2024-10-14T17:23:23.242947+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50907	157.20.182.233	443	TCP
2024-10-14T17:23:23.268847+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50908	157.20.182.233	443	TCP
2024-10-14T17:23:23.301760+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50910	157.20.182.233	443	TCP
2024-10-14T17:23:23.350019+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50911	157.20.182.233	443	TCP
2024-10-14T17:23:23.377118+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50912	157.20.182.233	443	TCP
2024-10-14T17:23:23.419136+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50913	157.20.182.233	443	TCP
2024-10-14T17:23:23.439735+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50914	157.20.182.233	443	TCP
2024-10-14T17:23:23.473167+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50915	157.20.182.233	443	TCP
2024-10-14T17:23:23.514187+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50916	157.20.182.233	443	TCP
2024-10-14T17:23:23.698165+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50918	157.20.182.233	443	TCP
2024-10-14T17:23:23.767586+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50920	157.20.182.233	443	TCP
2024-10-14T17:23:23.783021+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50921	157.20.182.233	443	TCP
2024-10-14T17:23:23.798723+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50922	157.20.182.233	443	TCP
2024-10-14T17:23:23.815130+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50923	157.20.182.233	443	TCP
2024-10-14T17:23:23.829786+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50924	157.20.182.233	443	TCP
2024-10-14T17:23:23.845966+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50925	157.20.182.233	443	TCP
2024-10-14T17:23:23.861147+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50926	157.20.182.233	443	TCP
2024-10-14T17:23:23.876864+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50927	157.20.182.233	443	TCP
2024-10-14T17:23:23.892941+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50928	157.20.182.233	443	TCP
2024-10-14T17:23:23.923766+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50930	157.20.182.233	443	TCP
2024-10-14T17:23:23.939343+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50931	157.20.182.233	443	TCP
2024-10-14T17:23:23.955318+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50932	157.20.182.233	443	TCP
2024-10-14T17:23:23.970528+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50933	157.20.182.233	443	TCP
2024-10-14T17:23:24.001874+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50935	157.20.182.233	443	TCP
2024-10-14T17:23:24.017564+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50936	157.20.182.233	443	TCP
2024-10-14T17:23:24.034666+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50937	157.20.182.233	443	TCP
2024-10-14T17:23:24.064719+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50939	157.20.182.233	443	TCP
2024-10-14T17:23:24.080302+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50940	157.20.182.233	443	TCP
2024-10-14T17:23:24.095921+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50941	157.20.182.233	443	TCP
2024-10-14T17:23:24.111674+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50942	157.20.182.233	443	TCP
2024-10-14T17:23:24.127215+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50943	157.20.182.233	443	TCP
2024-10-14T17:23:24.173835+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50946	157.20.182.233	443	TCP
2024-10-14T17:23:24.189506+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50947	157.20.182.233	443	TCP
2024-10-14T17:23:24.205016+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50948	157.20.182.233	443	TCP
2024-10-14T17:23:24.220935+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50949	157.20.182.233	443	TCP
2024-10-14T17:23:24.236979+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50950	157.20.182.233	443	TCP
2024-10-14T17:23:24.299040+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50954	157.20.182.233	443	TCP
2024-10-14T17:23:24.317414+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50955	157.20.182.233	443	TCP
2024-10-14T17:23:24.347912+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50957	157.20.182.233	443	TCP
2024-10-14T17:23:24.377117+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50960	157.20.182.233	443	TCP
2024-10-14T17:23:24.393157+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50961	157.20.182.233	443	TCP
2024-10-14T17:23:24.408828+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50962	157.20.182.233	443	TCP
2024-10-14T17:23:24.423931+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50963	157.20.182.233	443	TCP
2024-10-14T17:23:24.439546+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50964	157.20.182.233	443	TCP
2024-10-14T17:23:24.455092+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50965	157.20.182.233	443	TCP
2024-10-14T17:23:24.486545+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50967	157.20.182.233	443	TCP
2024-10-14T17:23:24.502140+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50968	157.20.182.233	443	TCP
2024-10-14T17:23:24.517788+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50969	157.20.182.233	443	TCP
2024-10-14T17:23:24.549354+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50971	157.20.182.233	443	TCP
2024-10-14T17:23:24.564758+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50972	157.20.182.233	443	TCP
2024-10-14T17:23:24.580704+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50973	157.20.182.233	443	TCP
2024-10-14T17:23:24.595993+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50974	157.20.182.233	443	TCP
2024-10-14T17:23:24.612067+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50975	157.20.182.233	443	TCP
2024-10-14T17:23:24.627161+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50976	157.20.182.233	443	TCP
2024-10-14T17:23:24.642898+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50977	157.20.182.233	443	TCP
2024-10-14T17:23:24.658628+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50978	157.20.182.233	443	TCP
2024-10-14T17:23:24.675370+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50979	157.20.182.233	443	TCP
2024-10-14T17:23:24.720949+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50982	157.20.182.233	443	TCP
2024-10-14T17:23:24.736565+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50983	157.20.182.233	443	TCP
2024-10-14T17:23:24.752017+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50984	157.20.182.233	443	TCP
2024-10-14T17:23:24.768011+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50985	157.20.182.233	443	TCP
2024-10-14T17:23:24.783616+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50986	157.20.182.233	443	TCP
2024-10-14T17:23:24.814659+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50988	157.20.182.233	443	TCP
2024-10-14T17:23:24.830478+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50989	157.20.182.233	443	TCP
2024-10-14T17:23:24.846044+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50990	157.20.182.233	443	TCP
2024-10-14T17:23:24.861795+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50991	157.20.182.233	443	TCP
2024-10-14T17:23:24.877270+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50992	157.20.182.233	443	TCP
2024-10-14T17:23:24.892792+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50993	157.20.182.233	443	TCP
2024-10-14T17:23:24.924942+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50995	157.20.182.233	443	TCP
2024-10-14T17:23:24.939936+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50996	157.20.182.233	443	TCP
2024-10-14T17:23:24.955423+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	50997	157.20.182.233	443	TCP
2024-10-14T17:23:25.002119+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	51000	157.20.182.233	443	TCP
2024-10-14T17:23:25.017743+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	51001	157.20.182.233	443	TCP
2024-10-14T17:23:25.033784+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	51002	157.20.182.233	443	TCP
2024-10-14T17:23:25.054055+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	51003	157.20.182.233	443	TCP
2024-10-14T17:23:25.080591+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	51004	157.20.182.233	443	TCP
2024-10-14T17:23:25.096182+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	51005	157.20.182.233	443	TCP
2024-10-14T17:23:25.111608+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	51006	157.20.182.233	443	TCP
2024-10-14T17:23:25.127280+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	51007	157.20.182.233	443	TCP
2024-10-14T17:23:25.189802+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	51011	157.20.182.233	443	TCP
2024-10-14T17:23:25.205468+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	51012	157.20.182.233	443	TCP
2024-10-14T17:23:25.221113+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	51013	157.20.182.233	443	TCP
2024-10-14T17:23:25.252558+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	51015	157.20.182.233	443	TCP
2024-10-14T17:23:25.268392+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	51016	157.20.182.233	443	TCP
2024-10-14T17:23:25.283833+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	51017	157.20.182.233	443	TCP
2024-10-14T17:23:25.314678+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	51019	157.20.182.233	443	TCP
2024-10-14T17:23:25.330459+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	51020	157.20.182.233	443	TCP
2024-10-14T17:23:25.346180+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	51021	157.20.182.233	443	TCP
2024-10-14T17:23:25.361650+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	51022	157.20.182.233	443	TCP
2024-10-14T17:23:25.393630+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	51024	157.20.182.233	443	TCP
2024-10-14T17:23:25.409410+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	51025	157.20.182.233	443	TCP
2024-10-14T17:23:25.455622+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	51028	157.20.182.233	443	TCP
2024-10-14T17:23:25.470962+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	51029	157.20.182.233	443	TCP
2024-10-14T17:23:25.487092+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	51030	157.20.182.233	443	TCP
2024-10-14T17:23:25.517870+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	51032	157.20.182.233	443	TCP
2024-10-14T17:23:25.533556+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	51033	157.20.182.233	443	TCP
2024-10-14T17:23:25.549002+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	51034	157.20.182.233	443	TCP
2024-10-14T17:23:25.564736+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	51035	157.20.182.233	443	TCP
2024-10-14T17:23:25.581190+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	51036	157.20.182.233	443	TCP
2024-10-14T17:23:25.596314+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	51037	157.20.182.233	443	TCP
2024-10-14T17:23:25.643917+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	51040	157.20.182.233	443	TCP
2024-10-14T17:23:25.674498+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	51042	157.20.182.233	443	TCP
2024-10-14T17:23:25.690151+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	51043	157.20.182.233	443	TCP
2024-10-14T17:23:25.705368+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	51044	157.20.182.233	443	TCP
2024-10-14T17:23:25.720723+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	51045	157.20.182.233	443	TCP
2024-10-14T17:23:25.736912+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	51046	157.20.182.233	443	TCP
2024-10-14T17:23:25.753166+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	51047	157.20.182.233	443	TCP
2024-10-14T17:23:25.767879+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	51048	157.20.182.233	443	TCP
2024-10-14T17:23:25.799755+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	51050	157.20.182.233	443	TCP
2024-10-14T17:23:25.846011+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	51052	157.20.182.233	443	TCP
2024-10-14T17:23:25.865909+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	51053	157.20.182.233	443	TCP
2024-10-14T17:23:25.876828+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	51054	157.20.182.233	443	TCP
2024-10-14T17:23:25.892562+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	51055	157.20.182.233	443	TCP
2024-10-14T17:23:25.939527+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	51058	157.20.182.233	443	TCP
2024-10-14T17:23:25.986979+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	51061	157.20.182.233	443	TCP
2024-10-14T17:23:26.019599+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	51063	157.20.182.233	443	TCP
2024-10-14T17:23:26.043485+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	51064	157.20.182.233	443	TCP
2024-10-14T17:23:26.066349+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	51065	157.20.182.233	443	TCP
2024-10-14T17:23:26.081770+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	51066	157.20.182.233	443	TCP
2024-10-14T17:23:26.148951+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	51069	157.20.182.233	443	TCP
2024-10-14T17:23:26.158877+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	51070	157.20.182.233	443	TCP
2024-10-14T17:23:26.174708+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	51071	157.20.182.233	443	TCP
2024-10-14T17:23:26.189742+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	51072	157.20.182.233	443	TCP
2024-10-14T17:23:26.220468+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	51074	157.20.182.233	443	TCP
2024-10-14T17:23:26.236763+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	51075	157.20.182.233	443	TCP
2024-10-14T17:23:26.252224+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	51076	157.20.182.233	443	TCP
2024-10-14T17:23:26.267747+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	51077	157.20.182.233	443	TCP
2024-10-14T17:23:26.315300+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	51080	157.20.182.233	443	TCP
2024-10-14T17:23:26.330395+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	51081	157.20.182.233	443	TCP
2024-10-14T17:23:26.392783+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	51085	157.20.182.233	443	TCP
2024-10-14T17:23:26.408231+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	51086	157.20.182.233	443	TCP
2024-10-14T17:23:26.442791+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	51088	157.20.182.233	443	TCP
2024-10-14T17:23:26.456518+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	51089	157.20.182.233	443	TCP
2024-10-14T17:23:26.470836+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	51090	157.20.182.233	443	TCP
2024-10-14T17:23:26.487194+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	51091	157.20.182.233	443	TCP
2024-10-14T17:23:26.502235+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	51092	157.20.182.233	443	TCP
2024-10-14T17:23:26.517476+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	51093	157.20.182.233	443	TCP
2024-10-14T17:23:26.533122+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	51094	157.20.182.233	443	TCP
2024-10-14T17:23:26.548932+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	51095	157.20.182.233	443	TCP
2024-10-14T17:23:26.564281+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	51096	157.20.182.233	443	TCP
2024-10-14T17:23:26.580135+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	51097	157.20.182.233	443	TCP
2024-10-14T17:23:26.611471+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	51099	157.20.182.233	443	TCP
2024-10-14T17:23:26.627243+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	51100	157.20.182.233	443	TCP
2024-10-14T17:23:26.658548+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	51102	157.20.182.233	443	TCP
2024-10-14T17:23:26.674172+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	51103	157.20.182.233	443	TCP
2024-10-14T17:23:26.689773+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	51104	157.20.182.233	443	TCP
2024-10-14T17:23:26.705262+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	51105	157.20.182.233	443	TCP
2024-10-14T17:23:26.736040+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	51107	157.20.182.233	443	TCP
2024-10-14T17:23:26.768341+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	51109	157.20.182.233	443	TCP
2024-10-14T17:23:26.798882+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	51111	157.20.182.233	443	TCP
2024-10-14T17:23:26.861391+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	51115	157.20.182.233	443	TCP
2024-10-14T17:23:26.955170+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	51121	157.20.182.233	443	TCP
2024-10-14T17:23:27.017888+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	51125	157.20.182.233	443	TCP
2024-10-14T17:23:27.033403+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	51126	157.20.182.233	443	TCP
2024-10-14T17:23:27.065949+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	51128	157.20.182.233	443	TCP
2024-10-14T17:23:27.128234+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	51132	157.20.182.233	443	TCP
2024-10-14T17:23:27.158497+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	51134	157.20.182.233	443	TCP
2024-10-14T17:23:27.189711+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	51136	157.20.182.233	443	TCP
2024-10-14T17:23:27.205240+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	51137	157.20.182.233	443	TCP
2024-10-14T17:23:27.251893+0200	2031599	1	Malware Command and Control Activity Detected	192.168.2.6	51140	157.20.182.233	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.6% probability

Source: antispam_connect_eu.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source:

Binary string: C:\BUILD\work\e0dd96435fde7cb0\BUILDS\Release\x86\RegSvr.pdb source: antispam_connect_eu.exe

Source: C:\Users\user\Desktop\antispam_connect_eu.exe

Code function: 1_2_0042DFF0 EnterCriticalSection,PathAppendW,FindFirstFileW,FindClose,LeaveCriticalSection,PathAppendW,GetSystemTimeAsFileTime,PathAppendW,SHCreateDirectory,CreateFileW,NtSystemDebugControl,CloseHandle,DeleteFileW,LeaveCriticalSection,GetLastError,

1_2_0042DFF0

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49725 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49720 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49724 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49727 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49719 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49723 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49737 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49741 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49738 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49731 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49740 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49742 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49782 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49774 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49764 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49752 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49779 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49757 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49781 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49810 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49857 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49836 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49787 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49870 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49840 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49819 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49881 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49743 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49808 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49804 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49730 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49893 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49863 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49899 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49726 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49783 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49756 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49799 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49869 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49729 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49817 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49844 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49851 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49797 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49820 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49832 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49824 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49906 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49904 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49831 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49922 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49822 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49861 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49745 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49932 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49753 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49777 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49807 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49850 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49791 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49882 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49854 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49749 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49758 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49805 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49897 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49868 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49830 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49915 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49722 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49848 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49786 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49933 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49766 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49744 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49858 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49890 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49876 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49815 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49909 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49967 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49880 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49953 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49755 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49769 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49806 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49969 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49818 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49885 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49767 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49829 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49728 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49843 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50015 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49856 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50007 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50022 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49754 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49721 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49739 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49792 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49771 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50037 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50044 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49983 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49768 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49837 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50045 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49977 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49867 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49780 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49995 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49888 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49842 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49826 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49866 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50047 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49936 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49887 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49879 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49940 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49765 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49903 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50065 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49924 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49943 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49872 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50016 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49795 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49911 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50032 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50034 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49917 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49982 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49845 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49994 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50053 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49930 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49985 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50056 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49931 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50057 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49812 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49944 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50055 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49833 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50003 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49892 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50043 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50059 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49993 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49978 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50041 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49980 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50058 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49875 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49894 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49996 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49794 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49800 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49855 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49942 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50030 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49793 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50077 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49919 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50067 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50142 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50049 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50106 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50093 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50069 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49991 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49901 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49945 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50083 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49920 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50090 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49950 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49959 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49997 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50145 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50148 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50085 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50160 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50060 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49965 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50084 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50028 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50144 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50119 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50132 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49907 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49926 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49981 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50092 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50184 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50095 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50185 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50096 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50187 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50105 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50080 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50129 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50141 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50071 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50167 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50082 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50109 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50081 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50156 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50124 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50097 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50196 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50180 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50182 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50199 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50179 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49955 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49958 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50102 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50169 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50121 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50143 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50201 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50202 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49968 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50009 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50107 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50198 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50197 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50127 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50218 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50131 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50214 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50229 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50171 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50021 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50194 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50226 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50195 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50133 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50159 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50168 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50224 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49928 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50203 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50200 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50130 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50215 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49970 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50236 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50243 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50233 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49956 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50249 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50181 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50248 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49957 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49962 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49974 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50008 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50262 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50031 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50079 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50253 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50225 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50261 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50275 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50025 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50250 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50265 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50046 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50147 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50227 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50211 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50237 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50277 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50268 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50259 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49913 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50068 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50116 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50120 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49946 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50287 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49988 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50304 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50288 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50295 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50094 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50278 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50298 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50114 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50118 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50274 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50239 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50289 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50303 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50117 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:49948 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50315 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50157 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50321 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50263 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50305 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50290 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50006 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50293 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50246 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50266 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50284 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50330 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50336 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50316 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50331 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50343 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50318 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50319 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50346 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50340 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50162 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50350 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50352 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50158 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50348 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50333 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50019 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50358 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50213 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50362 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50364 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50307 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50344 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50361 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50302 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50372 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50170 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50332 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50301 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50356 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50347 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50384 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50329 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50388 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50373 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50070 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50385 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50328 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50378 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50391 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50392 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50379 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50359 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50376 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50395 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50292 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50380 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50357 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50397 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50334 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50408 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50365 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50342 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50407 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50404 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50363 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50276 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50403 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50409 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50320 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50420 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50210 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50345 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50434 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50436 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50429 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50417 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50437 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50433 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50438 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50377 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50423 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50441 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50450 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50413 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50405 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50449 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50444 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50435 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50447 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50430 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50426 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50427 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50415 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50410 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50446 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50421 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50451 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50207 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50452 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50222 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50455 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50235 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50459 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50462 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50324 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50464 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50471 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50472 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50461 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50466 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50456 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50442 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50453 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50468 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50465 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50458 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50457 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50146 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50480 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50476 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50483 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50154 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50490 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50460 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50479 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50155 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50492 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50477 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50489 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50500 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50504 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50507 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50511 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50518 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50522 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50523 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50475 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50519 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50394 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50493 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50240 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50499 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50538 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50542 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50508 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50494 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50531 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50406 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50513 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50532 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50412 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50533 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50411 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50454 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50510 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50463 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50486 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50534 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50173 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50549 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50553 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50529 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50524 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50515 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50551 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50536 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50526 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50258 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50577 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50539 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50561 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50550 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50578 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50559 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50581 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50569 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50541 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50568 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50587 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50558 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50582 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50445 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50279 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50589 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50570 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50564 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50448 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50596 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50574 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50416 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50554 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50501 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50592 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50593 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50547 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50560 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50502 -> 157.20.182.233:443
Source: Network traffic	Suricata IDS: 2031599 - Severity 1 - ET MALWARE Win32/SystemBC CnC Checkin : 192.168.2.6:50598 -> 157.20.182.233:443

Source: Joe Sandbox View

ASN Name: FCNUniversityPublicCorporationOsakaJP FCNUniversityPublicCorporationOsakaJP

Source: unknown	TCP traffic detected without corresponding DNS query: 157.20.182.233
Source: unknown	TCP traffic detected without corresponding DNS query: 157.20.182.233
Source: unknown	TCP traffic detected without corresponding DNS query: 157.20.182.233
Source: unknown	TCP traffic detected without corresponding DNS query: 157.20.182.233
Source: unknown	TCP traffic detected without corresponding DNS query: 157.20.182.233
Source: unknown	TCP traffic detected without corresponding DNS query: 157.20.182.233
Source: unknown	TCP traffic detected without corresponding DNS query: 157.20.182.233
Source: unknown	TCP traffic detected without corresponding DNS query: 157.20.182.233
Source: unknown	TCP traffic detected without corresponding DNS query: 157.20.182.233
Source: unknown	TCP traffic detected without corresponding DNS query: 157.20.182.233
Source: unknown	TCP traffic detected without corresponding DNS query: 157.20.182.233
Source: unknown	TCP traffic detected without corresponding DNS query: 157.20.182.233
Source: unknown	TCP traffic detected without corresponding DNS query: 157.20.182.233
Source: unknown	TCP traffic detected without corresponding DNS query: 157.20.182.233
Source: unknown	TCP traffic detected without corresponding DNS query: 157.20.182.233
Source: unknown	TCP traffic detected without corresponding DNS query: 157.20.182.233
Source: unknown	TCP traffic detected without corresponding DNS query: 157.20.182.233
Source: unknown	TCP traffic detected without corresponding DNS query: 157.20.182.233
Source: unknown	TCP traffic detected without corresponding DNS query: 157.20.182.233
Source: unknown	TCP traffic detected without corresponding DNS query: 157.20.182.233
Source: unknown	TCP traffic detected without corresponding DNS query: 157.20.182.233
Source: unknown	TCP traffic detected without corresponding DNS query: 157.20.182.233
Source: unknown	TCP traffic detected without corresponding DNS query: 157.20.182.233
Source: unknown	TCP traffic detected without corresponding DNS query: 157.20.182.233
Source: unknown	TCP traffic detected without corresponding DNS query: 157.20.182.233
Source: unknown	TCP traffic detected without corresponding DNS query: 157.20.182.233
Source: unknown	TCP traffic detected without corresponding DNS query: 157.20.182.233
Source: unknown	TCP traffic detected without corresponding DNS query: 157.20.182.233
Source: unknown	TCP traffic detected without corresponding DNS query: 157.20.182.233
Source: unknown	TCP traffic detected without corresponding DNS query: 157.20.182.233
Source: unknown	TCP traffic detected without corresponding DNS query: 157.20.182.233
Source: unknown	TCP traffic detected without corresponding DNS query: 157.20.182.233
Source: unknown	TCP traffic detected without corresponding DNS query: 157.20.182.233
Source: unknown	TCP traffic detected without corresponding DNS query: 157.20.182.233
Source: unknown	TCP traffic detected without corresponding DNS query: 157.20.182.233
Source: unknown	TCP traffic detected without corresponding DNS query: 157.20.182.233
Source: unknown	TCP traffic detected without corresponding DNS query: 157.20.182.233
Source: unknown	TCP traffic detected without corresponding DNS query: 157.20.182.233
Source: unknown	TCP traffic detected without corresponding DNS query: 157.20.182.233
Source: unknown	TCP traffic detected without corresponding DNS query: 157.20.182.233
Source: unknown	TCP traffic detected without corresponding DNS query: 157.20.182.233
Source: unknown	TCP traffic detected without corresponding DNS query: 157.20.182.233
Source: unknown	TCP traffic detected without corresponding DNS query: 157.20.182.233
Source: unknown	TCP traffic detected without corresponding DNS query: 157.20.182.233
Source: unknown	TCP traffic detected without corresponding DNS query: 157.20.182.233
Source: unknown	TCP traffic detected without corresponding DNS query: 157.20.182.233
Source: unknown	TCP traffic detected without corresponding DNS query: 157.20.182.233
Source: unknown	TCP traffic detected without corresponding DNS query: 157.20.182.233
Source: unknown	TCP traffic detected without corresponding DNS query: 157.20.182.233
Source: unknown	TCP traffic detected without corresponding DNS query: 157.20.182.233

Source: unknown	Network traffic detected: HTTP traffic on port 57084 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50693 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52633 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50211 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50452 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51548 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50440 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58168 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58181 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51524 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52645 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50464 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57096 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52404 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51319 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50439 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52608 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51320 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50235 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58144 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52416 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51512 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50656 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51561 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54609 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57047 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51103 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58156 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50259 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51307 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51500 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51573 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52621 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56180 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52428 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50644 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52516
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52517
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53847
Source: unknown	Network traffic detected: HTTP traffic on port 51115 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52514
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52515
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53845
Source: unknown	Network traffic detected: HTTP traffic on port 56803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52518
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52519
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53840
Source: unknown	Network traffic detected: HTTP traffic on port 50632 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52512
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53844
Source: unknown	Network traffic detected: HTTP traffic on port 50873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52513
Source: unknown	Network traffic detected: HTTP traffic on port 53537 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53842
Source: unknown	Network traffic detected: HTTP traffic on port 53778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52510
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52511
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53841
Source: unknown	Network traffic detected: HTTP traffic on port 57023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57264 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52527
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52528
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52525
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52526
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53856
Source: unknown	Network traffic detected: HTTP traffic on port 57276 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52529
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52520
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53850
Source: unknown	Network traffic detected: HTTP traffic on port 52453 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52523
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52524
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52521
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52522
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53852
Source: unknown	Network traffic detected: HTTP traffic on port 58590 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52200 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51207
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52538
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51208
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52539
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51205
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52536
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53868
Source: unknown	Network traffic detected: HTTP traffic on port 57011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51206
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52537
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51209
Source: unknown	Network traffic detected: HTTP traffic on port 58348 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52530
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51200
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52531
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51203
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52534
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51204
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52535
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53865
Source: unknown	Network traffic detected: HTTP traffic on port 54851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56192 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51201
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52532
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51202
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52533
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53863
Source: unknown	Network traffic detected: HTTP traffic on port 57252 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50620 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53525 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51218
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52549
Source: unknown	Network traffic detected: HTTP traffic on port 53922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51219
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52547
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51216
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51217
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52548
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51210
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52541
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53873
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51211
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52542
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53871
Source: unknown	Network traffic detected: HTTP traffic on port 58336 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52540
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52545
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51214
Source: unknown	Network traffic detected: HTTP traffic on port 50897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51215
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52546
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52543
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51212
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51213
Source: unknown	Network traffic detected: HTTP traffic on port 52212 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52544
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53874
Source: unknown	Network traffic detected: HTTP traffic on port 56827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53880
Source: unknown	Network traffic detected: HTTP traffic on port 57288 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52441 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51127 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53804
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53803
Source: unknown	Network traffic detected: HTTP traffic on port 51140 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53801
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53805
Source: unknown	Network traffic detected: HTTP traffic on port 55502 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53800
Source: unknown	Network traffic detected: HTTP traffic on port 52477 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55299 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58324 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53809
Source: unknown	Network traffic detected: HTTP traffic on port 50607 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53813
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53818
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53810
Source: unknown	Network traffic detected: HTTP traffic on port 58577 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51139 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53501 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50476 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53823
Source: unknown	Network traffic detected: HTTP traffic on port 51790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53827
Source: unknown	Network traffic detected: HTTP traffic on port 55287 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53822
Source: unknown	Network traffic detected: HTTP traffic on port 50619 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53821
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53820
Source: unknown	Network traffic detected: HTTP traffic on port 58312 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50223 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52465 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52505
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52506
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53836
Source: unknown	Network traffic detected: HTTP traffic on port 54430 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52503
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52504
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52509
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52507
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52508
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52501
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53833
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52502
Source: unknown	Network traffic detected: HTTP traffic on port 53513 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53832
Source: unknown	Network traffic detected: HTTP traffic on port 50488 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52500
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53830
Source: unknown	Network traffic detected: HTTP traffic on port 53909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58193 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58589 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51536 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51144
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52475
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51145
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52476
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51142
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52473
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51143
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52474
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51148
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52479
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51149
Source: unknown	Network traffic detected: HTTP traffic on port 57215 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52477
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51146
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51147
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52478
Source: unknown	Network traffic detected: HTTP traffic on port 54201 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56623 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51176 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51151
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52482
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51152
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52483
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52480
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51150
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52481
Source: unknown	Network traffic detected: HTTP traffic on port 53598 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53357 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51164 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53116 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54178 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57203 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53345 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51155
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52486
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51156
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52487
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51153
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52484
Source: unknown	Network traffic detected: HTTP traffic on port 57685 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51154
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52485
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51159
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51157
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52488
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51158
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52489
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52490
Source: unknown	Network traffic detected: HTTP traffic on port 54442 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52493
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51162
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51163
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52494
Source: unknown	Network traffic detected: HTTP traffic on port 57456 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51160
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52491
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52492
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51161
Source: unknown	Network traffic detected: HTTP traffic on port 50812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50080 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57227 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56635 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51166
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52497
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51167
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52498
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51164
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52495
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52496
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51165
Source: unknown	Network traffic detected: HTTP traffic on port 53369 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51152 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51168
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52499
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51169
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51170
Source: unknown	Network traffic detected: HTTP traffic on port 54191 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51173
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51174
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51171
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51172
Source: unknown	Network traffic detected: HTTP traffic on port 57673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57444 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51177
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51178
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51175
Source: unknown	Network traffic detected: HTTP traffic on port 53104 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51176
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51179
Source: unknown	Network traffic detected: HTTP traffic on port 50079 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51180
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51181
Source: unknown	Network traffic detected: HTTP traffic on port 54225 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51184
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51185
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51182
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51183
Source: unknown	Network traffic detected: HTTP traffic on port 53333 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53562 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54454 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51108
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52439
Source: unknown	Network traffic detected: HTTP traffic on port 56576 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51109
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51106
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52437
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51107
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52438
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53768
Source: unknown	Network traffic detected: HTTP traffic on port 55984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54395 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51100
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52431
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51101
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52432
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52430
Source: unknown	Network traffic detected: HTTP traffic on port 50055 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53760
Source: unknown	Network traffic detected: HTTP traffic on port 57420 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51104
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52435
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52436
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51105
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51102
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52433
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51103
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52434
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53764
Source: unknown	Network traffic detected: HTTP traffic on port 56839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53770
Source: unknown	Network traffic detected: HTTP traffic on port 55058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57503 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51119
Source: unknown	Network traffic detected: HTTP traffic on port 56659 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51117
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52448
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52449
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51118
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51111
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52442
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51112
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52440
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51110
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52441
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51115
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52446
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51116
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52447
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51113
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52444
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53776
Source: unknown	Network traffic detected: HTTP traffic on port 54466 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51114
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52445
Source: unknown	Network traffic detected: HTTP traffic on port 53550 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53775
Source: unknown	Network traffic detected: HTTP traffic on port 56564 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56588 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53781
Source: unknown	Network traffic detected: HTTP traffic on port 55996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53780
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52450
Source: unknown	Network traffic detected: HTTP traffic on port 54142 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50067 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57240 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54213 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51188 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51128
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52459
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51129
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51122
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52453
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51123
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52454
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51120
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52451
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51121
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52452
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53782
Source: unknown	Network traffic detected: HTTP traffic on port 57493 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53789
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52457
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51126
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51127
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52458
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51124
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52455
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51125
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52456
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53786
Source: unknown	Network traffic detected: HTTP traffic on port 56840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54008 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52460

Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Code function: 1_2_00422120 NtAllocateVirtualMemory,NtProtectVirtualMemory,	1_2_00422120
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Code function: 1_2_0054E210 GetModuleHandleW,GetProcAddress,NtQueryInformationProcess,GetCurrentProcess,NtQueryInformationProcess,	1_2_0054E210
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Code function: 1_2_00443500 GetCurrentProcess,WaitForSingleObject,NtClose,GetCurrentProcessId,CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,	1_2_00443500
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Code function: 1_2_00443950 CreateIoCompletionPort,CloseHandle,GetCurrentProcess,NtCreateWorkerFactory,CloseHandle,NtQueryInformationProcess,NtQuerySystemInformation,CloseHandle,GetCurrentProcessId,CloseHandle,CloseHandle,NtQueryInformationWorkerFactory,CloseHandle,CloseHandle,	1_2_00443950
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Code function: 1_2_0042DFF0 EnterCriticalSection,PathAppendW,FindFirstFileW,FindClose,LeaveCriticalSection,PathAppendW,GetSystemTimeAsFileTime,PathAppendW,SHCreateDirectory,CreateFileW,NtSystemDebugControl,CloseHandle,DeleteFileW,LeaveCriticalSection,GetLastError,	1_2_0042DFF0

Source: C:\Users\user\Desktop\antispam_connect_eu.exe

Code function: 1_2_00447250: GetTickCount,DeviceIoControl,

1_2_00447250

Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Code function: 1_2_00429000	1_2_00429000
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Code function: 1_2_00409150	1_2_00409150
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Code function: 1_2_00426140	1_2_00426140
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Code function: 1_2_0040B3A0	1_2_0040B3A0
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Code function: 1_2_0055E3A0	1_2_0055E3A0
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Code function: 1_2_00426420	1_2_00426420
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Code function: 1_2_005464C0	1_2_005464C0
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Code function: 1_2_004254E0	1_2_004254E0
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Code function: 1_2_005C3510	1_2_005C3510
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Code function: 1_2_004426F0	1_2_004426F0
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Code function: 1_2_0055D690	1_2_0055D690
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Code function: 1_2_0042A800	1_2_0042A800
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Code function: 1_2_0047F960	1_2_0047F960
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Code function: 1_2_00469900	1_2_00469900
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Code function: 1_2_0046C9D0	1_2_0046C9D0
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Code function: 1_2_0043EA40	1_2_0043EA40
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Code function: 1_2_00422AC0	1_2_00422AC0
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Code function: 1_2_00467BD0	1_2_00467BD0
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Code function: 1_2_00426C20	1_2_00426C20
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Code function: 1_2_00570C30	1_2_00570C30
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Code function: 1_2_00548D50	1_2_00548D50
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Code function: 1_2_005E3D24	1_2_005E3D24
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Code function: 1_2_00425DB0	1_2_00425DB0
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Code function: 1_2_00438E40	1_2_00438E40
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Code function: 1_2_00577E70	1_2_00577E70
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Code function: 1_2_00494E20	1_2_00494E20
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Code function: 1_2_0042BE30	1_2_0042BE30
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Code function: 1_2_00574ED0	1_2_00574ED0
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Code function: 1_2_00422EF0	1_2_00422EF0
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Code function: 1_2_005D6EAE	1_2_005D6EAE

Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Code function: String function: 0048D830 appears 197 times
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Code function: String function: 00428320 appears 74 times
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Code function: String function: 004286E0 appears 73 times
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Code function: String function: 00428230 appears 85 times

Source: antispam_connect_eu.exe, 00000001.00000000.2185103460.000000000075A000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameRegSvr.exeH vs antispam_connect_eu.exe
Source: antispam_connect_eu.exe	Binary or memory string: OriginalFilenameRegSvr.exeH vs antispam_connect_eu.exe

Source: antispam_connect_eu.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: antispam_connect_eu.exe	Binary string: BU`BU Unable to retrieve the path of the module!Unable to get the path of the module!SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell FoldersUnable to retrieve a path of the known folder ({})!Unable to store the path of the module!%LOCALAPPDATA%ProgramFilesCommon AppData%APPDATA%ProgramFiles(Arm)ProgramFilesDirProgramW6432ProgramFiles(x86)ProgramFilesDir (arm)CommonProgramFilesSOFTWARE\Microsoft\Windows\CurrentVersionProgramFilesDir (x86)CommonProgramFiles(Arm)CommonFilesDirCommonProgramW6432CommonProgramFiles(x86)\\?\CommonFilesDir (x86)CommonFilesDir (Arm)Unable to retrieve volume paths for volume '{}'!\Device\LanmanRedirector\Unable to enumerate volumes!Unable to convert NT path '{}' to a volume GUID path!\\.\GLOBALROOT\Device\Mup\\SystemRoot\Microsoft Base Cryptographic Provider v1.0
Source: antispam_connect_eu.exe	Binary string: DiskSN1DiskSN2BoardInformationTAGEnclosureInformatonSNEnclosureInformatonTAGProcessorSNDiskSN3DiskSN4SystemInformationSNBoardInformationSNBatterySNPowerSupplyPNPowerSupplySNPowerSupplyTAGProcessorTAGMemoryPNMemorySNMemoryTAG\\.\Scsi%u:SCSIDISKGetSystemFirmwareTableSystemUUIDProcessorIDDiskMajoritySN\Device\PhysicalMemoryNtOpenSection%d/%d/%d

Source: classification engine

Classification label: mal68.troj.evad.winEXE@1/0@0/1

Source: C:\Users\user\Desktop\antispam_connect_eu.exe

Code function: 1_2_00443500 GetCurrentProcess,WaitForSingleObject,NtClose,GetCurrentProcessId,CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

1_2_00443500

Source: C:\Users\user\Desktop\antispam_connect_eu.exe

Command line argument: ^L`

1_2_00604BB0

Source: antispam_connect_eu.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\antispam_connect_eu.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: antispam_connect_eu.exe	String found in binary or memory: company-install-path
Source: antispam_connect_eu.exe	String found in binary or memory: TSYSTEM\Software\Software\\IcarusLogsOverrideProgramFolderPersistentStorageOverrideDataFolderEmpty product id for get_product_icarus_common_files_dir.reg-keyproduct-reg-keyprogram-data-diricarus.iniproduct-dirdata-dircompany-install-path]

Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Section loaded: dbgcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Section loaded: mswsock.dll	Jump to behavior

Source: antispam_connect_eu.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: antispam_connect_eu.exe

Static file information: File size 3621376 > 1048576

Source: antispam_connect_eu.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x231400

Source: antispam_connect_eu.exe

Static PE information: More than 200 imports for KERNEL32.dll

Source: antispam_connect_eu.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: antispam_connect_eu.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: antispam_connect_eu.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: antispam_connect_eu.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: antispam_connect_eu.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: antispam_connect_eu.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: antispam_connect_eu.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:

Binary string: C:\BUILD\work\e0dd96435fde7cb0\BUILDS\Release\x86\RegSvr.pdb source: antispam_connect_eu.exe

Source: antispam_connect_eu.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: antispam_connect_eu.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: antispam_connect_eu.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: antispam_connect_eu.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: antispam_connect_eu.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\antispam_connect_eu.exe

Code function: 1_2_0042B9A0 InitializeCriticalSection,UuidCreate,GetSystemDirectoryW,LoadLibraryW,GetProcAddress,GetLastError,GetLastError,

1_2_0042B9A0

Source: antispam_connect_eu.exe

Static PE information: real checksum: 0x382ed4 should be: 0x379216

Source: C:\Users\user\Desktop\antispam_connect_eu.exe

Code function: 1_2_005C7DF3 push ecx; ret

1_2_005C7E06

Source: C:\Users\user\Desktop\antispam_connect_eu.exe

Code function: 1_2_0056EB60 EnterCriticalSection,GetModuleHandleW,GetCurrentProcess,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetLastError,SetLastError,GetProcAddress,GetProcAddress,GetLastError,SetLastError,GetProcAddress,GetLastError,SetLastError,GetProcAddress,GetLastError,SetLastError,GetProcAddress,GetLastError,SetLastError,GetProcAddress,GetLastError,SetLastError,GetProcAddress,GetLastError,SetLastError,GetProcAddress,GetLastError,SetLastError,GetProcAddress,GetLastError,SetLastError,GetProcAddress,GetLastError,RegQueryValueExW,RegCloseKey,GlobalMemoryStatusEx,GetLastError,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,GetLastError,InitializeSecurityDescriptor,AllocateAndInitializeSid,GetLengthSid,InitializeAcl,AddAce,AddAce,FreeSid,SetSecurityDescriptorDacl,GetLastError,GetProcessHeap,HeapAlloc,InitializeCriticalSectionEx,LeaveCriticalSection,

1_2_0056EB60

Malware Analysis System Evasion

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Source: C:\Users\user\Desktop\antispam_connect_eu.exe

Evasive API call chain: GetPEB, DecisionNodes, Sleep

graph_1-58278

Source: C:\Users\user\Desktop\antispam_connect_eu.exe

Code function: 1_2_00443500 GetCurrentProcess,WaitForSingleObject,NtClose,GetCurrentProcessId,CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

1_2_00443500

Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Thread delayed: delay time: 180000			Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Thread delayed: delay time: 180000			Jump to behavior

Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Window / User API: threadDelayed 4509			Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Window / User API: threadDelayed 4283			Jump to behavior

Source: C:\Users\user\Desktop\antispam_connect_eu.exe

API coverage: 4.8 %

Source: C:\Users\user\Desktop\antispam_connect_eu.exe TID: 2912	Thread sleep count: 4509 > 30	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe TID: 2912	Thread sleep time: -811620000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe TID: 2912	Thread sleep count: 4283 > 30	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe TID: 2912	Thread sleep time: -770940000s >= -30000s	Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\antispam_connect_eu.exe

1_2_0042DFF0

Source: C:\Users\user\Desktop\antispam_connect_eu.exe

Code function: 1_2_0056F720 GetSystemInfo,GetVersionExW,GetVersionExW,GetModuleHandleW,GetProcAddress,

1_2_0056F720

Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Thread delayed: delay time: 180000			Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Thread delayed: delay time: 180000			Jump to behavior

Source: antispam_connect_eu.exe, 00000001.00000002.3439462873.0000000004938000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllh

Anti Debugging

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Source: C:\Users\user\Desktop\antispam_connect_eu.exe

Code function: 1_2_0043F020 GetCurrentProcess,CheckRemoteDebuggerPresent,RaiseException,

1_2_0043F020

Source: C:\Users\user\Desktop\antispam_connect_eu.exe

Code function: 1_2_0054D670 LdrUnlockLoaderLock,LdrUnlockLoaderLock,Concurrency::scheduler_worker_creation_error::scheduler_worker_creation_error,

1_2_0054D670

Source: C:\Users\user\Desktop\antispam_connect_eu.exe

Code function: 1_2_005D3073 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

1_2_005D3073

Source: C:\Users\user\Desktop\antispam_connect_eu.exe

Code function: 1_2_00443500 GetCurrentProcess,WaitForSingleObject,NtClose,GetCurrentProcessId,CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

1_2_00443500

Source: C:\Users\user\Desktop\antispam_connect_eu.exe

Code function: 1_2_0042B9A0 InitializeCriticalSection,UuidCreate,GetSystemDirectoryW,LoadLibraryW,GetProcAddress,GetLastError,GetLastError,

1_2_0042B9A0

Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Code function: 1_2_004225E0 mov eax, dword ptr fs:[00000030h]	1_2_004225E0
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Code function: 1_2_005E1602 mov ecx, dword ptr fs:[00000030h]	1_2_005E1602
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Code function: 1_2_005E6D05 mov eax, dword ptr fs:[00000030h]	1_2_005E6D05
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Code function: 1_2_063C12EA mov eax, dword ptr fs:[00000030h]	1_2_063C12EA
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Code function: 1_2_063C133B mov eax, dword ptr fs:[00000030h]	1_2_063C133B
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Code function: 1_2_063C131E mov eax, dword ptr fs:[00000030h]	1_2_063C131E
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Code function: 1_2_063C1374 mov eax, dword ptr fs:[00000030h]	1_2_063C1374
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Code function: 1_2_063C1357 mov eax, dword ptr fs:[00000030h]	1_2_063C1357

Source: C:\Users\user\Desktop\antispam_connect_eu.exe

Code function: 1_2_00568410 GetModuleHandleW,GetClassInfoExW,GetLastError,Sleep,GetProcessHeap,asw_process_storage_allocate_connector,HeapAlloc,asw_process_storage_allocate_connector,InitializeCriticalSection,GetProcessHeap,GetProcessHeap,RegisterClassExW,asw_process_storage_deallocate_connector,HeapFree,asw_process_storage_deallocate_connector,DeleteCriticalSection,GetProcessHeap,asw_process_storage_deallocate_connector,HeapFree,asw_process_storage_deallocate_connector,GetLastError,Concurrency::scheduler_worker_creation_error::scheduler_worker_creation_error,GetLastError,Concurrency::scheduler_worker_creation_error::scheduler_worker_creation_error,

1_2_00568410

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Code function: 1_2_005D3073 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_005D3073
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Code function: 1_2_005C72DB SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_005C72DB
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Code function: 1_2_0043E570 GetModuleHandleW,GetProcAddress,VirtualProtect,VirtualProtect,SetUnhandledExceptionFilter,	1_2_0043E570
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Code function: 1_2_0043DF80 GetModuleHandleW,GetProcAddress,GetCurrentThreadId,EnterCriticalSection,asw_process_storage_deallocate_connector,HeapFree,asw_process_storage_deallocate_connector,LeaveCriticalSection,SetUnhandledExceptionFilter,GetModuleHandleW,GetProcAddress,VirtualProtect,VirtualProtect,AddVectoredExceptionHandler,SetErrorMode,	1_2_0043DF80

Source: C:\Users\user\Desktop\antispam_connect_eu.exe

1_2_0056EB60

Source: C:\Users\user\Desktop\antispam_connect_eu.exe

Code function: 1_2_0054E9D0 FreeSid,AllocateAndInitializeSid,GetLastError,Concurrency::scheduler_worker_creation_error::scheduler_worker_creation_error,

1_2_0054E9D0

Source: C:\Users\user\Desktop\antispam_connect_eu.exe

Code function: 1_2_005709C0 cpuid

1_2_005709C0

Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Code function: GetLocaleInfoW,	1_2_005E5333
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	1_2_005EB3BF
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Code function: GetLocaleInfoW,	1_2_005EB5C0
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Code function: EnumSystemLocalesW,	1_2_005EB667
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Code function: EnumSystemLocalesW,	1_2_005EB6B2
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Code function: EnumSystemLocalesW,	1_2_005EB74D
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	1_2_005EB7E0
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Code function: GetLocaleInfoW,	1_2_005EBA40
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	1_2_005EBB69
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Code function: GetLocaleInfoW,	1_2_005EBC6F
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	1_2_005EBD3E
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Code function: EnumSystemLocalesW,	1_2_005E4DCD

Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\antispam_connect_eu.exe

Code function: 1_2_005ADF30 QueryUnbiasedInterruptTime,GetSystemTimes,

1_2_005ADF30

Source: C:\Users\user\Desktop\antispam_connect_eu.exe

Code function: 1_2_0056F720 GetSystemInfo,GetVersionExW,GetVersionExW,GetModuleHandleW,GetProcAddress,

1_2_0056F720

Stealing of Sensitive Information

Yara detected SystemBC

Source: Yara match

File source: 00000001.00000002.3439574414.00000000063C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Remote Access Functionality

Yara detected SystemBC

Source: Yara match

File source: 00000001.00000002.3439574414.00000000063C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Code function: 1_2_0042D190 RemoveVectoredExceptionHandler,RpcBindingFree,		1_2_0042D190
Source: C:\Users\user\Desktop\antispam_connect_eu.exe	Code function: 1_2_0042BE30 GetFileAttributesW,GetModuleHandleW,GetModuleFileNameW,GetLastError,PathFindFileNameW,PathRemoveFileSpecW,___std_exception_destroy,RpcStringBindingComposeW,RpcBindingFromStringBindingW,RpcStringFreeW,GetFileAttributesW,Concurrency::cancel_current_task,		1_2_0042BE30

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	3 Command and Scripting Interpreter	1 DLL Side-Loading	1 DLL Side-Loading	21 Virtualization/Sandbox Evasion	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	12 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	11 Native API	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Deobfuscate/Decode Files or Information	LSASS Memory	131 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	2 Obfuscated Files or Information	Security Account Manager	21 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	1 Process Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	34 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
157.20.182.233	unknown	unknown		24297	FCNUniversityPublicCorporationOsakaJP	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1533404
Start date and time:	2024-10-14 17:21:13 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 48s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	4
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	antispam_connect_eu.exe
Detection:	MAL
Classification:	mal68.troj.evad.winEXE@1/0@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 78% Number of executed functions: 25 Number of non-executed functions: 275
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Reached maximum number of 1000 Suricata alerts, please consult the 'Suricata Logs'
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtDeviceIoControlFile calls found.
VT rate limit hit for: antispam_connect_eu.exe

Simulations

Behavior and APIs

Time	Type	Description
11:22:15	API Interceptor	8793x Sleep call for process: antispam_connect_eu.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
FCNUniversityPublicCorporationOsakaJP	nJohIBtNm5.exe	Get hash	malicious	LummaC, Amadey, Clipboard Hijacker, CryptOne, Cryptbot, LummaC Stealer, RedLine	Browse	157.20.182.66
	pic4.jpg.exe	Get hash	malicious	AsyncRAT, DcRat, Stealerium, StormKitty	Browse	157.20.182.183
	mips.elf	Get hash	malicious	Mirai, Moobot	Browse	157.20.197.9
	KKveTTgaAAsecNNaaaa.mpsl.elf	Get hash	malicious	Unknown	Browse	163.227.107.22
	SecuriteInfo.com.Linux.Siggen.9999.23751.27873.elf	Get hash	malicious	Mirai	Browse	163.227.120.19
	botx.arm6.elf	Get hash	malicious	Mirai	Browse	163.227.119.35
	x86.elf	Get hash	malicious	Unknown	Browse	163.226.55.171
	Pn0jlaHvxE.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	157.16.29.198
	Adobe DocumentsAdobe.exe	Get hash	malicious	Unknown	Browse	157.20.182.103
	Adobe DocumentsAdobe.exe	Get hash	malicious	Unknown	Browse	157.20.182.103

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.589107930080094
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	antispam_connect_eu.exe
File size:	3'621'376 bytes
MD5:	ba115c337d529887f22c0c2ac398ab2d
SHA1:	517a916a794161deabf13ff2cd45956b8b918eb4
SHA256:	8f14a21c1956fcadda8457f75c21bfd37cb5b5dd5cd184b5f455e1904599c620
SHA512:	aaaeaf70be36b69323fae291b644c2937b10bfe066e2cc059a8ba6766ec084965cc8a8ad4299219f3c9831cdf8cd9c0d7be29991f64ffba82b1f2df411b44d21
SSDEEP:	49152:RI2hpmxxDHK+1dACGa9C217MxjVmRoNdKtGv6ufmkHhKlBtvtMtbdpQBc1yr0JpW:RFpmxtHK2mHY17M8ofKtGv1fmRXI
TLSH:	ADF58F10BA0B8067EDA313B15A6C97B7873CFE211F7541C783D45A2C1D529C26B72BEA
File Content Preview:	MZ......................@...................................@...........!..L.!This program cannot be run in DOS mode....$.......................^...E.....1.............................^.......^................._.....O.......G...............^...........Y..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x569890
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x66E0889B [Tue Sep 10 17:57:47 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	43c04c908bbe27c9c72200a8326d208f

Authenticode Signature

Signature Valid:
Signature Issuer:
Signature Validation Error:
Error Number:
Not Before, Not After
Subject Chain
Version:
Thumbprint MD5:
Thumbprint SHA-1:
Thumbprint SHA-256:
Serial:

Entrypoint Preview

Instruction
call 00007FB3288F6571h
jmp 00007FB328897E5Bh
int3
int3
int3
int3
int3
int3
push ebp
mov ebp, esp
and esp, FFFFFFF0h
sub esp, 28h
push esi
push edi
mov edi, ecx
mov dword ptr [esp+20h], 00000000h
push 00000077h
xorps xmm0, xmm0
mov dword ptr [esp+10h], edi
push 00687D88h
lea ecx, dword ptr [esp+18h]
mov dword ptr [esp+14h], edi
movaps esp+18h, dqword ptr [xmm0]
mov dword ptr [esp+2Ch], 00000000h
call 00007FB328756928h
cmp dword ptr [esp+24h], 0Fh
lea eax, dword ptr [esp+10h]
mov ecx, edi
cmovnbe eax, dword ptr [esp+10h]
push eax
push FFFFFFFFh
call 00007FB328739290h
mov ecx, dword ptr [esp+24h]
mov dword ptr [edi], 00687E10h
cmp ecx, 0Fh
jbe 00007FB32889809Bh
mov edx, dword ptr [esp+10h]
inc ecx
mov eax, edx
cmp ecx, 00001000h
jc 00007FB328898082h
mov edx, dword ptr [eax-04h]
add ecx, 23h
sub eax, edx
add eax, FFFFFFFCh
cmp eax, 1Fh
jnbe 00007FB3288980BAh
push ecx
push edx
call 00007FB3288F54EEh
add esp, 08h
lea esi, dword ptr [edi+10h]
mov ecx, esi
call 00007FB32873C5CEh
mov dword ptr [edi], 00687E04h
xorps xmm0, xmm0
movq qword ptr [esi], xmm0
push esi
mov dword ptr [esi], 00000000h
mov dword ptr [esi+04h], 00000000h
call 00007FB3288F29E9h

Rich Headers

Programming Language:

[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x2e9c10	0xe4	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2e9cf4	0xdc	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x35a000	0x1dd8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x372c48	0x2ae0	.reloc
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x35c000	0x227e0	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x2abf88	0x8c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x2ac040	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x2abec8	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x233000	0x504	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x23133a	0x231400	b88d0130eb5341c06629c803b13443db	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x233000	0xb8bfc	0xb8c00	7a17565cf303a48c888862ecdf65941d	False	0.3050958326285521	data	5.207535423045056	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x2ec000	0x6d25c	0x65800	48f3eb6896a1566e026ccb23ec0c7d1c	False	0.060638277401477834	data	5.026375093598806	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x35a000	0x1dd8	0x1e00	22392b2aa367bafc860b07e4f8a5e324	False	0.728515625	data	7.164708207572471	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x35c000	0x227e0	0x22800	d59032299572c89b81be3f0d143d0757	False	0.5994536911231884	data	6.641302574453114	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x35a0e8	0x36c	data	English	United States	0.4474885844748858
RT_ANIICON	0x35a454	0x1800	data			0.7893880208333334
RT_MANIFEST	0x35bc54	0x182	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	English	United States	0.6113989637305699

Imports

DLL	Import
RPCRT4.dll	RpcRevertToSelf, RpcImpersonateClient, RpcServerUnregisterIfEx, RpcServerRegisterIf2, RpcObjectSetType, RpcServerUseProtseqEpW, RpcEpRegisterW, RpcEpUnregister, RpcBindingToStringBindingW, I_RpcBindingInqLocalClientPID, RpcMgmtEpEltInqBegin, RpcAsyncCancelCall, NdrAsyncClientCall, NdrServerCall2, NdrAsyncServerCall, UuidToStringW, UuidFromStringW, RpcStringBindingParseW, RpcSsDestroyClientContext, RpcIfInqId, RpcAsyncCompleteCall, RpcMgmtEpEltInqNextW, RpcMgmtEpEltInqDone, UuidCreate, NdrClientCall2, RpcBindingFree, RpcStringFreeW, RpcBindingFromStringBindingW, RpcStringBindingComposeW, RpcAsyncInitializeHandle
WTSAPI32.dll	WTSQuerySessionInformationW, WTSFreeMemory
SHELL32.dll	SHGetFolderPathW
ntdll.dll	RtlNtStatusToDosError, NtSetInformationThread, RtlUnwind, NtQueryInformationProcess, NtCreateWorkerFactory, NtClose, RtlDllShutdownInProgress, NtSystemDebugControl, VerSetConditionMask, NtOpenKey, NtQueryKey, NtDeleteKey, RtlCaptureContext, NtQuerySystemInformation, NtQueryInformationWorkerFactory
KERNEL32.dll	GetExitCodeProcess, VerifyVersionInfoW, FindFirstFileW, DeleteFileW, ReadProcessMemory, GetCurrentProcess, InitializeProcThreadAttributeList, UpdateProcThreadAttribute, GetSystemTimeAsFileTime, FindClose, GetProcessId, GetEnvironmentVariableW, SetEnvironmentVariableW, CreateThread, TlsFree, TlsAlloc, TlsSetValue, TlsGetValue, SetErrorMode, SetUnhandledExceptionFilter, AddVectoredExceptionHandler, RemoveVectoredExceptionHandler, VirtualQuery, VirtualProtect, OpenProcess, DeviceIoControl, CheckRemoteDebuggerPresent, FlushInstructionCache, RaiseException, GetTickCount, CreateEventW, SetEvent, QueryFullProcessImageNameW, GetPriorityClass, OpenThread, GetThreadPriority, K32EnumProcesses, GetThreadTimes, K32GetProcessMemoryInfo, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, GetProcessHandleCount, CreateIoCompletionPort, Sleep, TerminateProcess, GetNativeSystemInfo, DuplicateHandle, GetSystemTimes, GetProcessTimes, SetLastError, InitializeCriticalSectionEx, HeapSize, HeapReAlloc, DecodePointer, HeapDestroy, GetFileTime, CompareFileTime, SetFilePointerEx, UnlockFileEx, LockFileEx, GetFileSizeEx, ReadFile, QueryUnbiasedInterruptTime, CancelIoEx, GetOverlappedResult, ResetEvent, ReadDirectoryChangesW, UnregisterWaitEx, ProcessIdToSessionId, WaitForMultipleObjects, GetCurrentThread, InitializeCriticalSectionAndSpinCount, LocalFree, TerminateThread, ResumeThread, SetThreadPriority, QueryPerformanceFrequency, QueryPerformanceCounter, QueryThreadCycleTime, GetThreadId, WriteFile, FlushFileBuffers, GetFileInformationByHandle, GetFullPathNameW, OutputDebugStringA, FileTimeToSystemTime, WaitForSingleObject, FindNextFileW, ExpandEnvironmentStringsW, SetFileAttributesW, SetFileInformationByHandle, MoveFileExW, GetFileAttributesExW, SetFilePointer, SetEndOfFile, FindFirstFileExW, GetDriveTypeW, GetDiskFreeSpaceExW, FindResourceW, LoadResource, LockResource, SizeofResource, K32GetMappedFileNameW, GetCurrentDirectoryW, GetWindowsDirectoryW, GetVolumePathNameW, GetVolumeNameForVolumeMountPointW, FindFirstVolumeW, QueryDosDeviceW, FindNextVolumeW, GetVolumePathNamesForVolumeNameW, FindVolumeClose, MapViewOfFile, UnmapViewOfFile, CreateFileMappingW, GlobalMemoryStatusEx, CompareStringW, SetThreadpoolWait, CreateThreadpoolWait, CloseThreadpoolWait, WaitForThreadpoolWaitCallbacks, GetTickCount64, GetSystemInfo, GetVersionExW, GetProcessAffinityMask, GetLongPathNameW, VirtualAlloc, VirtualFree, GetExitCodeThread, GetFileSize, SetFileTime, FormatMessageA, LCMapStringW, ExitProcess, GetStdHandle, FreeLibraryAndExitThread, ExitThread, InterlockedPushEntrySList, OutputDebugStringW, GetStartupInfoW, IsDebuggerPresent, UnhandledExceptionFilter, InitializeSListHead, IsProcessorFeaturePresent, GetCPInfo, CreateProcessW, GetModuleFileNameW, GetFileAttributesW, LoadLibraryW, GetSystemDirectoryW, HeapFree, HeapAlloc, GetCurrentThreadId, GetModuleHandleExW, GetModuleFileNameA, LeaveCriticalSection, EnterCriticalSection, DeleteCriticalSection, InitializeCriticalSection, GetCurrentProcessId, GetCommandLineW, SetDllDirectoryW, GetProcessHeap, FreeLibrary, GetModuleHandleW, GetProcAddress, GetLastError, CloseHandle, LoadLibraryExW, CreateFileW, MultiByteToWideChar, WideCharToMultiByte, GetLocaleInfoW, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, GetFileType, GetConsoleOutputCP, GetConsoleMode, IsValidCodePage, GetACP, GetOEMCP, GetCommandLineA, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetStdHandle, GetTimeZoneInformation, ReadConsoleW, WriteConsoleW, FindResourceExW, RegisterWaitForSingleObject, GetVersion, GetFileInformationByHandleEx, GetStringTypeW, CreateDirectoryW, LCMapStringEx, EncodePointer, WakeConditionVariable, GetLocaleInfoEx, SleepConditionVariableSRW, WaitForSingleObjectEx, ReleaseSRWLockExclusive, AcquireSRWLockExclusive, TryAcquireSRWLockExclusive, ReleaseSRWLockShared, AcquireSRWLockShared, WakeAllConditionVariable, InitOnceComplete, InitOnceBeginInitialize, AreFileApisANSI
USER32.dll	PeekMessageW, IsHungAppWindow, GetGUIThreadInfo, SendMessageCallbackW, RegisterClassExW, GetClassInfoExW, SetWindowLongW, SendMessageW, PostMessageW, RegisterWindowMessageW, LoadStringW, GetSystemMetrics
ADVAPI32.dll	RegQueryMultipleValuesW, RegDeleteTreeW, RegNotifyChangeKeyValue, RegSetValueExW, RegQueryValueExW, RegQueryInfoKeyW, RegEnumValueW, RegEnumKeyExW, RegDeleteValueW, RegCreateKeyExW, CryptReleaseContext, CryptGenRandom, CryptAcquireContextW, FreeSid, RegOpenKeyExW, AddAce, InitializeAcl, GetLengthSid, AllocateAndInitializeSid, ImpersonateSelf, AdjustTokenPrivileges, LookupPrivilegeValueW, CheckTokenMembership, DuplicateToken, EqualSid, OpenProcessToken, GetTokenInformation, SetSecurityDescriptorDacl, InitializeSecurityDescriptor, OpenThreadToken, RegCloseKey, RevertToSelf
ole32.dll	OleUninitialize, CoCreateGuid, OleInitialize
POWRPROF.dll	CallNtPowerInformation
SHLWAPI.dll	PathFindFileNameW, PathRemoveFileSpecW, PathAppendW

Exports

Name	Ordinal	Address
asw_process_storage_allocate_connector	1	0x568380
asw_process_storage_deallocate_connector	2	0x5683a0
on_avast_dll_unload	3	0x558760
onexit_register_connector_avast_2	4	0x568200

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-14T17:22:16.598482+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49719	157.20.182.233	443	TCP
2024-10-14T17:22:16.705514+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49720	157.20.182.233	443	TCP
2024-10-14T17:22:16.814903+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49721	157.20.182.233	443	TCP
2024-10-14T17:22:16.924157+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49722	157.20.182.233	443	TCP
2024-10-14T17:22:17.033527+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49723	157.20.182.233	443	TCP
2024-10-14T17:22:17.142759+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49724	157.20.182.233	443	TCP
2024-10-14T17:22:17.252183+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49725	157.20.182.233	443	TCP
2024-10-14T17:22:17.361897+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49726	157.20.182.233	443	TCP
2024-10-14T17:22:17.471332+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49727	157.20.182.233	443	TCP
2024-10-14T17:22:17.580509+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49728	157.20.182.233	443	TCP
2024-10-14T17:22:17.690106+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49729	157.20.182.233	443	TCP
2024-10-14T17:22:17.800110+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49730	157.20.182.233	443	TCP
2024-10-14T17:22:17.908810+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49731	157.20.182.233	443	TCP
2024-10-14T17:22:18.018181+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49737	157.20.182.233	443	TCP
2024-10-14T17:22:18.127805+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49738	157.20.182.233	443	TCP
2024-10-14T17:22:18.236725+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49739	157.20.182.233	443	TCP
2024-10-14T17:22:18.350370+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49740	157.20.182.233	443	TCP
2024-10-14T17:22:18.465921+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49741	157.20.182.233	443	TCP
2024-10-14T17:22:18.581033+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49742	157.20.182.233	443	TCP
2024-10-14T17:22:18.694666+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49743	157.20.182.233	443	TCP
2024-10-14T17:22:18.812932+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49744	157.20.182.233	443	TCP
2024-10-14T17:22:18.943371+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49745	157.20.182.233	443	TCP
2024-10-14T17:22:19.080076+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49749	157.20.182.233	443	TCP
2024-10-14T17:22:19.192506+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49752	157.20.182.233	443	TCP
2024-10-14T17:22:19.299430+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49753	157.20.182.233	443	TCP
2024-10-14T17:22:19.408709+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49754	157.20.182.233	443	TCP
2024-10-14T17:22:19.518526+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49755	157.20.182.233	443	TCP
2024-10-14T17:22:19.627404+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49756	157.20.182.233	443	TCP
2024-10-14T17:22:19.737588+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49757	157.20.182.233	443	TCP
2024-10-14T17:22:19.847084+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49758	157.20.182.233	443	TCP
2024-10-14T17:22:19.955471+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49764	157.20.182.233	443	TCP
2024-10-14T17:22:20.064843+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49765	157.20.182.233	443	TCP
2024-10-14T17:22:20.174087+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49766	157.20.182.233	443	TCP
2024-10-14T17:22:20.283459+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49767	157.20.182.233	443	TCP
2024-10-14T17:22:20.392910+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49768	157.20.182.233	443	TCP
2024-10-14T17:22:20.502264+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49769	157.20.182.233	443	TCP
2024-10-14T17:22:20.611579+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49771	157.20.182.233	443	TCP
2024-10-14T17:22:20.720963+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49774	157.20.182.233	443	TCP
2024-10-14T17:22:20.830491+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49777	157.20.182.233	443	TCP
2024-10-14T17:22:20.939529+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49779	157.20.182.233	443	TCP
2024-10-14T17:22:21.049408+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49780	157.20.182.233	443	TCP
2024-10-14T17:22:21.158647+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49781	157.20.182.233	443	TCP
2024-10-14T17:22:21.267672+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49782	157.20.182.233	443	TCP
2024-10-14T17:22:21.377598+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49783	157.20.182.233	443	TCP
2024-10-14T17:22:21.495119+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49786	157.20.182.233	443	TCP
2024-10-14T17:22:21.640098+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49787	157.20.182.233	443	TCP
2024-10-14T17:22:21.753009+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49791	157.20.182.233	443	TCP
2024-10-14T17:22:21.861548+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49792	157.20.182.233	443	TCP
2024-10-14T17:22:21.970952+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49793	157.20.182.233	443	TCP
2024-10-14T17:22:22.082384+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49794	157.20.182.233	443	TCP
2024-10-14T17:22:22.191181+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49795	157.20.182.233	443	TCP
2024-10-14T17:22:22.299277+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49797	157.20.182.233	443	TCP
2024-10-14T17:22:22.408466+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49799	157.20.182.233	443	TCP
2024-10-14T17:22:22.518052+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49800	157.20.182.233	443	TCP
2024-10-14T17:22:22.627122+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49804	157.20.182.233	443	TCP
2024-10-14T17:22:22.736733+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49805	157.20.182.233	443	TCP
2024-10-14T17:22:22.846090+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49806	157.20.182.233	443	TCP
2024-10-14T17:22:22.955374+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49807	157.20.182.233	443	TCP
2024-10-14T17:22:23.064599+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49808	157.20.182.233	443	TCP
2024-10-14T17:22:23.174029+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49810	157.20.182.233	443	TCP
2024-10-14T17:22:23.283568+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49812	157.20.182.233	443	TCP
2024-10-14T17:22:23.392780+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49815	157.20.182.233	443	TCP
2024-10-14T17:22:23.502347+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49817	157.20.182.233	443	TCP
2024-10-14T17:22:23.611661+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49818	157.20.182.233	443	TCP
2024-10-14T17:22:23.721132+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49819	157.20.182.233	443	TCP
2024-10-14T17:22:23.830361+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49820	157.20.182.233	443	TCP
2024-10-14T17:22:23.939940+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49822	157.20.182.233	443	TCP
2024-10-14T17:22:24.049060+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49824	157.20.182.233	443	TCP
2024-10-14T17:22:24.158277+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49826	157.20.182.233	443	TCP
2024-10-14T17:22:24.268092+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49829	157.20.182.233	443	TCP
2024-10-14T17:22:24.377469+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49830	157.20.182.233	443	TCP
2024-10-14T17:22:24.486816+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49831	157.20.182.233	443	TCP
2024-10-14T17:22:24.595906+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49832	157.20.182.233	443	TCP
2024-10-14T17:22:24.705300+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49833	157.20.182.233	443	TCP
2024-10-14T17:22:24.814623+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49836	157.20.182.233	443	TCP
2024-10-14T17:22:24.924140+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49837	157.20.182.233	443	TCP
2024-10-14T17:22:25.033286+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49840	157.20.182.233	443	TCP
2024-10-14T17:22:25.142938+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49842	157.20.182.233	443	TCP
2024-10-14T17:22:25.252193+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49843	157.20.182.233	443	TCP
2024-10-14T17:22:25.361405+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49844	157.20.182.233	443	TCP
2024-10-14T17:22:25.470973+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49845	157.20.182.233	443	TCP
2024-10-14T17:22:25.580456+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49848	157.20.182.233	443	TCP
2024-10-14T17:22:25.689516+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49850	157.20.182.233	443	TCP
2024-10-14T17:22:25.799265+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49851	157.20.182.233	443	TCP
2024-10-14T17:22:25.908254+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49854	157.20.182.233	443	TCP
2024-10-14T17:22:26.017965+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49855	157.20.182.233	443	TCP
2024-10-14T17:22:26.127087+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49856	157.20.182.233	443	TCP
2024-10-14T17:22:26.236818+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49857	157.20.182.233	443	TCP
2024-10-14T17:22:26.345981+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49858	157.20.182.233	443	TCP
2024-10-14T17:22:26.455203+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49861	157.20.182.233	443	TCP
2024-10-14T17:22:26.564735+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49863	157.20.182.233	443	TCP
2024-10-14T17:22:26.674223+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49866	157.20.182.233	443	TCP
2024-10-14T17:22:26.783598+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49867	157.20.182.233	443	TCP
2024-10-14T17:22:26.892856+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49868	157.20.182.233	443	TCP
2024-10-14T17:22:27.002062+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49869	157.20.182.233	443	TCP
2024-10-14T17:22:27.111650+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49870	157.20.182.233	443	TCP
2024-10-14T17:22:27.220984+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49872	157.20.182.233	443	TCP
2024-10-14T17:22:27.330335+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49875	157.20.182.233	443	TCP
2024-10-14T17:22:27.439944+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49876	157.20.182.233	443	TCP
2024-10-14T17:22:27.549102+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49879	157.20.182.233	443	TCP
2024-10-14T17:22:27.672094+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49880	157.20.182.233	443	TCP
2024-10-14T17:22:27.783882+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49881	157.20.182.233	443	TCP
2024-10-14T17:22:27.892837+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49882	157.20.182.233	443	TCP
2024-10-14T17:22:28.002422+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49885	157.20.182.233	443	TCP
2024-10-14T17:22:28.112223+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49887	157.20.182.233	443	TCP
2024-10-14T17:22:28.224135+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49888	157.20.182.233	443	TCP
2024-10-14T17:22:28.373956+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49890	157.20.182.233	443	TCP
2024-10-14T17:22:28.501470+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49892	157.20.182.233	443	TCP
2024-10-14T17:22:28.635629+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49893	157.20.182.233	443	TCP
2024-10-14T17:22:28.752339+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49894	157.20.182.233	443	TCP
2024-10-14T17:22:28.861947+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49897	157.20.182.233	443	TCP
2024-10-14T17:22:28.970966+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49899	157.20.182.233	443	TCP
2024-10-14T17:22:29.080130+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49901	157.20.182.233	443	TCP
2024-10-14T17:22:29.189386+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49903	157.20.182.233	443	TCP
2024-10-14T17:22:29.299612+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49904	157.20.182.233	443	TCP
2024-10-14T17:22:29.408784+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49906	157.20.182.233	443	TCP
2024-10-14T17:22:29.517929+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49907	157.20.182.233	443	TCP
2024-10-14T17:22:29.627083+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49909	157.20.182.233	443	TCP
2024-10-14T17:22:29.736706+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49911	157.20.182.233	443	TCP
2024-10-14T17:22:29.845824+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49913	157.20.182.233	443	TCP
2024-10-14T17:22:29.955335+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49915	157.20.182.233	443	TCP
2024-10-14T17:22:30.081493+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49917	157.20.182.233	443	TCP
2024-10-14T17:22:30.190925+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49919	157.20.182.233	443	TCP
2024-10-14T17:22:30.299479+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49920	157.20.182.233	443	TCP
2024-10-14T17:22:30.408597+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49922	157.20.182.233	443	TCP
2024-10-14T17:22:30.517421+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49924	157.20.182.233	443	TCP
2024-10-14T17:22:30.627133+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49926	157.20.182.233	443	TCP
2024-10-14T17:22:30.765305+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49928	157.20.182.233	443	TCP
2024-10-14T17:22:30.877034+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49930	157.20.182.233	443	TCP
2024-10-14T17:22:31.024808+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49931	157.20.182.233	443	TCP
2024-10-14T17:22:31.138993+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49932	157.20.182.233	443	TCP
2024-10-14T17:22:31.260874+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49933	157.20.182.233	443	TCP
2024-10-14T17:22:31.376898+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49936	157.20.182.233	443	TCP
2024-10-14T17:22:31.486363+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49940	157.20.182.233	443	TCP
2024-10-14T17:22:31.595649+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49942	157.20.182.233	443	TCP
2024-10-14T17:22:31.705833+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49943	157.20.182.233	443	TCP
2024-10-14T17:22:31.814570+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49944	157.20.182.233	443	TCP
2024-10-14T17:22:31.924218+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49945	157.20.182.233	443	TCP
2024-10-14T17:22:32.033619+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49946	157.20.182.233	443	TCP
2024-10-14T17:22:32.143355+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49948	157.20.182.233	443	TCP
2024-10-14T17:22:32.252816+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49950	157.20.182.233	443	TCP
2024-10-14T17:22:32.361800+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49953	157.20.182.233	443	TCP
2024-10-14T17:22:32.471055+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49955	157.20.182.233	443	TCP
2024-10-14T17:22:32.580221+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49956	157.20.182.233	443	TCP
2024-10-14T17:22:32.690000+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49957	157.20.182.233	443	TCP
2024-10-14T17:22:32.799093+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49958	157.20.182.233	443	TCP
2024-10-14T17:22:32.909013+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49959	157.20.182.233	443	TCP
2024-10-14T17:22:33.033094+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49962	157.20.182.233	443	TCP
2024-10-14T17:22:33.142510+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49965	157.20.182.233	443	TCP
2024-10-14T17:22:33.252087+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49967	157.20.182.233	443	TCP
2024-10-14T17:22:33.361516+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49968	157.20.182.233	443	TCP
2024-10-14T17:22:33.470852+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49969	157.20.182.233	443	TCP
2024-10-14T17:22:33.580111+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49970	157.20.182.233	443	TCP
2024-10-14T17:22:33.690414+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49971	157.20.182.233	443	TCP
2024-10-14T17:22:33.799621+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49974	157.20.182.233	443	TCP
2024-10-14T17:22:33.908129+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49977	157.20.182.233	443	TCP
2024-10-14T17:22:34.019037+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49978	157.20.182.233	443	TCP
2024-10-14T17:22:34.127253+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49980	157.20.182.233	443	TCP
2024-10-14T17:22:34.239509+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49981	157.20.182.233	443	TCP
2024-10-14T17:22:34.345737+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49982	157.20.182.233	443	TCP
2024-10-14T17:22:34.455702+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49983	157.20.182.233	443	TCP
2024-10-14T17:22:34.564525+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49985	157.20.182.233	443	TCP
2024-10-14T17:22:34.673826+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49988	157.20.182.233	443	TCP
2024-10-14T17:22:34.783312+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49991	157.20.182.233	443	TCP
2024-10-14T17:22:34.892684+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49993	157.20.182.233	443	TCP
2024-10-14T17:22:35.002163+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49994	157.20.182.233	443	TCP
2024-10-14T17:22:35.111680+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49995	157.20.182.233	443	TCP
2024-10-14T17:22:35.220738+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49996	157.20.182.233	443	TCP
2024-10-14T17:22:35.330449+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49997	157.20.182.233	443	TCP
2024-10-14T17:22:35.440068+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	49999	157.20.182.233	443	TCP
2024-10-14T17:22:35.549135+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50003	157.20.182.233	443	TCP
2024-10-14T17:22:35.658893+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50004	157.20.182.233	443	TCP
2024-10-14T17:22:35.768343+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50006	157.20.182.233	443	TCP
2024-10-14T17:22:35.877450+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50007	157.20.182.233	443	TCP
2024-10-14T17:22:35.987213+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50008	157.20.182.233	443	TCP
2024-10-14T17:22:36.095862+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50009	157.20.182.233	443	TCP
2024-10-14T17:22:36.205056+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50011	157.20.182.233	443	TCP
2024-10-14T17:22:36.314417+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50015	157.20.182.233	443	TCP
2024-10-14T17:22:36.424479+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50016	157.20.182.233	443	TCP
2024-10-14T17:22:36.533670+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50018	157.20.182.233	443	TCP
2024-10-14T17:22:36.643631+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50019	157.20.182.233	443	TCP
2024-10-14T17:22:36.752112+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50020	157.20.182.233	443	TCP
2024-10-14T17:22:36.861814+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50021	157.20.182.233	443	TCP
2024-10-14T17:22:36.971143+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50022	157.20.182.233	443	TCP
2024-10-14T17:22:37.080394+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50025	157.20.182.233	443	TCP
2024-10-14T17:22:37.189779+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50028	157.20.182.233	443	TCP
2024-10-14T17:22:37.299072+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50030	157.20.182.233	443	TCP
2024-10-14T17:22:37.411375+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50031	157.20.182.233	443	TCP
2024-10-14T17:22:37.518356+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50032	157.20.182.233	443	TCP
2024-10-14T17:22:37.627250+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50033	157.20.182.233	443	TCP
2024-10-14T17:22:37.736399+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50034	157.20.182.233	443	TCP
2024-10-14T17:22:37.845680+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50037	157.20.182.233	443	TCP
2024-10-14T17:22:38.064790+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50041	157.20.182.233	443	TCP
2024-10-14T17:22:38.174416+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50043	157.20.182.233	443	TCP
2024-10-14T17:22:38.283502+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50044	157.20.182.233	443	TCP
2024-10-14T17:22:38.392861+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50045	157.20.182.233	443	TCP
2024-10-14T17:22:38.502550+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50046	157.20.182.233	443	TCP
2024-10-14T17:22:38.611631+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50047	157.20.182.233	443	TCP
2024-10-14T17:22:38.720943+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50049	157.20.182.233	443	TCP
2024-10-14T17:22:38.830234+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50053	157.20.182.233	443	TCP
2024-10-14T17:22:38.939679+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50055	157.20.182.233	443	TCP
2024-10-14T17:22:39.049160+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50056	157.20.182.233	443	TCP
2024-10-14T17:22:39.158512+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50057	157.20.182.233	443	TCP
2024-10-14T17:22:39.267741+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50058	157.20.182.233	443	TCP
2024-10-14T17:22:39.377471+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50059	157.20.182.233	443	TCP
2024-10-14T17:22:39.506727+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50060	157.20.182.233	443	TCP
2024-10-14T17:22:39.611576+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50065	157.20.182.233	443	TCP
2024-10-14T17:22:39.721054+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50067	157.20.182.233	443	TCP
2024-10-14T17:22:39.830296+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50068	157.20.182.233	443	TCP
2024-10-14T17:22:39.939815+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50069	157.20.182.233	443	TCP
2024-10-14T17:22:40.049421+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50070	157.20.182.233	443	TCP
2024-10-14T17:22:40.158395+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50071	157.20.182.233	443	TCP
2024-10-14T17:22:40.267805+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50072	157.20.182.233	443	TCP
2024-10-14T17:22:40.376965+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50077	157.20.182.233	443	TCP
2024-10-14T17:22:40.486621+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50079	157.20.182.233	443	TCP
2024-10-14T17:22:40.596031+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50080	157.20.182.233	443	TCP
2024-10-14T17:22:40.705395+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50081	157.20.182.233	443	TCP
2024-10-14T17:22:40.827873+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50082	157.20.182.233	443	TCP
2024-10-14T17:22:40.939564+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50083	157.20.182.233	443	TCP
2024-10-14T17:22:41.049189+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50084	157.20.182.233	443	TCP
2024-10-14T17:22:41.158484+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50085	157.20.182.233	443	TCP
2024-10-14T17:22:41.267803+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50090	157.20.182.233	443	TCP
2024-10-14T17:22:41.377011+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50092	157.20.182.233	443	TCP
2024-10-14T17:22:41.499332+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50093	157.20.182.233	443	TCP
2024-10-14T17:22:41.611739+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50094	157.20.182.233	443	TCP
2024-10-14T17:22:41.720827+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50095	157.20.182.233	443	TCP
2024-10-14T17:22:41.830568+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50096	157.20.182.233	443	TCP
2024-10-14T17:22:41.939904+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50097	157.20.182.233	443	TCP
2024-10-14T17:22:42.048964+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50102	157.20.182.233	443	TCP
2024-10-14T17:22:42.158312+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50104	157.20.182.233	443	TCP
2024-10-14T17:22:42.268034+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50105	157.20.182.233	443	TCP
2024-10-14T17:22:42.377242+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50106	157.20.182.233	443	TCP
2024-10-14T17:22:42.486621+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50107	157.20.182.233	443	TCP
2024-10-14T17:22:42.595949+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50108	157.20.182.233	443	TCP
2024-10-14T17:22:42.705804+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50109	157.20.182.233	443	TCP
2024-10-14T17:22:42.814657+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50114	157.20.182.233	443	TCP
2024-10-14T17:22:42.924087+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50116	157.20.182.233	443	TCP
2024-10-14T17:22:43.033844+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50117	157.20.182.233	443	TCP
2024-10-14T17:22:43.142867+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50118	157.20.182.233	443	TCP
2024-10-14T17:22:43.252316+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50119	157.20.182.233	443	TCP
2024-10-14T17:22:43.361807+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50120	157.20.182.233	443	TCP
2024-10-14T17:22:43.471238+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50121	157.20.182.233	443	TCP
2024-10-14T17:22:43.581615+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50124	157.20.182.233	443	TCP
2024-10-14T17:22:43.690252+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50127	157.20.182.233	443	TCP
2024-10-14T17:22:43.799098+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50129	157.20.182.233	443	TCP
2024-10-14T17:22:43.908404+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50130	157.20.182.233	443	TCP
2024-10-14T17:22:44.017884+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50131	157.20.182.233	443	TCP
2024-10-14T17:22:44.127411+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50132	157.20.182.233	443	TCP
2024-10-14T17:22:44.236458+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50133	157.20.182.233	443	TCP
2024-10-14T17:22:44.345836+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50134	157.20.182.233	443	TCP
2024-10-14T17:22:44.455394+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50139	157.20.182.233	443	TCP
2024-10-14T17:22:44.564588+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50141	157.20.182.233	443	TCP
2024-10-14T17:22:44.674372+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50142	157.20.182.233	443	TCP
2024-10-14T17:22:44.783406+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50143	157.20.182.233	443	TCP
2024-10-14T17:22:44.893934+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50144	157.20.182.233	443	TCP
2024-10-14T17:22:45.002376+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50145	157.20.182.233	443	TCP
2024-10-14T17:22:45.112618+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50146	157.20.182.233	443	TCP
2024-10-14T17:22:45.221440+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50147	157.20.182.233	443	TCP
2024-10-14T17:22:45.330444+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50148	157.20.182.233	443	TCP
2024-10-14T17:22:45.439414+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50154	157.20.182.233	443	TCP
2024-10-14T17:22:45.549360+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50155	157.20.182.233	443	TCP
2024-10-14T17:22:45.658734+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50156	157.20.182.233	443	TCP
2024-10-14T17:22:45.768006+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50157	157.20.182.233	443	TCP
2024-10-14T17:22:45.877194+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50158	157.20.182.233	443	TCP
2024-10-14T17:22:45.986472+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50159	157.20.182.233	443	TCP
2024-10-14T17:22:46.095774+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50160	157.20.182.233	443	TCP
2024-10-14T17:22:46.205301+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50162	157.20.182.233	443	TCP
2024-10-14T17:22:46.314694+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50167	157.20.182.233	443	TCP
2024-10-14T17:22:46.424195+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50168	157.20.182.233	443	TCP
2024-10-14T17:22:46.533355+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50169	157.20.182.233	443	TCP
2024-10-14T17:22:46.642928+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50170	157.20.182.233	443	TCP
2024-10-14T17:22:46.752212+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50171	157.20.182.233	443	TCP
2024-10-14T17:22:46.861404+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50172	157.20.182.233	443	TCP
2024-10-14T17:22:46.970771+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50173	157.20.182.233	443	TCP
2024-10-14T17:22:47.080147+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50179	157.20.182.233	443	TCP
2024-10-14T17:22:47.189473+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50180	157.20.182.233	443	TCP
2024-10-14T17:22:47.299026+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50181	157.20.182.233	443	TCP
2024-10-14T17:22:47.408345+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50182	157.20.182.233	443	TCP
2024-10-14T17:22:47.626950+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50184	157.20.182.233	443	TCP
2024-10-14T17:22:47.736495+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50185	157.20.182.233	443	TCP
2024-10-14T17:22:47.845746+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50187	157.20.182.233	443	TCP
2024-10-14T17:22:48.174039+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50194	157.20.182.233	443	TCP
2024-10-14T17:22:48.283408+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50195	157.20.182.233	443	TCP
2024-10-14T17:22:48.393104+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50196	157.20.182.233	443	TCP
2024-10-14T17:22:48.502322+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50197	157.20.182.233	443	TCP
2024-10-14T17:22:48.611473+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50198	157.20.182.233	443	TCP
2024-10-14T17:22:48.721068+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50199	157.20.182.233	443	TCP
2024-10-14T17:22:48.830388+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50200	157.20.182.233	443	TCP
2024-10-14T17:22:48.939432+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50201	157.20.182.233	443	TCP
2024-10-14T17:22:49.049470+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50202	157.20.182.233	443	TCP
2024-10-14T17:22:49.158538+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50203	157.20.182.233	443	TCP
2024-10-14T17:22:49.267751+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50207	157.20.182.233	443	TCP
2024-10-14T17:22:49.377252+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50210	157.20.182.233	443	TCP
2024-10-14T17:22:49.486395+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50211	157.20.182.233	443	TCP
2024-10-14T17:22:49.705335+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50213	157.20.182.233	443	TCP
2024-10-14T17:22:49.814574+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50214	157.20.182.233	443	TCP
2024-10-14T17:22:49.924038+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50215	157.20.182.233	443	TCP
2024-10-14T17:22:50.033298+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50218	157.20.182.233	443	TCP
2024-10-14T17:22:50.142948+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50222	157.20.182.233	443	TCP
2024-10-14T17:22:50.361496+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50224	157.20.182.233	443	TCP
2024-10-14T17:22:50.471034+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50225	157.20.182.233	443	TCP
2024-10-14T17:22:50.580376+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50226	157.20.182.233	443	TCP
2024-10-14T17:22:50.689761+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50227	157.20.182.233	443	TCP
2024-10-14T17:22:50.798928+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50229	157.20.182.233	443	TCP
2024-10-14T17:22:50.908170+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50233	157.20.182.233	443	TCP
2024-10-14T17:22:51.018126+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50235	157.20.182.233	443	TCP
2024-10-14T17:22:51.127169+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50236	157.20.182.233	443	TCP
2024-10-14T17:22:51.236922+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50237	157.20.182.233	443	TCP
2024-10-14T17:22:51.455545+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50239	157.20.182.233	443	TCP
2024-10-14T17:22:51.564908+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50240	157.20.182.233	443	TCP
2024-10-14T17:22:51.674072+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50243	157.20.182.233	443	TCP
2024-10-14T17:22:51.788437+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50246	157.20.182.233	443	TCP
2024-10-14T17:22:51.892943+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50248	157.20.182.233	443	TCP
2024-10-14T17:22:52.002162+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50249	157.20.182.233	443	TCP
2024-10-14T17:22:52.111409+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50250	157.20.182.233	443	TCP
2024-10-14T17:22:52.424393+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50253	157.20.182.233	443	TCP
2024-10-14T17:22:52.533481+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50258	157.20.182.233	443	TCP
2024-10-14T17:22:52.642933+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50259	157.20.182.233	443	TCP
2024-10-14T17:22:52.752298+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50261	157.20.182.233	443	TCP
2024-10-14T17:22:52.846535+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50262	157.20.182.233	443	TCP
2024-10-14T17:22:52.940290+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50263	157.20.182.233	443	TCP
2024-10-14T17:22:53.127149+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50265	157.20.182.233	443	TCP
2024-10-14T17:22:53.221238+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50266	157.20.182.233	443	TCP
2024-10-14T17:22:53.314699+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50268	157.20.182.233	443	TCP
2024-10-14T17:22:53.408504+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50271	157.20.182.233	443	TCP
2024-10-14T17:22:53.502944+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50274	157.20.182.233	443	TCP
2024-10-14T17:22:53.596197+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50275	157.20.182.233	443	TCP
2024-10-14T17:22:53.689952+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50276	157.20.182.233	443	TCP
2024-10-14T17:22:53.783841+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50277	157.20.182.233	443	TCP
2024-10-14T17:22:53.885007+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50278	157.20.182.233	443	TCP
2024-10-14T17:22:53.986683+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50279	157.20.182.233	443	TCP
2024-10-14T17:22:54.174281+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50284	157.20.182.233	443	TCP
2024-10-14T17:22:54.267819+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50287	157.20.182.233	443	TCP
2024-10-14T17:22:54.361597+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50288	157.20.182.233	443	TCP
2024-10-14T17:22:54.455419+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50289	157.20.182.233	443	TCP
2024-10-14T17:22:54.549684+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50290	157.20.182.233	443	TCP
2024-10-14T17:22:54.642770+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50291	157.20.182.233	443	TCP
2024-10-14T17:22:54.736685+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50292	157.20.182.233	443	TCP
2024-10-14T17:22:54.830481+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50293	157.20.182.233	443	TCP
2024-10-14T17:22:54.924098+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50295	157.20.182.233	443	TCP
2024-10-14T17:22:55.018345+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50298	157.20.182.233	443	TCP
2024-10-14T17:22:55.111742+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50301	157.20.182.233	443	TCP
2024-10-14T17:22:55.205865+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50302	157.20.182.233	443	TCP
2024-10-14T17:22:55.299104+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50303	157.20.182.233	443	TCP
2024-10-14T17:22:55.392788+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50304	157.20.182.233	443	TCP
2024-10-14T17:22:55.486634+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50305	157.20.182.233	443	TCP
2024-10-14T17:22:55.674538+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50307	157.20.182.233	443	TCP
2024-10-14T17:22:55.767846+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50309	157.20.182.233	443	TCP
2024-10-14T17:22:55.862149+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50313	157.20.182.233	443	TCP
2024-10-14T17:22:55.962084+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50315	157.20.182.233	443	TCP
2024-10-14T17:22:56.049136+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50316	157.20.182.233	443	TCP
2024-10-14T17:22:56.145892+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50317	157.20.182.233	443	TCP
2024-10-14T17:22:56.236612+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50318	157.20.182.233	443	TCP
2024-10-14T17:22:56.330141+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50319	157.20.182.233	443	TCP
2024-10-14T17:22:56.424079+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50320	157.20.182.233	443	TCP
2024-10-14T17:22:56.518590+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50321	157.20.182.233	443	TCP
2024-10-14T17:22:56.611509+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50324	157.20.182.233	443	TCP
2024-10-14T17:22:56.705379+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50328	157.20.182.233	443	TCP
2024-10-14T17:22:56.799016+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50329	157.20.182.233	443	TCP
2024-10-14T17:22:56.893719+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50330	157.20.182.233	443	TCP
2024-10-14T17:22:56.986851+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50331	157.20.182.233	443	TCP
2024-10-14T17:22:57.080453+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50332	157.20.182.233	443	TCP
2024-10-14T17:22:57.174075+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50333	157.20.182.233	443	TCP
2024-10-14T17:22:57.267782+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50334	157.20.182.233	443	TCP
2024-10-14T17:22:57.361372+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50336	157.20.182.233	443	TCP
2024-10-14T17:22:57.455015+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50340	157.20.182.233	443	TCP
2024-10-14T17:22:57.548813+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50342	157.20.182.233	443	TCP
2024-10-14T17:22:57.642929+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50343	157.20.182.233	443	TCP
2024-10-14T17:22:57.736708+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50344	157.20.182.233	443	TCP
2024-10-14T17:22:57.814674+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50345	157.20.182.233	443	TCP
2024-10-14T17:22:57.892663+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50346	157.20.182.233	443	TCP
2024-10-14T17:22:57.971053+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50347	157.20.182.233	443	TCP
2024-10-14T17:22:58.049105+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50348	157.20.182.233	443	TCP
2024-10-14T17:22:58.127203+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50350	157.20.182.233	443	TCP
2024-10-14T17:22:58.205480+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50352	157.20.182.233	443	TCP
2024-10-14T17:22:58.283603+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50356	157.20.182.233	443	TCP
2024-10-14T17:22:58.361784+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50357	157.20.182.233	443	TCP
2024-10-14T17:22:58.439595+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50358	157.20.182.233	443	TCP
2024-10-14T17:22:58.517736+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50359	157.20.182.233	443	TCP
2024-10-14T17:22:58.595907+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50361	157.20.182.233	443	TCP
2024-10-14T17:22:58.686739+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50362	157.20.182.233	443	TCP
2024-10-14T17:22:58.768010+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50363	157.20.182.233	443	TCP
2024-10-14T17:22:58.846128+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50364	157.20.182.233	443	TCP
2024-10-14T17:22:58.923909+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50365	157.20.182.233	443	TCP
2024-10-14T17:22:59.002886+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50367	157.20.182.233	443	TCP
2024-10-14T17:22:59.158573+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50372	157.20.182.233	443	TCP
2024-10-14T17:22:59.236803+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50373	157.20.182.233	443	TCP
2024-10-14T17:22:59.314772+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50375	157.20.182.233	443	TCP
2024-10-14T17:22:59.392797+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50376	157.20.182.233	443	TCP
2024-10-14T17:22:59.471604+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50377	157.20.182.233	443	TCP
2024-10-14T17:22:59.548825+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50378	157.20.182.233	443	TCP
2024-10-14T17:22:59.627144+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50379	157.20.182.233	443	TCP
2024-10-14T17:22:59.705357+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50380	157.20.182.233	443	TCP
2024-10-14T17:22:59.784025+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50381	157.20.182.233	443	TCP
2024-10-14T17:22:59.862442+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50384	157.20.182.233	443	TCP
2024-10-14T17:22:59.939541+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50385	157.20.182.233	443	TCP
2024-10-14T17:23:00.018322+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50388	157.20.182.233	443	TCP
2024-10-14T17:23:00.174179+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50391	157.20.182.233	443	TCP
2024-10-14T17:23:00.251964+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50392	157.20.182.233	443	TCP
2024-10-14T17:23:00.330176+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50393	157.20.182.233	443	TCP
2024-10-14T17:23:00.408416+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50394	157.20.182.233	443	TCP
2024-10-14T17:23:00.486687+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50395	157.20.182.233	443	TCP
2024-10-14T17:23:00.642941+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50397	157.20.182.233	443	TCP
2024-10-14T17:23:00.720871+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50399	157.20.182.233	443	TCP
2024-10-14T17:23:00.799243+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50403	157.20.182.233	443	TCP
2024-10-14T17:23:00.877232+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50404	157.20.182.233	443	TCP
2024-10-14T17:23:00.955263+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50405	157.20.182.233	443	TCP
2024-10-14T17:23:01.033372+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50406	157.20.182.233	443	TCP
2024-10-14T17:23:01.111665+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50407	157.20.182.233	443	TCP
2024-10-14T17:23:01.189765+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50408	157.20.182.233	443	TCP
2024-10-14T17:23:01.267542+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50409	157.20.182.233	443	TCP
2024-10-14T17:23:01.345934+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50410	157.20.182.233	443	TCP
2024-10-14T17:23:01.424176+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50411	157.20.182.233	443	TCP
2024-10-14T17:23:01.502319+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50412	157.20.182.233	443	TCP
2024-10-14T17:23:01.580316+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50413	157.20.182.233	443	TCP
2024-10-14T17:23:01.658164+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50414	157.20.182.233	443	TCP
2024-10-14T17:23:01.736580+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50415	157.20.182.233	443	TCP
2024-10-14T17:23:01.815414+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50416	157.20.182.233	443	TCP
2024-10-14T17:23:01.892986+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50417	157.20.182.233	443	TCP
2024-10-14T17:23:02.049125+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50419	157.20.182.233	443	TCP
2024-10-14T17:23:02.127211+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50420	157.20.182.233	443	TCP
2024-10-14T17:23:02.220927+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50421	157.20.182.233	443	TCP
2024-10-14T17:23:02.651982+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50423	157.20.182.233	443	TCP
2024-10-14T17:23:02.731228+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50424	157.20.182.233	443	TCP
2024-10-14T17:23:02.826083+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50425	157.20.182.233	443	TCP
2024-10-14T17:23:02.892701+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50426	157.20.182.233	443	TCP
2024-10-14T17:23:02.970983+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50427	157.20.182.233	443	TCP
2024-10-14T17:23:03.049373+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50428	157.20.182.233	443	TCP
2024-10-14T17:23:03.127471+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50429	157.20.182.233	443	TCP
2024-10-14T17:23:03.205311+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50430	157.20.182.233	443	TCP
2024-10-14T17:23:03.439717+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50433	157.20.182.233	443	TCP
2024-10-14T17:23:03.517764+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50434	157.20.182.233	443	TCP
2024-10-14T17:23:03.595997+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50435	157.20.182.233	443	TCP
2024-10-14T17:23:03.658415+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50436	157.20.182.233	443	TCP
2024-10-14T17:23:03.720974+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50437	157.20.182.233	443	TCP
2024-10-14T17:23:03.784358+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50438	157.20.182.233	443	TCP
2024-10-14T17:23:03.861722+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50439	157.20.182.233	443	TCP
2024-10-14T17:23:03.924450+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50440	157.20.182.233	443	TCP
2024-10-14T17:23:03.986277+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50441	157.20.182.233	443	TCP
2024-10-14T17:23:04.048830+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50442	157.20.182.233	443	TCP
2024-10-14T17:23:04.111197+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50443	157.20.182.233	443	TCP
2024-10-14T17:23:04.174004+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50444	157.20.182.233	443	TCP
2024-10-14T17:23:04.236582+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50445	157.20.182.233	443	TCP
2024-10-14T17:23:04.299004+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50446	157.20.182.233	443	TCP
2024-10-14T17:23:04.361418+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50447	157.20.182.233	443	TCP
2024-10-14T17:23:04.423732+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50448	157.20.182.233	443	TCP
2024-10-14T17:23:04.489339+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50449	157.20.182.233	443	TCP
2024-10-14T17:23:04.564530+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50450	157.20.182.233	443	TCP
2024-10-14T17:23:04.627252+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50451	157.20.182.233	443	TCP
2024-10-14T17:23:04.689785+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50452	157.20.182.233	443	TCP
2024-10-14T17:23:04.752114+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50453	157.20.182.233	443	TCP
2024-10-14T17:23:04.818566+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50454	157.20.182.233	443	TCP
2024-10-14T17:23:04.894726+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50455	157.20.182.233	443	TCP
2024-10-14T17:23:04.955495+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50456	157.20.182.233	443	TCP
2024-10-14T17:23:05.017791+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50457	157.20.182.233	443	TCP
2024-10-14T17:23:05.080278+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50458	157.20.182.233	443	TCP
2024-10-14T17:23:05.142714+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50459	157.20.182.233	443	TCP
2024-10-14T17:23:05.205282+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50460	157.20.182.233	443	TCP
2024-10-14T17:23:05.267738+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50461	157.20.182.233	443	TCP
2024-10-14T17:23:05.330093+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50462	157.20.182.233	443	TCP
2024-10-14T17:23:05.392510+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50463	157.20.182.233	443	TCP
2024-10-14T17:23:05.455076+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50464	157.20.182.233	443	TCP
2024-10-14T17:23:05.521257+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50465	157.20.182.233	443	TCP
2024-10-14T17:23:05.580273+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50466	157.20.182.233	443	TCP
2024-10-14T17:23:05.642859+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50467	157.20.182.233	443	TCP
2024-10-14T17:23:05.705238+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50468	157.20.182.233	443	TCP
2024-10-14T17:23:05.767633+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50469	157.20.182.233	443	TCP
2024-10-14T17:23:05.830604+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50470	157.20.182.233	443	TCP
2024-10-14T17:23:05.893462+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50471	157.20.182.233	443	TCP
2024-10-14T17:23:05.955787+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50472	157.20.182.233	443	TCP
2024-10-14T17:23:06.018462+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50473	157.20.182.233	443	TCP
2024-10-14T17:23:06.142631+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50475	157.20.182.233	443	TCP
2024-10-14T17:23:06.205836+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50476	157.20.182.233	443	TCP
2024-10-14T17:23:06.267718+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50477	157.20.182.233	443	TCP
2024-10-14T17:23:06.330725+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50478	157.20.182.233	443	TCP
2024-10-14T17:23:06.392941+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50479	157.20.182.233	443	TCP
2024-10-14T17:23:06.455081+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50480	157.20.182.233	443	TCP
2024-10-14T17:23:06.517975+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50481	157.20.182.233	443	TCP
2024-10-14T17:23:06.580499+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50482	157.20.182.233	443	TCP
2024-10-14T17:23:06.643100+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50483	157.20.182.233	443	TCP
2024-10-14T17:23:06.705577+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50484	157.20.182.233	443	TCP
2024-10-14T17:23:06.767722+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50486	157.20.182.233	443	TCP
2024-10-14T17:23:06.830356+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50487	157.20.182.233	443	TCP
2024-10-14T17:23:06.896176+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50488	157.20.182.233	443	TCP
2024-10-14T17:23:06.956377+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50489	157.20.182.233	443	TCP
2024-10-14T17:23:07.018752+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50490	157.20.182.233	443	TCP
2024-10-14T17:23:07.081271+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50491	157.20.182.233	443	TCP
2024-10-14T17:23:07.180384+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50492	157.20.182.233	443	TCP
2024-10-14T17:23:07.262565+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50493	157.20.182.233	443	TCP
2024-10-14T17:23:07.343359+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50494	157.20.182.233	443	TCP
2024-10-14T17:23:07.470689+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50496	157.20.182.233	443	TCP
2024-10-14T17:23:07.533321+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50497	157.20.182.233	443	TCP
2024-10-14T17:23:07.658451+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50499	157.20.182.233	443	TCP
2024-10-14T17:23:07.720897+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50500	157.20.182.233	443	TCP
2024-10-14T17:23:07.783234+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50501	157.20.182.233	443	TCP
2024-10-14T17:23:07.845854+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50502	157.20.182.233	443	TCP
2024-10-14T17:23:07.908273+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50503	157.20.182.233	443	TCP
2024-10-14T17:23:07.971021+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50504	157.20.182.233	443	TCP
2024-10-14T17:23:08.033353+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50505	157.20.182.233	443	TCP
2024-10-14T17:23:08.095833+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50506	157.20.182.233	443	TCP
2024-10-14T17:23:08.158078+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50507	157.20.182.233	443	TCP
2024-10-14T17:23:08.220489+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50508	157.20.182.233	443	TCP
2024-10-14T17:23:08.283314+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50509	157.20.182.233	443	TCP
2024-10-14T17:23:08.345680+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50510	157.20.182.233	443	TCP
2024-10-14T17:23:08.408658+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50511	157.20.182.233	443	TCP
2024-10-14T17:23:08.533047+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50513	157.20.182.233	443	TCP
2024-10-14T17:23:08.660934+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50515	157.20.182.233	443	TCP
2024-10-14T17:23:08.721518+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50516	157.20.182.233	443	TCP
2024-10-14T17:23:08.784184+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50517	157.20.182.233	443	TCP
2024-10-14T17:23:08.845951+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50518	157.20.182.233	443	TCP
2024-10-14T17:23:08.908542+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50519	157.20.182.233	443	TCP
2024-10-14T17:23:08.971047+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50520	157.20.182.233	443	TCP
2024-10-14T17:23:09.096421+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50522	157.20.182.233	443	TCP
2024-10-14T17:23:09.158476+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50523	157.20.182.233	443	TCP
2024-10-14T17:23:09.205119+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50524	157.20.182.233	443	TCP
2024-10-14T17:23:09.298895+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50526	157.20.182.233	443	TCP
2024-10-14T17:23:09.345730+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50527	157.20.182.233	443	TCP
2024-10-14T17:23:09.392892+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50528	157.20.182.233	443	TCP
2024-10-14T17:23:09.439771+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50529	157.20.182.233	443	TCP
2024-10-14T17:23:09.490525+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50530	157.20.182.233	443	TCP
2024-10-14T17:23:09.548995+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50531	157.20.182.233	443	TCP
2024-10-14T17:23:09.598070+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50532	157.20.182.233	443	TCP
2024-10-14T17:23:09.658425+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50533	157.20.182.233	443	TCP
2024-10-14T17:23:09.705440+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50534	157.20.182.233	443	TCP
2024-10-14T17:23:09.919542+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50536	157.20.182.233	443	TCP
2024-10-14T17:23:09.987545+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50537	157.20.182.233	443	TCP
2024-10-14T17:23:10.038626+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50538	157.20.182.233	443	TCP
2024-10-14T17:23:10.095961+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50539	157.20.182.233	443	TCP
2024-10-14T17:23:10.142960+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50540	157.20.182.233	443	TCP
2024-10-14T17:23:10.189521+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50541	157.20.182.233	443	TCP
2024-10-14T17:23:10.236654+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50542	157.20.182.233	443	TCP
2024-10-14T17:23:10.283296+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50543	157.20.182.233	443	TCP
2024-10-14T17:23:10.330063+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50544	157.20.182.233	443	TCP
2024-10-14T17:23:10.377068+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50545	157.20.182.233	443	TCP
2024-10-14T17:23:10.423605+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50546	157.20.182.233	443	TCP
2024-10-14T17:23:10.471249+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50547	157.20.182.233	443	TCP
2024-10-14T17:23:10.564356+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50549	157.20.182.233	443	TCP
2024-10-14T17:23:10.611418+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50550	157.20.182.233	443	TCP
2024-10-14T17:23:10.658133+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50551	157.20.182.233	443	TCP
2024-10-14T17:23:10.705301+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50552	157.20.182.233	443	TCP
2024-10-14T17:23:10.752168+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50553	157.20.182.233	443	TCP
2024-10-14T17:23:10.799082+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50554	157.20.182.233	443	TCP
2024-10-14T17:23:10.845890+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50555	157.20.182.233	443	TCP
2024-10-14T17:23:10.893007+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50556	157.20.182.233	443	TCP
2024-10-14T17:23:10.940176+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50557	157.20.182.233	443	TCP
2024-10-14T17:23:10.986805+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50558	157.20.182.233	443	TCP
2024-10-14T17:23:11.033510+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50559	157.20.182.233	443	TCP
2024-10-14T17:23:11.080287+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50560	157.20.182.233	443	TCP
2024-10-14T17:23:11.126917+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50561	157.20.182.233	443	TCP
2024-10-14T17:23:11.174251+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50562	157.20.182.233	443	TCP
2024-10-14T17:23:11.221209+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50563	157.20.182.233	443	TCP
2024-10-14T17:23:11.267822+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50564	157.20.182.233	443	TCP
2024-10-14T17:23:11.314583+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50565	157.20.182.233	443	TCP
2024-10-14T17:23:11.361646+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50566	157.20.182.233	443	TCP
2024-10-14T17:23:11.408193+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50567	157.20.182.233	443	TCP
2024-10-14T17:23:11.454903+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50568	157.20.182.233	443	TCP
2024-10-14T17:23:11.502358+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50569	157.20.182.233	443	TCP
2024-10-14T17:23:11.549077+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50570	157.20.182.233	443	TCP
2024-10-14T17:23:11.595825+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50571	157.20.182.233	443	TCP
2024-10-14T17:23:11.642384+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50572	157.20.182.233	443	TCP
2024-10-14T17:23:11.689216+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50573	157.20.182.233	443	TCP
2024-10-14T17:23:11.736024+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50574	157.20.182.233	443	TCP
2024-10-14T17:23:11.782968+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50575	157.20.182.233	443	TCP
2024-10-14T17:23:11.829908+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50576	157.20.182.233	443	TCP
2024-10-14T17:23:11.877844+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50577	157.20.182.233	443	TCP
2024-10-14T17:23:11.924144+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50578	157.20.182.233	443	TCP
2024-10-14T17:23:11.970722+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50579	157.20.182.233	443	TCP
2024-10-14T17:23:12.064357+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50581	157.20.182.233	443	TCP
2024-10-14T17:23:12.111652+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50582	157.20.182.233	443	TCP
2024-10-14T17:23:12.158442+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50583	157.20.182.233	443	TCP
2024-10-14T17:23:12.205460+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50584	157.20.182.233	443	TCP
2024-10-14T17:23:12.345808+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50587	157.20.182.233	443	TCP
2024-10-14T17:23:12.392625+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50588	157.20.182.233	443	TCP
2024-10-14T17:23:12.439415+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50589	157.20.182.233	443	TCP
2024-10-14T17:23:12.486368+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50590	157.20.182.233	443	TCP
2024-10-14T17:23:12.533759+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50591	157.20.182.233	443	TCP
2024-10-14T17:23:12.580400+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50592	157.20.182.233	443	TCP
2024-10-14T17:23:12.627540+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50593	157.20.182.233	443	TCP
2024-10-14T17:23:12.674297+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50594	157.20.182.233	443	TCP
2024-10-14T17:23:12.720686+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50595	157.20.182.233	443	TCP
2024-10-14T17:23:12.767807+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50596	157.20.182.233	443	TCP
2024-10-14T17:23:12.814937+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50597	157.20.182.233	443	TCP
2024-10-14T17:23:12.861456+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50598	157.20.182.233	443	TCP
2024-10-14T17:23:12.908783+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50599	157.20.182.233	443	TCP
2024-10-14T17:23:13.001984+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50601	157.20.182.233	443	TCP
2024-10-14T17:23:13.095986+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50603	157.20.182.233	443	TCP
2024-10-14T17:23:13.142766+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50604	157.20.182.233	443	TCP
2024-10-14T17:23:13.189578+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50605	157.20.182.233	443	TCP
2024-10-14T17:23:13.236838+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50606	157.20.182.233	443	TCP
2024-10-14T17:23:13.283486+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50607	157.20.182.233	443	TCP
2024-10-14T17:23:13.329964+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50608	157.20.182.233	443	TCP
2024-10-14T17:23:13.376680+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50609	157.20.182.233	443	TCP
2024-10-14T17:23:13.423766+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50610	157.20.182.233	443	TCP
2024-10-14T17:23:13.470604+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50611	157.20.182.233	443	TCP
2024-10-14T17:23:13.517378+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50612	157.20.182.233	443	TCP
2024-10-14T17:23:13.565001+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50613	157.20.182.233	443	TCP
2024-10-14T17:23:13.611530+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50614	157.20.182.233	443	TCP
2024-10-14T17:23:13.659012+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50615	157.20.182.233	443	TCP
2024-10-14T17:23:13.752174+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50617	157.20.182.233	443	TCP
2024-10-14T17:23:13.798760+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50618	157.20.182.233	443	TCP
2024-10-14T17:23:13.845903+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50619	157.20.182.233	443	TCP
2024-10-14T17:23:13.893098+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50620	157.20.182.233	443	TCP
2024-10-14T17:23:13.939752+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50621	157.20.182.233	443	TCP
2024-10-14T17:23:13.986528+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50622	157.20.182.233	443	TCP
2024-10-14T17:23:14.033577+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50623	157.20.182.233	443	TCP
2024-10-14T17:23:14.080240+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50624	157.20.182.233	443	TCP
2024-10-14T17:23:14.127148+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50625	157.20.182.233	443	TCP
2024-10-14T17:23:14.221125+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50627	157.20.182.233	443	TCP
2024-10-14T17:23:14.267905+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50628	157.20.182.233	443	TCP
2024-10-14T17:23:14.315191+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50629	157.20.182.233	443	TCP
2024-10-14T17:23:14.362460+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50630	157.20.182.233	443	TCP
2024-10-14T17:23:14.408668+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50631	157.20.182.233	443	TCP
2024-10-14T17:23:14.455008+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50632	157.20.182.233	443	TCP
2024-10-14T17:23:14.549027+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50634	157.20.182.233	443	TCP
2024-10-14T17:23:14.595980+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50635	157.20.182.233	443	TCP
2024-10-14T17:23:14.689825+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50637	157.20.182.233	443	TCP
2024-10-14T17:23:14.736544+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50638	157.20.182.233	443	TCP
2024-10-14T17:23:14.830024+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50640	157.20.182.233	443	TCP
2024-10-14T17:23:14.877087+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50641	157.20.182.233	443	TCP
2024-10-14T17:23:14.923897+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50642	157.20.182.233	443	TCP
2024-10-14T17:23:14.970942+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50643	157.20.182.233	443	TCP
2024-10-14T17:23:15.017721+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50644	157.20.182.233	443	TCP
2024-10-14T17:23:15.064755+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50645	157.20.182.233	443	TCP
2024-10-14T17:23:15.112005+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50646	157.20.182.233	443	TCP
2024-10-14T17:23:15.157938+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50647	157.20.182.233	443	TCP
2024-10-14T17:23:15.189271+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50648	157.20.182.233	443	TCP
2024-10-14T17:23:15.220497+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50649	157.20.182.233	443	TCP
2024-10-14T17:23:15.251852+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50650	157.20.182.233	443	TCP
2024-10-14T17:23:15.330174+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50652	157.20.182.233	443	TCP
2024-10-14T17:23:15.361267+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50653	157.20.182.233	443	TCP
2024-10-14T17:23:15.392307+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50654	157.20.182.233	443	TCP
2024-10-14T17:23:15.454736+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50656	157.20.182.233	443	TCP
2024-10-14T17:23:15.486137+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50657	157.20.182.233	443	TCP
2024-10-14T17:23:15.517451+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50658	157.20.182.233	443	TCP
2024-10-14T17:23:15.611637+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50661	157.20.182.233	443	TCP
2024-10-14T17:23:15.642841+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50662	157.20.182.233	443	TCP
2024-10-14T17:23:15.674019+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50663	157.20.182.233	443	TCP
2024-10-14T17:23:15.705162+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50664	157.20.182.233	443	TCP
2024-10-14T17:23:15.767582+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50666	157.20.182.233	443	TCP
2024-10-14T17:23:15.829935+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50668	157.20.182.233	443	TCP
2024-10-14T17:23:15.861218+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50669	157.20.182.233	443	TCP
2024-10-14T17:23:15.892388+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50670	157.20.182.233	443	TCP
2024-10-14T17:23:15.955123+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50672	157.20.182.233	443	TCP
2024-10-14T17:23:15.986541+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50673	157.20.182.233	443	TCP
2024-10-14T17:23:16.017758+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50674	157.20.182.233	443	TCP
2024-10-14T17:23:16.048952+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50675	157.20.182.233	443	TCP
2024-10-14T17:23:16.111251+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50677	157.20.182.233	443	TCP
2024-10-14T17:23:16.142360+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50678	157.20.182.233	443	TCP
2024-10-14T17:23:16.173614+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50679	157.20.182.233	443	TCP
2024-10-14T17:23:16.205058+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50680	157.20.182.233	443	TCP
2024-10-14T17:23:16.252480+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50681	157.20.182.233	443	TCP
2024-10-14T17:23:16.283472+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50682	157.20.182.233	443	TCP
2024-10-14T17:23:16.314451+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50683	157.20.182.233	443	TCP
2024-10-14T17:23:16.378311+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50685	157.20.182.233	443	TCP
2024-10-14T17:23:16.408302+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50686	157.20.182.233	443	TCP
2024-10-14T17:23:16.439475+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50687	157.20.182.233	443	TCP
2024-10-14T17:23:16.470644+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50688	157.20.182.233	443	TCP
2024-10-14T17:23:16.501945+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50689	157.20.182.233	443	TCP
2024-10-14T17:23:16.533188+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50690	157.20.182.233	443	TCP
2024-10-14T17:23:16.564462+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50691	157.20.182.233	443	TCP
2024-10-14T17:23:16.595568+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50692	157.20.182.233	443	TCP
2024-10-14T17:23:16.627035+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50693	157.20.182.233	443	TCP
2024-10-14T17:23:16.658633+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50694	157.20.182.233	443	TCP
2024-10-14T17:23:16.689912+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50695	157.20.182.233	443	TCP
2024-10-14T17:23:16.720870+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50696	157.20.182.233	443	TCP
2024-10-14T17:23:16.751759+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50697	157.20.182.233	443	TCP
2024-10-14T17:23:16.782963+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50698	157.20.182.233	443	TCP
2024-10-14T17:23:16.845634+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50700	157.20.182.233	443	TCP
2024-10-14T17:23:16.876688+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50701	157.20.182.233	443	TCP
2024-10-14T17:23:16.907897+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50702	157.20.182.233	443	TCP
2024-10-14T17:23:16.939389+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50703	157.20.182.233	443	TCP
2024-10-14T17:23:16.970910+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50704	157.20.182.233	443	TCP
2024-10-14T17:23:17.003292+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50705	157.20.182.233	443	TCP
2024-10-14T17:23:17.033443+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50706	157.20.182.233	443	TCP
2024-10-14T17:23:17.065383+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50707	157.20.182.233	443	TCP
2024-10-14T17:23:17.095920+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50708	157.20.182.233	443	TCP
2024-10-14T17:23:17.126926+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50709	157.20.182.233	443	TCP
2024-10-14T17:23:17.157956+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50710	157.20.182.233	443	TCP
2024-10-14T17:23:17.189305+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50711	157.20.182.233	443	TCP
2024-10-14T17:23:17.220525+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50712	157.20.182.233	443	TCP
2024-10-14T17:23:17.251678+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50713	157.20.182.233	443	TCP
2024-10-14T17:23:17.282984+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50714	157.20.182.233	443	TCP
2024-10-14T17:23:17.314415+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50715	157.20.182.233	443	TCP
2024-10-14T17:23:17.345490+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50716	157.20.182.233	443	TCP
2024-10-14T17:23:17.408230+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50718	157.20.182.233	443	TCP
2024-10-14T17:23:17.470392+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50720	157.20.182.233	443	TCP
2024-10-14T17:23:17.501670+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50721	157.20.182.233	443	TCP
2024-10-14T17:23:17.532861+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50722	157.20.182.233	443	TCP
2024-10-14T17:23:17.564233+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50723	157.20.182.233	443	TCP
2024-10-14T17:23:17.595890+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50724	157.20.182.233	443	TCP
2024-10-14T17:23:17.626849+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50725	157.20.182.233	443	TCP
2024-10-14T17:23:17.660479+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50726	157.20.182.233	443	TCP
2024-10-14T17:23:17.689510+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50727	157.20.182.233	443	TCP
2024-10-14T17:23:17.752183+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50729	157.20.182.233	443	TCP
2024-10-14T17:23:17.783298+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50730	157.20.182.233	443	TCP
2024-10-14T17:23:17.814318+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50731	157.20.182.233	443	TCP
2024-10-14T17:23:17.845733+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50732	157.20.182.233	443	TCP
2024-10-14T17:23:17.876968+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50733	157.20.182.233	443	TCP
2024-10-14T17:23:17.908119+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50734	157.20.182.233	443	TCP
2024-10-14T17:23:17.939631+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50735	157.20.182.233	443	TCP
2024-10-14T17:23:17.970554+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50736	157.20.182.233	443	TCP
2024-10-14T17:23:18.001724+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50737	157.20.182.233	443	TCP
2024-10-14T17:23:18.064810+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50739	157.20.182.233	443	TCP
2024-10-14T17:23:18.095699+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50740	157.20.182.233	443	TCP
2024-10-14T17:23:18.189310+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50743	157.20.182.233	443	TCP
2024-10-14T17:23:18.220606+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50744	157.20.182.233	443	TCP
2024-10-14T17:23:18.251801+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50745	157.20.182.233	443	TCP
2024-10-14T17:23:18.283416+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50746	157.20.182.233	443	TCP
2024-10-14T17:23:18.314378+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50747	157.20.182.233	443	TCP
2024-10-14T17:23:18.345651+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50748	157.20.182.233	443	TCP
2024-10-14T17:23:18.408761+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50750	157.20.182.233	443	TCP
2024-10-14T17:23:18.439717+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50751	157.20.182.233	443	TCP
2024-10-14T17:23:18.470671+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50752	157.20.182.233	443	TCP
2024-10-14T17:23:18.501888+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50753	157.20.182.233	443	TCP
2024-10-14T17:23:18.533035+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50754	157.20.182.233	443	TCP
2024-10-14T17:23:18.564318+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50755	157.20.182.233	443	TCP
2024-10-14T17:23:18.595874+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50756	157.20.182.233	443	TCP
2024-10-14T17:23:18.626913+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50757	157.20.182.233	443	TCP
2024-10-14T17:23:18.689473+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50759	157.20.182.233	443	TCP
2024-10-14T17:23:18.725903+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50760	157.20.182.233	443	TCP
2024-10-14T17:23:18.752226+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50761	157.20.182.233	443	TCP
2024-10-14T17:23:18.783617+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50762	157.20.182.233	443	TCP
2024-10-14T17:23:18.815352+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50763	157.20.182.233	443	TCP
2024-10-14T17:23:18.845998+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50764	157.20.182.233	443	TCP
2024-10-14T17:23:18.908503+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50766	157.20.182.233	443	TCP
2024-10-14T17:23:18.940218+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50767	157.20.182.233	443	TCP
2024-10-14T17:23:18.970739+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50768	157.20.182.233	443	TCP
2024-10-14T17:23:19.002249+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50769	157.20.182.233	443	TCP
2024-10-14T17:23:19.034909+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50770	157.20.182.233	443	TCP
2024-10-14T17:23:19.067132+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50771	157.20.182.233	443	TCP
2024-10-14T17:23:19.096146+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50772	157.20.182.233	443	TCP
2024-10-14T17:23:19.158399+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50774	157.20.182.233	443	TCP
2024-10-14T17:23:19.189513+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50775	157.20.182.233	443	TCP
2024-10-14T17:23:19.221089+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50776	157.20.182.233	443	TCP
2024-10-14T17:23:19.252461+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50777	157.20.182.233	443	TCP
2024-10-14T17:23:19.283379+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50778	157.20.182.233	443	TCP
2024-10-14T17:23:19.346055+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50780	157.20.182.233	443	TCP
2024-10-14T17:23:19.379470+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50781	157.20.182.233	443	TCP
2024-10-14T17:23:19.408754+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50782	157.20.182.233	443	TCP
2024-10-14T17:23:19.440188+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50783	157.20.182.233	443	TCP
2024-10-14T17:23:19.502389+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50785	157.20.182.233	443	TCP
2024-10-14T17:23:19.533538+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50786	157.20.182.233	443	TCP
2024-10-14T17:23:19.596071+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50788	157.20.182.233	443	TCP
2024-10-14T17:23:19.627093+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50789	157.20.182.233	443	TCP
2024-10-14T17:23:19.690179+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50791	157.20.182.233	443	TCP
2024-10-14T17:23:19.721171+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50792	157.20.182.233	443	TCP
2024-10-14T17:23:19.752376+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50793	157.20.182.233	443	TCP
2024-10-14T17:23:19.783708+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50794	157.20.182.233	443	TCP
2024-10-14T17:23:19.814440+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50795	157.20.182.233	443	TCP
2024-10-14T17:23:19.845609+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50796	157.20.182.233	443	TCP
2024-10-14T17:23:19.876945+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50797	157.20.182.233	443	TCP
2024-10-14T17:23:19.908544+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50798	157.20.182.233	443	TCP
2024-10-14T17:23:19.939320+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50799	157.20.182.233	443	TCP
2024-10-14T17:23:19.970883+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50800	157.20.182.233	443	TCP
2024-10-14T17:23:20.001807+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50801	157.20.182.233	443	TCP
2024-10-14T17:23:20.033441+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50802	157.20.182.233	443	TCP
2024-10-14T17:23:20.066524+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50803	157.20.182.233	443	TCP
2024-10-14T17:23:20.119127+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50804	157.20.182.233	443	TCP
2024-10-14T17:23:20.144517+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50805	157.20.182.233	443	TCP
2024-10-14T17:23:20.175262+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50806	157.20.182.233	443	TCP
2024-10-14T17:23:20.205814+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50807	157.20.182.233	443	TCP
2024-10-14T17:23:20.268850+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50809	157.20.182.233	443	TCP
2024-10-14T17:23:20.300115+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50810	157.20.182.233	443	TCP
2024-10-14T17:23:20.330538+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50811	157.20.182.233	443	TCP
2024-10-14T17:23:20.361970+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50812	157.20.182.233	443	TCP
2024-10-14T17:23:20.392620+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50813	157.20.182.233	443	TCP
2024-10-14T17:23:20.423722+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50814	157.20.182.233	443	TCP
2024-10-14T17:23:20.517613+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50817	157.20.182.233	443	TCP
2024-10-14T17:23:20.580292+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50818	157.20.182.233	443	TCP
2024-10-14T17:23:20.670955+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50820	157.20.182.233	443	TCP
2024-10-14T17:23:20.742157+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50822	157.20.182.233	443	TCP
2024-10-14T17:23:20.784835+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50823	157.20.182.233	443	TCP
2024-10-14T17:23:20.818680+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50824	157.20.182.233	443	TCP
2024-10-14T17:23:20.955120+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50826	157.20.182.233	443	TCP
2024-10-14T17:23:21.033606+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50828	157.20.182.233	443	TCP
2024-10-14T17:23:21.064696+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50829	157.20.182.233	443	TCP
2024-10-14T17:23:21.095584+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50830	157.20.182.233	443	TCP
2024-10-14T17:23:21.127605+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50831	157.20.182.233	443	TCP
2024-10-14T17:23:21.158876+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50832	157.20.182.233	443	TCP
2024-10-14T17:23:21.221083+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50834	157.20.182.233	443	TCP
2024-10-14T17:23:21.252349+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50835	157.20.182.233	443	TCP
2024-10-14T17:23:21.283041+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50836	157.20.182.233	443	TCP
2024-10-14T17:23:21.314748+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50837	157.20.182.233	443	TCP
2024-10-14T17:23:21.377113+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50839	157.20.182.233	443	TCP
2024-10-14T17:23:21.408357+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50840	157.20.182.233	443	TCP
2024-10-14T17:23:21.439381+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50841	157.20.182.233	443	TCP
2024-10-14T17:23:21.471364+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50842	157.20.182.233	443	TCP
2024-10-14T17:23:21.502559+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50843	157.20.182.233	443	TCP
2024-10-14T17:23:21.533721+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50844	157.20.182.233	443	TCP
2024-10-14T17:23:21.564917+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50845	157.20.182.233	443	TCP
2024-10-14T17:23:21.596077+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50846	157.20.182.233	443	TCP
2024-10-14T17:23:21.627292+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50847	157.20.182.233	443	TCP
2024-10-14T17:23:21.658568+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50848	157.20.182.233	443	TCP
2024-10-14T17:23:21.690209+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50849	157.20.182.233	443	TCP
2024-10-14T17:23:21.721155+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50850	157.20.182.233	443	TCP
2024-10-14T17:23:21.752703+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50851	157.20.182.233	443	TCP
2024-10-14T17:23:21.783734+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50852	157.20.182.233	443	TCP
2024-10-14T17:23:21.814959+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50853	157.20.182.233	443	TCP
2024-10-14T17:23:21.846475+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50854	157.20.182.233	443	TCP
2024-10-14T17:23:21.877246+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50855	157.20.182.233	443	TCP
2024-10-14T17:23:21.908924+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50856	157.20.182.233	443	TCP
2024-10-14T17:23:21.939682+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50857	157.20.182.233	443	TCP
2024-10-14T17:23:21.971129+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50858	157.20.182.233	443	TCP
2024-10-14T17:23:22.002329+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50859	157.20.182.233	443	TCP
2024-10-14T17:23:22.033597+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50860	157.20.182.233	443	TCP
2024-10-14T17:23:22.096448+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50862	157.20.182.233	443	TCP
2024-10-14T17:23:22.158599+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50864	157.20.182.233	443	TCP
2024-10-14T17:23:22.190113+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50865	157.20.182.233	443	TCP
2024-10-14T17:23:22.221648+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50866	157.20.182.233	443	TCP
2024-10-14T17:23:22.314794+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50869	157.20.182.233	443	TCP
2024-10-14T17:23:22.346157+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50870	157.20.182.233	443	TCP
2024-10-14T17:23:22.377065+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50871	157.20.182.233	443	TCP
2024-10-14T17:23:22.392589+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50872	157.20.182.233	443	TCP
2024-10-14T17:23:22.408257+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50873	157.20.182.233	443	TCP
2024-10-14T17:23:22.423932+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50874	157.20.182.233	443	TCP
2024-10-14T17:23:22.439613+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50875	157.20.182.233	443	TCP
2024-10-14T17:23:22.471199+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50876	157.20.182.233	443	TCP
2024-10-14T17:23:22.502539+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50877	157.20.182.233	443	TCP
2024-10-14T17:23:22.533853+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50878	157.20.182.233	443	TCP
2024-10-14T17:23:22.564926+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50879	157.20.182.233	443	TCP
2024-10-14T17:23:22.596298+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50880	157.20.182.233	443	TCP
2024-10-14T17:23:22.627679+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50881	157.20.182.233	443	TCP
2024-10-14T17:23:22.658739+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50882	157.20.182.233	443	TCP
2024-10-14T17:23:22.690024+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50883	157.20.182.233	443	TCP
2024-10-14T17:23:22.720990+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50884	157.20.182.233	443	TCP
2024-10-14T17:23:22.752520+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50885	157.20.182.233	443	TCP
2024-10-14T17:23:22.767669+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50886	157.20.182.233	443	TCP
2024-10-14T17:23:22.814555+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50889	157.20.182.233	443	TCP
2024-10-14T17:23:22.830010+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50890	157.20.182.233	443	TCP
2024-10-14T17:23:22.845616+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50891	157.20.182.233	443	TCP
2024-10-14T17:23:22.861509+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50892	157.20.182.233	443	TCP
2024-10-14T17:23:22.893109+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50894	157.20.182.233	443	TCP
2024-10-14T17:23:22.939712+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50896	157.20.182.233	443	TCP
2024-10-14T17:23:22.955012+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50897	157.20.182.233	443	TCP
2024-10-14T17:23:22.970453+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50898	157.20.182.233	443	TCP
2024-10-14T17:23:22.986287+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50899	157.20.182.233	443	TCP
2024-10-14T17:23:23.001807+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50900	157.20.182.233	443	TCP
2024-10-14T17:23:23.017569+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50901	157.20.182.233	443	TCP
2024-10-14T17:23:23.048681+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50903	157.20.182.233	443	TCP
2024-10-14T17:23:23.085478+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50904	157.20.182.233	443	TCP
2024-10-14T17:23:23.128373+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50905	157.20.182.233	443	TCP
2024-10-14T17:23:23.242947+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50907	157.20.182.233	443	TCP
2024-10-14T17:23:23.268847+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50908	157.20.182.233	443	TCP
2024-10-14T17:23:23.301760+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50910	157.20.182.233	443	TCP
2024-10-14T17:23:23.350019+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50911	157.20.182.233	443	TCP
2024-10-14T17:23:23.377118+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50912	157.20.182.233	443	TCP
2024-10-14T17:23:23.419136+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50913	157.20.182.233	443	TCP
2024-10-14T17:23:23.439735+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50914	157.20.182.233	443	TCP
2024-10-14T17:23:23.473167+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50915	157.20.182.233	443	TCP
2024-10-14T17:23:23.514187+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50916	157.20.182.233	443	TCP
2024-10-14T17:23:23.698165+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50918	157.20.182.233	443	TCP
2024-10-14T17:23:23.767586+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50920	157.20.182.233	443	TCP
2024-10-14T17:23:23.783021+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50921	157.20.182.233	443	TCP
2024-10-14T17:23:23.798723+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50922	157.20.182.233	443	TCP
2024-10-14T17:23:23.815130+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50923	157.20.182.233	443	TCP
2024-10-14T17:23:23.829786+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50924	157.20.182.233	443	TCP
2024-10-14T17:23:23.845966+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50925	157.20.182.233	443	TCP
2024-10-14T17:23:23.861147+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50926	157.20.182.233	443	TCP
2024-10-14T17:23:23.876864+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50927	157.20.182.233	443	TCP
2024-10-14T17:23:23.892941+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50928	157.20.182.233	443	TCP
2024-10-14T17:23:23.923766+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50930	157.20.182.233	443	TCP
2024-10-14T17:23:23.939343+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50931	157.20.182.233	443	TCP
2024-10-14T17:23:23.955318+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50932	157.20.182.233	443	TCP
2024-10-14T17:23:23.970528+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50933	157.20.182.233	443	TCP
2024-10-14T17:23:24.001874+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50935	157.20.182.233	443	TCP
2024-10-14T17:23:24.017564+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50936	157.20.182.233	443	TCP
2024-10-14T17:23:24.034666+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50937	157.20.182.233	443	TCP
2024-10-14T17:23:24.064719+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50939	157.20.182.233	443	TCP
2024-10-14T17:23:24.080302+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50940	157.20.182.233	443	TCP
2024-10-14T17:23:24.095921+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50941	157.20.182.233	443	TCP
2024-10-14T17:23:24.111674+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50942	157.20.182.233	443	TCP
2024-10-14T17:23:24.127215+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50943	157.20.182.233	443	TCP
2024-10-14T17:23:24.173835+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50946	157.20.182.233	443	TCP
2024-10-14T17:23:24.189506+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50947	157.20.182.233	443	TCP
2024-10-14T17:23:24.205016+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50948	157.20.182.233	443	TCP
2024-10-14T17:23:24.220935+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50949	157.20.182.233	443	TCP
2024-10-14T17:23:24.236979+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50950	157.20.182.233	443	TCP
2024-10-14T17:23:24.299040+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50954	157.20.182.233	443	TCP
2024-10-14T17:23:24.317414+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50955	157.20.182.233	443	TCP
2024-10-14T17:23:24.347912+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50957	157.20.182.233	443	TCP
2024-10-14T17:23:24.377117+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50960	157.20.182.233	443	TCP
2024-10-14T17:23:24.393157+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50961	157.20.182.233	443	TCP
2024-10-14T17:23:24.408828+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50962	157.20.182.233	443	TCP
2024-10-14T17:23:24.423931+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50963	157.20.182.233	443	TCP
2024-10-14T17:23:24.439546+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50964	157.20.182.233	443	TCP
2024-10-14T17:23:24.455092+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50965	157.20.182.233	443	TCP
2024-10-14T17:23:24.486545+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50967	157.20.182.233	443	TCP
2024-10-14T17:23:24.502140+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50968	157.20.182.233	443	TCP
2024-10-14T17:23:24.517788+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50969	157.20.182.233	443	TCP
2024-10-14T17:23:24.549354+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50971	157.20.182.233	443	TCP
2024-10-14T17:23:24.564758+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50972	157.20.182.233	443	TCP
2024-10-14T17:23:24.580704+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50973	157.20.182.233	443	TCP
2024-10-14T17:23:24.595993+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50974	157.20.182.233	443	TCP
2024-10-14T17:23:24.612067+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50975	157.20.182.233	443	TCP
2024-10-14T17:23:24.627161+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50976	157.20.182.233	443	TCP
2024-10-14T17:23:24.642898+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50977	157.20.182.233	443	TCP
2024-10-14T17:23:24.658628+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50978	157.20.182.233	443	TCP
2024-10-14T17:23:24.675370+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50979	157.20.182.233	443	TCP
2024-10-14T17:23:24.720949+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50982	157.20.182.233	443	TCP
2024-10-14T17:23:24.736565+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50983	157.20.182.233	443	TCP
2024-10-14T17:23:24.752017+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50984	157.20.182.233	443	TCP
2024-10-14T17:23:24.768011+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50985	157.20.182.233	443	TCP
2024-10-14T17:23:24.783616+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50986	157.20.182.233	443	TCP
2024-10-14T17:23:24.814659+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50988	157.20.182.233	443	TCP
2024-10-14T17:23:24.830478+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50989	157.20.182.233	443	TCP
2024-10-14T17:23:24.846044+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50990	157.20.182.233	443	TCP
2024-10-14T17:23:24.861795+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50991	157.20.182.233	443	TCP
2024-10-14T17:23:24.877270+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50992	157.20.182.233	443	TCP
2024-10-14T17:23:24.892792+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50993	157.20.182.233	443	TCP
2024-10-14T17:23:24.924942+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50995	157.20.182.233	443	TCP
2024-10-14T17:23:24.939936+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50996	157.20.182.233	443	TCP
2024-10-14T17:23:24.955423+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	50997	157.20.182.233	443	TCP
2024-10-14T17:23:25.002119+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	51000	157.20.182.233	443	TCP
2024-10-14T17:23:25.017743+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	51001	157.20.182.233	443	TCP
2024-10-14T17:23:25.033784+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	51002	157.20.182.233	443	TCP
2024-10-14T17:23:25.054055+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	51003	157.20.182.233	443	TCP
2024-10-14T17:23:25.080591+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	51004	157.20.182.233	443	TCP
2024-10-14T17:23:25.096182+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	51005	157.20.182.233	443	TCP
2024-10-14T17:23:25.111608+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	51006	157.20.182.233	443	TCP
2024-10-14T17:23:25.127280+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	51007	157.20.182.233	443	TCP
2024-10-14T17:23:25.189802+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	51011	157.20.182.233	443	TCP
2024-10-14T17:23:25.205468+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	51012	157.20.182.233	443	TCP
2024-10-14T17:23:25.221113+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	51013	157.20.182.233	443	TCP
2024-10-14T17:23:25.252558+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	51015	157.20.182.233	443	TCP
2024-10-14T17:23:25.268392+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	51016	157.20.182.233	443	TCP
2024-10-14T17:23:25.283833+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	51017	157.20.182.233	443	TCP
2024-10-14T17:23:25.314678+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	51019	157.20.182.233	443	TCP
2024-10-14T17:23:25.330459+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	51020	157.20.182.233	443	TCP
2024-10-14T17:23:25.346180+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	51021	157.20.182.233	443	TCP
2024-10-14T17:23:25.361650+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	51022	157.20.182.233	443	TCP
2024-10-14T17:23:25.393630+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	51024	157.20.182.233	443	TCP
2024-10-14T17:23:25.409410+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	51025	157.20.182.233	443	TCP
2024-10-14T17:23:25.455622+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	51028	157.20.182.233	443	TCP
2024-10-14T17:23:25.470962+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	51029	157.20.182.233	443	TCP
2024-10-14T17:23:25.487092+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	51030	157.20.182.233	443	TCP
2024-10-14T17:23:25.517870+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	51032	157.20.182.233	443	TCP
2024-10-14T17:23:25.533556+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	51033	157.20.182.233	443	TCP
2024-10-14T17:23:25.549002+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	51034	157.20.182.233	443	TCP
2024-10-14T17:23:25.564736+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	51035	157.20.182.233	443	TCP
2024-10-14T17:23:25.581190+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	51036	157.20.182.233	443	TCP
2024-10-14T17:23:25.596314+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	51037	157.20.182.233	443	TCP
2024-10-14T17:23:25.643917+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	51040	157.20.182.233	443	TCP
2024-10-14T17:23:25.674498+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	51042	157.20.182.233	443	TCP
2024-10-14T17:23:25.690151+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	51043	157.20.182.233	443	TCP
2024-10-14T17:23:25.705368+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	51044	157.20.182.233	443	TCP
2024-10-14T17:23:25.720723+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	51045	157.20.182.233	443	TCP
2024-10-14T17:23:25.736912+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	51046	157.20.182.233	443	TCP
2024-10-14T17:23:25.753166+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	51047	157.20.182.233	443	TCP
2024-10-14T17:23:25.767879+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	51048	157.20.182.233	443	TCP
2024-10-14T17:23:25.799755+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	51050	157.20.182.233	443	TCP
2024-10-14T17:23:25.846011+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	51052	157.20.182.233	443	TCP
2024-10-14T17:23:25.865909+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	51053	157.20.182.233	443	TCP
2024-10-14T17:23:25.876828+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	51054	157.20.182.233	443	TCP
2024-10-14T17:23:25.892562+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	51055	157.20.182.233	443	TCP
2024-10-14T17:23:25.939527+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	51058	157.20.182.233	443	TCP
2024-10-14T17:23:25.986979+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	51061	157.20.182.233	443	TCP
2024-10-14T17:23:26.019599+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	51063	157.20.182.233	443	TCP
2024-10-14T17:23:26.043485+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	51064	157.20.182.233	443	TCP
2024-10-14T17:23:26.066349+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	51065	157.20.182.233	443	TCP
2024-10-14T17:23:26.081770+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	51066	157.20.182.233	443	TCP
2024-10-14T17:23:26.148951+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	51069	157.20.182.233	443	TCP
2024-10-14T17:23:26.158877+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	51070	157.20.182.233	443	TCP
2024-10-14T17:23:26.174708+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	51071	157.20.182.233	443	TCP
2024-10-14T17:23:26.189742+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	51072	157.20.182.233	443	TCP
2024-10-14T17:23:26.220468+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	51074	157.20.182.233	443	TCP
2024-10-14T17:23:26.236763+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	51075	157.20.182.233	443	TCP
2024-10-14T17:23:26.252224+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	51076	157.20.182.233	443	TCP
2024-10-14T17:23:26.267747+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	51077	157.20.182.233	443	TCP
2024-10-14T17:23:26.315300+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	51080	157.20.182.233	443	TCP
2024-10-14T17:23:26.330395+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	51081	157.20.182.233	443	TCP
2024-10-14T17:23:26.392783+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	51085	157.20.182.233	443	TCP
2024-10-14T17:23:26.408231+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	51086	157.20.182.233	443	TCP
2024-10-14T17:23:26.442791+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	51088	157.20.182.233	443	TCP
2024-10-14T17:23:26.456518+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	51089	157.20.182.233	443	TCP
2024-10-14T17:23:26.470836+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	51090	157.20.182.233	443	TCP
2024-10-14T17:23:26.487194+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	51091	157.20.182.233	443	TCP
2024-10-14T17:23:26.502235+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	51092	157.20.182.233	443	TCP
2024-10-14T17:23:26.517476+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	51093	157.20.182.233	443	TCP
2024-10-14T17:23:26.533122+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	51094	157.20.182.233	443	TCP
2024-10-14T17:23:26.548932+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	51095	157.20.182.233	443	TCP
2024-10-14T17:23:26.564281+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	51096	157.20.182.233	443	TCP
2024-10-14T17:23:26.580135+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	51097	157.20.182.233	443	TCP
2024-10-14T17:23:26.611471+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	51099	157.20.182.233	443	TCP
2024-10-14T17:23:26.627243+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	51100	157.20.182.233	443	TCP
2024-10-14T17:23:26.658548+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	51102	157.20.182.233	443	TCP
2024-10-14T17:23:26.674172+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	51103	157.20.182.233	443	TCP
2024-10-14T17:23:26.689773+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	51104	157.20.182.233	443	TCP
2024-10-14T17:23:26.705262+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	51105	157.20.182.233	443	TCP
2024-10-14T17:23:26.736040+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	51107	157.20.182.233	443	TCP
2024-10-14T17:23:26.768341+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	51109	157.20.182.233	443	TCP
2024-10-14T17:23:26.798882+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	51111	157.20.182.233	443	TCP
2024-10-14T17:23:26.861391+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	51115	157.20.182.233	443	TCP
2024-10-14T17:23:26.955170+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	51121	157.20.182.233	443	TCP
2024-10-14T17:23:27.017888+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	51125	157.20.182.233	443	TCP
2024-10-14T17:23:27.033403+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	51126	157.20.182.233	443	TCP
2024-10-14T17:23:27.065949+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	51128	157.20.182.233	443	TCP
2024-10-14T17:23:27.128234+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	51132	157.20.182.233	443	TCP
2024-10-14T17:23:27.158497+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	51134	157.20.182.233	443	TCP
2024-10-14T17:23:27.189711+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	51136	157.20.182.233	443	TCP
2024-10-14T17:23:27.205240+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	51137	157.20.182.233	443	TCP
2024-10-14T17:23:27.251893+0200	2031599	ET MALWARE Win32/SystemBC CnC Checkin	1	192.168.2.6	51140	157.20.182.233	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 14, 2024 17:22:16.598037958 CEST	49719	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:16.598110914 CEST	443	49719	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:16.598208904 CEST	49719	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:16.598481894 CEST	49719	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:16.598495007 CEST	443	49719	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:16.598548889 CEST	443	49719	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:16.704937935 CEST	49720	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:16.704988956 CEST	443	49720	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:16.705074072 CEST	49720	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:16.705513954 CEST	49720	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:16.705529928 CEST	443	49720	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:16.705579042 CEST	443	49720	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:16.814357996 CEST	49721	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:16.814405918 CEST	443	49721	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:16.814517975 CEST	49721	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:16.814903021 CEST	49721	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:16.814917088 CEST	443	49721	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:16.814960957 CEST	443	49721	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:16.923635960 CEST	49722	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:16.923687935 CEST	443	49722	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:16.923785925 CEST	49722	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:16.924156904 CEST	49722	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:16.924170017 CEST	443	49722	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:16.924282074 CEST	443	49722	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:17.032939911 CEST	49723	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:17.032999039 CEST	443	49723	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:17.033114910 CEST	49723	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:17.033526897 CEST	49723	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:17.033544064 CEST	443	49723	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:17.033628941 CEST	443	49723	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:17.142242908 CEST	49724	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:17.142344952 CEST	443	49724	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:17.142445087 CEST	49724	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:17.142759085 CEST	49724	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:17.142796040 CEST	443	49724	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:17.142863989 CEST	443	49724	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:17.251688004 CEST	49725	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:17.251741886 CEST	443	49725	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:17.251844883 CEST	49725	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:17.252182961 CEST	49725	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:17.252197027 CEST	443	49725	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:17.252254963 CEST	443	49725	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:17.361377001 CEST	49726	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:17.361404896 CEST	443	49726	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:17.361536980 CEST	49726	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:17.361896992 CEST	49726	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:17.361907005 CEST	443	49726	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:17.361963987 CEST	443	49726	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:17.470675945 CEST	49727	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:17.470796108 CEST	443	49727	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:17.471036911 CEST	49727	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:17.471332073 CEST	49727	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:17.471370935 CEST	443	49727	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:17.471522093 CEST	443	49727	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:17.580004930 CEST	49728	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:17.580049038 CEST	443	49728	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:17.580174923 CEST	49728	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:17.580508947 CEST	49728	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:17.580523968 CEST	443	49728	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:17.580569983 CEST	443	49728	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:17.689568043 CEST	49729	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:17.689625025 CEST	443	49729	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:17.689714909 CEST	49729	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:17.690105915 CEST	49729	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:17.690119028 CEST	443	49729	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:17.690155029 CEST	443	49729	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:17.798892021 CEST	49730	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:17.798957109 CEST	443	49730	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:17.799556017 CEST	49730	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:17.800110102 CEST	49730	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:17.800126076 CEST	443	49730	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:17.800168037 CEST	443	49730	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:17.908204079 CEST	49731	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:17.908258915 CEST	443	49731	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:17.908360958 CEST	49731	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:17.908809900 CEST	49731	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:17.908827066 CEST	443	49731	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:17.908875942 CEST	443	49731	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:18.017581940 CEST	49737	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:18.017621040 CEST	443	49737	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:18.017719984 CEST	49737	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:18.018181086 CEST	49737	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:18.018194914 CEST	443	49737	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:18.018234968 CEST	443	49737	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:18.127080917 CEST	49738	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:18.127149105 CEST	443	49738	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:18.127285004 CEST	49738	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:18.127804995 CEST	49738	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:18.127821922 CEST	443	49738	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:18.127877951 CEST	443	49738	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:18.236258984 CEST	49739	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:18.236305952 CEST	443	49739	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:18.236407995 CEST	49739	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:18.236725092 CEST	49739	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:18.236738920 CEST	443	49739	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:18.236831903 CEST	443	49739	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:18.349736929 CEST	49740	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:18.349790096 CEST	443	49740	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:18.349863052 CEST	49740	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:18.350369930 CEST	49740	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:18.350383043 CEST	443	49740	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:18.350492954 CEST	443	49740	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:18.465157986 CEST	49741	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:18.465218067 CEST	443	49741	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:18.465305090 CEST	49741	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:18.465920925 CEST	49741	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:18.465945005 CEST	443	49741	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:18.466001034 CEST	443	49741	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:18.580483913 CEST	49742	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:18.580549002 CEST	443	49742	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:18.580626011 CEST	49742	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:18.581032991 CEST	49742	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:18.581053019 CEST	443	49742	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:18.581101894 CEST	443	49742	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:18.694101095 CEST	49743	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:18.694175959 CEST	443	49743	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:18.694286108 CEST	49743	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:18.694665909 CEST	49743	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:18.694684029 CEST	443	49743	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:18.694735050 CEST	443	49743	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:18.812287092 CEST	49744	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:18.812335014 CEST	443	49744	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:18.812498093 CEST	49744	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:18.812932014 CEST	49744	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:18.812948942 CEST	443	49744	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:18.812999964 CEST	443	49744	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:18.938735962 CEST	49745	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:18.938796997 CEST	443	49745	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:18.938905001 CEST	49745	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:18.943371058 CEST	49745	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:18.943393946 CEST	443	49745	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:18.943451881 CEST	443	49745	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:19.079533100 CEST	49749	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:19.079596996 CEST	443	49749	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:19.079710960 CEST	49749	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:19.080075979 CEST	49749	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:19.080097914 CEST	443	49749	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:19.080183029 CEST	443	49749	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:19.191963911 CEST	49752	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:19.192014933 CEST	443	49752	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:19.192116976 CEST	49752	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:19.192506075 CEST	49752	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:19.192523956 CEST	443	49752	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:19.192595959 CEST	443	49752	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:19.298691034 CEST	49753	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:19.298751116 CEST	443	49753	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:19.298907042 CEST	49753	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:19.299429893 CEST	49753	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:19.299442053 CEST	443	49753	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:19.299494982 CEST	443	49753	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:19.408154964 CEST	49754	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:19.408210039 CEST	443	49754	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:19.408302069 CEST	49754	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:19.408709049 CEST	49754	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:19.408719063 CEST	443	49754	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:19.408766985 CEST	443	49754	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:19.517901897 CEST	49755	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:19.517947912 CEST	443	49755	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:19.518033028 CEST	49755	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:19.518526077 CEST	49755	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:19.518537998 CEST	443	49755	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:19.518588066 CEST	443	49755	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:19.626872063 CEST	49756	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:19.626924038 CEST	443	49756	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:19.627052069 CEST	49756	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:19.627403975 CEST	49756	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:19.627420902 CEST	443	49756	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:19.627486944 CEST	443	49756	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:19.737102032 CEST	49757	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:19.737149954 CEST	443	49757	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:19.737587929 CEST	49757	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:19.737587929 CEST	49757	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:19.737618923 CEST	443	49757	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:19.737703085 CEST	443	49757	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:19.846487999 CEST	49758	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:19.846529961 CEST	443	49758	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:19.846788883 CEST	49758	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:19.847084045 CEST	49758	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:19.847095013 CEST	443	49758	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:19.847126961 CEST	443	49758	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:19.954932928 CEST	49764	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:19.954989910 CEST	443	49764	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:19.955135107 CEST	49764	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:19.955471039 CEST	49764	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:19.955486059 CEST	443	49764	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:19.955518961 CEST	443	49764	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:20.064332008 CEST	49765	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:20.064383030 CEST	443	49765	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:20.064496040 CEST	49765	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:20.064842939 CEST	49765	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:20.064852953 CEST	443	49765	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:20.064878941 CEST	443	49765	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:20.173559904 CEST	49766	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:20.173599005 CEST	443	49766	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:20.173712015 CEST	49766	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:20.174087048 CEST	49766	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:20.174094915 CEST	443	49766	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:20.174144983 CEST	443	49766	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:20.282972097 CEST	49767	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:20.283015013 CEST	443	49767	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:20.283106089 CEST	49767	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:20.283458948 CEST	49767	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:20.283478022 CEST	443	49767	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:20.283540964 CEST	443	49767	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:20.392482042 CEST	49768	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:20.392533064 CEST	443	49768	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:20.392618895 CEST	49768	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:20.392910004 CEST	49768	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:20.392919064 CEST	443	49768	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:20.392955065 CEST	443	49768	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:20.501769066 CEST	49769	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:20.501832008 CEST	443	49769	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:20.501966953 CEST	49769	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:20.502264023 CEST	49769	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:20.502289057 CEST	443	49769	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:20.502353907 CEST	443	49769	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:20.611109018 CEST	49771	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:20.611157894 CEST	443	49771	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:20.611233950 CEST	49771	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:20.611578941 CEST	49771	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:20.611592054 CEST	443	49771	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:20.611634016 CEST	443	49771	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:20.720441103 CEST	49774	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:20.720503092 CEST	443	49774	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:20.720571995 CEST	49774	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:20.720963001 CEST	49774	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:20.720978975 CEST	443	49774	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:20.721009970 CEST	443	49774	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:20.829839945 CEST	49777	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:20.829891920 CEST	443	49777	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:20.829982996 CEST	49777	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:20.830491066 CEST	49777	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:20.830509901 CEST	443	49777	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:20.830574036 CEST	443	49777	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:20.939069986 CEST	49779	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:20.939135075 CEST	443	49779	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:20.939214945 CEST	49779	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:20.939528942 CEST	49779	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:20.939539909 CEST	443	49779	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:20.939590931 CEST	443	49779	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:21.048868895 CEST	49780	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:21.048929930 CEST	443	49780	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:21.049061060 CEST	49780	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:21.049407959 CEST	49780	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:21.049420118 CEST	443	49780	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:21.049468040 CEST	443	49780	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:21.158036947 CEST	49781	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:21.158090115 CEST	443	49781	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:21.158175945 CEST	49781	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:21.158647060 CEST	49781	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:21.158660889 CEST	443	49781	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:21.158730984 CEST	443	49781	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:21.267249107 CEST	49782	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:21.267290115 CEST	443	49782	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:21.267363071 CEST	49782	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:21.267672062 CEST	49782	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:21.267687082 CEST	443	49782	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:21.267746925 CEST	443	49782	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:21.377024889 CEST	49783	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:21.377070904 CEST	443	49783	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:21.377151966 CEST	49783	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:21.377598047 CEST	49783	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:21.377646923 CEST	443	49783	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:21.377701044 CEST	443	49783	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:21.494690895 CEST	49786	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:21.494729996 CEST	443	49786	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:21.494796038 CEST	49786	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:21.495119095 CEST	49786	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:21.495127916 CEST	443	49786	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:21.495173931 CEST	443	49786	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:21.633126974 CEST	49787	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:21.633188009 CEST	443	49787	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:21.633291006 CEST	49787	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:21.640098095 CEST	49787	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:21.640130043 CEST	443	49787	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:21.640198946 CEST	443	49787	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:21.752480984 CEST	49791	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:21.752494097 CEST	443	49791	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:21.752545118 CEST	49791	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:21.753009081 CEST	49791	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:21.753021955 CEST	443	49791	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:21.753125906 CEST	443	49791	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:21.861144066 CEST	49792	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:21.861186028 CEST	443	49792	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:21.861253023 CEST	49792	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:21.861547947 CEST	49792	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:21.861566067 CEST	443	49792	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:21.861624002 CEST	443	49792	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:21.970423937 CEST	49793	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:21.970479965 CEST	443	49793	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:21.970573902 CEST	49793	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:21.970952034 CEST	49793	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:21.970966101 CEST	443	49793	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:21.971076965 CEST	443	49793	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:22.081887007 CEST	49794	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:22.081943989 CEST	443	49794	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:22.082015038 CEST	49794	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:22.082384109 CEST	49794	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:22.082397938 CEST	443	49794	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:22.082504988 CEST	443	49794	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:22.190687895 CEST	49795	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:22.190737009 CEST	443	49795	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:22.190804958 CEST	49795	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:22.191180944 CEST	49795	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:22.191199064 CEST	443	49795	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:22.191330910 CEST	443	49795	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:22.298841953 CEST	49797	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:22.298878908 CEST	443	49797	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:22.298978090 CEST	49797	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:22.299277067 CEST	49797	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:22.299293995 CEST	443	49797	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:22.299401045 CEST	443	49797	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:22.408037901 CEST	49799	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:22.408067942 CEST	443	49799	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:22.408140898 CEST	49799	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:22.408466101 CEST	49799	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:22.408479929 CEST	443	49799	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:22.408601999 CEST	443	49799	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:22.517561913 CEST	49800	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:22.517610073 CEST	443	49800	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:22.517703056 CEST	49800	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:22.518052101 CEST	49800	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:22.518057108 CEST	443	49800	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:22.519143105 CEST	443	49800	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:22.626607895 CEST	49804	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:22.626658916 CEST	443	49804	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:22.626739025 CEST	49804	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:22.627121925 CEST	49804	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:22.627139091 CEST	443	49804	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:22.627245903 CEST	443	49804	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:22.736110926 CEST	49805	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:22.736186028 CEST	443	49805	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:22.736282110 CEST	49805	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:22.736732960 CEST	49805	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:22.736761093 CEST	443	49805	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:22.736890078 CEST	443	49805	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:22.845565081 CEST	49806	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:22.845629930 CEST	443	49806	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:22.845758915 CEST	49806	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:22.846090078 CEST	49806	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:22.846111059 CEST	443	49806	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:22.846244097 CEST	443	49806	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:22.954893112 CEST	49807	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:22.954942942 CEST	443	49807	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:22.955065966 CEST	49807	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:22.955374002 CEST	49807	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:22.955399036 CEST	443	49807	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:22.955511093 CEST	443	49807	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:23.064126968 CEST	49808	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:23.064177990 CEST	443	49808	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:23.064286947 CEST	49808	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:23.064599037 CEST	49808	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:23.064610958 CEST	443	49808	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:23.064651012 CEST	443	49808	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:23.173549891 CEST	49810	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:23.173579931 CEST	443	49810	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:23.173644066 CEST	49810	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:23.174029112 CEST	49810	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:23.174046040 CEST	443	49810	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:23.174081087 CEST	443	49810	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:23.283040047 CEST	49812	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:23.283077002 CEST	443	49812	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:23.283175945 CEST	49812	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:23.283567905 CEST	49812	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:23.283579111 CEST	443	49812	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:23.283611059 CEST	443	49812	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:23.392374992 CEST	49815	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:23.392383099 CEST	443	49815	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:23.392457008 CEST	49815	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:23.392780066 CEST	49815	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:23.392788887 CEST	443	49815	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:23.392824888 CEST	443	49815	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:23.501898050 CEST	49817	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:23.501940012 CEST	443	49817	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:23.502038002 CEST	49817	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:23.502346992 CEST	49817	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:23.502357006 CEST	443	49817	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:23.502394915 CEST	443	49817	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:23.611229897 CEST	49818	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:23.611246109 CEST	443	49818	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:23.611310959 CEST	49818	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:23.611660957 CEST	49818	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:23.611669064 CEST	443	49818	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:23.611711979 CEST	443	49818	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:23.720577002 CEST	49819	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:23.720635891 CEST	443	49819	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:23.720735073 CEST	49819	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:23.721132040 CEST	49819	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:23.721143007 CEST	443	49819	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:23.721188068 CEST	443	49819	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:23.829850912 CEST	49820	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:23.829886913 CEST	443	49820	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:23.829999924 CEST	49820	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:23.830360889 CEST	49820	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:23.830370903 CEST	443	49820	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:23.830429077 CEST	443	49820	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:23.939347029 CEST	49822	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:23.939399958 CEST	443	49822	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:23.939521074 CEST	49822	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:23.939939976 CEST	49822	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:23.939959049 CEST	443	49822	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:23.940064907 CEST	443	49822	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:24.048573971 CEST	49824	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:24.048600912 CEST	443	49824	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:24.048713923 CEST	49824	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:24.049060106 CEST	49824	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:24.049072981 CEST	443	49824	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:24.049184084 CEST	443	49824	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:24.157763958 CEST	49826	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:24.157802105 CEST	443	49826	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:24.157881021 CEST	49826	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:24.158277035 CEST	49826	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:24.158294916 CEST	443	49826	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:24.158370018 CEST	443	49826	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:24.267469883 CEST	49829	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:24.267570972 CEST	443	49829	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:24.267721891 CEST	49829	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:24.268091917 CEST	49829	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:24.268106937 CEST	443	49829	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:24.268213034 CEST	443	49829	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:24.377007961 CEST	49830	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:24.377051115 CEST	443	49830	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:24.377173901 CEST	49830	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:24.377469063 CEST	49830	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:24.377480030 CEST	443	49830	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:24.377522945 CEST	443	49830	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:24.486171007 CEST	49831	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:24.486274958 CEST	443	49831	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:24.486429930 CEST	49831	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:24.486815929 CEST	49831	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:24.486850977 CEST	443	49831	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:24.486957073 CEST	443	49831	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:24.595254898 CEST	49832	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:24.595309019 CEST	443	49832	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:24.595392942 CEST	49832	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:24.595906019 CEST	49832	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:24.595926046 CEST	443	49832	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:24.595971107 CEST	443	49832	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:24.704854965 CEST	49833	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:24.704909086 CEST	443	49833	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:24.704993963 CEST	49833	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:24.705300093 CEST	49833	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:24.705310106 CEST	443	49833	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:24.705353975 CEST	443	49833	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:24.814152956 CEST	49836	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:24.814189911 CEST	443	49836	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:24.814297915 CEST	49836	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:24.814623117 CEST	49836	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:24.814637899 CEST	443	49836	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:24.814903975 CEST	443	49836	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:24.923660994 CEST	49837	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:24.923692942 CEST	443	49837	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:24.923789024 CEST	49837	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:24.924139977 CEST	49837	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:24.924149036 CEST	443	49837	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:24.924196959 CEST	443	49837	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:25.032879114 CEST	49840	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:25.032903910 CEST	443	49840	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:25.032994032 CEST	49840	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:25.033286095 CEST	49840	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:25.033299923 CEST	443	49840	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:25.033396959 CEST	443	49840	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:25.142396927 CEST	49842	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:25.142505884 CEST	443	49842	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:25.142613888 CEST	49842	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:25.142937899 CEST	49842	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:25.142976999 CEST	443	49842	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:25.143075943 CEST	443	49842	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:25.251724005 CEST	49843	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:25.251769066 CEST	443	49843	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:25.251888037 CEST	49843	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:25.252192974 CEST	49843	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:25.252206087 CEST	443	49843	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:25.252315044 CEST	443	49843	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:25.360919952 CEST	49844	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:25.360961914 CEST	443	49844	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:25.361063957 CEST	49844	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:25.361404896 CEST	49844	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:25.361421108 CEST	443	49844	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:25.361491919 CEST	443	49844	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:25.470370054 CEST	49845	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:25.470416069 CEST	443	49845	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:25.470501900 CEST	49845	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:25.470973015 CEST	49845	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:25.470989943 CEST	443	49845	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:25.471102953 CEST	443	49845	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:25.579963923 CEST	49848	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:25.580003023 CEST	443	49848	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:25.580090046 CEST	49848	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:25.580456018 CEST	49848	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:25.580472946 CEST	443	49848	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:25.580509901 CEST	443	49848	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:25.689007998 CEST	49850	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:25.689059019 CEST	443	49850	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:25.689136982 CEST	49850	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:25.689516068 CEST	49850	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:25.689527035 CEST	443	49850	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:25.689620972 CEST	443	49850	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:25.798666000 CEST	49851	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:25.798712969 CEST	443	49851	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:25.798825026 CEST	49851	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:25.799264908 CEST	49851	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:25.799277067 CEST	443	49851	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:25.799309969 CEST	443	49851	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:25.907866955 CEST	49854	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:25.907908916 CEST	443	49854	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:25.907978058 CEST	49854	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:25.908253908 CEST	49854	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:25.908269882 CEST	443	49854	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:25.908317089 CEST	443	49854	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:26.017410040 CEST	49855	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:26.017445087 CEST	443	49855	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:26.017553091 CEST	49855	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:26.017965078 CEST	49855	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:26.017980099 CEST	443	49855	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:26.018033028 CEST	443	49855	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:26.126681089 CEST	49856	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:26.126720905 CEST	443	49856	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:26.126816988 CEST	49856	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:26.127087116 CEST	49856	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:26.127104998 CEST	443	49856	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:26.127207041 CEST	443	49856	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:26.236107111 CEST	49857	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:26.236165047 CEST	443	49857	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:26.236259937 CEST	49857	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:26.236818075 CEST	49857	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:26.236838102 CEST	443	49857	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:26.236928940 CEST	443	49857	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:26.345505953 CEST	49858	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:26.345560074 CEST	443	49858	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:26.345685005 CEST	49858	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:26.345980883 CEST	49858	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:26.345999956 CEST	443	49858	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:26.346036911 CEST	443	49858	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:26.454791069 CEST	49861	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:26.454814911 CEST	443	49861	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:26.454876900 CEST	49861	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:26.455203056 CEST	49861	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:26.455213070 CEST	443	49861	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:26.455317974 CEST	443	49861	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:26.564275026 CEST	49863	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:26.564317942 CEST	443	49863	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:26.564440012 CEST	49863	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:26.564734936 CEST	49863	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:26.564750910 CEST	443	49863	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:26.564776897 CEST	443	49863	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:26.673738003 CEST	49866	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:26.673841000 CEST	443	49866	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:26.673940897 CEST	49866	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:26.674222946 CEST	49866	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:26.674271107 CEST	443	49866	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:26.674326897 CEST	443	49866	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:26.783015966 CEST	49867	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:26.783060074 CEST	443	49867	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:26.783165932 CEST	49867	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:26.783597946 CEST	49867	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:26.783611059 CEST	443	49867	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:26.783643007 CEST	443	49867	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:26.892354965 CEST	49868	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:26.892394066 CEST	443	49868	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:26.892523050 CEST	49868	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:26.892855883 CEST	49868	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:26.892868042 CEST	443	49868	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:26.892944098 CEST	443	49868	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:27.001619101 CEST	49869	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:27.001660109 CEST	443	49869	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:27.001739979 CEST	49869	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:27.002062082 CEST	49869	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:27.002074003 CEST	443	49869	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:27.002146959 CEST	443	49869	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:27.111169100 CEST	49870	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:27.111212969 CEST	443	49870	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:27.111300945 CEST	49870	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:27.111649990 CEST	49870	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:27.111663103 CEST	443	49870	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:27.111721039 CEST	443	49870	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:27.220462084 CEST	49872	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:27.220501900 CEST	443	49872	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:27.220726013 CEST	49872	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:27.220983982 CEST	49872	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:27.220994949 CEST	443	49872	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:27.221101046 CEST	443	49872	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:27.329843044 CEST	49875	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:27.329885960 CEST	443	49875	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:27.329972982 CEST	49875	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:27.330334902 CEST	49875	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:27.330351114 CEST	443	49875	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:27.330439091 CEST	443	49875	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:27.439409018 CEST	49876	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:27.439467907 CEST	443	49876	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:27.439601898 CEST	49876	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:27.439944029 CEST	49876	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:27.439963102 CEST	443	49876	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:27.440030098 CEST	443	49876	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:27.548593998 CEST	49879	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:27.548655987 CEST	443	49879	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:27.548752069 CEST	49879	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:27.549102068 CEST	49879	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:27.549112082 CEST	443	49879	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:27.549168110 CEST	443	49879	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:27.671324968 CEST	49880	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:27.671349049 CEST	443	49880	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:27.671432018 CEST	49880	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:27.672094107 CEST	49880	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:27.672107935 CEST	443	49880	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:27.672189951 CEST	443	49880	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:27.783231974 CEST	49881	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:27.783277035 CEST	443	49881	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:27.783401966 CEST	49881	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:27.783881903 CEST	49881	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:27.783894062 CEST	443	49881	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:27.783986092 CEST	443	49881	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:27.892383099 CEST	49882	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:27.892400980 CEST	443	49882	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:27.892596006 CEST	49882	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:27.892837048 CEST	49882	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:27.892846107 CEST	443	49882	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:27.892934084 CEST	443	49882	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:28.001981020 CEST	49885	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:28.002003908 CEST	443	49885	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:28.002068996 CEST	49885	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:28.002422094 CEST	49885	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:28.002433062 CEST	443	49885	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:28.002518892 CEST	443	49885	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:28.111715078 CEST	49887	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:28.111761093 CEST	443	49887	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:28.111846924 CEST	49887	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:28.112222910 CEST	49887	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:28.112235069 CEST	443	49887	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:28.112360001 CEST	443	49887	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:28.223681927 CEST	49888	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:28.223737955 CEST	443	49888	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:28.223815918 CEST	49888	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:28.224134922 CEST	49888	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:28.224152088 CEST	443	49888	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:28.224292994 CEST	443	49888	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:28.373539925 CEST	49890	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:28.373572111 CEST	443	49890	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:28.373651028 CEST	49890	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:28.373955965 CEST	49890	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:28.373967886 CEST	443	49890	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:28.374099970 CEST	443	49890	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:28.497288942 CEST	49892	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:28.497323990 CEST	443	49892	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:28.497437954 CEST	49892	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:28.501470089 CEST	49892	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:28.501487970 CEST	443	49892	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:28.501579046 CEST	443	49892	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:28.634918928 CEST	49893	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:28.634959936 CEST	443	49893	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:28.635037899 CEST	49893	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:28.635628939 CEST	49893	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:28.635641098 CEST	443	49893	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:28.635730028 CEST	443	49893	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:28.751717091 CEST	49894	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:28.751759052 CEST	443	49894	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:28.751832008 CEST	49894	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:28.752338886 CEST	49894	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:28.752351046 CEST	443	49894	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:28.752435923 CEST	443	49894	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:28.861103058 CEST	49897	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:28.861134052 CEST	443	49897	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:28.861433029 CEST	49897	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:28.861947060 CEST	49897	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:28.861965895 CEST	443	49897	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:28.862031937 CEST	443	49897	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:28.970556021 CEST	49899	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:28.970581055 CEST	443	49899	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:28.970653057 CEST	49899	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:28.970966101 CEST	49899	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:28.970978975 CEST	443	49899	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:28.971043110 CEST	443	49899	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:29.079632044 CEST	49901	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:29.079658031 CEST	443	49901	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:29.079726934 CEST	49901	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:29.080130100 CEST	49901	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:29.080148935 CEST	443	49901	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:29.080210924 CEST	443	49901	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:29.188993931 CEST	49903	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:29.189013958 CEST	443	49903	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:29.189084053 CEST	49903	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:29.189385891 CEST	49903	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:29.189395905 CEST	443	49903	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:29.190129995 CEST	443	49903	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:29.299077988 CEST	49904	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:29.299118042 CEST	443	49904	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:29.299283981 CEST	49904	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:29.299612045 CEST	49904	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:29.299626112 CEST	443	49904	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:29.299709082 CEST	443	49904	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:29.408196926 CEST	49906	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:29.408232927 CEST	443	49906	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:29.408416033 CEST	49906	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:29.408783913 CEST	49906	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:29.408798933 CEST	443	49906	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:29.408854961 CEST	443	49906	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:29.517338991 CEST	49907	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:29.517407894 CEST	443	49907	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:29.517499924 CEST	49907	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:29.517929077 CEST	49907	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:29.517946005 CEST	443	49907	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:29.518035889 CEST	443	49907	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:29.626688957 CEST	49909	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:29.626712084 CEST	443	49909	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:29.626777887 CEST	49909	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:29.627083063 CEST	49909	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:29.627096891 CEST	443	49909	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:29.627136946 CEST	443	49909	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:29.736186981 CEST	49911	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:29.736227036 CEST	443	49911	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:29.736299038 CEST	49911	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:29.736706018 CEST	49911	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:29.736728907 CEST	443	49911	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:29.736756086 CEST	443	49911	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:29.845424891 CEST	49913	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:29.845448971 CEST	443	49913	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:29.845524073 CEST	49913	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:29.845824003 CEST	49913	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:29.845832109 CEST	443	49913	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:29.845868111 CEST	443	49913	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:29.954881907 CEST	49915	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:29.954925060 CEST	443	49915	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:29.955007076 CEST	49915	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:29.955334902 CEST	49915	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:29.955353975 CEST	443	49915	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:29.955394983 CEST	443	49915	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:30.080794096 CEST	49917	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:30.080828905 CEST	443	49917	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:30.080899000 CEST	49917	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:30.081492901 CEST	49917	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:30.081505060 CEST	443	49917	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:30.081542015 CEST	443	49917	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:30.190496922 CEST	49919	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:30.190555096 CEST	443	49919	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:30.190633059 CEST	49919	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:30.190924883 CEST	49919	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:30.190943003 CEST	443	49919	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:30.190973997 CEST	443	49919	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:30.298978090 CEST	49920	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:30.299004078 CEST	443	49920	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:30.299112082 CEST	49920	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:30.299479008 CEST	49920	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:30.299485922 CEST	443	49920	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:30.299515963 CEST	443	49920	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:30.407996893 CEST	49922	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:30.408035994 CEST	443	49922	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:30.408299923 CEST	49922	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:30.408596992 CEST	49922	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:30.408608913 CEST	443	49922	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:30.408658028 CEST	443	49922	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:30.517038107 CEST	49924	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:30.517071962 CEST	443	49924	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:30.517128944 CEST	49924	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:30.517421007 CEST	49924	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:30.517435074 CEST	443	49924	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:30.517484903 CEST	443	49924	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:30.626702070 CEST	49926	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:30.626737118 CEST	443	49926	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:30.626835108 CEST	49926	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:30.627132893 CEST	49926	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:30.627145052 CEST	443	49926	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:30.627233028 CEST	443	49926	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:30.764884949 CEST	49928	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:30.764925957 CEST	443	49928	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:30.764997005 CEST	49928	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:30.765305042 CEST	49928	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:30.765320063 CEST	443	49928	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:30.765408039 CEST	443	49928	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:30.876481056 CEST	49930	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:30.876521111 CEST	443	49930	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:30.876745939 CEST	49930	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:30.877033949 CEST	49930	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:30.877055883 CEST	443	49930	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:30.877135992 CEST	443	49930	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:31.024240971 CEST	49931	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:31.024283886 CEST	443	49931	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:31.024353027 CEST	49931	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:31.024807930 CEST	49931	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:31.024821043 CEST	443	49931	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:31.024903059 CEST	443	49931	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:31.135082960 CEST	49932	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:31.135126114 CEST	443	49932	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:31.135204077 CEST	49932	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:31.138993025 CEST	49932	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:31.139004946 CEST	443	49932	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:31.139086008 CEST	443	49932	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:31.257231951 CEST	49933	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:31.257273912 CEST	443	49933	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:31.257344961 CEST	49933	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:31.260874033 CEST	49933	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:31.260888100 CEST	443	49933	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:31.260921955 CEST	443	49933	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:31.376549959 CEST	49936	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:31.376580000 CEST	443	49936	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:31.376638889 CEST	49936	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:31.376898050 CEST	49936	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:31.376909018 CEST	443	49936	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:31.376969099 CEST	443	49936	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:31.486018896 CEST	49940	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:31.486036062 CEST	443	49940	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:31.486362934 CEST	49940	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:31.486362934 CEST	49940	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:31.486386061 CEST	443	49940	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:31.486447096 CEST	443	49940	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:31.595232964 CEST	49942	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:31.595268011 CEST	443	49942	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:31.595375061 CEST	49942	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:31.595649004 CEST	49942	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:31.595664024 CEST	443	49942	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:31.595698118 CEST	443	49942	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:31.705338001 CEST	49943	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:31.705374002 CEST	443	49943	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:31.705476999 CEST	49943	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:31.705832958 CEST	49943	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:31.705843925 CEST	443	49943	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:31.705912113 CEST	443	49943	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:31.814017057 CEST	49944	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:31.814069033 CEST	443	49944	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:31.814243078 CEST	49944	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:31.814569950 CEST	49944	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:31.814589024 CEST	443	49944	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:31.814624071 CEST	443	49944	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:31.923685074 CEST	49945	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:31.923724890 CEST	443	49945	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:31.923877954 CEST	49945	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:31.924217939 CEST	49945	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:31.924235106 CEST	443	49945	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:31.924273968 CEST	443	49945	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:32.033102989 CEST	49946	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:32.033145905 CEST	443	49946	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:32.033248901 CEST	49946	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:32.033618927 CEST	49946	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:32.033631086 CEST	443	49946	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:32.033684015 CEST	443	49946	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:32.142607927 CEST	49948	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:32.142648935 CEST	443	49948	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:32.142721891 CEST	49948	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:32.143354893 CEST	49948	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:32.143381119 CEST	443	49948	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:32.143429041 CEST	443	49948	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:32.251605988 CEST	49950	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:32.251653910 CEST	443	49950	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:32.252413034 CEST	49950	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:32.252815962 CEST	49950	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:32.252846003 CEST	443	49950	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:32.252881050 CEST	443	49950	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:32.361329079 CEST	49953	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:32.361382008 CEST	443	49953	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:32.361465931 CEST	49953	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:32.361799955 CEST	49953	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:32.361820936 CEST	443	49953	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:32.361859083 CEST	443	49953	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:32.470532894 CEST	49955	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:32.470573902 CEST	443	49955	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:32.470655918 CEST	49955	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:32.471055031 CEST	49955	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:32.471076965 CEST	443	49955	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:32.471113920 CEST	443	49955	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:32.579767942 CEST	49956	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:32.579813004 CEST	443	49956	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:32.579890013 CEST	49956	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:32.580220938 CEST	49956	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:32.580235958 CEST	443	49956	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:32.580281973 CEST	443	49956	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:32.689438105 CEST	49957	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:32.689480066 CEST	443	49957	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:32.689599037 CEST	49957	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:32.690000057 CEST	49957	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:32.690011978 CEST	443	49957	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:32.690052986 CEST	443	49957	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:32.798603058 CEST	49958	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:32.798640013 CEST	443	49958	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:32.798722982 CEST	49958	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:32.799093008 CEST	49958	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:32.799104929 CEST	443	49958	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:32.799149990 CEST	443	49958	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:32.908500910 CEST	49959	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:32.908549070 CEST	443	49959	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:32.908629894 CEST	49959	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:32.909013033 CEST	49959	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:32.909029007 CEST	443	49959	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:32.909077883 CEST	443	49959	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:33.032718897 CEST	49962	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:33.032742977 CEST	443	49962	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:33.032819986 CEST	49962	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:33.033093929 CEST	49962	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:33.033103943 CEST	443	49962	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:33.033127069 CEST	443	49962	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:33.142102003 CEST	49965	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:33.142129898 CEST	443	49965	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:33.142194033 CEST	49965	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:33.142509937 CEST	49965	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:33.142520905 CEST	443	49965	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:33.142560005 CEST	443	49965	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:33.251657963 CEST	49967	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:33.251682997 CEST	443	49967	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:33.251764059 CEST	49967	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:33.252087116 CEST	49967	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:33.252096891 CEST	443	49967	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:33.252132893 CEST	443	49967	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:33.361056089 CEST	49968	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:33.361100912 CEST	443	49968	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:33.361196041 CEST	49968	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:33.361515999 CEST	49968	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:33.361529112 CEST	443	49968	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:33.361571074 CEST	443	49968	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:33.470345974 CEST	49969	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:33.470393896 CEST	443	49969	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:33.470504999 CEST	49969	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:33.470851898 CEST	49969	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:33.470868111 CEST	443	49969	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:33.470916033 CEST	443	49969	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:33.579699039 CEST	49970	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:33.579725027 CEST	443	49970	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:33.579796076 CEST	49970	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:33.580111027 CEST	49970	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:33.580123901 CEST	443	49970	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:33.580161095 CEST	443	49970	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:33.689678907 CEST	49971	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:33.689726114 CEST	443	49971	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:33.689799070 CEST	49971	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:33.690413952 CEST	49971	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:33.690428019 CEST	443	49971	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:33.690463066 CEST	443	49971	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:33.799252987 CEST	49974	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:33.799292088 CEST	443	49974	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:33.799351931 CEST	49974	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:33.799621105 CEST	49974	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:33.799640894 CEST	443	49974	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:33.799674988 CEST	443	49974	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:33.907756090 CEST	49977	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:33.907769918 CEST	443	49977	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:33.907852888 CEST	49977	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:33.908128977 CEST	49977	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:33.908139944 CEST	443	49977	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:33.908190012 CEST	443	49977	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:34.017970085 CEST	49978	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:34.018017054 CEST	443	49978	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:34.018110037 CEST	49978	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:34.019037008 CEST	49978	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:34.019052029 CEST	443	49978	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:34.019092083 CEST	443	49978	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:34.126744032 CEST	49980	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:34.126775980 CEST	443	49980	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:34.126847029 CEST	49980	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:34.127253056 CEST	49980	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:34.127265930 CEST	443	49980	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:34.127304077 CEST	443	49980	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:34.238972902 CEST	49981	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:34.239027023 CEST	443	49981	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:34.239109039 CEST	49981	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:34.239509106 CEST	49981	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:34.239522934 CEST	443	49981	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:34.239558935 CEST	443	49981	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:34.345304012 CEST	49982	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:34.345359087 CEST	443	49982	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:34.345424891 CEST	49982	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:34.345736980 CEST	49982	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:34.345758915 CEST	443	49982	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:34.345796108 CEST	443	49982	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:34.455068111 CEST	49983	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:34.455106974 CEST	443	49983	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:34.455224991 CEST	49983	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:34.455702066 CEST	49983	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:34.455719948 CEST	443	49983	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:34.455777884 CEST	443	49983	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:34.564055920 CEST	49985	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:34.564084053 CEST	443	49985	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:34.564172029 CEST	49985	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:34.564524889 CEST	49985	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:34.564539909 CEST	443	49985	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:34.564569950 CEST	443	49985	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:34.673464060 CEST	49988	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:34.673475027 CEST	443	49988	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:34.673546076 CEST	49988	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:34.673825979 CEST	49988	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:34.673835993 CEST	443	49988	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:34.673871994 CEST	443	49988	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:34.782866001 CEST	49991	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:34.782876968 CEST	443	49991	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:34.782958984 CEST	49991	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:34.783312082 CEST	49991	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:34.783319950 CEST	443	49991	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:34.783368111 CEST	443	49991	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:34.892214060 CEST	49993	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:34.892221928 CEST	443	49993	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:34.892302036 CEST	49993	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:34.892683983 CEST	49993	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:34.892692089 CEST	443	49993	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:34.892710924 CEST	443	49993	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:35.001698017 CEST	49994	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:35.001710892 CEST	443	49994	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:35.001796961 CEST	49994	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:35.002162933 CEST	49994	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:35.002173901 CEST	443	49994	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:35.002202988 CEST	443	49994	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:35.111154079 CEST	49995	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:35.111258984 CEST	443	49995	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:35.111366987 CEST	49995	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:35.111680031 CEST	49995	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:35.111699104 CEST	443	49995	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:35.111757994 CEST	443	49995	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:35.220341921 CEST	49996	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:35.220382929 CEST	443	49996	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:35.220491886 CEST	49996	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:35.220737934 CEST	49996	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:35.220752001 CEST	443	49996	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:35.220808029 CEST	443	49996	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:35.329869032 CEST	49997	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:35.329940081 CEST	443	49997	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:35.330079079 CEST	49997	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:35.330449104 CEST	49997	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:35.330480099 CEST	443	49997	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:35.330524921 CEST	443	49997	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:35.439408064 CEST	49999	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:35.439450026 CEST	443	49999	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:35.439594030 CEST	49999	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:35.440068007 CEST	49999	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:35.440079927 CEST	443	49999	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:35.440124989 CEST	443	49999	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:35.548722982 CEST	50003	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:35.548752069 CEST	443	50003	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:35.548857927 CEST	50003	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:35.549134970 CEST	50003	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:35.549149036 CEST	443	50003	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:35.549196959 CEST	443	50003	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:35.658428907 CEST	50004	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:35.658479929 CEST	443	50004	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:35.658543110 CEST	50004	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:35.658893108 CEST	50004	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:35.658906937 CEST	443	50004	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:35.658936977 CEST	443	50004	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:35.767570972 CEST	50006	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:35.767597914 CEST	443	50006	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:35.767683029 CEST	50006	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:35.768342972 CEST	50006	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:35.768358946 CEST	443	50006	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:35.768405914 CEST	443	50006	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:35.876950979 CEST	50007	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:35.876990080 CEST	443	50007	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:35.877069950 CEST	50007	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:35.877449989 CEST	50007	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:35.877459049 CEST	443	50007	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:35.877521038 CEST	443	50007	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:35.986733913 CEST	50008	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:35.986779928 CEST	443	50008	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:35.986860991 CEST	50008	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:35.987212896 CEST	50008	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:35.987231016 CEST	443	50008	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:35.987281084 CEST	443	50008	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:36.095443964 CEST	50009	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:36.095485926 CEST	443	50009	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:36.095861912 CEST	50009	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:36.095861912 CEST	50009	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:36.095900059 CEST	443	50009	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:36.095987082 CEST	443	50009	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:36.204689980 CEST	50011	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:36.204705000 CEST	443	50011	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:36.204777956 CEST	50011	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:36.205055952 CEST	50011	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:36.205071926 CEST	443	50011	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:36.205131054 CEST	443	50011	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:36.314022064 CEST	50015	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:36.314049006 CEST	443	50015	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:36.314122915 CEST	50015	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:36.314416885 CEST	50015	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:36.314434052 CEST	443	50015	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:36.314476967 CEST	443	50015	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:36.423727036 CEST	50016	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:36.423787117 CEST	443	50016	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:36.423886061 CEST	50016	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:36.424479008 CEST	50016	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:36.424496889 CEST	443	50016	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:36.424563885 CEST	443	50016	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:36.532942057 CEST	50018	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:36.532979965 CEST	443	50018	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:36.533052921 CEST	50018	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:36.533669949 CEST	50018	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:36.533679008 CEST	443	50018	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:36.533718109 CEST	443	50018	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:36.642930031 CEST	50019	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:36.642976999 CEST	443	50019	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:36.643126011 CEST	50019	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:36.643630981 CEST	50019	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:36.643644094 CEST	443	50019	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:36.643697023 CEST	443	50019	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:36.751558065 CEST	50020	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:36.751614094 CEST	443	50020	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:36.751693964 CEST	50020	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:36.752111912 CEST	50020	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:36.752130985 CEST	443	50020	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:36.752188921 CEST	443	50020	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:36.861161947 CEST	50021	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:36.861208916 CEST	443	50021	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:36.861493111 CEST	50021	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:36.861814022 CEST	50021	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:36.861823082 CEST	443	50021	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:36.861865997 CEST	443	50021	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:36.970504999 CEST	50022	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:36.970549107 CEST	443	50022	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:36.970685005 CEST	50022	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:36.971143007 CEST	50022	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:36.971162081 CEST	443	50022	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:36.971194983 CEST	443	50022	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:37.079822063 CEST	50025	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:37.079857111 CEST	443	50025	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:37.079956055 CEST	50025	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:37.080394030 CEST	50025	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:37.080409050 CEST	443	50025	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:37.080452919 CEST	443	50025	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:37.189192057 CEST	50028	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:37.189249039 CEST	443	50028	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:37.189347029 CEST	50028	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:37.189779043 CEST	50028	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:37.189793110 CEST	443	50028	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:37.189855099 CEST	443	50028	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:37.298479080 CEST	50030	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:37.298515081 CEST	443	50030	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:37.298621893 CEST	50030	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:37.299072027 CEST	50030	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:37.299089909 CEST	443	50030	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:37.299138069 CEST	443	50030	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:37.410797119 CEST	50031	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:37.410876036 CEST	443	50031	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:37.410973072 CEST	50031	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:37.411375046 CEST	50031	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:37.411387920 CEST	443	50031	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:37.411443949 CEST	443	50031	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:37.517797947 CEST	50032	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:37.517862082 CEST	443	50032	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:37.518069983 CEST	50032	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:37.518356085 CEST	50032	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:37.518367052 CEST	443	50032	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:37.518416882 CEST	443	50032	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:37.626737118 CEST	50033	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:37.626791000 CEST	443	50033	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:37.626910925 CEST	50033	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:37.627249956 CEST	50033	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:37.627264023 CEST	443	50033	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:37.627325058 CEST	443	50033	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:37.735907078 CEST	50034	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:37.735949039 CEST	443	50034	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:37.736022949 CEST	50034	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:37.736398935 CEST	50034	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:37.736414909 CEST	443	50034	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:37.736478090 CEST	443	50034	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:37.845335007 CEST	50037	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:37.845350027 CEST	443	50037	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:37.845428944 CEST	50037	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:37.845679998 CEST	50037	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:37.845695019 CEST	443	50037	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:37.845736027 CEST	443	50037	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:37.954992056 CEST	50040	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:37.955044985 CEST	443	50040	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:37.955265999 CEST	50040	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:37.955457926 CEST	50040	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:37.955481052 CEST	443	50040	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:37.955521107 CEST	443	50040	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:38.064261913 CEST	50041	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:38.064331055 CEST	443	50041	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:38.064424992 CEST	50041	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:38.064790010 CEST	50041	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:38.064806938 CEST	443	50041	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:38.064837933 CEST	443	50041	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:38.173713923 CEST	50043	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:38.173780918 CEST	443	50043	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:38.173938036 CEST	50043	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:38.174416065 CEST	50043	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:38.174439907 CEST	443	50043	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:38.174509048 CEST	443	50043	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:38.282964945 CEST	50044	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:38.283020020 CEST	443	50044	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:38.283128977 CEST	50044	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:38.283502102 CEST	50044	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:38.283529043 CEST	443	50044	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:38.283590078 CEST	443	50044	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:38.392291069 CEST	50045	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:38.392330885 CEST	443	50045	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:38.392447948 CEST	50045	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:38.392860889 CEST	50045	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:38.392874002 CEST	443	50045	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:38.392911911 CEST	443	50045	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:38.501983881 CEST	50046	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:38.502005100 CEST	443	50046	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:38.502099991 CEST	50046	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:38.502549887 CEST	50046	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:38.502561092 CEST	443	50046	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:38.502599955 CEST	443	50046	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:38.611079931 CEST	50047	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:38.611134052 CEST	443	50047	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:38.611236095 CEST	50047	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:38.611630917 CEST	50047	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:38.611650944 CEST	443	50047	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:38.611690044 CEST	443	50047	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:38.720479012 CEST	50049	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:38.720520973 CEST	443	50049	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:38.720591068 CEST	50049	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:38.720942974 CEST	50049	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:38.720968008 CEST	443	50049	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:38.721014977 CEST	443	50049	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:38.829788923 CEST	50053	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:38.829828024 CEST	443	50053	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:38.829919100 CEST	50053	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:38.830234051 CEST	50053	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:38.830246925 CEST	443	50053	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:38.830327034 CEST	443	50053	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:38.939172983 CEST	50055	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:38.939218998 CEST	443	50055	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:38.939342022 CEST	50055	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:38.939678907 CEST	50055	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:38.939694881 CEST	443	50055	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:38.939758062 CEST	443	50055	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:39.048717976 CEST	50056	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:39.048764944 CEST	443	50056	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:39.048860073 CEST	50056	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:39.049160004 CEST	50056	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:39.049174070 CEST	443	50056	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:39.049251080 CEST	443	50056	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:39.157947063 CEST	50057	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:39.158019066 CEST	443	50057	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:39.158119917 CEST	50057	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:39.158512115 CEST	50057	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:39.158529997 CEST	443	50057	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:39.158597946 CEST	443	50057	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:39.267291069 CEST	50058	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:39.267343998 CEST	443	50058	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:39.267451048 CEST	50058	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:39.267740965 CEST	50058	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:39.267755985 CEST	443	50058	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:39.267816067 CEST	443	50058	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:39.376889944 CEST	50059	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:39.376941919 CEST	443	50059	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:39.377079964 CEST	50059	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:39.377470970 CEST	50059	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:39.377485037 CEST	443	50059	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:39.377559900 CEST	443	50059	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:39.506208897 CEST	50060	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:39.506280899 CEST	443	50060	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:39.506380081 CEST	50060	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:39.506726980 CEST	50060	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:39.506738901 CEST	443	50060	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:39.506824017 CEST	443	50060	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:39.611157894 CEST	50065	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:39.611208916 CEST	443	50065	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:39.611282110 CEST	50065	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:39.611576080 CEST	50065	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:39.611596107 CEST	443	50065	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:39.611624956 CEST	443	50065	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:39.720632076 CEST	50067	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:39.720657110 CEST	443	50067	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:39.720727921 CEST	50067	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:39.721054077 CEST	50067	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:39.721061945 CEST	443	50067	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:39.721096992 CEST	443	50067	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:39.829842091 CEST	50068	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:39.829885006 CEST	443	50068	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:39.829968929 CEST	50068	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:39.830296040 CEST	50068	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:39.830316067 CEST	443	50068	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:39.830393076 CEST	443	50068	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:39.939150095 CEST	50069	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:39.939203024 CEST	443	50069	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:39.939300060 CEST	50069	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:39.939815044 CEST	50069	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:39.939835072 CEST	443	50069	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:39.939873934 CEST	443	50069	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:40.048659086 CEST	50070	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:40.048705101 CEST	443	50070	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:40.048804045 CEST	50070	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:40.049421072 CEST	50070	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:40.049434900 CEST	443	50070	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:40.049472094 CEST	443	50070	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:40.157968044 CEST	50071	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:40.158009052 CEST	443	50071	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:40.158087969 CEST	50071	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:40.158395052 CEST	50071	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:40.158406973 CEST	443	50071	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:40.158447981 CEST	443	50071	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:40.267282009 CEST	50072	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:40.267318964 CEST	443	50072	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:40.267400980 CEST	50072	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:40.267805099 CEST	50072	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:40.267822027 CEST	443	50072	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:40.267855883 CEST	443	50072	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:40.376542091 CEST	50077	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:40.376555920 CEST	443	50077	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:40.376635075 CEST	50077	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:40.376965046 CEST	50077	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:40.376976013 CEST	443	50077	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:40.377015114 CEST	443	50077	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:40.486186028 CEST	50079	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:40.486202955 CEST	443	50079	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:40.486275911 CEST	50079	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:40.486620903 CEST	50079	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:40.486638069 CEST	443	50079	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:40.486694098 CEST	443	50079	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:40.595473051 CEST	50080	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:40.595524073 CEST	443	50080	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:40.595660925 CEST	50080	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:40.596030951 CEST	50080	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:40.596048117 CEST	443	50080	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:40.596097946 CEST	443	50080	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:40.704866886 CEST	50081	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:40.704906940 CEST	443	50081	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:40.704974890 CEST	50081	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:40.705394983 CEST	50081	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:40.705404043 CEST	443	50081	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:40.705766916 CEST	443	50081	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:40.827367067 CEST	50082	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:40.827393055 CEST	443	50082	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:40.827493906 CEST	50082	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:40.827872992 CEST	50082	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:40.827884912 CEST	443	50082	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:40.827960014 CEST	443	50082	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:40.939030886 CEST	50083	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:40.939083099 CEST	443	50083	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:40.939209938 CEST	50083	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:40.939563990 CEST	50083	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:40.939582109 CEST	443	50083	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:40.939707994 CEST	443	50083	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:41.048558950 CEST	50084	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:41.048573971 CEST	443	50084	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:41.048758030 CEST	50084	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:41.049189091 CEST	50084	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:41.049204111 CEST	443	50084	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:41.049280882 CEST	443	50084	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:41.158068895 CEST	50085	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:41.158107042 CEST	443	50085	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:41.158183098 CEST	50085	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:41.158483982 CEST	50085	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:41.158498049 CEST	443	50085	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:41.158554077 CEST	443	50085	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:41.267230034 CEST	50090	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:41.267282963 CEST	443	50090	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:41.267441034 CEST	50090	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:41.267802954 CEST	50090	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:41.267817974 CEST	443	50090	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:41.267929077 CEST	443	50090	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:41.376544952 CEST	50092	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:41.376579046 CEST	443	50092	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:41.376655102 CEST	50092	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:41.377011061 CEST	50092	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:41.377031088 CEST	443	50092	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:41.377110958 CEST	443	50092	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:41.498831987 CEST	50093	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:41.498886108 CEST	443	50093	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:41.498958111 CEST	50093	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:41.499331951 CEST	50093	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:41.499347925 CEST	443	50093	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:41.499466896 CEST	443	50093	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:41.611223936 CEST	50094	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:41.611267090 CEST	443	50094	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:41.611360073 CEST	50094	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:41.611738920 CEST	50094	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:41.611752033 CEST	443	50094	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:41.611870050 CEST	443	50094	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:41.720387936 CEST	50095	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:41.720421076 CEST	443	50095	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:41.720490932 CEST	50095	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:41.720827103 CEST	50095	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:41.720840931 CEST	443	50095	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:41.720957994 CEST	443	50095	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:41.829773903 CEST	50096	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:41.829816103 CEST	443	50096	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:41.829899073 CEST	50096	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:41.830568075 CEST	50096	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:41.830585957 CEST	443	50096	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:41.830733061 CEST	443	50096	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:41.939409018 CEST	50097	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:41.939448118 CEST	443	50097	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:41.939580917 CEST	50097	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:41.939903975 CEST	50097	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:41.939922094 CEST	443	50097	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:41.940052986 CEST	443	50097	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:42.048515081 CEST	50102	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:42.048548937 CEST	443	50102	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:42.048639059 CEST	50102	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:42.048964024 CEST	50102	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:42.048980951 CEST	443	50102	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:42.049076080 CEST	443	50102	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:42.157854080 CEST	50104	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:42.157890081 CEST	443	50104	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:42.158015013 CEST	50104	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:42.158312082 CEST	50104	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:42.158325911 CEST	443	50104	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:42.158468962 CEST	443	50104	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:42.267452955 CEST	50105	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:42.267491102 CEST	443	50105	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:42.267581940 CEST	50105	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:42.268033981 CEST	50105	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:42.268049955 CEST	443	50105	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:42.268184900 CEST	443	50105	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:42.376672983 CEST	50106	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:42.376715899 CEST	443	50106	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:42.376811028 CEST	50106	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:42.377242088 CEST	50106	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:42.377259970 CEST	443	50106	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:42.377374887 CEST	443	50106	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:42.486145020 CEST	50107	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:42.486186981 CEST	443	50107	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:42.486273050 CEST	50107	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:42.486620903 CEST	50107	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:42.486634970 CEST	443	50107	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:42.486756086 CEST	443	50107	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:42.595331907 CEST	50108	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:42.595371008 CEST	443	50108	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:42.595453024 CEST	50108	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:42.595948935 CEST	50108	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:42.595964909 CEST	443	50108	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:42.596045017 CEST	443	50108	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:42.705156088 CEST	50109	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:42.705240011 CEST	443	50109	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:42.705348969 CEST	50109	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:42.705804110 CEST	50109	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:42.705830097 CEST	443	50109	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:42.705918074 CEST	443	50109	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:42.814218998 CEST	50114	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:42.814248085 CEST	443	50114	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:42.814330101 CEST	50114	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:42.814656973 CEST	50114	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:42.814671993 CEST	443	50114	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:42.814753056 CEST	443	50114	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:42.923592091 CEST	50116	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:42.923613071 CEST	443	50116	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:42.923701048 CEST	50116	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:42.924087048 CEST	50116	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:42.924098969 CEST	443	50116	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:42.924217939 CEST	443	50116	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:43.033348083 CEST	50117	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:43.033437967 CEST	443	50117	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:43.033538103 CEST	50117	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:43.033843994 CEST	50117	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:43.033868074 CEST	443	50117	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:43.033951998 CEST	443	50117	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:43.142314911 CEST	50118	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:43.142405033 CEST	443	50118	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:43.142560959 CEST	50118	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:43.142867088 CEST	50118	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:43.142895937 CEST	443	50118	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:43.142990112 CEST	443	50118	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:43.251893997 CEST	50119	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:43.251931906 CEST	443	50119	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:43.252001047 CEST	50119	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:43.252315998 CEST	50119	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:43.252326012 CEST	443	50119	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:43.252413988 CEST	443	50119	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:43.361320972 CEST	50120	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:43.361368895 CEST	443	50120	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:43.361498117 CEST	50120	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:43.361807108 CEST	50120	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:43.361824036 CEST	443	50120	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:43.361898899 CEST	443	50120	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:43.470581055 CEST	50121	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:43.470614910 CEST	443	50121	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:43.470798016 CEST	50121	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:43.471237898 CEST	50121	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:43.471251965 CEST	443	50121	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:43.471342087 CEST	443	50121	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:43.580048084 CEST	50124	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:43.580091000 CEST	443	50124	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:43.581264019 CEST	50124	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:43.581614971 CEST	50124	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:43.581645012 CEST	443	50124	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:43.581698895 CEST	443	50124	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:43.689716101 CEST	50127	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:43.689796925 CEST	443	50127	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:43.689891100 CEST	50127	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:43.690252066 CEST	50127	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:43.690288067 CEST	443	50127	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:43.690382004 CEST	443	50127	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:43.798536062 CEST	50129	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:43.798577070 CEST	443	50129	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:43.798726082 CEST	50129	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:43.799098015 CEST	50129	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:43.799113035 CEST	443	50129	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:43.799241066 CEST	443	50129	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:43.907973051 CEST	50130	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:43.908014059 CEST	443	50130	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:43.908091068 CEST	50130	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:43.908404112 CEST	50130	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:43.908416033 CEST	443	50130	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:43.908534050 CEST	443	50130	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:44.017349958 CEST	50131	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:44.017422915 CEST	443	50131	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:44.017579079 CEST	50131	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:44.017884016 CEST	50131	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:44.017904043 CEST	443	50131	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:44.018202066 CEST	443	50131	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:44.126749039 CEST	50132	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:44.126796961 CEST	443	50132	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:44.127006054 CEST	50132	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:44.127410889 CEST	50132	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:44.127429962 CEST	443	50132	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:44.127465963 CEST	443	50132	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:44.236000061 CEST	50133	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:44.236028910 CEST	443	50133	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:44.236170053 CEST	50133	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:44.236458063 CEST	50133	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:44.236468077 CEST	443	50133	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:44.236496925 CEST	443	50133	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:44.345310926 CEST	50134	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:44.345357895 CEST	443	50134	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:44.345510006 CEST	50134	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:44.345835924 CEST	50134	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:44.345854998 CEST	443	50134	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:44.345921040 CEST	443	50134	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:44.454830885 CEST	50139	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:44.454871893 CEST	443	50139	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:44.454996109 CEST	50139	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:44.455394030 CEST	50139	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:44.455405951 CEST	443	50139	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:44.455457926 CEST	443	50139	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:44.564080000 CEST	50141	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:44.564111948 CEST	443	50141	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:44.564271927 CEST	50141	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:44.564588070 CEST	50141	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:44.564603090 CEST	443	50141	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:44.564634085 CEST	443	50141	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:44.673902035 CEST	50142	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:44.673935890 CEST	443	50142	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:44.674056053 CEST	50142	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:44.674371958 CEST	50142	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:44.674386978 CEST	443	50142	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:44.674448013 CEST	443	50142	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:44.782946110 CEST	50143	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:44.782988071 CEST	443	50143	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:44.783058882 CEST	50143	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:44.783406019 CEST	50143	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:44.783417940 CEST	443	50143	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:44.783456087 CEST	443	50143	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:44.893282890 CEST	50144	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:44.893315077 CEST	443	50144	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:44.893934011 CEST	50144	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:44.893934011 CEST	50144	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:44.893963099 CEST	443	50144	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:44.894085884 CEST	443	50144	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:45.001868010 CEST	50145	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:45.001908064 CEST	443	50145	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:45.002106905 CEST	50145	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:45.002376080 CEST	50145	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:45.002389908 CEST	443	50145	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:45.002440929 CEST	443	50145	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:45.112082958 CEST	50146	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:45.112112045 CEST	443	50146	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:45.112303019 CEST	50146	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:45.112617970 CEST	50146	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:45.112633944 CEST	443	50146	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:45.112668991 CEST	443	50146	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:45.220873117 CEST	50147	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:45.220900059 CEST	443	50147	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:45.221009970 CEST	50147	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:45.221440077 CEST	50147	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:45.221450090 CEST	443	50147	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:45.221502066 CEST	443	50147	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:45.329898119 CEST	50148	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:45.329931974 CEST	443	50148	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:45.330059052 CEST	50148	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:45.330444098 CEST	50148	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:45.330455065 CEST	443	50148	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:45.330499887 CEST	443	50148	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:45.439044952 CEST	50154	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:45.439054966 CEST	443	50154	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:45.439129114 CEST	50154	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:45.439414024 CEST	50154	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:45.439424038 CEST	443	50154	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:45.439465046 CEST	443	50154	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:45.548621893 CEST	50155	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:45.548638105 CEST	443	50155	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:45.548840046 CEST	50155	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:45.549360037 CEST	50155	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:45.549379110 CEST	443	50155	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:45.549452066 CEST	443	50155	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:45.658077955 CEST	50156	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:45.658200979 CEST	443	50156	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:45.658319950 CEST	50156	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:45.658734083 CEST	50156	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:45.658771038 CEST	443	50156	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:45.658821106 CEST	443	50156	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:45.767503977 CEST	50157	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:45.767554998 CEST	443	50157	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:45.767683983 CEST	50157	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:45.768006086 CEST	50157	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:45.768019915 CEST	443	50157	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:45.768076897 CEST	443	50157	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:45.876705885 CEST	50158	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:45.876754045 CEST	443	50158	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:45.876840115 CEST	50158	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:45.877193928 CEST	50158	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:45.877207041 CEST	443	50158	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:45.877244949 CEST	443	50158	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:45.985965967 CEST	50159	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:45.986063957 CEST	443	50159	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:45.986339092 CEST	50159	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:45.986471891 CEST	50159	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:45.986505985 CEST	443	50159	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:45.986577034 CEST	443	50159	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:46.095288038 CEST	50160	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:46.095338106 CEST	443	50160	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:46.095457077 CEST	50160	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:46.095773935 CEST	50160	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:46.095793009 CEST	443	50160	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:46.095865965 CEST	443	50160	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:46.204792976 CEST	50162	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:46.204824924 CEST	443	50162	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:46.204937935 CEST	50162	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:46.205301046 CEST	50162	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:46.205311060 CEST	443	50162	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:46.205353022 CEST	443	50162	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:46.314210892 CEST	50167	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:46.314255953 CEST	443	50167	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:46.314338923 CEST	50167	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:46.314693928 CEST	50167	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:46.314708948 CEST	443	50167	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:46.314778090 CEST	443	50167	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:46.423641920 CEST	50168	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:46.423690081 CEST	443	50168	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:46.423840046 CEST	50168	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:46.424195051 CEST	50168	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:46.424205065 CEST	443	50168	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:46.425301075 CEST	443	50168	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:46.532886982 CEST	50169	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:46.532938957 CEST	443	50169	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:46.533066034 CEST	50169	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:46.533354998 CEST	50169	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:46.533373117 CEST	443	50169	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:46.533435106 CEST	443	50169	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:46.642435074 CEST	50170	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:46.642505884 CEST	443	50170	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:46.642611980 CEST	50170	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:46.642927885 CEST	50170	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:46.642961025 CEST	443	50170	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:46.643003941 CEST	443	50170	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:46.751698017 CEST	50171	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:46.751749992 CEST	443	50171	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:46.751827955 CEST	50171	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:46.752212048 CEST	50171	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:46.752226114 CEST	443	50171	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:46.752279043 CEST	443	50171	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:46.860945940 CEST	50172	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:46.860991001 CEST	443	50172	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:46.861069918 CEST	50172	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:46.861403942 CEST	50172	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:46.861413956 CEST	443	50172	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:46.861450911 CEST	443	50172	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:46.970263004 CEST	50173	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:46.970293045 CEST	443	50173	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:46.970372915 CEST	50173	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:46.970771074 CEST	50173	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:46.970788002 CEST	443	50173	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:46.970829010 CEST	443	50173	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:47.079737902 CEST	50179	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:47.079758883 CEST	443	50179	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:47.079830885 CEST	50179	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:47.080147028 CEST	50179	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:47.080161095 CEST	443	50179	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:47.080208063 CEST	443	50179	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:47.189049959 CEST	50180	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:47.189093113 CEST	443	50180	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:47.189167023 CEST	50180	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:47.189472914 CEST	50180	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:47.189496994 CEST	443	50180	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:47.189558983 CEST	443	50180	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:47.298608065 CEST	50181	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:47.298664093 CEST	443	50181	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:47.298758030 CEST	50181	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:47.299026012 CEST	50181	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:47.299045086 CEST	443	50181	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:47.299093008 CEST	443	50181	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:47.407896996 CEST	50182	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:47.407938957 CEST	443	50182	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:47.408037901 CEST	50182	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:47.408344984 CEST	50182	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:47.408358097 CEST	443	50182	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:47.408394098 CEST	443	50182	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:47.517411947 CEST	50183	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:47.517462015 CEST	443	50183	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:47.517604113 CEST	50183	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:47.517947912 CEST	50183	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:47.517971039 CEST	443	50183	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:47.518022060 CEST	443	50183	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:47.626549959 CEST	50184	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:47.626595020 CEST	443	50184	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:47.626672983 CEST	50184	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:47.626950026 CEST	50184	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:47.626961946 CEST	443	50184	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:47.627006054 CEST	443	50184	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:47.736031055 CEST	50185	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:47.736057997 CEST	443	50185	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:47.736126900 CEST	50185	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:47.736495018 CEST	50185	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:47.736507893 CEST	443	50185	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:47.736546040 CEST	443	50185	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:47.845360041 CEST	50187	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:47.845386028 CEST	443	50187	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:47.845449924 CEST	50187	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:47.845746040 CEST	50187	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:47.845756054 CEST	443	50187	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:47.845802069 CEST	443	50187	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:47.954648018 CEST	50188	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:47.954695940 CEST	443	50188	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:47.954783916 CEST	50188	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:47.955285072 CEST	50188	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:47.955298901 CEST	443	50188	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:47.955351114 CEST	443	50188	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:48.064085960 CEST	50193	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:48.064104080 CEST	443	50193	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:48.064235926 CEST	50193	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:48.064600945 CEST	50193	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:48.064619064 CEST	443	50193	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:48.064682007 CEST	443	50193	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:48.173536062 CEST	50194	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:48.173566103 CEST	443	50194	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:48.173703909 CEST	50194	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:48.174038887 CEST	50194	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:48.174056053 CEST	443	50194	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:48.174114943 CEST	443	50194	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:48.282972097 CEST	50195	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:48.283015966 CEST	443	50195	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:48.283082962 CEST	50195	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:48.283407927 CEST	50195	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:48.283422947 CEST	443	50195	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:48.283458948 CEST	443	50195	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:48.392601013 CEST	50196	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:48.392654896 CEST	443	50196	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:48.392751932 CEST	50196	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:48.393104076 CEST	50196	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:48.393119097 CEST	443	50196	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:48.393148899 CEST	443	50196	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:48.501795053 CEST	50197	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:48.501832008 CEST	443	50197	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:48.501970053 CEST	50197	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:48.502321959 CEST	50197	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:48.502335072 CEST	443	50197	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:48.502373934 CEST	443	50197	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:48.611064911 CEST	50198	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:48.611078024 CEST	443	50198	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:48.611146927 CEST	50198	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:48.611473083 CEST	50198	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:48.611485958 CEST	443	50198	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:48.611538887 CEST	443	50198	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:48.720422983 CEST	50199	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:48.720474958 CEST	443	50199	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:48.720755100 CEST	50199	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:48.721067905 CEST	50199	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:48.721085072 CEST	443	50199	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:48.721112967 CEST	443	50199	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:48.829879999 CEST	50200	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:48.829972029 CEST	443	50200	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:48.830063105 CEST	50200	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:48.830388069 CEST	50200	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:48.830425024 CEST	443	50200	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:48.830466986 CEST	443	50200	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:48.938978910 CEST	50201	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:48.939014912 CEST	443	50201	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:48.939096928 CEST	50201	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:48.939431906 CEST	50201	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:48.939444065 CEST	443	50201	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:48.939471006 CEST	443	50201	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:49.048990011 CEST	50202	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:49.049041986 CEST	443	50202	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:49.049160004 CEST	50202	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:49.049469948 CEST	50202	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:49.049484015 CEST	443	50202	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:49.049542904 CEST	443	50202	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:49.157958984 CEST	50203	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:49.158054113 CEST	443	50203	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:49.158163071 CEST	50203	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:49.158538103 CEST	50203	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:49.158581018 CEST	443	50203	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:49.158627987 CEST	443	50203	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:49.267318010 CEST	50207	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:49.267335892 CEST	443	50207	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:49.267435074 CEST	50207	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:49.267750978 CEST	50207	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:49.267764091 CEST	443	50207	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:49.267813921 CEST	443	50207	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:49.376883030 CEST	50210	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:49.376914024 CEST	443	50210	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:49.376995087 CEST	50210	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:49.377252102 CEST	50210	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:49.377262115 CEST	443	50210	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:49.377298117 CEST	443	50210	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:49.485977888 CEST	50211	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:49.486016989 CEST	443	50211	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:49.486207962 CEST	50211	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:49.486394882 CEST	50211	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:49.486426115 CEST	443	50211	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:49.486454964 CEST	443	50211	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:49.595412970 CEST	50212	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:49.595455885 CEST	443	50212	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:49.595582008 CEST	50212	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:49.595928907 CEST	50212	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:49.595948935 CEST	443	50212	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:49.596036911 CEST	443	50212	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:49.704840899 CEST	50213	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:49.704873085 CEST	443	50213	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:49.704974890 CEST	50213	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:49.705334902 CEST	50213	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:49.705346107 CEST	443	50213	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:49.705400944 CEST	443	50213	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:49.814078093 CEST	50214	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:49.814100027 CEST	443	50214	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:49.814178944 CEST	50214	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:49.814574003 CEST	50214	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:49.814590931 CEST	443	50214	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:49.814615011 CEST	443	50214	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:49.923579931 CEST	50215	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:49.923636913 CEST	443	50215	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:49.923752069 CEST	50215	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:49.924037933 CEST	50215	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:49.924057007 CEST	443	50215	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:49.924123049 CEST	443	50215	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:50.032919884 CEST	50218	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:50.032967091 CEST	443	50218	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:50.033056974 CEST	50218	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:50.033298016 CEST	50218	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:50.033319950 CEST	443	50218	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:50.033415079 CEST	443	50218	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:50.142388105 CEST	50222	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:50.142437935 CEST	443	50222	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:50.142504930 CEST	50222	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:50.142947912 CEST	50222	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:50.142970085 CEST	443	50222	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:50.143038988 CEST	443	50222	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:50.251781940 CEST	50223	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:50.251801014 CEST	443	50223	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:50.251908064 CEST	50223	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:50.252275944 CEST	50223	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:50.252285957 CEST	443	50223	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:50.252352953 CEST	443	50223	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:50.361076117 CEST	50224	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:50.361088037 CEST	443	50224	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:50.361187935 CEST	50224	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:50.361495972 CEST	50224	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:50.361505985 CEST	443	50224	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:50.361566067 CEST	443	50224	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:50.470484018 CEST	50225	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:50.470541000 CEST	443	50225	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:50.470664978 CEST	50225	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:50.471034050 CEST	50225	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:50.471055031 CEST	443	50225	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:50.471108913 CEST	443	50225	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:50.579946041 CEST	50226	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:50.579996109 CEST	443	50226	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:50.580087900 CEST	50226	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:50.580375910 CEST	50226	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:50.580395937 CEST	443	50226	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:50.580482006 CEST	443	50226	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:50.689275980 CEST	50227	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:50.689304113 CEST	443	50227	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:50.689423084 CEST	50227	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:50.689760923 CEST	50227	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:50.689773083 CEST	443	50227	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:50.689835072 CEST	443	50227	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:50.798548937 CEST	50229	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:50.798563957 CEST	443	50229	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:50.798626900 CEST	50229	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:50.798928022 CEST	50229	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:50.798940897 CEST	443	50229	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:50.799005985 CEST	443	50229	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:50.907814026 CEST	50233	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:50.907821894 CEST	443	50233	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:50.907907009 CEST	50233	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:50.908169985 CEST	50233	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:50.908175945 CEST	443	50233	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:50.908246994 CEST	443	50233	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:51.017627954 CEST	50235	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:51.017663002 CEST	443	50235	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:51.017771959 CEST	50235	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:51.018126011 CEST	50235	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:51.018151999 CEST	443	50235	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:51.018210888 CEST	443	50235	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:51.126714945 CEST	50236	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:51.126761913 CEST	443	50236	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:51.126833916 CEST	50236	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:51.127168894 CEST	50236	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:51.127190113 CEST	443	50236	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:51.127245903 CEST	443	50236	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:51.236248970 CEST	50237	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:51.236280918 CEST	443	50237	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:51.236422062 CEST	50237	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:51.236922026 CEST	50237	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:51.236938000 CEST	443	50237	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:51.237015009 CEST	443	50237	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:51.345572948 CEST	50238	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:51.345609903 CEST	443	50238	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:51.345752954 CEST	50238	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:51.346143007 CEST	50238	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:51.346158028 CEST	443	50238	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:51.346213102 CEST	443	50238	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:51.455077887 CEST	50239	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:51.455135107 CEST	443	50239	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:51.455235004 CEST	50239	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:51.455544949 CEST	50239	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:51.455564976 CEST	443	50239	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:51.455637932 CEST	443	50239	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:51.564356089 CEST	50240	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:51.564403057 CEST	443	50240	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:51.564558983 CEST	50240	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:51.564908028 CEST	50240	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:51.564928055 CEST	443	50240	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:51.564996004 CEST	443	50240	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:51.673573017 CEST	50243	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:51.673621893 CEST	443	50243	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:51.673707008 CEST	50243	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:51.674072027 CEST	50243	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:51.674084902 CEST	443	50243	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:51.674175978 CEST	443	50243	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:51.788001060 CEST	50246	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:51.788018942 CEST	443	50246	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:51.788100958 CEST	50246	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:51.788436890 CEST	50246	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:51.788449049 CEST	443	50246	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:51.788486958 CEST	443	50246	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:51.892509937 CEST	50248	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:51.892525911 CEST	443	50248	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:51.892612934 CEST	50248	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:51.892942905 CEST	50248	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:51.892952919 CEST	443	50248	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:51.893018007 CEST	443	50248	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:52.001662016 CEST	50249	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:52.001697063 CEST	443	50249	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:52.001774073 CEST	50249	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:52.002161980 CEST	50249	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:52.002178907 CEST	443	50249	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:52.002212048 CEST	443	50249	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:52.110972881 CEST	50250	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:52.111005068 CEST	443	50250	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:52.111104965 CEST	50250	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:52.111408949 CEST	50250	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:52.111423969 CEST	443	50250	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:52.111459970 CEST	443	50250	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:52.220439911 CEST	50251	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:52.220470905 CEST	443	50251	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:52.220592022 CEST	50251	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:52.220896959 CEST	50251	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:52.220915079 CEST	443	50251	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:52.220977068 CEST	443	50251	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:52.329817057 CEST	50252	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:52.329845905 CEST	443	50252	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:52.329911947 CEST	50252	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:52.330204010 CEST	50252	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:52.330219030 CEST	443	50252	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:52.330281019 CEST	443	50252	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:52.423930883 CEST	50253	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:52.423965931 CEST	443	50253	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:52.424040079 CEST	50253	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:52.424392939 CEST	50253	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:52.424405098 CEST	443	50253	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:52.424434900 CEST	443	50253	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:52.532859087 CEST	50258	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:52.532911062 CEST	443	50258	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:52.533034086 CEST	50258	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:52.533480883 CEST	50258	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:52.533508062 CEST	443	50258	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:52.533540010 CEST	443	50258	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:52.642417908 CEST	50259	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:52.642447948 CEST	443	50259	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:52.642568111 CEST	50259	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:52.642932892 CEST	50259	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:52.642949104 CEST	443	50259	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:52.643008947 CEST	443	50259	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:52.751744032 CEST	50261	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:52.751822948 CEST	443	50261	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:52.751948118 CEST	50261	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:52.752298117 CEST	50261	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:52.752332926 CEST	443	50261	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:52.752429008 CEST	443	50261	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:52.845880985 CEST	50262	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:52.845966101 CEST	443	50262	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:52.846048117 CEST	50262	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:52.846534967 CEST	50262	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:52.846569061 CEST	443	50262	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:52.846667051 CEST	443	50262	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:52.939665079 CEST	50263	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:52.939694881 CEST	443	50263	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:52.940042019 CEST	50263	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:52.940289974 CEST	50263	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:52.940304041 CEST	443	50263	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:52.940351009 CEST	443	50263	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:53.032943964 CEST	50264	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:53.032988071 CEST	443	50264	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:53.033077002 CEST	50264	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:53.033344984 CEST	50264	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:53.033363104 CEST	443	50264	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:53.033400059 CEST	443	50264	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:53.126638889 CEST	50265	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:53.126673937 CEST	443	50265	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:53.126791954 CEST	50265	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:53.127149105 CEST	50265	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:53.127163887 CEST	443	50265	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:53.127193928 CEST	443	50265	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:53.220556974 CEST	50266	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:53.220593929 CEST	443	50266	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:53.220834017 CEST	50266	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:53.221237898 CEST	50266	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:53.221254110 CEST	443	50266	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:53.221295118 CEST	443	50266	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:53.314212084 CEST	50268	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:53.314254045 CEST	443	50268	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:53.314357996 CEST	50268	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:53.314698935 CEST	50268	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:53.314709902 CEST	443	50268	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:53.314754963 CEST	443	50268	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:53.408010960 CEST	50271	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:53.408066988 CEST	443	50271	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:53.408206940 CEST	50271	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:53.408504009 CEST	50271	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:53.408523083 CEST	443	50271	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:53.408617973 CEST	443	50271	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:53.502594948 CEST	50274	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:53.502614021 CEST	443	50274	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:53.502676010 CEST	50274	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:53.502943993 CEST	50274	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:53.502955914 CEST	443	50274	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:53.503074884 CEST	443	50274	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:53.595468998 CEST	50275	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:53.595516920 CEST	443	50275	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:53.595704079 CEST	50275	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:53.596196890 CEST	50275	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:53.596215010 CEST	443	50275	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:53.596271038 CEST	443	50275	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:53.689445019 CEST	50276	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:53.689472914 CEST	443	50276	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:53.689573050 CEST	50276	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:53.689951897 CEST	50276	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:53.689965010 CEST	443	50276	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:53.690083981 CEST	443	50276	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:53.783226967 CEST	50277	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:53.783268929 CEST	443	50277	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:53.783391953 CEST	50277	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:53.783840895 CEST	50277	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:53.783857107 CEST	443	50277	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:53.783972979 CEST	443	50277	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:53.884416103 CEST	50278	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:53.884457111 CEST	443	50278	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:53.884541035 CEST	50278	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:53.885006905 CEST	50278	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:53.885026932 CEST	443	50278	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:53.885072947 CEST	443	50278	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:53.986278057 CEST	50279	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:53.986304998 CEST	443	50279	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:53.986390114 CEST	50279	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:53.986682892 CEST	50279	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:53.986696005 CEST	443	50279	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:53.986819029 CEST	443	50279	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:54.079622030 CEST	50281	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:54.079643011 CEST	443	50281	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:54.079714060 CEST	50281	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:54.080167055 CEST	50281	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:54.080182076 CEST	443	50281	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:54.080265045 CEST	443	50281	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:54.173768044 CEST	50284	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:54.173799992 CEST	443	50284	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:54.173897028 CEST	50284	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:54.174280882 CEST	50284	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:54.174298048 CEST	443	50284	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:54.174401045 CEST	443	50284	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:54.267376900 CEST	50287	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:54.267400026 CEST	443	50287	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:54.267509937 CEST	50287	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:54.267818928 CEST	50287	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:54.267832994 CEST	443	50287	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:54.267921925 CEST	443	50287	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:54.361167908 CEST	50288	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:54.361206055 CEST	443	50288	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:54.361314058 CEST	50288	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:54.361597061 CEST	50288	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:54.361613989 CEST	443	50288	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:54.361726999 CEST	443	50288	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:54.454875946 CEST	50289	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:54.454910040 CEST	443	50289	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:54.454988003 CEST	50289	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:54.455419064 CEST	50289	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:54.455432892 CEST	443	50289	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:54.455532074 CEST	443	50289	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:54.549160004 CEST	50290	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:54.549185991 CEST	443	50290	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:54.549329042 CEST	50290	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:54.549684048 CEST	50290	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:54.549698114 CEST	443	50290	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:54.549745083 CEST	443	50290	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:54.642262936 CEST	50291	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:54.642302036 CEST	443	50291	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:54.642375946 CEST	50291	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:54.642770052 CEST	50291	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:54.642787933 CEST	443	50291	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:54.642838955 CEST	443	50291	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:54.736274958 CEST	50292	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:54.736299992 CEST	443	50292	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:54.736393929 CEST	50292	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:54.736685038 CEST	50292	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:54.736701012 CEST	443	50292	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:54.736819983 CEST	443	50292	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:54.830035925 CEST	50293	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:54.830070972 CEST	443	50293	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:54.830163002 CEST	50293	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:54.830481052 CEST	50293	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:54.830497026 CEST	443	50293	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:54.830548048 CEST	443	50293	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:54.923667908 CEST	50295	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:54.923693895 CEST	443	50295	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:54.923820019 CEST	50295	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:54.924098015 CEST	50295	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:54.924113989 CEST	443	50295	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:54.924227953 CEST	443	50295	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:55.017605066 CEST	50298	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:55.017621040 CEST	443	50298	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:55.018181086 CEST	50298	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:55.018345118 CEST	50298	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:55.018362045 CEST	443	50298	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:55.018418074 CEST	443	50298	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:55.111239910 CEST	50301	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:55.111258984 CEST	443	50301	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:55.111336946 CEST	50301	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:55.111742020 CEST	50301	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:55.111752987 CEST	443	50301	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:55.111802101 CEST	443	50301	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:55.205127954 CEST	50302	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:55.205154896 CEST	443	50302	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:55.205552101 CEST	50302	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:55.205864906 CEST	50302	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:55.205878973 CEST	443	50302	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:55.205998898 CEST	443	50302	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:55.298664093 CEST	50303	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:55.298712969 CEST	443	50303	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:55.298837900 CEST	50303	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:55.299103975 CEST	50303	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:55.299117088 CEST	443	50303	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:55.299231052 CEST	443	50303	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:55.392299891 CEST	50304	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:55.392328024 CEST	443	50304	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:55.392499924 CEST	50304	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:55.392787933 CEST	50304	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:55.392802954 CEST	443	50304	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:55.392879963 CEST	443	50304	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:55.486155987 CEST	50305	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:55.486190081 CEST	443	50305	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:55.486339092 CEST	50305	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:55.486634016 CEST	50305	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:55.486651897 CEST	443	50305	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:55.486747026 CEST	443	50305	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:55.579858065 CEST	50306	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:55.579888105 CEST	443	50306	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:55.580025911 CEST	50306	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:55.580338001 CEST	50306	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:55.580353975 CEST	443	50306	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:55.580420017 CEST	443	50306	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:55.673940897 CEST	50307	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:55.673974991 CEST	443	50307	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:55.674221992 CEST	50307	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:55.674537897 CEST	50307	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:55.674547911 CEST	443	50307	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:55.674613953 CEST	443	50307	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:55.767343998 CEST	50309	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:55.767379999 CEST	443	50309	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:55.767461061 CEST	50309	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:55.767846107 CEST	50309	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:55.767863989 CEST	443	50309	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:55.767923117 CEST	443	50309	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:55.861505985 CEST	50313	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:55.861532927 CEST	443	50313	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:55.861602068 CEST	50313	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:55.862149000 CEST	50313	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:55.862174034 CEST	443	50313	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:55.862226963 CEST	443	50313	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:55.961028099 CEST	50315	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:55.961054087 CEST	443	50315	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:55.961252928 CEST	50315	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:55.962084055 CEST	50315	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:55.962099075 CEST	443	50315	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:55.962199926 CEST	443	50315	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:56.048671961 CEST	50316	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:56.048687935 CEST	443	50316	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:56.048774958 CEST	50316	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:56.049135923 CEST	50316	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:56.049163103 CEST	443	50316	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:56.049223900 CEST	443	50316	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:56.142313957 CEST	50317	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:56.142358065 CEST	443	50317	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:56.145555019 CEST	50317	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:56.145891905 CEST	50317	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:56.145915985 CEST	443	50317	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:56.145965099 CEST	443	50317	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:56.236099005 CEST	50318	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:56.236157894 CEST	443	50318	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:56.236310959 CEST	50318	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:56.236612082 CEST	50318	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:56.236632109 CEST	443	50318	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:56.236685038 CEST	443	50318	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:56.329721928 CEST	50319	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:56.329756975 CEST	443	50319	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:56.329881907 CEST	50319	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:56.330141068 CEST	50319	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:56.330158949 CEST	443	50319	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:56.330245972 CEST	443	50319	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:56.423656940 CEST	50320	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:56.423688889 CEST	443	50320	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:56.423754930 CEST	50320	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:56.424078941 CEST	50320	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:56.424093962 CEST	443	50320	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:56.424161911 CEST	443	50320	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:56.518178940 CEST	50321	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:56.518201113 CEST	443	50321	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:56.518275976 CEST	50321	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:56.518589973 CEST	50321	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:56.518603086 CEST	443	50321	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:56.518695116 CEST	443	50321	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:56.611089945 CEST	50324	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:56.611116886 CEST	443	50324	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:56.611219883 CEST	50324	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:56.611509085 CEST	50324	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:56.611526966 CEST	443	50324	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:56.611555099 CEST	443	50324	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:56.704945087 CEST	50328	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:56.704974890 CEST	443	50328	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:56.705044031 CEST	50328	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:56.705379009 CEST	50328	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:56.705394983 CEST	443	50328	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:56.705465078 CEST	443	50328	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:56.798592091 CEST	50329	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:56.798628092 CEST	443	50329	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:56.798914909 CEST	50329	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:56.799015999 CEST	50329	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:56.799029112 CEST	443	50329	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:56.799098969 CEST	443	50329	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:56.893241882 CEST	50330	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:56.893265963 CEST	443	50330	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:56.893342018 CEST	50330	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:56.893718958 CEST	50330	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:56.893737078 CEST	443	50330	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:56.893793106 CEST	443	50330	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:56.986409903 CEST	50331	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:56.986443996 CEST	443	50331	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:56.986526012 CEST	50331	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:56.986850977 CEST	50331	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:56.986867905 CEST	443	50331	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:56.986967087 CEST	443	50331	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:57.079927921 CEST	50332	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:57.079968929 CEST	443	50332	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:57.080054998 CEST	50332	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:57.080452919 CEST	50332	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:57.080470085 CEST	443	50332	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:57.080516100 CEST	443	50332	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:57.173616886 CEST	50333	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:57.173655987 CEST	443	50333	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:57.173783064 CEST	50333	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:57.174074888 CEST	50333	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:57.174092054 CEST	443	50333	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:57.174191952 CEST	443	50333	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:57.267349005 CEST	50334	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:57.267360926 CEST	443	50334	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:57.267445087 CEST	50334	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:57.267781973 CEST	50334	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:57.267798901 CEST	443	50334	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:57.267891884 CEST	443	50334	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:57.360925913 CEST	50336	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:57.360976934 CEST	443	50336	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:57.361049891 CEST	50336	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:57.361371994 CEST	50336	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:57.361388922 CEST	443	50336	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:57.361480951 CEST	443	50336	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:57.454623938 CEST	50340	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:57.454665899 CEST	443	50340	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:57.454740047 CEST	50340	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:57.455014944 CEST	50340	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:57.455032110 CEST	443	50340	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:57.455121994 CEST	443	50340	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:57.548403978 CEST	50342	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:57.548439980 CEST	443	50342	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:57.548650980 CEST	50342	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:57.548813105 CEST	50342	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:57.548827887 CEST	443	50342	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:57.548918962 CEST	443	50342	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:57.642431974 CEST	50343	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:57.642489910 CEST	443	50343	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:57.642589092 CEST	50343	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:57.642929077 CEST	50343	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:57.642945051 CEST	443	50343	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:57.643050909 CEST	443	50343	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:57.736196041 CEST	50344	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:57.736222029 CEST	443	50344	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:57.736311913 CEST	50344	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:57.736707926 CEST	50344	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:57.736725092 CEST	443	50344	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:57.736788988 CEST	443	50344	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:57.814179897 CEST	50345	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:57.814218998 CEST	443	50345	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:57.814301014 CEST	50345	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:57.814673901 CEST	50345	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:57.814687014 CEST	443	50345	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:57.814789057 CEST	443	50345	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:57.892266989 CEST	50346	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:57.892287970 CEST	443	50346	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:57.892360926 CEST	50346	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:57.892663002 CEST	50346	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:57.892673969 CEST	443	50346	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:57.892729044 CEST	443	50346	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:57.970608950 CEST	50347	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:57.970652103 CEST	443	50347	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:57.970736980 CEST	50347	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:57.971052885 CEST	50347	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:57.971071959 CEST	443	50347	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:57.971127033 CEST	443	50347	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:58.048648119 CEST	50348	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:58.048688889 CEST	443	50348	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:58.048810959 CEST	50348	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:58.049104929 CEST	50348	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:58.049120903 CEST	443	50348	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:58.049175024 CEST	443	50348	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:58.126749992 CEST	50350	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:58.126806974 CEST	443	50350	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:58.126895905 CEST	50350	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:58.127202988 CEST	50350	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:58.127218962 CEST	443	50350	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:58.127275944 CEST	443	50350	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:58.204941988 CEST	50352	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:58.204981089 CEST	443	50352	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:58.205104113 CEST	50352	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:58.205480099 CEST	50352	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:58.205504894 CEST	443	50352	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:58.205554008 CEST	443	50352	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:58.283054113 CEST	50356	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:58.283150911 CEST	443	50356	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:58.283251047 CEST	50356	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:58.283602953 CEST	50356	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:58.283618927 CEST	443	50356	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:58.283657074 CEST	443	50356	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:58.361219883 CEST	50357	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:58.361294031 CEST	443	50357	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:58.361392021 CEST	50357	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:58.361783981 CEST	50357	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:58.361803055 CEST	443	50357	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:58.361857891 CEST	443	50357	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:58.439197063 CEST	50358	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:58.439243078 CEST	443	50358	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:58.439320087 CEST	50358	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:58.439594984 CEST	50358	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:58.439610004 CEST	443	50358	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:58.439651012 CEST	443	50358	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:58.517286062 CEST	50359	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:58.517309904 CEST	443	50359	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:58.517405987 CEST	50359	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:58.517735958 CEST	50359	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:58.517748117 CEST	443	50359	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:58.517791986 CEST	443	50359	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:58.595263004 CEST	50361	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:58.595304012 CEST	443	50361	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:58.595511913 CEST	50361	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:58.595906973 CEST	50361	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:58.595925093 CEST	443	50361	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:58.596023083 CEST	443	50361	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:58.686146975 CEST	50362	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:58.686228991 CEST	443	50362	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:58.686321020 CEST	50362	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:58.686738968 CEST	50362	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:58.686774015 CEST	443	50362	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:58.686811924 CEST	443	50362	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:58.767426968 CEST	50363	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:58.767482996 CEST	443	50363	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:58.767579079 CEST	50363	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:58.768009901 CEST	50363	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:58.768024921 CEST	443	50363	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:58.768065929 CEST	443	50363	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:58.845624924 CEST	50364	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:58.845655918 CEST	443	50364	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:58.845730066 CEST	50364	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:58.846127987 CEST	50364	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:58.846141100 CEST	443	50364	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:58.846189976 CEST	443	50364	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:58.923492908 CEST	50365	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:58.923515081 CEST	443	50365	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:58.923587084 CEST	50365	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:58.923908949 CEST	50365	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:58.923921108 CEST	443	50365	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:58.923958063 CEST	443	50365	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:59.002250910 CEST	50367	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:59.002286911 CEST	443	50367	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:59.002351999 CEST	50367	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:59.002886057 CEST	50367	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:59.002897978 CEST	443	50367	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:59.002932072 CEST	443	50367	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:59.079966068 CEST	50370	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:59.079974890 CEST	443	50370	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:59.080037117 CEST	50370	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:59.080446959 CEST	50370	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:59.080457926 CEST	443	50370	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:59.080534935 CEST	443	50370	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:59.158132076 CEST	50372	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:59.158171892 CEST	443	50372	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:59.158260107 CEST	50372	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:59.158572912 CEST	50372	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:59.158584118 CEST	443	50372	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:59.158627987 CEST	443	50372	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:59.236109018 CEST	50373	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:59.236143112 CEST	443	50373	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:59.236206055 CEST	50373	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:59.236803055 CEST	50373	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:59.236816883 CEST	443	50373	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:59.237066984 CEST	443	50373	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:59.314256907 CEST	50375	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:59.314301014 CEST	443	50375	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:59.314389944 CEST	50375	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:59.314771891 CEST	50375	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:59.314788103 CEST	443	50375	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:59.314908028 CEST	443	50375	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:59.392402887 CEST	50376	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:59.392421961 CEST	443	50376	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:59.392528057 CEST	50376	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:59.392796993 CEST	50376	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:59.392810106 CEST	443	50376	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:59.392929077 CEST	443	50376	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:59.470899105 CEST	50377	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:59.470933914 CEST	443	50377	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:59.471095085 CEST	50377	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:59.471604109 CEST	50377	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:59.471615076 CEST	443	50377	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:59.471714973 CEST	443	50377	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:59.548439980 CEST	50378	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:59.548461914 CEST	443	50378	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:59.548567057 CEST	50378	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:59.548825026 CEST	50378	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:59.548844099 CEST	443	50378	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:59.548964024 CEST	443	50378	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:59.626707077 CEST	50379	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:59.626739025 CEST	443	50379	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:59.626907110 CEST	50379	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:59.627144098 CEST	50379	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:59.627159119 CEST	443	50379	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:59.627216101 CEST	443	50379	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:59.704943895 CEST	50380	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:59.704957962 CEST	443	50380	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:59.705059052 CEST	50380	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:59.705357075 CEST	50380	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:59.705368996 CEST	443	50380	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:59.705434084 CEST	443	50380	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:59.783037901 CEST	50381	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:59.783070087 CEST	443	50381	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:59.783144951 CEST	50381	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:59.784024954 CEST	50381	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:59.784044981 CEST	443	50381	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:59.784122944 CEST	443	50381	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:59.861845970 CEST	50384	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:59.861867905 CEST	443	50384	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:59.862174034 CEST	50384	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:59.862442017 CEST	50384	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:59.862452984 CEST	443	50384	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:59.862518072 CEST	443	50384	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:59.939141035 CEST	50385	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:59.939168930 CEST	443	50385	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:59.939296007 CEST	50385	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:59.939541101 CEST	50385	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:22:59.939558983 CEST	443	50385	157.20.182.233	192.168.2.6
Oct 14, 2024 17:22:59.939614058 CEST	443	50385	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:00.017884970 CEST	50388	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:00.017903090 CEST	443	50388	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:00.017997026 CEST	50388	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:00.018321991 CEST	50388	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:00.018332958 CEST	443	50388	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:00.018384933 CEST	443	50388	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:00.095499039 CEST	50389	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:00.095554113 CEST	443	50389	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:00.095688105 CEST	50389	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:00.095980883 CEST	50389	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:00.095995903 CEST	443	50389	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:00.096082926 CEST	443	50389	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:00.173724890 CEST	50391	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:00.173758030 CEST	443	50391	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:00.173893929 CEST	50391	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:00.174179077 CEST	50391	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:00.174194098 CEST	443	50391	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:00.174308062 CEST	443	50391	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:00.251605034 CEST	50392	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:00.251636028 CEST	443	50392	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:00.251707077 CEST	50392	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:00.251964092 CEST	50392	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:00.251980066 CEST	443	50392	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:00.252105951 CEST	443	50392	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:00.329716921 CEST	50393	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:00.329746962 CEST	443	50393	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:00.329870939 CEST	50393	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:00.330176115 CEST	50393	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:00.330188990 CEST	443	50393	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:00.330296993 CEST	443	50393	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:00.407999039 CEST	50394	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:00.408026934 CEST	443	50394	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:00.408103943 CEST	50394	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:00.408416033 CEST	50394	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:00.408430099 CEST	443	50394	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:00.408551931 CEST	443	50394	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:00.486166000 CEST	50395	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:00.486241102 CEST	443	50395	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:00.486346960 CEST	50395	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:00.486686945 CEST	50395	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:00.486717939 CEST	443	50395	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:00.486767054 CEST	443	50395	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:00.564300060 CEST	50396	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:00.564328909 CEST	443	50396	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:00.564420938 CEST	50396	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:00.564753056 CEST	50396	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:00.564764977 CEST	443	50396	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:00.564892054 CEST	443	50396	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:00.642502069 CEST	50397	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:00.642522097 CEST	443	50397	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:00.642628908 CEST	50397	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:00.642940998 CEST	50397	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:00.642954111 CEST	443	50397	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:00.643076897 CEST	443	50397	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:00.720441103 CEST	50399	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:00.720469952 CEST	443	50399	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:00.720561981 CEST	50399	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:00.720870972 CEST	50399	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:00.720882893 CEST	443	50399	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:00.720937014 CEST	443	50399	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:00.798851013 CEST	50403	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:00.798866987 CEST	443	50403	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:00.798952103 CEST	50403	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:00.799242973 CEST	50403	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:00.799253941 CEST	443	50403	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:00.799318075 CEST	443	50403	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:00.876701117 CEST	50404	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:00.876758099 CEST	443	50404	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:00.876847029 CEST	50404	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:00.877232075 CEST	50404	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:00.877249002 CEST	443	50404	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:00.877367020 CEST	443	50404	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:00.954823971 CEST	50405	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:00.954857111 CEST	443	50405	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:00.954931021 CEST	50405	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:00.955262899 CEST	50405	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:00.955276012 CEST	443	50405	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:00.955324888 CEST	443	50405	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:01.032922983 CEST	50406	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:01.032949924 CEST	443	50406	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:01.033077002 CEST	50406	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:01.033371925 CEST	50406	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:01.033392906 CEST	443	50406	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:01.033535957 CEST	443	50406	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:01.111093998 CEST	50407	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:01.111155987 CEST	443	50407	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:01.111253023 CEST	50407	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:01.111665010 CEST	50407	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:01.111685991 CEST	443	50407	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:01.111820936 CEST	443	50407	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:01.189306974 CEST	50408	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:01.189357042 CEST	443	50408	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:01.189510107 CEST	50408	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:01.189764977 CEST	50408	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:01.189785004 CEST	443	50408	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:01.189903975 CEST	443	50408	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:01.267163038 CEST	50409	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:01.267204046 CEST	443	50409	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:01.267302036 CEST	50409	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:01.267541885 CEST	50409	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:01.267555952 CEST	443	50409	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:01.267673016 CEST	443	50409	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:01.345416069 CEST	50410	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:01.345446110 CEST	443	50410	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:01.345551968 CEST	50410	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:01.345933914 CEST	50410	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:01.345951080 CEST	443	50410	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:01.346003056 CEST	443	50410	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:01.423681021 CEST	50411	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:01.423736095 CEST	443	50411	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:01.423870087 CEST	50411	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:01.424175978 CEST	50411	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:01.424194098 CEST	443	50411	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:01.424318075 CEST	443	50411	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:01.501795053 CEST	50412	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:01.501848936 CEST	443	50412	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:01.501960993 CEST	50412	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:01.502319098 CEST	50412	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:01.502337933 CEST	443	50412	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:01.502413988 CEST	443	50412	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:01.579910994 CEST	50413	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:01.579962015 CEST	443	50413	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:01.580040932 CEST	50413	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:01.580316067 CEST	50413	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:01.580331087 CEST	443	50413	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:01.580444098 CEST	443	50413	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:01.657798052 CEST	50414	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:01.657816887 CEST	443	50414	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:01.657931089 CEST	50414	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:01.658164024 CEST	50414	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:01.658178091 CEST	443	50414	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:01.658271074 CEST	443	50414	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:01.736084938 CEST	50415	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:01.736140013 CEST	443	50415	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:01.736242056 CEST	50415	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:01.736579895 CEST	50415	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:01.736601114 CEST	443	50415	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:01.736726046 CEST	443	50415	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:01.814577103 CEST	50416	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:01.814624071 CEST	443	50416	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:01.814757109 CEST	50416	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:01.815413952 CEST	50416	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:01.815432072 CEST	443	50416	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:01.815553904 CEST	443	50416	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:01.892507076 CEST	50417	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:01.892543077 CEST	443	50417	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:01.892615080 CEST	50417	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:01.892986059 CEST	50417	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:01.893002987 CEST	443	50417	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:01.893120050 CEST	443	50417	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:01.970777988 CEST	50418	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:01.970804930 CEST	443	50418	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:01.970972061 CEST	50418	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:01.971185923 CEST	50418	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:01.971199989 CEST	443	50418	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:01.971260071 CEST	443	50418	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:02.048641920 CEST	50419	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:02.048677921 CEST	443	50419	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:02.048804998 CEST	50419	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:02.049124956 CEST	50419	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:02.049140930 CEST	443	50419	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:02.049261093 CEST	443	50419	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:02.126773119 CEST	50420	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:02.126821995 CEST	443	50420	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:02.127032042 CEST	50420	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:02.127211094 CEST	50420	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:02.127222061 CEST	443	50420	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:02.127371073 CEST	443	50420	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:02.220541000 CEST	50421	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:02.220563889 CEST	443	50421	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:02.220649958 CEST	50421	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:02.220927000 CEST	50421	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:02.220938921 CEST	443	50421	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:02.221009016 CEST	443	50421	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:02.312140942 CEST	50422	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:02.312172890 CEST	443	50422	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:02.312264919 CEST	50422	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:02.327558041 CEST	50422	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:02.327572107 CEST	443	50422	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:02.327646971 CEST	443	50422	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:02.651072979 CEST	50423	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:02.651113033 CEST	443	50423	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:02.651190996 CEST	50423	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:02.651982069 CEST	50423	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:02.651998043 CEST	443	50423	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:02.652103901 CEST	443	50423	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:02.724225998 CEST	50424	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:02.724251032 CEST	443	50424	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:02.724325895 CEST	50424	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:02.731228113 CEST	50424	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:02.731240988 CEST	443	50424	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:02.731321096 CEST	443	50424	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:02.825475931 CEST	50425	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:02.825526953 CEST	443	50425	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:02.825608015 CEST	50425	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:02.826082945 CEST	50425	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:02.826097965 CEST	443	50425	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:02.826170921 CEST	443	50425	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:02.892282963 CEST	50426	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:02.892297983 CEST	443	50426	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:02.892379999 CEST	50426	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:02.892700911 CEST	50426	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:02.892712116 CEST	443	50426	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:02.892760038 CEST	443	50426	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:02.970498085 CEST	50427	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:02.970515013 CEST	443	50427	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:02.970588923 CEST	50427	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:02.970983028 CEST	50427	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:02.970994949 CEST	443	50427	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:02.971052885 CEST	443	50427	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:03.048945904 CEST	50428	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:03.048976898 CEST	443	50428	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:03.049093962 CEST	50428	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:03.049372911 CEST	50428	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:03.049386024 CEST	443	50428	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:03.049447060 CEST	443	50428	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:03.127029896 CEST	50429	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:03.127067089 CEST	443	50429	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:03.127166986 CEST	50429	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:03.127470970 CEST	50429	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:03.127484083 CEST	443	50429	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:03.127568960 CEST	443	50429	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:03.204879045 CEST	50430	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:03.204895020 CEST	443	50430	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:03.205014944 CEST	50430	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:03.205311060 CEST	50430	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:03.205322027 CEST	443	50430	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:03.205387115 CEST	443	50430	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:03.282870054 CEST	50431	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:03.282908916 CEST	443	50431	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:03.283071041 CEST	50431	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:03.283318996 CEST	50431	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:03.283334017 CEST	443	50431	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:03.283415079 CEST	443	50431	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:03.361076117 CEST	50432	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:03.361108065 CEST	443	50432	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:03.361181021 CEST	50432	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:03.361519098 CEST	50432	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:03.361532927 CEST	443	50432	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:03.361604929 CEST	443	50432	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:03.439279079 CEST	50433	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:03.439310074 CEST	443	50433	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:03.439426899 CEST	50433	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:03.439717054 CEST	50433	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:03.439730883 CEST	443	50433	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:03.439783096 CEST	443	50433	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:03.517309904 CEST	50434	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:03.517337084 CEST	443	50434	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:03.517441988 CEST	50434	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:03.517764091 CEST	50434	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:03.517777920 CEST	443	50434	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:03.517831087 CEST	443	50434	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:03.595558882 CEST	50435	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:03.595592022 CEST	443	50435	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:03.595712900 CEST	50435	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:03.595997095 CEST	50435	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:03.596008062 CEST	443	50435	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:03.596067905 CEST	443	50435	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:03.657974958 CEST	50436	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:03.657994986 CEST	443	50436	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:03.658070087 CEST	50436	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:03.658415079 CEST	50436	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:03.658427000 CEST	443	50436	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:03.658478022 CEST	443	50436	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:03.720472097 CEST	50437	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:03.720501900 CEST	443	50437	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:03.720592976 CEST	50437	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:03.720973969 CEST	50437	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:03.720995903 CEST	443	50437	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:03.721081018 CEST	443	50437	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:03.783638000 CEST	50438	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:03.783691883 CEST	443	50438	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:03.783915043 CEST	50438	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:03.784358025 CEST	50438	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:03.784382105 CEST	443	50438	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:03.784419060 CEST	443	50438	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:03.861176968 CEST	50439	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:03.861222982 CEST	443	50439	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:03.861306906 CEST	50439	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:03.861721992 CEST	50439	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:03.861735106 CEST	443	50439	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:03.861804962 CEST	443	50439	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:03.923909903 CEST	50440	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:03.923957109 CEST	443	50440	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:03.924031019 CEST	50440	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:03.924449921 CEST	50440	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:03.924465895 CEST	443	50440	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:03.924531937 CEST	443	50440	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:03.985882044 CEST	50441	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:03.985915899 CEST	443	50441	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:03.985991001 CEST	50441	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:03.986277103 CEST	50441	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:03.986289978 CEST	443	50441	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:03.986356020 CEST	443	50441	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:04.048433065 CEST	50442	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:04.048460007 CEST	443	50442	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:04.048546076 CEST	50442	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:04.048830032 CEST	50442	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:04.048846960 CEST	443	50442	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:04.048973083 CEST	443	50442	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:04.110843897 CEST	50443	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:04.110867023 CEST	443	50443	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:04.110933065 CEST	50443	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:04.111196995 CEST	50443	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:04.111212015 CEST	443	50443	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:04.111273050 CEST	443	50443	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:04.173511028 CEST	50444	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:04.173552990 CEST	443	50444	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:04.173645973 CEST	50444	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:04.174004078 CEST	50444	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:04.174021959 CEST	443	50444	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:04.174154043 CEST	443	50444	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:04.236083031 CEST	50445	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:04.236121893 CEST	443	50445	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:04.236249924 CEST	50445	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:04.236582041 CEST	50445	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:04.236596107 CEST	443	50445	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:04.236727953 CEST	443	50445	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:04.298638105 CEST	50446	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:04.298646927 CEST	443	50446	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:04.298737049 CEST	50446	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:04.299004078 CEST	50446	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:04.299015999 CEST	443	50446	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:04.299071074 CEST	443	50446	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:04.361018896 CEST	50447	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:04.361044884 CEST	443	50447	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:04.361151934 CEST	50447	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:04.361418009 CEST	50447	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:04.361437082 CEST	443	50447	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:04.361498117 CEST	443	50447	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:04.423330069 CEST	50448	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:04.423351049 CEST	443	50448	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:04.423455954 CEST	50448	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:04.423732042 CEST	50448	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:04.423744917 CEST	443	50448	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:04.423871994 CEST	443	50448	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:04.488903046 CEST	50449	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:04.488935947 CEST	443	50449	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:04.489011049 CEST	50449	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:04.489339113 CEST	50449	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:04.489351988 CEST	443	50449	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:04.489407063 CEST	443	50449	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:04.564127922 CEST	50450	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:04.564147949 CEST	443	50450	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:04.564244032 CEST	50450	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:04.564529896 CEST	50450	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:04.564542055 CEST	443	50450	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:04.564671040 CEST	443	50450	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:04.626831055 CEST	50451	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:04.626872063 CEST	443	50451	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:04.626970053 CEST	50451	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:04.627252102 CEST	50451	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:04.627263069 CEST	443	50451	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:04.627363920 CEST	443	50451	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:04.689210892 CEST	50452	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:04.689254045 CEST	443	50452	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:04.689426899 CEST	50452	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:04.689785004 CEST	50452	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:04.689799070 CEST	443	50452	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:04.689866066 CEST	443	50452	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:04.751626968 CEST	50453	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:04.751667023 CEST	443	50453	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:04.751791954 CEST	50453	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:04.752114058 CEST	50453	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:04.752127886 CEST	443	50453	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:04.752185106 CEST	443	50453	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:04.818147898 CEST	50454	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:04.818165064 CEST	443	50454	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:04.818279982 CEST	50454	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:04.818566084 CEST	50454	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:04.818577051 CEST	443	50454	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:04.818677902 CEST	443	50454	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:04.894123077 CEST	50455	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:04.894159079 CEST	443	50455	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:04.894232988 CEST	50455	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:04.894726038 CEST	50455	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:04.894741058 CEST	443	50455	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:04.894875050 CEST	443	50455	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:04.955035925 CEST	50456	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:04.955066919 CEST	443	50456	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:04.955199957 CEST	50456	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:04.955495119 CEST	50456	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:04.955508947 CEST	443	50456	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:04.955568075 CEST	443	50456	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:05.017398119 CEST	50457	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:05.017446041 CEST	443	50457	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:05.017530918 CEST	50457	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:05.017791033 CEST	50457	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:05.017805099 CEST	443	50457	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:05.017981052 CEST	443	50457	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:05.079802036 CEST	50458	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:05.079833031 CEST	443	50458	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:05.079912901 CEST	50458	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:05.080277920 CEST	50458	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:05.080293894 CEST	443	50458	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:05.080423117 CEST	443	50458	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:05.142332077 CEST	50459	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:05.142364025 CEST	443	50459	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:05.142461061 CEST	50459	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:05.142714024 CEST	50459	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:05.142728090 CEST	443	50459	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:05.142793894 CEST	443	50459	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:05.204891920 CEST	50460	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:05.204935074 CEST	443	50460	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:05.205029964 CEST	50460	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:05.205281973 CEST	50460	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:05.205292940 CEST	443	50460	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:05.205434084 CEST	443	50460	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:05.267317057 CEST	50461	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:05.267358065 CEST	443	50461	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:05.267478943 CEST	50461	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:05.267738104 CEST	50461	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:05.267749071 CEST	443	50461	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:05.267868042 CEST	443	50461	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:05.329755068 CEST	50462	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:05.329778910 CEST	443	50462	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:05.329865932 CEST	50462	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:05.330092907 CEST	50462	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:05.330105066 CEST	443	50462	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:05.330167055 CEST	443	50462	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:05.392142057 CEST	50463	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:05.392163038 CEST	443	50463	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:05.392241001 CEST	50463	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:05.392509937 CEST	50463	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:05.392518044 CEST	443	50463	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:05.392601967 CEST	443	50463	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:05.454770088 CEST	50464	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:05.454782009 CEST	443	50464	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:05.454854012 CEST	50464	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:05.455075979 CEST	50464	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:05.455087900 CEST	443	50464	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:05.455146074 CEST	443	50464	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:05.520802975 CEST	50465	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:05.520872116 CEST	443	50465	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:05.520996094 CEST	50465	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:05.521256924 CEST	50465	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:05.521269083 CEST	443	50465	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:05.521397114 CEST	443	50465	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:05.579782963 CEST	50466	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:05.579839945 CEST	443	50466	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:05.579927921 CEST	50466	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:05.580272913 CEST	50466	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:05.580285072 CEST	443	50466	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:05.580404043 CEST	443	50466	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:05.642429113 CEST	50467	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:05.642458916 CEST	443	50467	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:05.642533064 CEST	50467	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:05.642858982 CEST	50467	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:05.642869949 CEST	443	50467	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:05.642927885 CEST	443	50467	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:05.704751015 CEST	50468	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:05.704783916 CEST	443	50468	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:05.704859972 CEST	50468	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:05.705238104 CEST	50468	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:05.705250978 CEST	443	50468	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:05.705375910 CEST	443	50468	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:05.767236948 CEST	50469	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:05.767276049 CEST	443	50469	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:05.767374992 CEST	50469	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:05.767632961 CEST	50469	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:05.767652035 CEST	443	50469	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:05.767760992 CEST	443	50469	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:05.830105066 CEST	50470	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:05.830142021 CEST	443	50470	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:05.830228090 CEST	50470	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:05.830604076 CEST	50470	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:05.830622911 CEST	443	50470	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:05.830704927 CEST	443	50470	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:05.892920017 CEST	50471	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:05.892955065 CEST	443	50471	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:05.893058062 CEST	50471	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:05.893461943 CEST	50471	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:05.893475056 CEST	443	50471	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:05.893604040 CEST	443	50471	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:05.955277920 CEST	50472	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:05.955334902 CEST	443	50472	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:05.955421925 CEST	50472	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:05.955786943 CEST	50472	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:05.955813885 CEST	443	50472	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:05.955941916 CEST	443	50472	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:06.017978907 CEST	50473	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:06.018011093 CEST	443	50473	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:06.018141031 CEST	50473	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:06.018461943 CEST	50473	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:06.018476009 CEST	443	50473	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:06.018599987 CEST	443	50473	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:06.080387115 CEST	50474	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:06.080415964 CEST	443	50474	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:06.080518007 CEST	50474	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:06.080807924 CEST	50474	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:06.080821991 CEST	443	50474	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:06.080940962 CEST	443	50474	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:06.142210960 CEST	50475	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:06.142246008 CEST	443	50475	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:06.142386913 CEST	50475	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:06.142631054 CEST	50475	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:06.142646074 CEST	443	50475	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:06.142735958 CEST	443	50475	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:06.205394983 CEST	50476	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:06.205432892 CEST	443	50476	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:06.205513000 CEST	50476	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:06.205836058 CEST	50476	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:06.205847979 CEST	443	50476	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:06.205975056 CEST	443	50476	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:06.267283916 CEST	50477	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:06.267319918 CEST	443	50477	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:06.267412901 CEST	50477	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:06.267718077 CEST	50477	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:06.267729998 CEST	443	50477	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:06.267848015 CEST	443	50477	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:06.330241919 CEST	50478	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:06.330255032 CEST	443	50478	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:06.330389977 CEST	50478	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:06.330724955 CEST	50478	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:06.330734968 CEST	443	50478	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:06.330817938 CEST	443	50478	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:06.392388105 CEST	50479	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:06.392424107 CEST	443	50479	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:06.392519951 CEST	50479	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:06.392940998 CEST	50479	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:06.392956018 CEST	443	50479	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:06.393023014 CEST	443	50479	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:06.454725027 CEST	50480	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:06.454754114 CEST	443	50480	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:06.454865932 CEST	50480	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:06.455080986 CEST	50480	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:06.455096960 CEST	443	50480	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:06.455157995 CEST	443	50480	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:06.517599106 CEST	50481	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:06.517618895 CEST	443	50481	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:06.517699957 CEST	50481	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:06.517975092 CEST	50481	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:06.517983913 CEST	443	50481	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:06.518106937 CEST	443	50481	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:06.580115080 CEST	50482	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:06.580148935 CEST	443	50482	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:06.580250025 CEST	50482	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:06.580498934 CEST	50482	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:06.580506086 CEST	443	50482	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:06.580615997 CEST	443	50482	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:06.642596006 CEST	50483	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:06.642644882 CEST	443	50483	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:06.642741919 CEST	50483	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:06.643100023 CEST	50483	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:06.643120050 CEST	443	50483	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:06.643196106 CEST	443	50483	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:06.704879999 CEST	50484	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:06.704910994 CEST	443	50484	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:06.705017090 CEST	50484	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:06.705576897 CEST	50484	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:06.705591917 CEST	443	50484	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:06.705719948 CEST	443	50484	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:06.767349005 CEST	50486	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:06.767379045 CEST	443	50486	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:06.767451048 CEST	50486	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:06.767721891 CEST	50486	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:06.767731905 CEST	443	50486	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:06.767838955 CEST	443	50486	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:06.829958916 CEST	50487	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:06.830019951 CEST	443	50487	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:06.830085993 CEST	50487	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:06.830355883 CEST	50487	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:06.830383062 CEST	443	50487	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:06.830452919 CEST	443	50487	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:06.895623922 CEST	50488	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:06.895656109 CEST	443	50488	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:06.895735979 CEST	50488	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:06.896176100 CEST	50488	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:06.896186113 CEST	443	50488	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:06.896327972 CEST	443	50488	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:06.955765009 CEST	50489	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:06.955800056 CEST	443	50489	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:06.955861092 CEST	50489	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:06.956377029 CEST	50489	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:06.956389904 CEST	443	50489	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:06.956420898 CEST	443	50489	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:07.018080950 CEST	50490	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:07.018112898 CEST	443	50490	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:07.018187046 CEST	50490	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:07.018752098 CEST	50490	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:07.018767118 CEST	443	50490	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:07.018877983 CEST	443	50490	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:07.080570936 CEST	50491	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:07.080609083 CEST	443	50491	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:07.080676079 CEST	50491	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:07.081270933 CEST	50491	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:07.081281900 CEST	443	50491	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:07.081396103 CEST	443	50491	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:07.179593086 CEST	50492	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:07.179646969 CEST	443	50492	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:07.179719925 CEST	50492	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:07.180383921 CEST	50492	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:07.180403948 CEST	443	50492	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:07.180459976 CEST	443	50492	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:07.258599043 CEST	50493	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:07.258611917 CEST	443	50493	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:07.258704901 CEST	50493	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:07.262564898 CEST	50493	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:07.262576103 CEST	443	50493	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:07.262630939 CEST	443	50493	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:07.342868090 CEST	50494	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:07.342885017 CEST	443	50494	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:07.343009949 CEST	50494	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:07.343358994 CEST	50494	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:07.343373060 CEST	443	50494	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:07.343493938 CEST	443	50494	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:07.408078909 CEST	50495	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:07.408106089 CEST	443	50495	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:07.408176899 CEST	50495	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:07.408442974 CEST	50495	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:07.408456087 CEST	443	50495	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:07.408507109 CEST	443	50495	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:07.470273972 CEST	50496	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:07.470284939 CEST	443	50496	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:07.470459938 CEST	50496	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:07.470689058 CEST	50496	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:07.470699072 CEST	443	50496	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:07.470761061 CEST	443	50496	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:07.532948017 CEST	50497	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:07.532979965 CEST	443	50497	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:07.533034086 CEST	50497	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:07.533320904 CEST	50497	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:07.533338070 CEST	443	50497	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:07.533459902 CEST	443	50497	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:07.595333099 CEST	50498	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:07.595355034 CEST	443	50498	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:07.595475912 CEST	50498	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:07.595869064 CEST	50498	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:07.595881939 CEST	443	50498	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:07.595978975 CEST	443	50498	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:07.657988071 CEST	50499	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:07.658010960 CEST	443	50499	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:07.658077955 CEST	50499	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:07.658451080 CEST	50499	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:07.658459902 CEST	443	50499	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:07.658531904 CEST	443	50499	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:07.720449924 CEST	50500	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:07.720503092 CEST	443	50500	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:07.720611095 CEST	50500	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:07.720896959 CEST	50500	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:07.720912933 CEST	443	50500	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:07.720976114 CEST	443	50500	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:07.782814026 CEST	50501	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:07.782841921 CEST	443	50501	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:07.782943964 CEST	50501	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:07.783233881 CEST	50501	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:07.783246994 CEST	443	50501	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:07.783315897 CEST	443	50501	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:07.845468044 CEST	50502	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:07.845493078 CEST	443	50502	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:07.845565081 CEST	50502	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:07.845854044 CEST	50502	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:07.845861912 CEST	443	50502	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:07.845947027 CEST	443	50502	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:07.907840967 CEST	50503	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:07.907892942 CEST	443	50503	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:07.907999992 CEST	50503	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:07.908272982 CEST	50503	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:07.908291101 CEST	443	50503	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:07.908373117 CEST	443	50503	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:07.970596075 CEST	50504	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:07.970628023 CEST	443	50504	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:07.970691919 CEST	50504	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:07.971020937 CEST	50504	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:07.971040010 CEST	443	50504	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:07.971070051 CEST	443	50504	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:08.032939911 CEST	50505	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:08.032973051 CEST	443	50505	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:08.033075094 CEST	50505	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:08.033353090 CEST	50505	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:08.033363104 CEST	443	50505	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:08.033401966 CEST	443	50505	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:08.095364094 CEST	50506	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:08.095407009 CEST	443	50506	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:08.095493078 CEST	50506	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:08.095833063 CEST	50506	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:08.095844984 CEST	443	50506	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:08.095966101 CEST	443	50506	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:08.157721043 CEST	50507	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:08.157761097 CEST	443	50507	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:08.157834053 CEST	50507	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:08.158077955 CEST	50507	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:08.158092976 CEST	443	50507	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:08.158171892 CEST	443	50507	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:08.220170975 CEST	50508	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:08.220204115 CEST	443	50508	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:08.220276117 CEST	50508	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:08.220489025 CEST	50508	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:08.220504045 CEST	443	50508	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:08.220562935 CEST	443	50508	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:08.282823086 CEST	50509	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:08.282869101 CEST	443	50509	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:08.282942057 CEST	50509	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:08.283313990 CEST	50509	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:08.283325911 CEST	443	50509	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:08.283409119 CEST	443	50509	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:08.345293045 CEST	50510	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:08.345326900 CEST	443	50510	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:08.345443964 CEST	50510	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:08.345679998 CEST	50510	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:08.345700979 CEST	443	50510	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:08.345767021 CEST	443	50510	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:08.408148050 CEST	50511	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:08.408205032 CEST	443	50511	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:08.408325911 CEST	50511	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:08.408658028 CEST	50511	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:08.408674955 CEST	443	50511	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:08.408730984 CEST	443	50511	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:08.470308065 CEST	50512	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:08.470354080 CEST	443	50512	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:08.470455885 CEST	50512	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:08.470747948 CEST	50512	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:08.470765114 CEST	443	50512	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:08.470833063 CEST	443	50512	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:08.532694101 CEST	50513	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:08.532743931 CEST	443	50513	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:08.532828093 CEST	50513	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:08.533046961 CEST	50513	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:08.533061981 CEST	443	50513	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:08.533123970 CEST	443	50513	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:08.595314026 CEST	50514	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:08.595345020 CEST	443	50514	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:08.595432997 CEST	50514	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:08.595623970 CEST	50514	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:08.595634937 CEST	443	50514	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:08.595702887 CEST	443	50514	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:08.660466909 CEST	50515	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:08.660533905 CEST	443	50515	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:08.660655975 CEST	50515	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:08.660933971 CEST	50515	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:08.660954952 CEST	443	50515	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:08.661010027 CEST	443	50515	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:08.721014023 CEST	50516	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:08.721084118 CEST	443	50516	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:08.721168995 CEST	50516	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:08.721518040 CEST	50516	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:08.721534967 CEST	443	50516	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:08.721642017 CEST	443	50516	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:08.783613920 CEST	50517	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:08.783654928 CEST	443	50517	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:08.783720970 CEST	50517	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:08.784183979 CEST	50517	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:08.784194946 CEST	443	50517	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:08.784255028 CEST	443	50517	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:08.845597982 CEST	50518	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:08.845613003 CEST	443	50518	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:08.845695972 CEST	50518	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:08.845951080 CEST	50518	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:08.845962048 CEST	443	50518	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:08.846031904 CEST	443	50518	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:08.908133984 CEST	50519	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:08.908184052 CEST	443	50519	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:08.908267021 CEST	50519	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:08.908541918 CEST	50519	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:08.908562899 CEST	443	50519	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:08.908655882 CEST	443	50519	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:08.970647097 CEST	50520	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:08.970680952 CEST	443	50520	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:08.970755100 CEST	50520	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:08.971046925 CEST	50520	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:08.971057892 CEST	443	50520	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:08.971110106 CEST	443	50520	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:09.033102036 CEST	50521	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:09.033154011 CEST	443	50521	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:09.033340931 CEST	50521	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:09.033639908 CEST	50521	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:09.033653021 CEST	443	50521	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:09.033709049 CEST	443	50521	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:09.095669031 CEST	50522	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:09.095685005 CEST	443	50522	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:09.095959902 CEST	50522	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:09.096421003 CEST	50522	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:09.096431971 CEST	443	50522	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:09.096472979 CEST	443	50522	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:09.158075094 CEST	50523	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:09.158099890 CEST	443	50523	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:09.158168077 CEST	50523	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:09.158476114 CEST	50523	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:09.158482075 CEST	443	50523	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:09.158613920 CEST	443	50523	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:09.204639912 CEST	50524	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:09.204710007 CEST	443	50524	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:09.204826117 CEST	50524	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:09.205118895 CEST	50524	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:09.205133915 CEST	443	50524	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:09.205254078 CEST	443	50524	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:09.251456976 CEST	50525	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:09.251493931 CEST	443	50525	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:09.251573086 CEST	50525	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:09.251847982 CEST	50525	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:09.251861095 CEST	443	50525	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:09.251957893 CEST	443	50525	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:09.298481941 CEST	50526	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:09.298516035 CEST	443	50526	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:09.298612118 CEST	50526	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:09.298894882 CEST	50526	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:09.298904896 CEST	443	50526	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:09.299007893 CEST	443	50526	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:09.345279932 CEST	50527	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:09.345319986 CEST	443	50527	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:09.345441103 CEST	50527	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:09.345730066 CEST	50527	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:09.345742941 CEST	443	50527	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:09.345866919 CEST	443	50527	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:09.392465115 CEST	50528	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:09.392494917 CEST	443	50528	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:09.392569065 CEST	50528	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:09.392891884 CEST	50528	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:09.392903090 CEST	443	50528	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:09.393030882 CEST	443	50528	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:09.439245939 CEST	50529	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:09.439287901 CEST	443	50529	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:09.439373016 CEST	50529	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:09.439770937 CEST	50529	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:09.439789057 CEST	443	50529	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:09.439913034 CEST	443	50529	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:09.486274004 CEST	50530	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:09.486306906 CEST	443	50530	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:09.490040064 CEST	50530	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:09.490525007 CEST	50530	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:09.490542889 CEST	443	50530	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:09.490664959 CEST	443	50530	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:09.548557997 CEST	50531	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:09.548603058 CEST	443	50531	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:09.548702002 CEST	50531	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:09.548995018 CEST	50531	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:09.549011946 CEST	443	50531	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:09.549076080 CEST	443	50531	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:09.595705032 CEST	50532	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:09.595735073 CEST	443	50532	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:09.597671032 CEST	50532	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:09.598069906 CEST	50532	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:09.598078966 CEST	443	50532	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:09.598114967 CEST	443	50532	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:09.657989025 CEST	50533	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:09.658036947 CEST	443	50533	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:09.658138990 CEST	50533	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:09.658425093 CEST	50533	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:09.658442974 CEST	443	50533	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:09.658586979 CEST	443	50533	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:09.705025911 CEST	50534	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:09.705065966 CEST	443	50534	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:09.705138922 CEST	50534	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:09.705440044 CEST	50534	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:09.705455065 CEST	443	50534	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:09.705528975 CEST	443	50534	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:09.796828985 CEST	50535	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:09.796843052 CEST	443	50535	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:09.797108889 CEST	50535	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:09.815635920 CEST	50535	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:09.815650940 CEST	443	50535	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:09.815706015 CEST	443	50535	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:09.912183046 CEST	50536	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:09.912226915 CEST	443	50536	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:09.912348032 CEST	50536	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:09.919542074 CEST	50536	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:09.919562101 CEST	443	50536	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:09.919629097 CEST	443	50536	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:09.987073898 CEST	50537	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:09.987107038 CEST	443	50537	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:09.987198114 CEST	50537	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:09.987545013 CEST	50537	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:09.987557888 CEST	443	50537	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:09.987613916 CEST	443	50537	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:10.038037062 CEST	50538	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:10.038048983 CEST	443	50538	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:10.038233042 CEST	50538	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:10.038625956 CEST	50538	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:10.038635015 CEST	443	50538	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:10.038687944 CEST	443	50538	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:10.095509052 CEST	50539	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:10.095546961 CEST	443	50539	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:10.095664978 CEST	50539	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:10.095961094 CEST	50539	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:10.095979929 CEST	443	50539	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:10.096087933 CEST	443	50539	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:10.142457008 CEST	50540	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:10.142509937 CEST	443	50540	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:10.142626047 CEST	50540	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:10.142960072 CEST	50540	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:10.142976046 CEST	443	50540	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:10.143069029 CEST	443	50540	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:10.189105988 CEST	50541	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:10.189145088 CEST	443	50541	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:10.189210892 CEST	50541	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:10.189521074 CEST	50541	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:10.189532995 CEST	443	50541	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:10.189608097 CEST	443	50541	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:10.236155987 CEST	50542	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:10.236182928 CEST	443	50542	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:10.236284018 CEST	50542	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:10.236654043 CEST	50542	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:10.236665010 CEST	443	50542	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:10.236711025 CEST	443	50542	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:10.282927990 CEST	50543	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:10.282967091 CEST	443	50543	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:10.283063889 CEST	50543	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:10.283296108 CEST	50543	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:10.283313990 CEST	443	50543	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:10.283364058 CEST	443	50543	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:10.329725027 CEST	50544	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:10.329756021 CEST	443	50544	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:10.329828024 CEST	50544	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:10.330063105 CEST	50544	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:10.330077887 CEST	443	50544	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:10.330156088 CEST	443	50544	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:10.376646042 CEST	50545	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:10.376683950 CEST	443	50545	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:10.376796961 CEST	50545	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:10.377068043 CEST	50545	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:10.377079964 CEST	443	50545	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:10.377131939 CEST	443	50545	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:10.423233986 CEST	50546	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:10.423254967 CEST	443	50546	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:10.423345089 CEST	50546	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:10.423604965 CEST	50546	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:10.423614025 CEST	443	50546	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:10.423667908 CEST	443	50546	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:10.470748901 CEST	50547	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:10.470803022 CEST	443	50547	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:10.470927000 CEST	50547	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:10.471249104 CEST	50547	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:10.471262932 CEST	443	50547	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:10.471369982 CEST	443	50547	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:10.517224073 CEST	50548	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:10.517255068 CEST	443	50548	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:10.517340899 CEST	50548	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:10.517669916 CEST	50548	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:10.517684937 CEST	443	50548	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:10.517755032 CEST	443	50548	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:10.563993931 CEST	50549	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:10.564029932 CEST	443	50549	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:10.564136028 CEST	50549	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:10.564356089 CEST	50549	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:10.564367056 CEST	443	50549	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:10.564418077 CEST	443	50549	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:10.611094952 CEST	50550	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:10.611108065 CEST	443	50550	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:10.611181974 CEST	50550	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:10.611418009 CEST	50550	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:10.611428022 CEST	443	50550	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:10.611490011 CEST	443	50550	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:10.657814026 CEST	50551	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:10.657839060 CEST	443	50551	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:10.657922029 CEST	50551	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:10.658133030 CEST	50551	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:10.658149004 CEST	443	50551	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:10.658205032 CEST	443	50551	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:10.704824924 CEST	50552	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:10.704853058 CEST	443	50552	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:10.704936981 CEST	50552	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:10.705301046 CEST	50552	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:10.705310106 CEST	443	50552	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:10.705357075 CEST	443	50552	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:10.751738071 CEST	50553	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:10.751784086 CEST	443	50553	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:10.751882076 CEST	50553	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:10.752167940 CEST	50553	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:10.752185106 CEST	443	50553	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:10.752248049 CEST	443	50553	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:10.798738003 CEST	50554	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:10.798753023 CEST	443	50554	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:10.798832893 CEST	50554	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:10.799082041 CEST	50554	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:10.799094915 CEST	443	50554	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:10.799156904 CEST	443	50554	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:10.845458984 CEST	50555	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:10.845515013 CEST	443	50555	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:10.845611095 CEST	50555	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:10.845890045 CEST	50555	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:10.845901012 CEST	443	50555	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:10.846019030 CEST	443	50555	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:10.892514944 CEST	50556	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:10.892549992 CEST	443	50556	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:10.892680883 CEST	50556	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:10.893007040 CEST	50556	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:10.893019915 CEST	443	50556	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:10.893080950 CEST	443	50556	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:10.939732075 CEST	50557	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:10.939779997 CEST	443	50557	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:10.939877987 CEST	50557	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:10.940176010 CEST	50557	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:10.940191984 CEST	443	50557	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:10.940263033 CEST	443	50557	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:10.986376047 CEST	50558	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:10.986408949 CEST	443	50558	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:10.986490011 CEST	50558	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:10.986804962 CEST	50558	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:10.986829996 CEST	443	50558	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:10.986872911 CEST	443	50558	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:11.033056974 CEST	50559	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:11.033070087 CEST	443	50559	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:11.033153057 CEST	50559	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:11.033509970 CEST	50559	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:11.033519983 CEST	443	50559	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:11.033575058 CEST	443	50559	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:11.079737902 CEST	50560	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:11.079755068 CEST	443	50560	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:11.079833984 CEST	50560	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:11.080286980 CEST	50560	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:11.080298901 CEST	443	50560	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:11.080349922 CEST	443	50560	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:11.126563072 CEST	50561	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:11.126581907 CEST	443	50561	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:11.126648903 CEST	50561	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:11.126916885 CEST	50561	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:11.126930952 CEST	443	50561	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:11.126996994 CEST	443	50561	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:11.173671007 CEST	50562	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:11.173739910 CEST	443	50562	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:11.173841000 CEST	50562	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:11.174251080 CEST	50562	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:11.174268007 CEST	443	50562	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:11.174330950 CEST	443	50562	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:11.220705032 CEST	50563	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:11.220737934 CEST	443	50563	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:11.220875025 CEST	50563	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:11.221209049 CEST	50563	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:11.221220970 CEST	443	50563	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:11.221280098 CEST	443	50563	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:11.267402887 CEST	50564	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:11.267436981 CEST	443	50564	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:11.267519951 CEST	50564	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:11.267822027 CEST	50564	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:11.267834902 CEST	443	50564	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:11.267904043 CEST	443	50564	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:11.314177990 CEST	50565	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:11.314205885 CEST	443	50565	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:11.314284086 CEST	50565	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:11.314583063 CEST	50565	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:11.314599037 CEST	443	50565	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:11.314659119 CEST	443	50565	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:11.361139059 CEST	50566	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:11.361186981 CEST	443	50566	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:11.361342907 CEST	50566	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:11.361645937 CEST	50566	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:11.361661911 CEST	443	50566	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:11.361736059 CEST	443	50566	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:11.407831907 CEST	50567	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:11.407844067 CEST	443	50567	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:11.407946110 CEST	50567	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:11.408193111 CEST	50567	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:11.408202887 CEST	443	50567	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:11.408253908 CEST	443	50567	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:11.454538107 CEST	50568	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:11.454582930 CEST	443	50568	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:11.454688072 CEST	50568	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:11.454902887 CEST	50568	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:11.454922915 CEST	443	50568	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:11.454969883 CEST	443	50568	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:11.501797915 CEST	50569	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:11.501842976 CEST	443	50569	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:11.501962900 CEST	50569	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:11.502357960 CEST	50569	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:11.502368927 CEST	443	50569	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:11.502428055 CEST	443	50569	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:11.548623085 CEST	50570	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:11.548664093 CEST	443	50570	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:11.548790932 CEST	50570	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:11.549077034 CEST	50570	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:11.549087048 CEST	443	50570	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:11.549225092 CEST	443	50570	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:11.595419884 CEST	50571	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:11.595463037 CEST	443	50571	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:11.595536947 CEST	50571	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:11.595824957 CEST	50571	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:11.595841885 CEST	443	50571	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:11.595897913 CEST	443	50571	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:11.642014980 CEST	50572	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:11.642050982 CEST	443	50572	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:11.642137051 CEST	50572	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:11.642384052 CEST	50572	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:11.642400026 CEST	443	50572	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:11.642457008 CEST	443	50572	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:11.688873053 CEST	50573	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:11.688921928 CEST	443	50573	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:11.688987970 CEST	50573	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:11.689215899 CEST	50573	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:11.689228058 CEST	443	50573	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:11.689285994 CEST	443	50573	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:11.735721111 CEST	50574	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:11.735740900 CEST	443	50574	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:11.735800028 CEST	50574	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:11.736023903 CEST	50574	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:11.736032963 CEST	443	50574	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:11.736085892 CEST	443	50574	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:11.782665968 CEST	50575	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:11.782689095 CEST	443	50575	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:11.782742023 CEST	50575	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:11.782968044 CEST	50575	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:11.782980919 CEST	443	50575	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:11.783041000 CEST	443	50575	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:11.829580069 CEST	50576	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:11.829617023 CEST	443	50576	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:11.829675913 CEST	50576	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:11.829907894 CEST	50576	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:11.829925060 CEST	443	50576	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:11.829977036 CEST	443	50576	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:11.877425909 CEST	50577	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:11.877458096 CEST	443	50577	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:11.877542973 CEST	50577	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:11.877844095 CEST	50577	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:11.877856970 CEST	443	50577	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:11.877907991 CEST	443	50577	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:11.923705101 CEST	50578	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:11.923742056 CEST	443	50578	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:11.923820019 CEST	50578	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:11.924144030 CEST	50578	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:11.924154997 CEST	443	50578	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:11.924264908 CEST	443	50578	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:11.970361948 CEST	50579	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:11.970401049 CEST	443	50579	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:11.970490932 CEST	50579	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:11.970721960 CEST	50579	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:11.970738888 CEST	443	50579	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:11.970804930 CEST	443	50579	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:12.017112970 CEST	50580	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:12.017143011 CEST	443	50580	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:12.017213106 CEST	50580	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:12.017510891 CEST	50580	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:12.017527103 CEST	443	50580	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:12.017580986 CEST	443	50580	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:12.064018011 CEST	50581	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:12.064053059 CEST	443	50581	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:12.064140081 CEST	50581	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:12.064357042 CEST	50581	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:12.064368963 CEST	443	50581	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:12.064443111 CEST	443	50581	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:12.111243010 CEST	50582	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:12.111254930 CEST	443	50582	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:12.111434937 CEST	50582	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:12.111651897 CEST	50582	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:12.111661911 CEST	443	50582	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:12.111712933 CEST	443	50582	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:12.158058882 CEST	50583	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:12.158099890 CEST	443	50583	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:12.158169031 CEST	50583	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:12.158442020 CEST	50583	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:12.158458948 CEST	443	50583	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:12.158524990 CEST	443	50583	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:12.205004930 CEST	50584	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:12.205028057 CEST	443	50584	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:12.205149889 CEST	50584	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:12.205460072 CEST	50584	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:12.205470085 CEST	443	50584	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:12.205522060 CEST	443	50584	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:12.251909018 CEST	50585	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:12.251946926 CEST	443	50585	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:12.252029896 CEST	50585	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:12.252377033 CEST	50585	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:12.252393961 CEST	443	50585	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:12.252446890 CEST	443	50585	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:12.298660994 CEST	50586	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:12.298715115 CEST	443	50586	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:12.298813105 CEST	50586	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:12.299127102 CEST	50586	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:12.299145937 CEST	443	50586	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:12.299211025 CEST	443	50586	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:12.345412970 CEST	50587	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:12.345444918 CEST	443	50587	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:12.345592976 CEST	50587	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:12.345808029 CEST	50587	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:12.345818996 CEST	443	50587	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:12.345907927 CEST	443	50587	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:12.392210007 CEST	50588	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:12.392245054 CEST	443	50588	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:12.392345905 CEST	50588	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:12.392625093 CEST	50588	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:12.392635107 CEST	443	50588	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:12.392719030 CEST	443	50588	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:12.439037085 CEST	50589	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:12.439081907 CEST	443	50589	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:12.439176083 CEST	50589	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:12.439414978 CEST	50589	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:12.439430952 CEST	443	50589	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:12.439523935 CEST	443	50589	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:12.485989094 CEST	50590	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:12.486007929 CEST	443	50590	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:12.486088991 CEST	50590	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:12.486367941 CEST	50590	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:12.486381054 CEST	443	50590	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:12.486445904 CEST	443	50590	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:12.533329964 CEST	50591	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:12.533350945 CEST	443	50591	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:12.533456087 CEST	50591	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:12.533759117 CEST	50591	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:12.533770084 CEST	443	50591	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:12.533832073 CEST	443	50591	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:12.579974890 CEST	50592	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:12.579992056 CEST	443	50592	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:12.580081940 CEST	50592	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:12.580399990 CEST	50592	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:12.580409050 CEST	443	50592	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:12.580470085 CEST	443	50592	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:12.627131939 CEST	50593	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:12.627161980 CEST	443	50593	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:12.627237082 CEST	50593	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:12.627540112 CEST	50593	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:12.627557039 CEST	443	50593	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:12.627613068 CEST	443	50593	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:12.673872948 CEST	50594	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:12.673912048 CEST	443	50594	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:12.674005985 CEST	50594	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:12.674297094 CEST	50594	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:12.674318075 CEST	443	50594	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:12.674422979 CEST	443	50594	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:12.720346928 CEST	50595	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:12.720366955 CEST	443	50595	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:12.720454931 CEST	50595	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:12.720685959 CEST	50595	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:12.720695972 CEST	443	50595	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:12.720761061 CEST	443	50595	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:12.767430067 CEST	50596	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:12.767450094 CEST	443	50596	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:12.767523050 CEST	50596	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:12.767807007 CEST	50596	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:12.767817020 CEST	443	50596	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:12.767889977 CEST	443	50596	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:12.814523935 CEST	50597	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:12.814583063 CEST	443	50597	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:12.814673901 CEST	50597	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:12.814937115 CEST	50597	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:12.814956903 CEST	443	50597	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:12.815018892 CEST	443	50597	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:12.861071110 CEST	50598	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:12.861093998 CEST	443	50598	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:12.861165047 CEST	50598	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:12.861455917 CEST	50598	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:12.861473083 CEST	443	50598	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:12.861526012 CEST	443	50598	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:12.908332109 CEST	50599	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:12.908358097 CEST	443	50599	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:12.908461094 CEST	50599	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:12.908782959 CEST	50599	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:12.908792973 CEST	443	50599	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:12.908840895 CEST	443	50599	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:12.954840899 CEST	50600	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:12.954879999 CEST	443	50600	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:12.955014944 CEST	50600	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:12.955344915 CEST	50600	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:12.955359936 CEST	443	50600	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:12.955430031 CEST	443	50600	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:13.001548052 CEST	50601	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:13.001585960 CEST	443	50601	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:13.001656055 CEST	50601	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:13.001983881 CEST	50601	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:13.001995087 CEST	443	50601	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:13.002052069 CEST	443	50601	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:13.049261093 CEST	50602	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:13.049278021 CEST	443	50602	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:13.049350023 CEST	50602	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:13.050003052 CEST	50602	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:13.050013065 CEST	443	50602	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:13.050127029 CEST	443	50602	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:13.095585108 CEST	50603	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:13.095618010 CEST	443	50603	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:13.095673084 CEST	50603	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:13.095985889 CEST	50603	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:13.096000910 CEST	443	50603	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:13.096065998 CEST	443	50603	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:13.142266989 CEST	50604	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:13.142362118 CEST	443	50604	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:13.142477989 CEST	50604	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:13.142765999 CEST	50604	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:13.142786980 CEST	443	50604	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:13.142846107 CEST	443	50604	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:13.189155102 CEST	50605	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:13.189184904 CEST	443	50605	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:13.189294100 CEST	50605	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:13.189578056 CEST	50605	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:13.189588070 CEST	443	50605	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:13.189656973 CEST	443	50605	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:13.236411095 CEST	50606	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:13.236439943 CEST	443	50606	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:13.236738920 CEST	50606	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:13.236838102 CEST	50606	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:13.236843109 CEST	443	50606	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:13.236892939 CEST	443	50606	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:13.282964945 CEST	50607	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:13.283004999 CEST	443	50607	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:13.283144951 CEST	50607	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:13.283485889 CEST	50607	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:13.283499956 CEST	443	50607	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:13.283551931 CEST	443	50607	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:13.329577923 CEST	50608	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:13.329631090 CEST	443	50608	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:13.329737902 CEST	50608	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:13.329963923 CEST	50608	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:13.329982996 CEST	443	50608	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:13.330037117 CEST	443	50608	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:13.376382113 CEST	50609	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:13.376396894 CEST	443	50609	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:13.376475096 CEST	50609	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:13.376679897 CEST	50609	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:13.376689911 CEST	443	50609	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:13.376751900 CEST	443	50609	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:13.423381090 CEST	50610	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:13.423402071 CEST	443	50610	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:13.423495054 CEST	50610	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:13.423765898 CEST	50610	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:13.423775911 CEST	443	50610	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:13.423894882 CEST	443	50610	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:13.470217943 CEST	50611	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:13.470269918 CEST	443	50611	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:13.470390081 CEST	50611	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:13.470603943 CEST	50611	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:13.470637083 CEST	443	50611	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:13.470707893 CEST	443	50611	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:13.517043114 CEST	50612	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:13.517072916 CEST	443	50612	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:13.517170906 CEST	50612	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:13.517378092 CEST	50612	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:13.517393112 CEST	443	50612	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:13.517453909 CEST	443	50612	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:13.564551115 CEST	50613	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:13.564595938 CEST	443	50613	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:13.564701080 CEST	50613	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:13.565001011 CEST	50613	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:13.565012932 CEST	443	50613	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:13.565130949 CEST	443	50613	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:13.611108065 CEST	50614	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:13.611138105 CEST	443	50614	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:13.611212015 CEST	50614	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:13.611530066 CEST	50614	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:13.611543894 CEST	443	50614	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:13.611669064 CEST	443	50614	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:13.658432961 CEST	50615	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:13.658476114 CEST	443	50615	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:13.658576012 CEST	50615	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:13.659012079 CEST	50615	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:13.659027100 CEST	443	50615	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:13.659148932 CEST	443	50615	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:13.704832077 CEST	50616	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:13.704871893 CEST	443	50616	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:13.705276966 CEST	50616	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:13.705344915 CEST	50616	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:13.705352068 CEST	443	50616	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:13.705514908 CEST	443	50616	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:13.751631975 CEST	50617	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:13.751672029 CEST	443	50617	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:13.751745939 CEST	50617	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:13.752173901 CEST	50617	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:13.752188921 CEST	443	50617	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:13.752310038 CEST	443	50617	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:13.798382044 CEST	50618	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:13.798403978 CEST	443	50618	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:13.798485041 CEST	50618	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:13.798759937 CEST	50618	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:13.798774958 CEST	443	50618	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:13.798861980 CEST	443	50618	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:13.845415115 CEST	50619	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:13.845455885 CEST	443	50619	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:13.845565081 CEST	50619	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:13.845902920 CEST	50619	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:13.845915079 CEST	443	50619	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:13.845979929 CEST	443	50619	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:13.892698050 CEST	50620	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:13.892731905 CEST	443	50620	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:13.892818928 CEST	50620	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:13.893098116 CEST	50620	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:13.893106937 CEST	443	50620	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:13.893230915 CEST	443	50620	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:13.939248085 CEST	50621	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:13.939285994 CEST	443	50621	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:13.939425945 CEST	50621	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:13.939752102 CEST	50621	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:13.939768076 CEST	443	50621	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:13.939902067 CEST	443	50621	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:13.986105919 CEST	50622	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:13.986125946 CEST	443	50622	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:13.986244917 CEST	50622	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:13.986527920 CEST	50622	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:13.986537933 CEST	443	50622	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:13.986661911 CEST	443	50622	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:14.033168077 CEST	50623	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:14.033205986 CEST	443	50623	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:14.033284903 CEST	50623	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:14.033576965 CEST	50623	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:14.033590078 CEST	443	50623	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:14.033683062 CEST	443	50623	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:14.079807997 CEST	50624	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:14.079833984 CEST	443	50624	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:14.080015898 CEST	50624	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:14.080240011 CEST	50624	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:14.080245972 CEST	443	50624	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:14.080378056 CEST	443	50624	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:14.126748085 CEST	50625	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:14.126781940 CEST	443	50625	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:14.126847982 CEST	50625	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:14.127147913 CEST	50625	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:14.127165079 CEST	443	50625	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:14.127239943 CEST	443	50625	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:14.174082994 CEST	50626	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:14.174112082 CEST	443	50626	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:14.174176931 CEST	50626	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:14.174465895 CEST	50626	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:14.174487114 CEST	443	50626	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:14.174546957 CEST	443	50626	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:14.220674038 CEST	50627	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:14.220685005 CEST	443	50627	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:14.220803976 CEST	50627	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:14.221124887 CEST	50627	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:14.221132040 CEST	443	50627	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:14.221260071 CEST	443	50627	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:14.267407894 CEST	50628	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:14.267436028 CEST	443	50628	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:14.267543077 CEST	50628	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:14.267904997 CEST	50628	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:14.267915964 CEST	443	50628	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:14.267997980 CEST	443	50628	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:14.314796925 CEST	50629	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:14.314825058 CEST	443	50629	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:14.314933062 CEST	50629	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:14.315191031 CEST	50629	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:14.315206051 CEST	443	50629	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:14.315332890 CEST	443	50629	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:14.362068892 CEST	50630	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:14.362086058 CEST	443	50630	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:14.362168074 CEST	50630	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:14.362459898 CEST	50630	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:14.362474918 CEST	443	50630	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:14.362608910 CEST	443	50630	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:14.408241987 CEST	50631	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:14.408278942 CEST	443	50631	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:14.408376932 CEST	50631	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:14.408668041 CEST	50631	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:14.408677101 CEST	443	50631	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:14.408793926 CEST	443	50631	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:14.454613924 CEST	50632	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:14.454663038 CEST	443	50632	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:14.454735994 CEST	50632	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:14.455008030 CEST	50632	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:14.455018044 CEST	443	50632	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:14.455173969 CEST	443	50632	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:14.501534939 CEST	50633	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:14.501590014 CEST	443	50633	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:14.501688004 CEST	50633	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:14.501966953 CEST	50633	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:14.501977921 CEST	443	50633	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:14.502113104 CEST	443	50633	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:14.548686981 CEST	50634	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:14.548703909 CEST	443	50634	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:14.548774004 CEST	50634	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:14.549026966 CEST	50634	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:14.549031973 CEST	443	50634	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:14.549134016 CEST	443	50634	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:14.595525980 CEST	50635	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:14.595577002 CEST	443	50635	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:14.595665932 CEST	50635	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:14.595979929 CEST	50635	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:14.595995903 CEST	443	50635	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:14.596066952 CEST	443	50635	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:14.642371893 CEST	50636	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:14.642424107 CEST	443	50636	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:14.642570972 CEST	50636	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:14.642911911 CEST	50636	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:14.642927885 CEST	443	50636	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:14.643054962 CEST	443	50636	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:14.689294100 CEST	50637	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:14.689337969 CEST	443	50637	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:14.689538002 CEST	50637	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:14.689825058 CEST	50637	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:14.689837933 CEST	443	50637	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:14.689954042 CEST	443	50637	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:14.736103058 CEST	50638	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:14.736138105 CEST	443	50638	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:14.736264944 CEST	50638	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:14.736543894 CEST	50638	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:14.736556053 CEST	443	50638	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:14.736674070 CEST	443	50638	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:14.783113956 CEST	50639	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:14.783152103 CEST	443	50639	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:14.783214092 CEST	50639	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:14.783499956 CEST	50639	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:14.783516884 CEST	443	50639	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:14.783646107 CEST	443	50639	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:14.829623938 CEST	50640	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:14.829653978 CEST	443	50640	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:14.829730034 CEST	50640	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:14.830024004 CEST	50640	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:14.830039024 CEST	443	50640	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:14.830113888 CEST	443	50640	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:14.876702070 CEST	50641	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:14.876750946 CEST	443	50641	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:14.877087116 CEST	50641	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:14.877087116 CEST	50641	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:14.877121925 CEST	443	50641	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:14.877245903 CEST	443	50641	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:14.923432112 CEST	50642	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:14.923463106 CEST	443	50642	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:14.923588037 CEST	50642	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:14.923897028 CEST	50642	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:14.923908949 CEST	443	50642	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:14.923971891 CEST	443	50642	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:14.970506907 CEST	50643	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:14.970552921 CEST	443	50643	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:14.970659018 CEST	50643	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:14.970942020 CEST	50643	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:14.970956087 CEST	443	50643	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:14.971007109 CEST	443	50643	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:15.017313957 CEST	50644	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:15.017349005 CEST	443	50644	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:15.017426968 CEST	50644	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:15.017720938 CEST	50644	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:15.017735958 CEST	443	50644	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:15.017798901 CEST	443	50644	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:15.064172983 CEST	50645	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:15.064213991 CEST	443	50645	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:15.064310074 CEST	50645	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:15.064754963 CEST	50645	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:15.064768076 CEST	443	50645	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:15.064836979 CEST	443	50645	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:15.111409903 CEST	50646	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:15.111434937 CEST	443	50646	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:15.111524105 CEST	50646	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:15.112004995 CEST	50646	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:15.112015963 CEST	443	50646	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:15.112093925 CEST	443	50646	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:15.157628059 CEST	50647	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:15.157664061 CEST	443	50647	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:15.157742977 CEST	50647	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:15.157938004 CEST	50647	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:15.157954931 CEST	443	50647	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:15.158011913 CEST	443	50647	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:15.188966036 CEST	50648	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:15.189008951 CEST	443	50648	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:15.189080000 CEST	50648	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:15.189270973 CEST	50648	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:15.189285040 CEST	443	50648	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:15.189337969 CEST	443	50648	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:15.220037937 CEST	50649	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:15.220060110 CEST	443	50649	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:15.220196962 CEST	50649	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:15.220496893 CEST	50649	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:15.220511913 CEST	443	50649	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:15.220566988 CEST	443	50649	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:15.251524925 CEST	50650	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:15.251538038 CEST	443	50650	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:15.251599073 CEST	50650	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:15.251852036 CEST	50650	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:15.251864910 CEST	443	50650	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:15.251930952 CEST	443	50650	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:15.298978090 CEST	50651	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:15.299021959 CEST	443	50651	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:15.299160957 CEST	50651	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:15.299464941 CEST	50651	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:15.299479961 CEST	443	50651	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:15.299549103 CEST	443	50651	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:15.329775095 CEST	50652	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:15.329792976 CEST	443	50652	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:15.329885960 CEST	50652	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:15.330173969 CEST	50652	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:15.330183983 CEST	443	50652	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:15.330238104 CEST	443	50652	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:15.360924006 CEST	50653	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:15.360970974 CEST	443	50653	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:15.361046076 CEST	50653	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:15.361267090 CEST	50653	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:15.361284018 CEST	443	50653	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:15.361335039 CEST	443	50653	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:15.391999960 CEST	50654	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:15.392019033 CEST	443	50654	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:15.392088890 CEST	50654	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:15.392307043 CEST	50654	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:15.392322063 CEST	443	50654	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:15.392374992 CEST	443	50654	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:15.423290968 CEST	50655	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:15.423310041 CEST	443	50655	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:15.423373938 CEST	50655	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:15.423604012 CEST	50655	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:15.423613071 CEST	443	50655	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:15.423666000 CEST	443	50655	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:15.454448938 CEST	50656	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:15.454466105 CEST	443	50656	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:15.454534054 CEST	50656	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:15.454735994 CEST	50656	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:15.454745054 CEST	443	50656	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:15.454818010 CEST	443	50656	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:15.485749006 CEST	50657	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:15.485775948 CEST	443	50657	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:15.485838890 CEST	50657	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:15.486136913 CEST	50657	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:15.486150026 CEST	443	50657	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:15.486203909 CEST	443	50657	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:15.517112017 CEST	50658	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:15.517122984 CEST	443	50658	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:15.517219067 CEST	50658	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:15.517451048 CEST	50658	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:15.517461061 CEST	443	50658	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:15.517525911 CEST	443	50658	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:15.548221111 CEST	50659	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:15.548238993 CEST	443	50659	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:15.548316956 CEST	50659	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:15.548502922 CEST	50659	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:15.548512936 CEST	443	50659	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:15.548568964 CEST	443	50659	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:15.579642057 CEST	50660	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:15.579685926 CEST	443	50660	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:15.579758883 CEST	50660	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:15.580041885 CEST	50660	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:15.580056906 CEST	443	50660	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:15.580116034 CEST	443	50660	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:15.611298084 CEST	50661	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:15.611323118 CEST	443	50661	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:15.611398935 CEST	50661	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:15.611637115 CEST	50661	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:15.611650944 CEST	443	50661	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:15.611706018 CEST	443	50661	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:15.642421007 CEST	50662	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:15.642457962 CEST	443	50662	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:15.642551899 CEST	50662	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:15.642841101 CEST	50662	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:15.642855883 CEST	443	50662	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:15.642914057 CEST	443	50662	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:15.673599005 CEST	50663	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:15.673648119 CEST	443	50663	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:15.673790932 CEST	50663	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:15.674019098 CEST	50663	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:15.674031019 CEST	443	50663	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:15.674094915 CEST	443	50663	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:15.704663992 CEST	50664	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:15.704708099 CEST	443	50664	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:15.704916000 CEST	50664	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:15.705162048 CEST	50664	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:15.705178976 CEST	443	50664	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:15.705239058 CEST	443	50664	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:15.735860109 CEST	50665	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:15.735896111 CEST	443	50665	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:15.735969067 CEST	50665	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:15.736315966 CEST	50665	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:15.736329079 CEST	443	50665	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:15.736383915 CEST	443	50665	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:15.767222881 CEST	50666	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:15.767235041 CEST	443	50666	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:15.767301083 CEST	50666	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:15.767581940 CEST	50666	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:15.767591000 CEST	443	50666	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:15.767641068 CEST	443	50666	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:15.798326969 CEST	50667	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:15.798362970 CEST	443	50667	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:15.798427105 CEST	50667	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:15.798636913 CEST	50667	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:15.798654079 CEST	443	50667	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:15.798723936 CEST	443	50667	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:15.829642057 CEST	50668	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:15.829667091 CEST	443	50668	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:15.829725027 CEST	50668	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:15.829935074 CEST	50668	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:15.829950094 CEST	443	50668	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:15.830004930 CEST	443	50668	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:15.860888004 CEST	50669	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:15.860929966 CEST	443	50669	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:15.860982895 CEST	50669	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:15.861217976 CEST	50669	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:15.861233950 CEST	443	50669	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:15.861295938 CEST	443	50669	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:15.892088890 CEST	50670	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:15.892116070 CEST	443	50670	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:15.892175913 CEST	50670	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:15.892388105 CEST	50670	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:15.892399073 CEST	443	50670	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:15.892483950 CEST	443	50670	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:15.923376083 CEST	50671	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:15.923409939 CEST	443	50671	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:15.923469067 CEST	50671	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:15.923721075 CEST	50671	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:15.923733950 CEST	443	50671	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:15.923784018 CEST	443	50671	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:15.954761028 CEST	50672	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:15.954797029 CEST	443	50672	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:15.954875946 CEST	50672	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:15.955122948 CEST	50672	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:15.955137968 CEST	443	50672	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:15.955193996 CEST	443	50672	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:15.986120939 CEST	50673	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:15.986159086 CEST	443	50673	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:15.986263037 CEST	50673	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:15.986541033 CEST	50673	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:15.986552954 CEST	443	50673	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:15.986599922 CEST	443	50673	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:16.017334938 CEST	50674	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:16.017342091 CEST	443	50674	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:16.017410040 CEST	50674	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:16.017757893 CEST	50674	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:16.017765999 CEST	443	50674	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:16.017817020 CEST	443	50674	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:16.048489094 CEST	50675	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:16.048515081 CEST	443	50675	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:16.048599958 CEST	50675	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:16.048952103 CEST	50675	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:16.048965931 CEST	443	50675	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:16.049017906 CEST	443	50675	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:16.079713106 CEST	50676	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:16.079739094 CEST	443	50676	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:16.079802036 CEST	50676	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:16.080070972 CEST	50676	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:16.080085993 CEST	443	50676	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:16.080147982 CEST	443	50676	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:16.110866070 CEST	50677	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:16.110892057 CEST	443	50677	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:16.110971928 CEST	50677	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:16.111251116 CEST	50677	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:16.111263037 CEST	443	50677	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:16.111314058 CEST	443	50677	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:16.142046928 CEST	50678	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:16.142066002 CEST	443	50678	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:16.142124891 CEST	50678	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:16.142359972 CEST	50678	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:16.142369986 CEST	443	50678	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:16.142399073 CEST	443	50678	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:16.173248053 CEST	50679	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:16.173290968 CEST	443	50679	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:16.173489094 CEST	50679	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:16.173614025 CEST	50679	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:16.173635960 CEST	443	50679	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:16.173666000 CEST	443	50679	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:16.204531908 CEST	50680	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:16.204574108 CEST	443	50680	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:16.204641104 CEST	50680	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:16.205058098 CEST	50680	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:16.205068111 CEST	443	50680	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:16.211360931 CEST	443	50680	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:16.252027035 CEST	50681	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:16.252059937 CEST	443	50681	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:16.252146006 CEST	50681	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:16.252480030 CEST	50681	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:16.252491951 CEST	443	50681	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:16.252538919 CEST	443	50681	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:16.283049107 CEST	50682	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:16.283066034 CEST	443	50682	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:16.283160925 CEST	50682	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:16.283472061 CEST	50682	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:16.283482075 CEST	443	50682	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:16.283519030 CEST	443	50682	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:16.314080954 CEST	50683	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:16.314126968 CEST	443	50683	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:16.314209938 CEST	50683	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:16.314450979 CEST	50683	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:16.314460039 CEST	443	50683	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:16.314496040 CEST	443	50683	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:16.345733881 CEST	50684	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:16.345772982 CEST	443	50684	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:16.345865965 CEST	50684	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:16.346177101 CEST	50684	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:16.346187115 CEST	443	50684	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:16.346221924 CEST	443	50684	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:16.377753973 CEST	50685	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:16.377800941 CEST	443	50685	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:16.377929926 CEST	50685	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:16.378310919 CEST	50685	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:16.378324986 CEST	443	50685	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:16.378369093 CEST	443	50685	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:16.407927036 CEST	50686	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:16.407962084 CEST	443	50686	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:16.408045053 CEST	50686	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:16.408302069 CEST	50686	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:16.408314943 CEST	443	50686	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:16.408356905 CEST	443	50686	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:16.439064980 CEST	50687	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:16.439094067 CEST	443	50687	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:16.439172983 CEST	50687	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:16.439475060 CEST	50687	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:16.439486027 CEST	443	50687	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:16.439534903 CEST	443	50687	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:16.470283985 CEST	50688	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:16.470318079 CEST	443	50688	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:16.470376015 CEST	50688	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:16.470643997 CEST	50688	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:16.470653057 CEST	443	50688	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:16.470689058 CEST	443	50688	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:16.501580000 CEST	50689	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:16.501616955 CEST	443	50689	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:16.501672983 CEST	50689	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:16.501945019 CEST	50689	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:16.501956940 CEST	443	50689	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:16.502000093 CEST	443	50689	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:16.532835007 CEST	50690	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:16.532846928 CEST	443	50690	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:16.532932043 CEST	50690	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:16.533188105 CEST	50690	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:16.533196926 CEST	443	50690	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:16.533243895 CEST	443	50690	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:16.564050913 CEST	50691	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:16.564115047 CEST	443	50691	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:16.564312935 CEST	50691	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:16.564461946 CEST	50691	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:16.564475060 CEST	443	50691	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:16.564512968 CEST	443	50691	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:16.595196962 CEST	50692	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:16.595237970 CEST	443	50692	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:16.595303059 CEST	50692	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:16.595567942 CEST	50692	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:16.595577955 CEST	443	50692	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:16.595616102 CEST	443	50692	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:16.626703978 CEST	50693	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:16.626744032 CEST	443	50693	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:16.626801968 CEST	50693	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:16.627034903 CEST	50693	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:16.627048969 CEST	443	50693	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:16.627085924 CEST	443	50693	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:16.658205032 CEST	50694	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:16.658231020 CEST	443	50694	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:16.658305883 CEST	50694	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:16.658632994 CEST	50694	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:16.658648968 CEST	443	50694	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:16.658687115 CEST	443	50694	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:16.689425945 CEST	50695	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:16.689466953 CEST	443	50695	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:16.689582109 CEST	50695	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:16.689912081 CEST	50695	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:16.689920902 CEST	443	50695	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:16.689960957 CEST	443	50695	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:16.720462084 CEST	50696	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:16.720496893 CEST	443	50696	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:16.720578909 CEST	50696	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:16.720870018 CEST	50696	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:16.720881939 CEST	443	50696	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:16.720918894 CEST	443	50696	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:16.751354933 CEST	50697	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:16.751405954 CEST	443	50697	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:16.751471996 CEST	50697	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:16.751759052 CEST	50697	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:16.751766920 CEST	443	50697	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:16.751801014 CEST	443	50697	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:16.782618046 CEST	50698	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:16.782645941 CEST	443	50698	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:16.782718897 CEST	50698	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:16.782963037 CEST	50698	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:16.782969952 CEST	443	50698	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:16.783003092 CEST	443	50698	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:16.813978910 CEST	50699	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:16.813998938 CEST	443	50699	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:16.814062119 CEST	50699	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:16.814351082 CEST	50699	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:16.814368010 CEST	443	50699	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:16.814404011 CEST	443	50699	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:16.845279932 CEST	50700	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:16.845309019 CEST	443	50700	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:16.845381021 CEST	50700	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:16.845633984 CEST	50700	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:16.845648050 CEST	443	50700	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:16.845685005 CEST	443	50700	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:16.876375914 CEST	50701	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:16.876410961 CEST	443	50701	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:16.876475096 CEST	50701	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:16.876688004 CEST	50701	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:16.876699924 CEST	443	50701	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:16.876732111 CEST	443	50701	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:16.907598972 CEST	50702	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:16.907625914 CEST	443	50702	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:16.907708883 CEST	50702	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:16.907896996 CEST	50702	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:16.907907963 CEST	443	50702	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:16.907948971 CEST	443	50702	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:16.938997030 CEST	50703	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:16.939024925 CEST	443	50703	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:16.939101934 CEST	50703	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:16.939388990 CEST	50703	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:16.939400911 CEST	443	50703	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:16.939435959 CEST	443	50703	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:16.970347881 CEST	50704	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:16.970383883 CEST	443	50704	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:16.970612049 CEST	50704	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:16.970910072 CEST	50704	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:16.970923901 CEST	443	50704	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:16.970956087 CEST	443	50704	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:17.002580881 CEST	50705	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:17.002629042 CEST	443	50705	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:17.002763033 CEST	50705	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:17.003292084 CEST	50705	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:17.003307104 CEST	443	50705	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:17.003339052 CEST	443	50705	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:17.033029079 CEST	50706	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:17.033047915 CEST	443	50706	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:17.033128977 CEST	50706	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:17.033442974 CEST	50706	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:17.033453941 CEST	443	50706	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:17.033482075 CEST	443	50706	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:17.064928055 CEST	50707	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:17.064966917 CEST	443	50707	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:17.065037966 CEST	50707	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:17.065382957 CEST	50707	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:17.065397024 CEST	443	50707	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:17.065428019 CEST	443	50707	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:17.095531940 CEST	50708	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:17.095557928 CEST	443	50708	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:17.095628023 CEST	50708	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:17.095920086 CEST	50708	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:17.095931053 CEST	443	50708	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:17.096018076 CEST	443	50708	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:17.126513004 CEST	50709	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:17.126553059 CEST	443	50709	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:17.126645088 CEST	50709	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:17.126925945 CEST	50709	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:17.126935959 CEST	443	50709	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:17.126970053 CEST	443	50709	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:17.157644987 CEST	50710	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:17.157659054 CEST	443	50710	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:17.157721043 CEST	50710	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:17.157955885 CEST	50710	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:17.157965899 CEST	443	50710	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:17.158015966 CEST	443	50710	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:17.188982010 CEST	50711	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:17.189007044 CEST	443	50711	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:17.189075947 CEST	50711	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:17.189305067 CEST	50711	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:17.189321041 CEST	443	50711	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:17.189378977 CEST	443	50711	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:17.220150948 CEST	50712	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:17.220207930 CEST	443	50712	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:17.220278978 CEST	50712	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:17.220525026 CEST	50712	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:17.220536947 CEST	443	50712	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:17.220587015 CEST	443	50712	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:17.251367092 CEST	50713	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:17.251404047 CEST	443	50713	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:17.251485109 CEST	50713	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:17.251677990 CEST	50713	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:17.251693010 CEST	443	50713	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:17.251746893 CEST	443	50713	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:17.282665014 CEST	50714	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:17.282696962 CEST	443	50714	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:17.282763004 CEST	50714	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:17.282984018 CEST	50714	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:17.282998085 CEST	443	50714	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:17.283047915 CEST	443	50714	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:17.314018011 CEST	50715	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:17.314104080 CEST	443	50715	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:17.314188004 CEST	50715	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:17.314414978 CEST	50715	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:17.314428091 CEST	443	50715	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:17.314481974 CEST	443	50715	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:17.345165968 CEST	50716	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:17.345201969 CEST	443	50716	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:17.345285892 CEST	50716	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:17.345489979 CEST	50716	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:17.345503092 CEST	443	50716	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:17.345550060 CEST	443	50716	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:17.376677036 CEST	50717	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:17.376718044 CEST	443	50717	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:17.376822948 CEST	50717	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:17.377124071 CEST	50717	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:17.377140045 CEST	443	50717	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:17.377204895 CEST	443	50717	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:17.407855034 CEST	50718	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:17.407870054 CEST	443	50718	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:17.407943964 CEST	50718	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:17.408230066 CEST	50718	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:17.408241987 CEST	443	50718	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:17.408299923 CEST	443	50718	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:17.438894033 CEST	50719	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:17.438941956 CEST	443	50719	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:17.439014912 CEST	50719	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:17.439201117 CEST	50719	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:17.439213991 CEST	443	50719	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:17.439263105 CEST	443	50719	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:17.470107079 CEST	50720	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:17.470134020 CEST	443	50720	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:17.470196009 CEST	50720	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:17.470391989 CEST	50720	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:17.470402956 CEST	443	50720	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:17.470453024 CEST	443	50720	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:17.501374006 CEST	50721	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:17.501396894 CEST	443	50721	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:17.501461029 CEST	50721	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:17.501669884 CEST	50721	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:17.501696110 CEST	443	50721	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:17.501761913 CEST	443	50721	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:17.532567978 CEST	50722	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:17.532578945 CEST	443	50722	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:17.532639027 CEST	50722	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:17.532860994 CEST	50722	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:17.532872915 CEST	443	50722	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:17.532941103 CEST	443	50722	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:17.563827038 CEST	50723	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:17.563853979 CEST	443	50723	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:17.563944101 CEST	50723	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:17.564233065 CEST	50723	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:17.564245939 CEST	443	50723	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:17.564312935 CEST	443	50723	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:17.595355034 CEST	50724	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:17.595367908 CEST	443	50724	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:17.595501900 CEST	50724	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:17.595890045 CEST	50724	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:17.595904112 CEST	443	50724	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:17.595964909 CEST	443	50724	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:17.626501083 CEST	50725	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:17.626528025 CEST	443	50725	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:17.626610041 CEST	50725	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:17.626848936 CEST	50725	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:17.626863003 CEST	443	50725	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:17.626903057 CEST	443	50725	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:17.659965992 CEST	50726	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:17.659993887 CEST	443	50726	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:17.660130978 CEST	50726	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:17.660479069 CEST	50726	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:17.660492897 CEST	443	50726	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:17.660542965 CEST	443	50726	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:17.689100981 CEST	50727	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:17.689143896 CEST	443	50727	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:17.689337015 CEST	50727	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:17.689510107 CEST	50727	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:17.689524889 CEST	443	50727	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:17.689594030 CEST	443	50727	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:17.720746040 CEST	50728	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:17.720813036 CEST	443	50728	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:17.720892906 CEST	50728	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:17.721254110 CEST	50728	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:17.721270084 CEST	443	50728	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:17.721349001 CEST	443	50728	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:17.751718998 CEST	50729	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:17.751766920 CEST	443	50729	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:17.751946926 CEST	50729	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:17.752182961 CEST	50729	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:17.752196074 CEST	443	50729	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:17.752259970 CEST	443	50729	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:17.782926083 CEST	50730	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:17.782970905 CEST	443	50730	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:17.783052921 CEST	50730	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:17.783298016 CEST	50730	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:17.783310890 CEST	443	50730	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:17.783359051 CEST	443	50730	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:17.813966036 CEST	50731	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:17.813993931 CEST	443	50731	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:17.814085007 CEST	50731	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:17.814317942 CEST	50731	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:17.814332962 CEST	443	50731	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:17.814384937 CEST	443	50731	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:17.845253944 CEST	50732	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:17.845285892 CEST	443	50732	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:17.845447063 CEST	50732	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:17.845732927 CEST	50732	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:17.845747948 CEST	443	50732	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:17.845805883 CEST	443	50732	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:17.876595020 CEST	50733	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:17.876645088 CEST	443	50733	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:17.876719952 CEST	50733	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:17.876967907 CEST	50733	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:17.876983881 CEST	443	50733	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:17.877051115 CEST	443	50733	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:17.907710075 CEST	50734	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:17.907743931 CEST	443	50734	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:17.907955885 CEST	50734	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:17.908118963 CEST	50734	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:17.908133030 CEST	443	50734	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:17.908207893 CEST	443	50734	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:17.939307928 CEST	50735	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:17.939337015 CEST	443	50735	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:17.939399004 CEST	50735	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:17.939630985 CEST	50735	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:17.939645052 CEST	443	50735	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:17.939697981 CEST	443	50735	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:17.970226049 CEST	50736	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:17.970266104 CEST	443	50736	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:17.970434904 CEST	50736	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:17.970554113 CEST	50736	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:17.970571041 CEST	443	50736	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:17.970618963 CEST	443	50736	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:18.001355886 CEST	50737	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:18.001419067 CEST	443	50737	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:18.001492023 CEST	50737	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:18.001724005 CEST	50737	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:18.001741886 CEST	443	50737	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:18.001785040 CEST	443	50737	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:18.033288002 CEST	50738	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:18.033313036 CEST	443	50738	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:18.033374071 CEST	50738	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:18.033852100 CEST	50738	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:18.033866882 CEST	443	50738	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:18.033912897 CEST	443	50738	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:18.064301014 CEST	50739	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:18.064352989 CEST	443	50739	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:18.064440966 CEST	50739	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:18.064810038 CEST	50739	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:18.064827919 CEST	443	50739	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:18.064882040 CEST	443	50739	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:18.095307112 CEST	50740	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:18.095340967 CEST	443	50740	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:18.095415115 CEST	50740	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:18.095699072 CEST	50740	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:18.095722914 CEST	443	50740	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:18.095773935 CEST	443	50740	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:18.126470089 CEST	50741	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:18.126514912 CEST	443	50741	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:18.126585007 CEST	50741	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:18.126854897 CEST	50741	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:18.126869917 CEST	443	50741	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:18.126924992 CEST	443	50741	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:18.157759905 CEST	50742	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:18.157793045 CEST	443	50742	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:18.157844067 CEST	50742	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:18.158111095 CEST	50742	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:18.158124924 CEST	443	50742	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:18.158185959 CEST	443	50742	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:18.188946009 CEST	50743	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:18.188980103 CEST	443	50743	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:18.189037085 CEST	50743	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:18.189310074 CEST	50743	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:18.189321041 CEST	443	50743	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:18.189378977 CEST	443	50743	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:18.220232010 CEST	50744	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:18.220283985 CEST	443	50744	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:18.220344067 CEST	50744	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:18.220606089 CEST	50744	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:18.220622063 CEST	443	50744	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:18.220683098 CEST	443	50744	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:18.251441956 CEST	50745	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:18.251486063 CEST	443	50745	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:18.251559019 CEST	50745	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:18.251801014 CEST	50745	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:18.251821995 CEST	443	50745	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:18.251863956 CEST	443	50745	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:18.283051014 CEST	50746	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:18.283071995 CEST	443	50746	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:18.283138037 CEST	50746	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:18.283416033 CEST	50746	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:18.283427000 CEST	443	50746	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:18.283473969 CEST	443	50746	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:18.313972950 CEST	50747	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:18.314007044 CEST	443	50747	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:18.314088106 CEST	50747	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:18.314378023 CEST	50747	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:18.314390898 CEST	443	50747	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:18.314443111 CEST	443	50747	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:18.345269918 CEST	50748	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:18.345310926 CEST	443	50748	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:18.345381021 CEST	50748	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:18.345650911 CEST	50748	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:18.345663071 CEST	443	50748	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:18.345716953 CEST	443	50748	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:18.377293110 CEST	50749	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:18.377342939 CEST	443	50749	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:18.377425909 CEST	50749	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:18.377733946 CEST	50749	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:18.377749920 CEST	443	50749	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:18.377803087 CEST	443	50749	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:18.408246040 CEST	50750	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:18.408289909 CEST	443	50750	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:18.408400059 CEST	50750	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:18.408761024 CEST	50750	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:18.408776045 CEST	443	50750	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:18.408852100 CEST	443	50750	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:18.439260960 CEST	50751	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:18.439316988 CEST	443	50751	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:18.439436913 CEST	50751	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:18.439717054 CEST	50751	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:18.439728975 CEST	443	50751	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:18.439781904 CEST	443	50751	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:18.470267057 CEST	50752	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:18.470309019 CEST	443	50752	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:18.470408916 CEST	50752	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:18.470670938 CEST	50752	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:18.470681906 CEST	443	50752	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:18.470803976 CEST	443	50752	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:18.501476049 CEST	50753	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:18.501521111 CEST	443	50753	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:18.501605988 CEST	50753	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:18.501888037 CEST	50753	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:18.501903057 CEST	443	50753	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:18.501971960 CEST	443	50753	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:18.532689095 CEST	50754	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:18.532722950 CEST	443	50754	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:18.532799959 CEST	50754	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:18.533035040 CEST	50754	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:18.533050060 CEST	443	50754	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:18.533103943 CEST	443	50754	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:18.563968897 CEST	50755	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:18.564028978 CEST	443	50755	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:18.564117908 CEST	50755	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:18.564317942 CEST	50755	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:18.564335108 CEST	443	50755	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:18.564393997 CEST	443	50755	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:18.595518112 CEST	50756	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:18.595563889 CEST	443	50756	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:18.595645905 CEST	50756	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:18.595874071 CEST	50756	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:18.595890045 CEST	443	50756	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:18.595940113 CEST	443	50756	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:18.626543045 CEST	50757	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:18.626584053 CEST	443	50757	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:18.626665115 CEST	50757	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:18.626913071 CEST	50757	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:18.626928091 CEST	443	50757	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:18.626986980 CEST	443	50757	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:18.657819986 CEST	50758	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:18.657840014 CEST	443	50758	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:18.657917023 CEST	50758	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:18.658147097 CEST	50758	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:18.658158064 CEST	443	50758	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:18.658211946 CEST	443	50758	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:18.689116955 CEST	50759	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:18.689143896 CEST	443	50759	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:18.689215899 CEST	50759	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:18.689472914 CEST	50759	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:18.689485073 CEST	443	50759	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:18.689534903 CEST	443	50759	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:18.725517035 CEST	50760	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:18.725558996 CEST	443	50760	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:18.725632906 CEST	50760	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:18.725903034 CEST	50760	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:18.725919962 CEST	443	50760	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:18.725971937 CEST	443	50760	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:18.751820087 CEST	50761	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:18.751868010 CEST	443	50761	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:18.751961946 CEST	50761	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:18.752226114 CEST	50761	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:18.752243996 CEST	443	50761	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:18.752291918 CEST	443	50761	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:18.783198118 CEST	50762	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:18.783238888 CEST	443	50762	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:18.783319950 CEST	50762	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:18.783617020 CEST	50762	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:18.783632040 CEST	443	50762	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:18.783699989 CEST	443	50762	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:18.814573050 CEST	50763	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:18.814637899 CEST	443	50763	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:18.814717054 CEST	50763	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:18.815351963 CEST	50763	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:18.815366983 CEST	443	50763	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:18.815469980 CEST	443	50763	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:18.845535040 CEST	50764	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:18.845607042 CEST	443	50764	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:18.845716953 CEST	50764	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:18.845998049 CEST	50764	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:18.846020937 CEST	443	50764	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:18.846071005 CEST	443	50764	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:18.876802921 CEST	50765	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:18.876864910 CEST	443	50765	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:18.876974106 CEST	50765	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:18.877300978 CEST	50765	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:18.877319098 CEST	443	50765	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:18.877365112 CEST	443	50765	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:18.908037901 CEST	50766	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:18.908088923 CEST	443	50766	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:18.908216000 CEST	50766	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:18.908503056 CEST	50766	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:18.908515930 CEST	443	50766	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:18.908565044 CEST	443	50766	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:18.939801931 CEST	50767	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:18.939850092 CEST	443	50767	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:18.939954042 CEST	50767	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:18.940217972 CEST	50767	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:18.940238953 CEST	443	50767	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:18.940299988 CEST	443	50767	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:18.970335960 CEST	50768	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:18.970388889 CEST	443	50768	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:18.970614910 CEST	50768	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:18.970738888 CEST	50768	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:18.970757008 CEST	443	50768	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:18.970804930 CEST	443	50768	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:19.001867056 CEST	50769	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:19.001929998 CEST	443	50769	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:19.002021074 CEST	50769	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:19.002249002 CEST	50769	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:19.002265930 CEST	443	50769	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:19.002314091 CEST	443	50769	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:19.034049988 CEST	50770	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:19.034075022 CEST	443	50770	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:19.034159899 CEST	50770	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:19.034909010 CEST	50770	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:19.034928083 CEST	443	50770	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:19.034981966 CEST	443	50770	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:19.066615105 CEST	50771	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:19.066678047 CEST	443	50771	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:19.066762924 CEST	50771	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:19.067131996 CEST	50771	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:19.067151070 CEST	443	50771	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:19.067214966 CEST	443	50771	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:19.095700979 CEST	50772	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:19.095774889 CEST	443	50772	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:19.095884085 CEST	50772	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:19.096146107 CEST	50772	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:19.096163034 CEST	443	50772	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:19.096215010 CEST	443	50772	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:19.126703978 CEST	50773	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:19.126749039 CEST	443	50773	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:19.126847982 CEST	50773	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:19.127160072 CEST	50773	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:19.127172947 CEST	443	50773	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:19.127223015 CEST	443	50773	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:19.157849073 CEST	50774	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:19.157864094 CEST	443	50774	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:19.157944918 CEST	50774	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:19.158399105 CEST	50774	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:19.158411980 CEST	443	50774	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:19.158459902 CEST	443	50774	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:19.189100027 CEST	50775	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:19.189150095 CEST	443	50775	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:19.189218044 CEST	50775	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:19.189512968 CEST	50775	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:19.189527988 CEST	443	50775	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:19.189578056 CEST	443	50775	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:19.220598936 CEST	50776	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:19.220653057 CEST	443	50776	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:19.220760107 CEST	50776	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:19.221088886 CEST	50776	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:19.221107006 CEST	443	50776	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:19.221154928 CEST	443	50776	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:19.252012968 CEST	50777	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:19.252059937 CEST	443	50777	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:19.252208948 CEST	50777	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:19.252460957 CEST	50777	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:19.252477884 CEST	443	50777	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:19.252517939 CEST	443	50777	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:19.282980919 CEST	50778	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:19.283039093 CEST	443	50778	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:19.283128977 CEST	50778	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:19.283379078 CEST	50778	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:19.283401966 CEST	443	50778	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:19.283468008 CEST	443	50778	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:19.314024925 CEST	50779	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:19.314069986 CEST	443	50779	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:19.314165115 CEST	50779	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:19.314382076 CEST	50779	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:19.314405918 CEST	443	50779	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:19.314470053 CEST	443	50779	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:19.345526934 CEST	50780	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:19.345580101 CEST	443	50780	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:19.345658064 CEST	50780	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:19.346055031 CEST	50780	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:19.346070051 CEST	443	50780	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:19.346117973 CEST	443	50780	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:19.378906965 CEST	50781	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:19.378952980 CEST	443	50781	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:19.379029989 CEST	50781	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:19.379470110 CEST	50781	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:19.379482985 CEST	443	50781	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:19.379529953 CEST	443	50781	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:19.408198118 CEST	50782	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:19.408241987 CEST	443	50782	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:19.408328056 CEST	50782	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:19.408754110 CEST	50782	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:19.408765078 CEST	443	50782	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:19.408808947 CEST	443	50782	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:19.439655066 CEST	50783	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:19.439717054 CEST	443	50783	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:19.439872980 CEST	50783	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:19.440187931 CEST	50783	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:19.440202951 CEST	443	50783	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:19.440242052 CEST	443	50783	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:19.470841885 CEST	50784	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:19.470899105 CEST	443	50784	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:19.470994949 CEST	50784	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:19.471268892 CEST	50784	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:19.471282959 CEST	443	50784	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:19.471317053 CEST	443	50784	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:19.501868010 CEST	50785	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:19.501898050 CEST	443	50785	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:19.501991034 CEST	50785	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:19.502388954 CEST	50785	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:19.502403021 CEST	443	50785	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:19.502432108 CEST	443	50785	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:19.533098936 CEST	50786	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:19.533123970 CEST	443	50786	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:19.533237934 CEST	50786	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:19.533538103 CEST	50786	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:19.533548117 CEST	443	50786	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:19.533584118 CEST	443	50786	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:19.564305067 CEST	50787	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:19.564347029 CEST	443	50787	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:19.564460039 CEST	50787	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:19.564794064 CEST	50787	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:19.564806938 CEST	443	50787	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:19.564836979 CEST	443	50787	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:19.595474005 CEST	50788	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:19.595539093 CEST	443	50788	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:19.595768929 CEST	50788	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:19.596071005 CEST	50788	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:19.596101046 CEST	443	50788	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:19.596210957 CEST	443	50788	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:19.626705885 CEST	50789	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:19.626746893 CEST	443	50789	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:19.626838923 CEST	50789	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:19.627093077 CEST	50789	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:19.627110958 CEST	443	50789	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:19.627178907 CEST	443	50789	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:19.657937050 CEST	50790	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:19.657953024 CEST	443	50790	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:19.658044100 CEST	50790	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:19.658376932 CEST	50790	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:19.658387899 CEST	443	50790	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:19.658440113 CEST	443	50790	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:19.689570904 CEST	50791	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:19.689630032 CEST	443	50791	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:19.689717054 CEST	50791	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:19.690179110 CEST	50791	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:19.690195084 CEST	443	50791	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:19.690238953 CEST	443	50791	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:19.720685005 CEST	50792	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:19.720729113 CEST	443	50792	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:19.720794916 CEST	50792	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:19.721170902 CEST	50792	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:19.721183062 CEST	443	50792	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:19.721210003 CEST	443	50792	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:19.751882076 CEST	50793	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:19.751943111 CEST	443	50793	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:19.752068996 CEST	50793	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:19.752376080 CEST	50793	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:19.752392054 CEST	443	50793	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:19.752459049 CEST	443	50793	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:19.783250093 CEST	50794	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:19.783267975 CEST	443	50794	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:19.783394098 CEST	50794	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:19.783708096 CEST	50794	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:19.783720970 CEST	443	50794	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:19.783783913 CEST	443	50794	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:19.813996077 CEST	50795	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:19.814053059 CEST	443	50795	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:19.814146042 CEST	50795	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:19.814440012 CEST	50795	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:19.814455032 CEST	443	50795	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:19.814513922 CEST	443	50795	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:19.845211029 CEST	50796	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:19.845249891 CEST	443	50796	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:19.845330954 CEST	50796	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:19.845608950 CEST	50796	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:19.845626116 CEST	443	50796	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:19.845678091 CEST	443	50796	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:19.876430035 CEST	50797	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:19.876467943 CEST	443	50797	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:19.876545906 CEST	50797	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:19.876945019 CEST	50797	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:19.876959085 CEST	443	50797	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:19.877005100 CEST	443	50797	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:19.908113003 CEST	50798	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:19.908138037 CEST	443	50798	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:19.908206940 CEST	50798	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:19.908544064 CEST	50798	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:19.908556938 CEST	443	50798	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:19.908610106 CEST	443	50798	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:19.938981056 CEST	50799	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:19.939013958 CEST	443	50799	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:19.939097881 CEST	50799	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:19.939320087 CEST	50799	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:19.939336061 CEST	443	50799	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:19.939418077 CEST	443	50799	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:19.970356941 CEST	50800	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:19.970407009 CEST	443	50800	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:19.970649958 CEST	50800	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:19.970882893 CEST	50800	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:19.970901012 CEST	443	50800	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:19.970971107 CEST	443	50800	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:20.001408100 CEST	50801	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:20.001447916 CEST	443	50801	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:20.001554012 CEST	50801	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:20.001806974 CEST	50801	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:20.001821995 CEST	443	50801	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:20.001868010 CEST	443	50801	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:20.033044100 CEST	50802	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:20.033070087 CEST	443	50802	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:20.033138990 CEST	50802	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:20.033441067 CEST	50802	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:20.033453941 CEST	443	50802	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:20.033490896 CEST	443	50802	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:20.065887928 CEST	50803	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:20.065936089 CEST	443	50803	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:20.066025019 CEST	50803	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:20.066524029 CEST	50803	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:20.066540003 CEST	443	50803	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:20.066576958 CEST	443	50803	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:20.118333101 CEST	50804	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:20.118390083 CEST	443	50804	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:20.118459940 CEST	50804	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:20.119127035 CEST	50804	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:20.119147062 CEST	443	50804	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:20.119242907 CEST	443	50804	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:20.144016027 CEST	50805	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:20.144057989 CEST	443	50805	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:20.144155025 CEST	50805	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:20.144516945 CEST	50805	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:20.144532919 CEST	443	50805	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:20.144587994 CEST	443	50805	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:20.174772978 CEST	50806	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:20.174833059 CEST	443	50806	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:20.174913883 CEST	50806	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:20.175261974 CEST	50806	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:20.175276995 CEST	443	50806	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:20.175348043 CEST	443	50806	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:20.205246925 CEST	50807	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:20.205270052 CEST	443	50807	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:20.205352068 CEST	50807	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:20.205813885 CEST	50807	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:20.205825090 CEST	443	50807	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:20.205872059 CEST	443	50807	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:20.236697912 CEST	50808	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:20.236742973 CEST	443	50808	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:20.236835957 CEST	50808	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:20.237195969 CEST	50808	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:20.237205982 CEST	443	50808	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:20.237243891 CEST	443	50808	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:20.268203974 CEST	50809	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:20.268258095 CEST	443	50809	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:20.268348932 CEST	50809	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:20.268850088 CEST	50809	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:20.268865108 CEST	443	50809	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:20.268899918 CEST	443	50809	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:20.299623966 CEST	50810	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:20.299659014 CEST	443	50810	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:20.299740076 CEST	50810	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:20.300115108 CEST	50810	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:20.300132990 CEST	443	50810	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:20.300169945 CEST	443	50810	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:20.330035925 CEST	50811	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:20.330060959 CEST	443	50811	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:20.330156088 CEST	50811	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:20.330538034 CEST	50811	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:20.330547094 CEST	443	50811	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:20.330584049 CEST	443	50811	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:20.361445904 CEST	50812	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:20.361474991 CEST	443	50812	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:20.361551046 CEST	50812	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:20.361969948 CEST	50812	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:20.361979961 CEST	443	50812	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:20.362010002 CEST	443	50812	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:20.392198086 CEST	50813	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:20.392246962 CEST	443	50813	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:20.392334938 CEST	50813	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:20.392620087 CEST	50813	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:20.392631054 CEST	443	50813	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:20.392718077 CEST	443	50813	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:20.423372984 CEST	50814	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:20.423391104 CEST	443	50814	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:20.423475981 CEST	50814	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:20.423722029 CEST	50814	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:20.423734903 CEST	443	50814	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:20.423804045 CEST	443	50814	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:20.459667921 CEST	50815	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:20.459701061 CEST	443	50815	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:20.459800959 CEST	50815	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:20.460289955 CEST	50815	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:20.460300922 CEST	443	50815	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:20.460331917 CEST	443	50815	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:20.486094952 CEST	50816	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:20.486124992 CEST	443	50816	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:20.486203909 CEST	50816	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:20.486510038 CEST	50816	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:20.486521959 CEST	443	50816	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:20.486553907 CEST	443	50816	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:20.517195940 CEST	50817	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:20.517246962 CEST	443	50817	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:20.517326117 CEST	50817	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:20.517612934 CEST	50817	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:20.517631054 CEST	443	50817	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:20.517728090 CEST	443	50817	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:20.579833984 CEST	50818	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:20.579904079 CEST	443	50818	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:20.580005884 CEST	50818	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:20.580291986 CEST	50818	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:20.580312014 CEST	443	50818	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:20.580374956 CEST	443	50818	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:20.611001015 CEST	50819	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:20.611058950 CEST	443	50819	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:20.611170053 CEST	50819	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:20.611419916 CEST	50819	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:20.611433029 CEST	443	50819	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:20.611493111 CEST	443	50819	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:20.670447111 CEST	50820	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:20.670507908 CEST	443	50820	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:20.670674086 CEST	50820	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:20.670954943 CEST	50820	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:20.670969963 CEST	443	50820	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:20.671019077 CEST	443	50820	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:20.689824104 CEST	50821	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:20.689872026 CEST	443	50821	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:20.689968109 CEST	50821	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:20.690421104 CEST	50821	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:20.690437078 CEST	443	50821	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:20.690470934 CEST	443	50821	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:20.741637945 CEST	50822	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:20.741688013 CEST	443	50822	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:20.741827965 CEST	50822	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:20.742156982 CEST	50822	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:20.742176056 CEST	443	50822	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:20.742281914 CEST	443	50822	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:20.776338100 CEST	50823	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:20.776384115 CEST	443	50823	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:20.776473045 CEST	50823	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:20.784835100 CEST	50823	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:20.784854889 CEST	443	50823	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:20.784960032 CEST	443	50823	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:20.818070889 CEST	50824	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:20.818131924 CEST	443	50824	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:20.818243027 CEST	50824	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:20.818680048 CEST	50824	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:20.818696976 CEST	443	50824	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:20.818753004 CEST	443	50824	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:20.880405903 CEST	50825	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:20.880446911 CEST	443	50825	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:20.880530119 CEST	50825	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:20.931457043 CEST	50825	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:20.931471109 CEST	443	50825	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:20.931531906 CEST	443	50825	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:20.954744101 CEST	50826	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:20.954756975 CEST	443	50826	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:20.954849005 CEST	50826	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:20.955120087 CEST	50826	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:20.955128908 CEST	443	50826	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:20.955179930 CEST	443	50826	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:20.990490913 CEST	50827	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:20.990525007 CEST	443	50827	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:20.990617990 CEST	50827	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:20.994692087 CEST	50827	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:20.994705915 CEST	443	50827	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:20.994801998 CEST	443	50827	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:21.033159018 CEST	50828	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:21.033205986 CEST	443	50828	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:21.033274889 CEST	50828	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:21.033606052 CEST	50828	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:21.033623934 CEST	443	50828	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:21.033677101 CEST	443	50828	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:21.064095020 CEST	50829	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:21.064133883 CEST	443	50829	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:21.064208031 CEST	50829	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:21.064696074 CEST	50829	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:21.064709902 CEST	443	50829	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:21.064774990 CEST	443	50829	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:21.095261097 CEST	50830	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:21.095269918 CEST	443	50830	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:21.095340967 CEST	50830	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:21.095583916 CEST	50830	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:21.095592976 CEST	443	50830	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:21.095660925 CEST	443	50830	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:21.126976967 CEST	50831	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:21.127027035 CEST	443	50831	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:21.127098083 CEST	50831	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:21.127604961 CEST	50831	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:21.127624035 CEST	443	50831	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:21.127677917 CEST	443	50831	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:21.158313990 CEST	50832	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:21.158382893 CEST	443	50832	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:21.158503056 CEST	50832	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:21.158875942 CEST	50832	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:21.158893108 CEST	443	50832	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:21.158926010 CEST	443	50832	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:21.193631887 CEST	50833	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:21.193674088 CEST	443	50833	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:21.193782091 CEST	50833	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:21.194192886 CEST	50833	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:21.194205046 CEST	443	50833	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:21.194269896 CEST	443	50833	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:21.220593929 CEST	50834	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:21.220611095 CEST	443	50834	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:21.220698118 CEST	50834	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:21.221082926 CEST	50834	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:21.221091986 CEST	443	50834	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:21.221147060 CEST	443	50834	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:21.251939058 CEST	50835	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:21.251961946 CEST	443	50835	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:21.252058029 CEST	50835	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:21.252348900 CEST	50835	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:21.252362967 CEST	443	50835	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:21.252405882 CEST	443	50835	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:21.282712936 CEST	50836	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:21.282727957 CEST	443	50836	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:21.282816887 CEST	50836	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:21.283041000 CEST	50836	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:21.283052921 CEST	443	50836	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:21.283077955 CEST	443	50836	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:21.314266920 CEST	50837	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:21.314316034 CEST	443	50837	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:21.314410925 CEST	50837	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:21.314748049 CEST	50837	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:21.314760923 CEST	443	50837	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:21.314795971 CEST	443	50837	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:21.345172882 CEST	50838	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:21.345207930 CEST	443	50838	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:21.345331907 CEST	50838	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:21.345752001 CEST	50838	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:21.345768929 CEST	443	50838	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:21.345801115 CEST	443	50838	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:21.376743078 CEST	50839	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:21.376780987 CEST	443	50839	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:21.376862049 CEST	50839	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:21.377113104 CEST	50839	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:21.377124071 CEST	443	50839	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:21.377163887 CEST	443	50839	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:21.407974958 CEST	50840	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:21.408018112 CEST	443	50840	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:21.408114910 CEST	50840	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:21.408356905 CEST	50840	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:21.408370018 CEST	443	50840	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:21.408399105 CEST	443	50840	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:21.439002037 CEST	50841	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:21.439043045 CEST	443	50841	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:21.439141035 CEST	50841	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:21.439380884 CEST	50841	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:21.439404964 CEST	443	50841	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:21.439424038 CEST	443	50841	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:21.470810890 CEST	50842	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:21.470834017 CEST	443	50842	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:21.470897913 CEST	50842	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:21.471364021 CEST	50842	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:21.471375942 CEST	443	50842	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:21.471443892 CEST	443	50842	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:21.501916885 CEST	50843	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:21.501945972 CEST	443	50843	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:21.502105951 CEST	50843	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:21.502558947 CEST	50843	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:21.502564907 CEST	443	50843	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:21.503909111 CEST	443	50843	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:21.533169031 CEST	50844	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:21.533220053 CEST	443	50844	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:21.533324957 CEST	50844	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:21.533720970 CEST	50844	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:21.533737898 CEST	443	50844	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:21.533900976 CEST	443	50844	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:21.564302921 CEST	50845	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:21.564352989 CEST	443	50845	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:21.564477921 CEST	50845	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:21.564917088 CEST	50845	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:21.564930916 CEST	443	50845	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:21.564999104 CEST	443	50845	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:21.595436096 CEST	50846	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:21.595447063 CEST	443	50846	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:21.595582008 CEST	50846	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:21.596076965 CEST	50846	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:21.596086025 CEST	443	50846	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:21.596116066 CEST	443	50846	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:21.626770973 CEST	50847	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:21.626812935 CEST	443	50847	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:21.626893044 CEST	50847	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:21.627291918 CEST	50847	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:21.627306938 CEST	443	50847	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:21.627371073 CEST	443	50847	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:21.658030987 CEST	50848	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:21.658056974 CEST	443	50848	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:21.658149958 CEST	50848	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:21.658567905 CEST	50848	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:21.658581018 CEST	443	50848	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:21.658633947 CEST	443	50848	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:21.689547062 CEST	50849	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:21.689585924 CEST	443	50849	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:21.689754009 CEST	50849	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:21.690208912 CEST	50849	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:21.690222025 CEST	443	50849	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:21.690279007 CEST	443	50849	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:21.720609903 CEST	50850	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:21.720628977 CEST	443	50850	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:21.720726013 CEST	50850	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:21.721154928 CEST	50850	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:21.721165895 CEST	443	50850	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:21.721236944 CEST	443	50850	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:21.751990080 CEST	50851	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:21.752053022 CEST	443	50851	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:21.752310038 CEST	50851	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:21.752702951 CEST	50851	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:21.752717972 CEST	443	50851	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:21.752863884 CEST	443	50851	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:21.783207893 CEST	50852	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:21.783287048 CEST	443	50852	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:21.783421993 CEST	50852	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:21.783734083 CEST	50852	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:21.783747911 CEST	443	50852	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:21.783863068 CEST	443	50852	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:21.814429045 CEST	50853	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:21.814491034 CEST	443	50853	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:21.814582109 CEST	50853	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:21.814959049 CEST	50853	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:21.814975977 CEST	443	50853	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:21.815068960 CEST	443	50853	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:21.845746040 CEST	50854	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:21.845777988 CEST	443	50854	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:21.845875025 CEST	50854	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:21.846474886 CEST	50854	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:21.846491098 CEST	443	50854	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:21.846586943 CEST	443	50854	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:21.876790047 CEST	50855	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:21.876828909 CEST	443	50855	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:21.877038956 CEST	50855	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:21.877245903 CEST	50855	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:21.877260923 CEST	443	50855	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:21.877316952 CEST	443	50855	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:21.908371925 CEST	50856	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:21.908411980 CEST	443	50856	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:21.908507109 CEST	50856	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:21.908924103 CEST	50856	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:21.908938885 CEST	443	50856	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:21.908967018 CEST	443	50856	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:21.939218044 CEST	50857	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:21.939243078 CEST	443	50857	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:21.939420938 CEST	50857	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:21.939682007 CEST	50857	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:21.939693928 CEST	443	50857	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:21.939753056 CEST	443	50857	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:21.970643044 CEST	50858	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:21.970664024 CEST	443	50858	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:21.970762014 CEST	50858	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:21.971128941 CEST	50858	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:21.971141100 CEST	443	50858	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:21.971237898 CEST	443	50858	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:22.001835108 CEST	50859	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:22.001878023 CEST	443	50859	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:22.002103090 CEST	50859	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:22.002329111 CEST	50859	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:22.002341032 CEST	443	50859	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:22.002374887 CEST	443	50859	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:22.033080101 CEST	50860	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:22.033123016 CEST	443	50860	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:22.033308983 CEST	50860	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:22.033596992 CEST	50860	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:22.033607006 CEST	443	50860	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:22.033653021 CEST	443	50860	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:22.064644098 CEST	50861	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:22.064687967 CEST	443	50861	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:22.064773083 CEST	50861	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:22.065133095 CEST	50861	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:22.065150023 CEST	443	50861	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:22.065180063 CEST	443	50861	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:22.095922947 CEST	50862	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:22.095957041 CEST	443	50862	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:22.096040964 CEST	50862	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:22.096447945 CEST	50862	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:22.096465111 CEST	443	50862	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:22.096489906 CEST	443	50862	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:22.127243996 CEST	50863	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:22.127290010 CEST	443	50863	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:22.127353907 CEST	50863	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:22.127660036 CEST	50863	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:22.127671957 CEST	443	50863	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:22.127701998 CEST	443	50863	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:22.158087015 CEST	50864	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:22.158134937 CEST	443	50864	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:22.158233881 CEST	50864	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:22.158598900 CEST	50864	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:22.158613920 CEST	443	50864	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:22.158638000 CEST	443	50864	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:22.189539909 CEST	50865	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:22.189599991 CEST	443	50865	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:22.189738035 CEST	50865	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:22.190113068 CEST	50865	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:22.190129042 CEST	443	50865	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:22.190156937 CEST	443	50865	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:22.221168041 CEST	50866	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:22.221200943 CEST	443	50866	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:22.221277952 CEST	50866	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:22.221647978 CEST	50866	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:22.221658945 CEST	443	50866	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:22.221687078 CEST	443	50866	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:22.252441883 CEST	50867	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:22.252492905 CEST	443	50867	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:22.252568007 CEST	50867	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:22.252948046 CEST	50867	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:22.252959967 CEST	443	50867	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:22.252981901 CEST	443	50867	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:22.283145905 CEST	50868	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:22.283200979 CEST	443	50868	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:22.283267021 CEST	50868	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:22.283591032 CEST	50868	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:22.283602953 CEST	443	50868	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:22.283627987 CEST	443	50868	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:22.314312935 CEST	50869	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:22.314347029 CEST	443	50869	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:22.314443111 CEST	50869	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:22.314794064 CEST	50869	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:22.314805031 CEST	443	50869	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:22.314871073 CEST	443	50869	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:22.345688105 CEST	50870	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:22.345725060 CEST	443	50870	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:22.345803022 CEST	50870	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:22.346157074 CEST	50870	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:22.346167088 CEST	443	50870	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:22.346220970 CEST	443	50870	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:22.376660109 CEST	50871	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:22.376705885 CEST	443	50871	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:22.376794100 CEST	50871	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:22.377064943 CEST	50871	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:22.377079010 CEST	443	50871	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:22.377126932 CEST	443	50871	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:22.392146111 CEST	50872	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:22.392190933 CEST	443	50872	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:22.392273903 CEST	50872	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:22.392589092 CEST	50872	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:22.392604113 CEST	443	50872	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:22.392644882 CEST	443	50872	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:22.407794952 CEST	50873	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:22.407824039 CEST	443	50873	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:22.407979965 CEST	50873	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:22.408257008 CEST	50873	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:22.408266068 CEST	443	50873	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:22.408298969 CEST	443	50873	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:22.423543930 CEST	50874	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:22.423556089 CEST	443	50874	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:22.423643112 CEST	50874	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:22.423932076 CEST	50874	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:22.423944950 CEST	443	50874	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:22.423995018 CEST	443	50874	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:22.439196110 CEST	50875	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:22.439227104 CEST	443	50875	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:22.439310074 CEST	50875	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:22.439613104 CEST	50875	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:22.439627886 CEST	443	50875	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:22.439726114 CEST	443	50875	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:22.470712900 CEST	50876	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:22.470752954 CEST	443	50876	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:22.470854044 CEST	50876	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:22.471199036 CEST	50876	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:22.471210957 CEST	443	50876	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:22.471295118 CEST	443	50876	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:22.502001047 CEST	50877	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:22.502060890 CEST	443	50877	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:22.502175093 CEST	50877	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:22.502538919 CEST	50877	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:22.502552032 CEST	443	50877	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:22.502597094 CEST	443	50877	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:22.533329010 CEST	50878	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:22.533387899 CEST	443	50878	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:22.533477068 CEST	50878	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:22.533853054 CEST	50878	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:22.533863068 CEST	443	50878	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:22.533910990 CEST	443	50878	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:22.564393997 CEST	50879	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:22.564444065 CEST	443	50879	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:22.564539909 CEST	50879	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:22.564925909 CEST	50879	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:22.564935923 CEST	443	50879	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:22.564973116 CEST	443	50879	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:22.595731020 CEST	50880	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:22.595781088 CEST	443	50880	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:22.595935106 CEST	50880	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:22.596297979 CEST	50880	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:22.596309900 CEST	443	50880	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:22.596342087 CEST	443	50880	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:22.627073050 CEST	50881	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:22.627130985 CEST	443	50881	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:22.627269983 CEST	50881	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:22.627679110 CEST	50881	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:22.627690077 CEST	443	50881	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:22.627722025 CEST	443	50881	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:22.658035994 CEST	50882	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:22.658080101 CEST	443	50882	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:22.658169985 CEST	50882	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:22.658739090 CEST	50882	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:22.658747911 CEST	443	50882	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:22.658777952 CEST	443	50882	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:22.689405918 CEST	50883	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:22.689459085 CEST	443	50883	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:22.689553976 CEST	50883	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:22.690023899 CEST	50883	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:22.690036058 CEST	443	50883	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:22.690069914 CEST	443	50883	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:22.720381021 CEST	50884	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:22.720424891 CEST	443	50884	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:22.720508099 CEST	50884	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:22.720989943 CEST	50884	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:22.721000910 CEST	443	50884	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:22.721025944 CEST	443	50884	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:22.751857042 CEST	50885	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:22.751898050 CEST	443	50885	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:22.751993895 CEST	50885	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:22.752520084 CEST	50885	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:22.752532959 CEST	443	50885	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:22.752577066 CEST	443	50885	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:22.767231941 CEST	50886	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:22.767246008 CEST	443	50886	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:22.767364979 CEST	50886	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:22.767668962 CEST	50886	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:22.767678976 CEST	443	50886	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:22.767787933 CEST	443	50886	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:22.782947063 CEST	50887	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:22.783004045 CEST	443	50887	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:22.783087015 CEST	50887	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:22.783397913 CEST	50887	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:22.783415079 CEST	443	50887	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:22.783483982 CEST	443	50887	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:22.798531055 CEST	50888	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:22.798583984 CEST	443	50888	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:22.798672915 CEST	50888	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:22.798970938 CEST	50888	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:22.798985004 CEST	443	50888	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:22.799025059 CEST	443	50888	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:22.814040899 CEST	50889	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:22.814078093 CEST	443	50889	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:22.814157963 CEST	50889	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:22.814554930 CEST	50889	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:22.814567089 CEST	443	50889	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:22.814589024 CEST	443	50889	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:22.829667091 CEST	50890	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:22.829677105 CEST	443	50890	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:22.829740047 CEST	50890	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:22.830009937 CEST	50890	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:22.830018997 CEST	443	50890	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:22.830035925 CEST	443	50890	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:22.845273018 CEST	50891	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:22.845304012 CEST	443	50891	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:22.845366001 CEST	50891	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:22.845616102 CEST	50891	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:22.845626116 CEST	443	50891	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:22.845644951 CEST	443	50891	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:22.861073971 CEST	50892	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:22.861126900 CEST	443	50892	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:22.861201048 CEST	50892	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:22.861509085 CEST	50892	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:22.861520052 CEST	443	50892	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:22.861536026 CEST	443	50892	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:22.876844883 CEST	50893	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:22.876868010 CEST	443	50893	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:22.876955986 CEST	50893	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:22.877300978 CEST	50893	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:22.877310038 CEST	443	50893	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:22.877325058 CEST	443	50893	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:22.892678976 CEST	50894	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:22.892687082 CEST	443	50894	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:22.892755985 CEST	50894	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:22.893109083 CEST	50894	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:22.893116951 CEST	443	50894	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:22.893145084 CEST	443	50894	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:22.909734011 CEST	50895	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:22.909744024 CEST	443	50895	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:22.909815073 CEST	50895	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:22.910155058 CEST	50895	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:22.910161972 CEST	443	50895	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:22.910181999 CEST	443	50895	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:22.939260960 CEST	50896	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:22.939294100 CEST	443	50896	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:22.939366102 CEST	50896	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:22.939712048 CEST	50896	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:22.939722061 CEST	443	50896	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:22.939745903 CEST	443	50896	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:22.954607010 CEST	50897	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:22.954638958 CEST	443	50897	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:22.954706907 CEST	50897	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:22.955012083 CEST	50897	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:22.955024004 CEST	443	50897	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:22.955065966 CEST	443	50897	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:22.970097065 CEST	50898	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:22.970113039 CEST	443	50898	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:22.970196962 CEST	50898	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:22.970453024 CEST	50898	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:22.970462084 CEST	443	50898	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:22.970494986 CEST	443	50898	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:22.985837936 CEST	50899	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:22.985852957 CEST	443	50899	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:22.985919952 CEST	50899	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:22.986287117 CEST	50899	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:22.986294031 CEST	443	50899	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:22.986310005 CEST	443	50899	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:23.001442909 CEST	50900	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:23.001468897 CEST	443	50900	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:23.001529932 CEST	50900	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:23.001806974 CEST	50900	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:23.001816988 CEST	443	50900	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:23.001836061 CEST	443	50900	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:23.017136097 CEST	50901	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:23.017168999 CEST	443	50901	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:23.017257929 CEST	50901	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:23.017569065 CEST	50901	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:23.017582893 CEST	443	50901	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:23.017625093 CEST	443	50901	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:23.032685041 CEST	50902	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:23.032699108 CEST	443	50902	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:23.032767057 CEST	50902	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:23.033041954 CEST	50902	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:23.033052921 CEST	443	50902	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:23.033107996 CEST	443	50902	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:23.048356056 CEST	50903	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:23.048369884 CEST	443	50903	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:23.048419952 CEST	50903	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:23.048681021 CEST	50903	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:23.048688889 CEST	443	50903	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:23.048713923 CEST	443	50903	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:23.064632893 CEST	50904	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:23.064666986 CEST	443	50904	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:23.064732075 CEST	50904	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:23.085478067 CEST	50904	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:23.085490942 CEST	443	50904	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:23.085510015 CEST	443	50904	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:23.127904892 CEST	50905	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:23.127933979 CEST	443	50905	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:23.127994061 CEST	50905	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:23.128372908 CEST	50905	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:23.128381014 CEST	443	50905	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:23.128400087 CEST	443	50905	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:23.185700893 CEST	50906	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:23.185753107 CEST	443	50906	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:23.185817003 CEST	50906	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:23.190762043 CEST	50906	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:23.190776110 CEST	443	50906	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:23.190800905 CEST	443	50906	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:23.240339994 CEST	50907	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:23.240361929 CEST	443	50907	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:23.240422964 CEST	50907	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:23.242947102 CEST	50907	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:23.242955923 CEST	443	50907	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:23.242971897 CEST	443	50907	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:23.268059015 CEST	50908	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:23.268094063 CEST	443	50908	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:23.268155098 CEST	50908	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:23.268846989 CEST	50908	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:23.268861055 CEST	443	50908	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:23.269011974 CEST	443	50908	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:23.283454895 CEST	50909	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:23.283516884 CEST	443	50909	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:23.283579111 CEST	50909	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:23.284209013 CEST	50909	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:23.284224987 CEST	443	50909	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:23.284249067 CEST	443	50909	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:23.301213026 CEST	50910	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:23.301235914 CEST	443	50910	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:23.301291943 CEST	50910	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:23.301759958 CEST	50910	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:23.301770926 CEST	443	50910	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:23.301789999 CEST	443	50910	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:23.347251892 CEST	50911	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:23.347295046 CEST	443	50911	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:23.347368956 CEST	50911	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:23.350018978 CEST	50911	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:23.350030899 CEST	443	50911	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:23.350052118 CEST	443	50911	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:23.376698971 CEST	50912	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:23.376759052 CEST	443	50912	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:23.376825094 CEST	50912	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:23.377118111 CEST	50912	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:23.377135038 CEST	443	50912	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:23.377249956 CEST	443	50912	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:23.418575048 CEST	50913	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:23.418646097 CEST	443	50913	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:23.418742895 CEST	50913	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:23.419136047 CEST	50913	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:23.419151068 CEST	443	50913	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:23.419202089 CEST	443	50913	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:23.439343929 CEST	50914	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:23.439364910 CEST	443	50914	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:23.439440966 CEST	50914	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:23.439734936 CEST	50914	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:23.439744949 CEST	443	50914	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:23.439786911 CEST	443	50914	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:23.472630024 CEST	50915	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:23.472685099 CEST	443	50915	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:23.472798109 CEST	50915	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:23.473166943 CEST	50915	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:23.473181009 CEST	443	50915	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:23.473216057 CEST	443	50915	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:23.509735107 CEST	50916	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:23.509768009 CEST	443	50916	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:23.509850979 CEST	50916	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:23.514187098 CEST	50916	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:23.514229059 CEST	443	50916	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:23.514267921 CEST	443	50916	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:23.620300055 CEST	50917	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:23.620345116 CEST	443	50917	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:23.620420933 CEST	50917	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:23.624048948 CEST	50917	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:23.624068022 CEST	443	50917	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:23.624114037 CEST	443	50917	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:23.697791100 CEST	50918	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:23.697824001 CEST	443	50918	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:23.697901964 CEST	50918	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:23.698164940 CEST	50918	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:23.698180914 CEST	443	50918	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:23.698225021 CEST	443	50918	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:23.734628916 CEST	50919	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:23.734684944 CEST	443	50919	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:23.734757900 CEST	50919	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:23.737759113 CEST	50919	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:23.737776995 CEST	443	50919	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:23.737835884 CEST	443	50919	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:23.767112970 CEST	50920	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:23.767153025 CEST	443	50920	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:23.767244101 CEST	50920	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:23.767585993 CEST	50920	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:23.767597914 CEST	443	50920	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:23.767646074 CEST	443	50920	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:23.782696009 CEST	50921	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:23.782726049 CEST	443	50921	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:23.782895088 CEST	50921	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:23.783020973 CEST	50921	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:23.783034086 CEST	443	50921	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:23.783062935 CEST	443	50921	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:23.798170090 CEST	50922	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:23.798185110 CEST	443	50922	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:23.798459053 CEST	50922	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:23.798722982 CEST	50922	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:23.798732996 CEST	443	50922	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:23.798763037 CEST	443	50922	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:23.814384937 CEST	50923	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:23.814402103 CEST	443	50923	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:23.814587116 CEST	50923	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:23.815129995 CEST	50923	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:23.815139055 CEST	443	50923	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:23.815172911 CEST	443	50923	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:23.829492092 CEST	50924	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:23.829528093 CEST	443	50924	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:23.829711914 CEST	50924	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:23.829786062 CEST	50924	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:23.829797983 CEST	443	50924	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:23.829843044 CEST	443	50924	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:23.845534086 CEST	50925	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:23.845572948 CEST	443	50925	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:23.845639944 CEST	50925	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:23.845966101 CEST	50925	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:23.845979929 CEST	443	50925	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:23.846056938 CEST	443	50925	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:23.860752106 CEST	50926	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:23.860780001 CEST	443	50926	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:23.860860109 CEST	50926	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:23.861146927 CEST	50926	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:23.861160040 CEST	443	50926	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:23.861218929 CEST	443	50926	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:23.876434088 CEST	50927	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:23.876462936 CEST	443	50927	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:23.876646996 CEST	50927	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:23.876863956 CEST	50927	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:23.876876116 CEST	443	50927	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:23.876929045 CEST	443	50927	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:23.892313004 CEST	50928	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:23.892359018 CEST	443	50928	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:23.892435074 CEST	50928	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:23.892940998 CEST	50928	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:23.892956972 CEST	443	50928	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:23.893008947 CEST	443	50928	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:23.907865047 CEST	50929	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:23.907891989 CEST	443	50929	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:23.908152103 CEST	50929	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:23.908574104 CEST	50929	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:23.908590078 CEST	443	50929	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:23.908641100 CEST	443	50929	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:23.923399925 CEST	50930	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:23.923410892 CEST	443	50930	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:23.923491001 CEST	50930	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:23.923765898 CEST	50930	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:23.923779011 CEST	443	50930	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:23.923820972 CEST	443	50930	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:23.938951015 CEST	50931	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:23.938973904 CEST	443	50931	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:23.939040899 CEST	50931	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:23.939342976 CEST	50931	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:23.939354897 CEST	443	50931	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:23.939399004 CEST	443	50931	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:23.954582930 CEST	50932	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:23.954622030 CEST	443	50932	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:23.954683065 CEST	50932	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:23.955317974 CEST	50932	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:23.955331087 CEST	443	50932	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:23.955399990 CEST	443	50932	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:23.970196009 CEST	50933	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:23.970244884 CEST	443	50933	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:23.970330954 CEST	50933	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:23.970527887 CEST	50933	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:23.970542908 CEST	443	50933	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:23.970592976 CEST	443	50933	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:23.985876083 CEST	50934	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:23.985887051 CEST	443	50934	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:23.985990047 CEST	50934	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:23.986481905 CEST	50934	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:23.986493111 CEST	443	50934	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:23.986542940 CEST	443	50934	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.001501083 CEST	50935	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.001518011 CEST	443	50935	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.001585007 CEST	50935	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.001873970 CEST	50935	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.001883030 CEST	443	50935	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.001943111 CEST	443	50935	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.017201900 CEST	50936	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.017241955 CEST	443	50936	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.017316103 CEST	50936	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.017564058 CEST	50936	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.017579079 CEST	443	50936	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.017630100 CEST	443	50936	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.034125090 CEST	50937	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.034181118 CEST	443	50937	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.034246922 CEST	50937	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.034666061 CEST	50937	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.034687042 CEST	443	50937	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.034707069 CEST	443	50937	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.048559904 CEST	50938	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.048604965 CEST	443	50938	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.048686028 CEST	50938	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.049104929 CEST	50938	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.049120903 CEST	443	50938	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.049180984 CEST	443	50938	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.064295053 CEST	50939	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.064338923 CEST	443	50939	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.064402103 CEST	50939	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.064718962 CEST	50939	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.064730883 CEST	443	50939	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.064779043 CEST	443	50939	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.079848051 CEST	50940	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.079878092 CEST	443	50940	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.079946995 CEST	50940	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.080302000 CEST	50940	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.080313921 CEST	443	50940	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.080338955 CEST	443	50940	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.095494032 CEST	50941	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.095536947 CEST	443	50941	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.095607996 CEST	50941	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.095921040 CEST	50941	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.095946074 CEST	443	50941	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.095968008 CEST	443	50941	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.111007929 CEST	50942	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.111068964 CEST	443	50942	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.111246109 CEST	50942	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.111674070 CEST	50942	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.111694098 CEST	443	50942	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.111742973 CEST	443	50942	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.126791000 CEST	50943	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.126823902 CEST	443	50943	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.126904011 CEST	50943	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.127214909 CEST	50943	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.127226114 CEST	443	50943	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.127245903 CEST	443	50943	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.142374992 CEST	50944	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.142416000 CEST	443	50944	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.142501116 CEST	50944	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.142776966 CEST	50944	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.142791033 CEST	443	50944	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.142819881 CEST	443	50944	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.157778025 CEST	50945	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.157810926 CEST	443	50945	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.157880068 CEST	50945	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.158207893 CEST	50945	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.158221960 CEST	443	50945	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.158344984 CEST	443	50945	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.173424006 CEST	50946	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.173444986 CEST	443	50946	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.173511028 CEST	50946	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.173835039 CEST	50946	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.173847914 CEST	443	50946	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.173898935 CEST	443	50946	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.189105034 CEST	50947	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.189127922 CEST	443	50947	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.189184904 CEST	50947	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.189506054 CEST	50947	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.189512968 CEST	443	50947	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.190045118 CEST	443	50947	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.204612017 CEST	50948	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.204652071 CEST	443	50948	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.204792023 CEST	50948	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.205015898 CEST	50948	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.205030918 CEST	443	50948	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.205101967 CEST	443	50948	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.220405102 CEST	50949	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.220439911 CEST	443	50949	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.220525026 CEST	50949	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.220935106 CEST	50949	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.220949888 CEST	443	50949	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.220990896 CEST	443	50949	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.236464977 CEST	50950	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.236481905 CEST	443	50950	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.236577034 CEST	50950	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.236979008 CEST	50950	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.236994028 CEST	443	50950	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.237018108 CEST	443	50950	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.252084017 CEST	50951	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.252149105 CEST	443	50951	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.252254009 CEST	50951	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.253149033 CEST	50951	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.253170013 CEST	443	50951	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.253227949 CEST	443	50951	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.267508984 CEST	50952	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.267551899 CEST	443	50952	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.267630100 CEST	50952	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.267946005 CEST	50952	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.267963886 CEST	443	50952	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.268028021 CEST	443	50952	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.283086061 CEST	50953	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.283147097 CEST	443	50953	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.283226013 CEST	50953	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.283580065 CEST	50953	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.283595085 CEST	443	50953	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.283646107 CEST	443	50953	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.298635006 CEST	50954	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.298674107 CEST	443	50954	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.298742056 CEST	50954	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.299040079 CEST	50954	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.299055099 CEST	443	50954	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.299107075 CEST	443	50954	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.316983938 CEST	50955	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.317011118 CEST	443	50955	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.317105055 CEST	50955	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.317414045 CEST	50955	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.317426920 CEST	443	50955	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.317482948 CEST	443	50955	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.329955101 CEST	50956	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.330002069 CEST	443	50956	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.330073118 CEST	50956	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.330410004 CEST	50956	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.330420017 CEST	443	50956	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.330463886 CEST	443	50956	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.347513914 CEST	50957	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.347568035 CEST	443	50957	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.347634077 CEST	50957	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.347912073 CEST	50957	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.347925901 CEST	443	50957	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.348021984 CEST	443	50957	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.361278057 CEST	50958	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.361305952 CEST	443	50958	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.361376047 CEST	50958	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.361711979 CEST	50958	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.361721992 CEST	443	50958	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.361795902 CEST	443	50958	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.376713037 CEST	50960	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.376745939 CEST	443	50960	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.376816988 CEST	50960	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.377116919 CEST	50960	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.377132893 CEST	443	50960	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.377197027 CEST	443	50960	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.392537117 CEST	50961	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.392581940 CEST	443	50961	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.392688990 CEST	50961	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.393157005 CEST	50961	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.393174887 CEST	443	50961	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.393234015 CEST	443	50961	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.408377886 CEST	50962	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.408416986 CEST	443	50962	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.408828020 CEST	50962	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.408828020 CEST	50962	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.408869028 CEST	443	50962	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.409077883 CEST	443	50962	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.423544884 CEST	50963	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.423578978 CEST	443	50963	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.423660040 CEST	50963	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.423930883 CEST	50963	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.423944950 CEST	443	50963	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.423996925 CEST	443	50963	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.439141035 CEST	50964	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.439173937 CEST	443	50964	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.439259052 CEST	50964	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.439546108 CEST	50964	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.439560890 CEST	443	50964	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.439608097 CEST	443	50964	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.454680920 CEST	50965	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.454720974 CEST	443	50965	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.454796076 CEST	50965	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.455091953 CEST	50965	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.455102921 CEST	443	50965	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.455184937 CEST	443	50965	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.470438004 CEST	50966	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.470463037 CEST	443	50966	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.470532894 CEST	50966	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.470861912 CEST	50966	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.470875025 CEST	443	50966	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.470905066 CEST	443	50966	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.486078978 CEST	50967	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.486099005 CEST	443	50967	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.486211061 CEST	50967	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.486545086 CEST	50967	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.486557007 CEST	443	50967	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.486668110 CEST	443	50967	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.501692057 CEST	50968	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.501724958 CEST	443	50968	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.501799107 CEST	50968	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.502140045 CEST	50968	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.502151012 CEST	443	50968	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.502216101 CEST	443	50968	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.517363071 CEST	50969	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.517402887 CEST	443	50969	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.517483950 CEST	50969	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.517787933 CEST	50969	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.517807961 CEST	443	50969	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.517852068 CEST	443	50969	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.533119917 CEST	50970	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.533157110 CEST	443	50970	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.533267021 CEST	50970	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.533621073 CEST	50970	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.533639908 CEST	443	50970	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.533685923 CEST	443	50970	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.548837900 CEST	50971	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.548892021 CEST	443	50971	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.549007893 CEST	50971	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.549354076 CEST	50971	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.549371004 CEST	443	50971	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.549416065 CEST	443	50971	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.564295053 CEST	50972	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.564363003 CEST	443	50972	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.564448118 CEST	50972	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.564758062 CEST	50972	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.564773083 CEST	443	50972	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.564822912 CEST	443	50972	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.580117941 CEST	50973	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.580168962 CEST	443	50973	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.580323935 CEST	50973	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.580703974 CEST	50973	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.580724955 CEST	443	50973	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.580774069 CEST	443	50973	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.595561028 CEST	50974	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.595577955 CEST	443	50974	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.595649004 CEST	50974	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.595993042 CEST	50974	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.596000910 CEST	443	50974	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.596057892 CEST	443	50974	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.611541986 CEST	50975	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.611601114 CEST	443	50975	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.611690998 CEST	50975	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.612066984 CEST	50975	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.612092018 CEST	443	50975	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.612154007 CEST	443	50975	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.626712084 CEST	50976	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.626765966 CEST	443	50976	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.626838923 CEST	50976	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.627161026 CEST	50976	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.627177954 CEST	443	50976	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.627232075 CEST	443	50976	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.642398119 CEST	50977	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.642436028 CEST	443	50977	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.642512083 CEST	50977	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.642898083 CEST	50977	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.642915010 CEST	443	50977	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.642965078 CEST	443	50977	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.658230066 CEST	50978	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.658252954 CEST	443	50978	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.658324957 CEST	50978	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.658627987 CEST	50978	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.658643007 CEST	443	50978	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.658691883 CEST	443	50978	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.674957991 CEST	50979	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.675010920 CEST	443	50979	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.675092936 CEST	50979	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.675369978 CEST	50979	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.675389051 CEST	443	50979	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.675451994 CEST	443	50979	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.689414024 CEST	50980	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.689452887 CEST	443	50980	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.689579010 CEST	50980	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.690023899 CEST	50980	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.690038919 CEST	443	50980	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.690128088 CEST	443	50980	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.705939054 CEST	50981	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.705986023 CEST	443	50981	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.706056118 CEST	50981	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.706384897 CEST	50981	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.706402063 CEST	443	50981	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.706479073 CEST	443	50981	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.720527887 CEST	50982	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.720570087 CEST	443	50982	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.720645905 CEST	50982	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.720948935 CEST	50982	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.720968008 CEST	443	50982	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.721012115 CEST	443	50982	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.736093998 CEST	50983	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.736143112 CEST	443	50983	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.736226082 CEST	50983	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.736565113 CEST	50983	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.736578941 CEST	443	50983	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.736685038 CEST	443	50983	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.751594067 CEST	50984	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.751658916 CEST	443	50984	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.751738071 CEST	50984	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.752017021 CEST	50984	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.752029896 CEST	443	50984	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.752116919 CEST	443	50984	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.767488956 CEST	50985	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.767528057 CEST	443	50985	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.767659903 CEST	50985	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.768011093 CEST	50985	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.768024921 CEST	443	50985	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.768095016 CEST	443	50985	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.783111095 CEST	50986	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.783164024 CEST	443	50986	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.783281088 CEST	50986	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.783616066 CEST	50986	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.783631086 CEST	443	50986	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.783687115 CEST	443	50986	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.798758984 CEST	50987	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.798808098 CEST	443	50987	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.798944950 CEST	50987	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.799455881 CEST	50987	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.799474955 CEST	443	50987	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.799535036 CEST	443	50987	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.814186096 CEST	50988	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.814218998 CEST	443	50988	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.814331055 CEST	50988	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.814659119 CEST	50988	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.814672947 CEST	443	50988	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.814764977 CEST	443	50988	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.830070019 CEST	50989	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.830110073 CEST	443	50989	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.830194950 CEST	50989	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.830477953 CEST	50989	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.830492973 CEST	443	50989	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.830554008 CEST	443	50989	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.845532894 CEST	50990	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.845575094 CEST	443	50990	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.845674038 CEST	50990	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.846044064 CEST	50990	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.846060991 CEST	443	50990	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.846112967 CEST	443	50990	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.861232042 CEST	50991	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.861252069 CEST	443	50991	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.861341953 CEST	50991	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.861794949 CEST	50991	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.861804962 CEST	443	50991	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.861879110 CEST	443	50991	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.876821041 CEST	50992	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.876854897 CEST	443	50992	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.876954079 CEST	50992	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.877269983 CEST	50992	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.877284050 CEST	443	50992	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.877336979 CEST	443	50992	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.892272949 CEST	50993	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.892323971 CEST	443	50993	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.892411947 CEST	50993	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.892791986 CEST	50993	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.892807007 CEST	443	50993	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.892868996 CEST	443	50993	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.907876968 CEST	50994	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.907916069 CEST	443	50994	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.907999039 CEST	50994	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.908296108 CEST	50994	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.908315897 CEST	443	50994	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.908375978 CEST	443	50994	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.924130917 CEST	50995	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.924186945 CEST	443	50995	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.924268007 CEST	50995	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.924942017 CEST	50995	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.924963951 CEST	443	50995	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.925007105 CEST	443	50995	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.939435005 CEST	50996	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.939475060 CEST	443	50996	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.939565897 CEST	50996	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.939935923 CEST	50996	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.939949036 CEST	443	50996	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.940002918 CEST	443	50996	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.954957008 CEST	50997	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.955014944 CEST	443	50997	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.955111980 CEST	50997	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.955423117 CEST	50997	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.955437899 CEST	443	50997	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.955495119 CEST	443	50997	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.970362902 CEST	50998	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.970401049 CEST	443	50998	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.970493078 CEST	50998	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.970772028 CEST	50998	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.970784903 CEST	443	50998	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.970839977 CEST	443	50998	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.986141920 CEST	50999	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.986171007 CEST	443	50999	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.986249924 CEST	50999	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.986660004 CEST	50999	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:24.986676931 CEST	443	50999	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:24.986731052 CEST	443	50999	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.001676083 CEST	51000	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.001717091 CEST	443	51000	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.001777887 CEST	51000	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.002119064 CEST	51000	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.002129078 CEST	443	51000	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.002193928 CEST	443	51000	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.017261028 CEST	51001	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.017314911 CEST	443	51001	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.017390966 CEST	51001	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.017743111 CEST	51001	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.017757893 CEST	443	51001	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.017828941 CEST	443	51001	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.033238888 CEST	51002	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.033258915 CEST	443	51002	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.033356905 CEST	51002	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.033783913 CEST	51002	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.033796072 CEST	443	51002	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.033845901 CEST	443	51002	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.053512096 CEST	51003	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.053565025 CEST	443	51003	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.053654909 CEST	51003	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.054054976 CEST	51003	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.054069042 CEST	443	51003	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.054126978 CEST	443	51003	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.079962015 CEST	51004	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.080009937 CEST	443	51004	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.080110073 CEST	51004	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.080590963 CEST	51004	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.080601931 CEST	443	51004	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.080657005 CEST	443	51004	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.095567942 CEST	51005	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.095632076 CEST	443	51005	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.095710993 CEST	51005	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.096182108 CEST	51005	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.096201897 CEST	443	51005	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.096266985 CEST	443	51005	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.111145973 CEST	51006	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.111179113 CEST	443	51006	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.111244917 CEST	51006	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.111608028 CEST	51006	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.111624002 CEST	443	51006	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.111673117 CEST	443	51006	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.126749992 CEST	51007	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.126796007 CEST	443	51007	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.126863956 CEST	51007	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.127279997 CEST	51007	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.127295017 CEST	443	51007	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.127360106 CEST	443	51007	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.142359018 CEST	51008	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.142395973 CEST	443	51008	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.142477989 CEST	51008	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.142849922 CEST	51008	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.142863035 CEST	443	51008	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.142915010 CEST	443	51008	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.158297062 CEST	51009	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.158346891 CEST	443	51009	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.158423901 CEST	51009	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.158823967 CEST	51009	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.158838034 CEST	443	51009	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.158906937 CEST	443	51009	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.173655033 CEST	51010	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.173683882 CEST	443	51010	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.173767090 CEST	51010	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.174240112 CEST	51010	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.174252033 CEST	443	51010	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.174303055 CEST	443	51010	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.189254045 CEST	51011	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.189286947 CEST	443	51011	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.189354897 CEST	51011	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.189801931 CEST	51011	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.189814091 CEST	443	51011	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.189866066 CEST	443	51011	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.204972029 CEST	51012	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.205018997 CEST	443	51012	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.205123901 CEST	51012	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.205467939 CEST	51012	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.205482960 CEST	443	51012	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.205544949 CEST	443	51012	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.220629930 CEST	51013	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.220653057 CEST	443	51013	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.220731020 CEST	51013	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.221112967 CEST	51013	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.221127033 CEST	443	51013	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.221172094 CEST	443	51013	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.236351967 CEST	51014	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.236387014 CEST	443	51014	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.236453056 CEST	51014	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.236979961 CEST	51014	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.236991882 CEST	443	51014	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.237046957 CEST	443	51014	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.251935005 CEST	51015	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.251971006 CEST	443	51015	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.252079010 CEST	51015	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.252557993 CEST	51015	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.252573013 CEST	443	51015	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.252624035 CEST	443	51015	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.267726898 CEST	51016	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.267766953 CEST	443	51016	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.267853022 CEST	51016	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.268392086 CEST	51016	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.268404007 CEST	443	51016	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.268500090 CEST	443	51016	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.283205032 CEST	51017	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.283245087 CEST	443	51017	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.283317089 CEST	51017	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.283833027 CEST	51017	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.283848047 CEST	443	51017	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.283907890 CEST	443	51017	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.298712969 CEST	51018	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.298732996 CEST	443	51018	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.298818111 CEST	51018	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.299113989 CEST	51018	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.299140930 CEST	443	51018	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.299190044 CEST	443	51018	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.314119101 CEST	51019	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.314157963 CEST	443	51019	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.314244986 CEST	51019	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.314677954 CEST	51019	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.314694881 CEST	443	51019	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.314748049 CEST	443	51019	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.329751015 CEST	51020	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.329776049 CEST	443	51020	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.329858065 CEST	51020	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.330459118 CEST	51020	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.330472946 CEST	443	51020	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.330522060 CEST	443	51020	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.345683098 CEST	51021	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.345726013 CEST	443	51021	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.345829010 CEST	51021	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.346179962 CEST	51021	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.346194983 CEST	443	51021	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.346246004 CEST	443	51021	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.361159086 CEST	51022	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.361177921 CEST	443	51022	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.361252069 CEST	51022	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.361649990 CEST	51022	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.361659050 CEST	443	51022	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.361742020 CEST	443	51022	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.377068043 CEST	51023	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.377100945 CEST	443	51023	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.377191067 CEST	51023	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.377453089 CEST	51023	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.377466917 CEST	443	51023	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.377518892 CEST	443	51023	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.392874956 CEST	51024	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.392911911 CEST	443	51024	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.392987013 CEST	51024	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.393630028 CEST	51024	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.393647909 CEST	443	51024	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.393692017 CEST	443	51024	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.409007072 CEST	51025	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.409046888 CEST	443	51025	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.409143925 CEST	51025	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.409410000 CEST	51025	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.409420967 CEST	443	51025	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.409475088 CEST	443	51025	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.423671007 CEST	51026	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.423691988 CEST	443	51026	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.423893929 CEST	51026	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.424068928 CEST	51026	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.424079895 CEST	443	51026	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.424139023 CEST	443	51026	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.439460993 CEST	51027	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.439508915 CEST	443	51027	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.439579964 CEST	51027	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.440002918 CEST	51027	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.440017939 CEST	443	51027	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.440080881 CEST	443	51027	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.454962969 CEST	51028	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.455013990 CEST	443	51028	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.455167055 CEST	51028	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.455621958 CEST	51028	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.455637932 CEST	443	51028	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.455686092 CEST	443	51028	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.470460892 CEST	51029	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.470515013 CEST	443	51029	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.470593929 CEST	51029	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.470962048 CEST	51029	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.470973015 CEST	443	51029	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.471019030 CEST	443	51029	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.486485958 CEST	51030	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.486526966 CEST	443	51030	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.486607075 CEST	51030	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.487092018 CEST	51030	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.487102985 CEST	443	51030	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.487143993 CEST	443	51030	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.501681089 CEST	51031	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.501722097 CEST	443	51031	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.501828909 CEST	51031	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.502257109 CEST	51031	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.502269983 CEST	443	51031	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.502368927 CEST	443	51031	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.517398119 CEST	51032	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.517435074 CEST	443	51032	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.517575979 CEST	51032	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.517869949 CEST	51032	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.517883062 CEST	443	51032	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.517956018 CEST	443	51032	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.533082008 CEST	51033	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.533114910 CEST	443	51033	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.533183098 CEST	51033	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.533555984 CEST	51033	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.533571005 CEST	443	51033	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.533618927 CEST	443	51033	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.548633099 CEST	51034	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.548650980 CEST	443	51034	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.548762083 CEST	51034	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.549001932 CEST	51034	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.549012899 CEST	443	51034	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.549071074 CEST	443	51034	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.564178944 CEST	51035	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.564300060 CEST	443	51035	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.564414978 CEST	51035	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.564735889 CEST	51035	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.564769983 CEST	443	51035	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.564847946 CEST	443	51035	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.579910994 CEST	51036	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.579955101 CEST	443	51036	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.580737114 CEST	51036	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.581190109 CEST	51036	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.581202030 CEST	443	51036	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.581258059 CEST	443	51036	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.595753908 CEST	51037	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.595807076 CEST	443	51037	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.595937967 CEST	51037	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.596313953 CEST	51037	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.596324921 CEST	443	51037	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.596384048 CEST	443	51037	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.611418009 CEST	51038	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.611445904 CEST	443	51038	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.611546040 CEST	51038	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.611985922 CEST	51038	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.611996889 CEST	443	51038	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.612056971 CEST	443	51038	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.626745939 CEST	51039	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.626826048 CEST	443	51039	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.626948118 CEST	51039	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.627245903 CEST	51039	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.627269030 CEST	443	51039	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.627320051 CEST	443	51039	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.642457962 CEST	51040	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.642517090 CEST	443	51040	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.643662930 CEST	51040	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.643917084 CEST	51040	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.643930912 CEST	443	51040	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.643986940 CEST	443	51040	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.657874107 CEST	51041	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.657897949 CEST	443	51041	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.657993078 CEST	51041	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.658377886 CEST	51041	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.658389091 CEST	443	51041	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.658443928 CEST	443	51041	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.673990965 CEST	51042	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.674005032 CEST	443	51042	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.674200058 CEST	51042	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.674498081 CEST	51042	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.674516916 CEST	443	51042	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.674565077 CEST	443	51042	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.689579010 CEST	51043	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.689652920 CEST	443	51043	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.689744949 CEST	51043	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.690150976 CEST	51043	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.690169096 CEST	443	51043	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.690243959 CEST	443	51043	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.704750061 CEST	51044	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.704809904 CEST	443	51044	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.705013037 CEST	51044	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.705368042 CEST	51044	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.705379963 CEST	443	51044	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.705439091 CEST	443	51044	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.720305920 CEST	51045	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.720371008 CEST	443	51045	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.720494986 CEST	51045	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.720722914 CEST	51045	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.720738888 CEST	443	51045	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.720793962 CEST	443	51045	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.736305952 CEST	51046	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.736363888 CEST	443	51046	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.736627102 CEST	51046	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.736912012 CEST	51046	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.736927032 CEST	443	51046	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.736973047 CEST	443	51046	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.752504110 CEST	51047	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.752547979 CEST	443	51047	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.752681971 CEST	51047	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.753165960 CEST	51047	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.753176928 CEST	443	51047	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.753222942 CEST	443	51047	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.767366886 CEST	51048	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.767410994 CEST	443	51048	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.767488003 CEST	51048	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.767879009 CEST	51048	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.767891884 CEST	443	51048	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.767937899 CEST	443	51048	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.782982111 CEST	51049	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.783047915 CEST	443	51049	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.783154964 CEST	51049	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.783422947 CEST	51049	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.783438921 CEST	443	51049	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.783535004 CEST	443	51049	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.799146891 CEST	51050	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.799190998 CEST	443	51050	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.799299955 CEST	51050	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.799755096 CEST	51050	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.799765110 CEST	443	51050	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.799804926 CEST	443	51050	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.830130100 CEST	51051	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.830172062 CEST	443	51051	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.830271006 CEST	51051	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.830655098 CEST	51051	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.830665112 CEST	443	51051	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.830703020 CEST	443	51051	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.845555067 CEST	51052	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.845592976 CEST	443	51052	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.845674992 CEST	51052	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.846010923 CEST	51052	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.846024036 CEST	443	51052	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.846062899 CEST	443	51052	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.861146927 CEST	51053	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.861198902 CEST	443	51053	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.865606070 CEST	51053	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.865909100 CEST	51053	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.865921021 CEST	443	51053	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.865947008 CEST	443	51053	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.876458883 CEST	51054	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.876480103 CEST	443	51054	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.876586914 CEST	51054	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.876827955 CEST	51054	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.876836061 CEST	443	51054	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.876858950 CEST	443	51054	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.892237902 CEST	51055	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.892266035 CEST	443	51055	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.892350912 CEST	51055	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.892561913 CEST	51055	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.892569065 CEST	443	51055	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.892601967 CEST	443	51055	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.907793045 CEST	51056	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.907820940 CEST	443	51056	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.907932997 CEST	51056	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.908202887 CEST	51056	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.908214092 CEST	443	51056	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.908233881 CEST	443	51056	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.923753023 CEST	51057	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.923794985 CEST	443	51057	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.923877001 CEST	51057	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.924114943 CEST	51057	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.924124956 CEST	443	51057	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.924145937 CEST	443	51057	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.939121008 CEST	51058	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.939157009 CEST	443	51058	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.939249992 CEST	51058	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.939527035 CEST	51058	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.939537048 CEST	443	51058	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.939564943 CEST	443	51058	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.954740047 CEST	51059	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.954782963 CEST	443	51059	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.954937935 CEST	51059	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.955413103 CEST	51059	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.955421925 CEST	443	51059	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.955441952 CEST	443	51059	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.970613003 CEST	51060	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.970657110 CEST	443	51060	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.970748901 CEST	51060	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.970995903 CEST	51060	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.971008062 CEST	443	51060	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.971028090 CEST	443	51060	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.986538887 CEST	51061	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.986578941 CEST	443	51061	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.986675024 CEST	51061	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.986979008 CEST	51061	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:25.986990929 CEST	443	51061	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:25.987014055 CEST	443	51061	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.001564980 CEST	51062	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.001585960 CEST	443	51062	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.001660109 CEST	51062	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.001974106 CEST	51062	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.001986027 CEST	443	51062	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.002016068 CEST	443	51062	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.019258976 CEST	51063	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.019279957 CEST	443	51063	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.019481897 CEST	51063	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.019598961 CEST	51063	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.019608021 CEST	443	51063	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.019706011 CEST	443	51063	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.042306900 CEST	51064	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.042336941 CEST	443	51064	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.043108940 CEST	51064	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.043484926 CEST	51064	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.043498039 CEST	443	51064	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.043584108 CEST	443	51064	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.065808058 CEST	51065	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.065845966 CEST	443	51065	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.065922976 CEST	51065	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.066349030 CEST	51065	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.066361904 CEST	443	51065	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.066387892 CEST	443	51065	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.080988884 CEST	51066	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.081012964 CEST	443	51066	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.081120968 CEST	51066	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.081769943 CEST	51066	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.081784010 CEST	443	51066	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.081808090 CEST	443	51066	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.095499039 CEST	51067	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.095523119 CEST	443	51067	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.095592022 CEST	51067	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.096080065 CEST	51067	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.096091032 CEST	443	51067	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.096108913 CEST	443	51067	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.118247032 CEST	51068	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.118263960 CEST	443	51068	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.118354082 CEST	51068	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.118729115 CEST	51068	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.118737936 CEST	443	51068	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.118755102 CEST	443	51068	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.148439884 CEST	51069	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.148480892 CEST	443	51069	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.148566961 CEST	51069	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.148951054 CEST	51069	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.148962021 CEST	443	51069	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.148983955 CEST	443	51069	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.158299923 CEST	51070	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.158308983 CEST	443	51070	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.158385038 CEST	51070	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.158876896 CEST	51070	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.158884048 CEST	443	51070	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.158899069 CEST	443	51070	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.174072027 CEST	51071	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.174091101 CEST	443	51071	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.174292088 CEST	51071	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.174707890 CEST	51071	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.174717903 CEST	443	51071	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.174781084 CEST	443	51071	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.189129114 CEST	51072	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.189148903 CEST	443	51072	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.189235926 CEST	51072	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.189742088 CEST	51072	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.189749956 CEST	443	51072	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.189795017 CEST	443	51072	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.205382109 CEST	51073	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.205415010 CEST	443	51073	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.205502033 CEST	51073	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.205912113 CEST	51073	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.205924034 CEST	443	51073	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.205940962 CEST	443	51073	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.220125914 CEST	51074	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.220153093 CEST	443	51074	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.220242023 CEST	51074	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.220468044 CEST	51074	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.220484972 CEST	443	51074	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.220500946 CEST	443	51074	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.236057043 CEST	51075	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.236068964 CEST	443	51075	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.236357927 CEST	51075	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.236763000 CEST	51075	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.236769915 CEST	443	51075	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.236787081 CEST	443	51075	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.251754999 CEST	51076	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.251794100 CEST	443	51076	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.252034903 CEST	51076	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.252223969 CEST	51076	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.252240896 CEST	443	51076	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.252283096 CEST	443	51076	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.267193079 CEST	51077	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.267235994 CEST	443	51077	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.267345905 CEST	51077	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.267746925 CEST	51077	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.267757893 CEST	443	51077	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.267779112 CEST	443	51077	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.282815933 CEST	51078	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.282826900 CEST	443	51078	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.282891035 CEST	51078	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.283364058 CEST	51078	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.283374071 CEST	443	51078	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.283404112 CEST	443	51078	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.298485994 CEST	51079	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.298516035 CEST	443	51079	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.298687935 CEST	51079	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.299174070 CEST	51079	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.299182892 CEST	443	51079	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.299201965 CEST	443	51079	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.314296007 CEST	51080	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.314313889 CEST	443	51080	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.314457893 CEST	51080	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.315299988 CEST	51080	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.315309048 CEST	443	51080	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.315326929 CEST	443	51080	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.329757929 CEST	51081	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.329792023 CEST	443	51081	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.329972029 CEST	51081	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.330394983 CEST	51081	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.330404043 CEST	443	51081	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.330445051 CEST	443	51081	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.345155954 CEST	51082	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.345165968 CEST	443	51082	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.345221996 CEST	51082	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.345448017 CEST	51082	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.345453978 CEST	443	51082	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.345475912 CEST	443	51082	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.360908031 CEST	51083	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.360930920 CEST	443	51083	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.360989094 CEST	51083	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.361224890 CEST	51083	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.361232996 CEST	443	51083	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.361249924 CEST	443	51083	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.376439095 CEST	51084	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.376487017 CEST	443	51084	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.376554966 CEST	51084	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.376868010 CEST	51084	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.376882076 CEST	443	51084	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.376904011 CEST	443	51084	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.392194986 CEST	51085	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.392230034 CEST	443	51085	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.392442942 CEST	51085	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.392782927 CEST	51085	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.392792940 CEST	443	51085	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.392813921 CEST	443	51085	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.407820940 CEST	51086	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.407840014 CEST	443	51086	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.407907963 CEST	51086	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.408231020 CEST	51086	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.408240080 CEST	443	51086	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.408282042 CEST	443	51086	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.423907995 CEST	51087	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.423957109 CEST	443	51087	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.424143076 CEST	51087	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.424571991 CEST	51087	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.424582958 CEST	443	51087	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.424629927 CEST	443	51087	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.442137003 CEST	51088	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.442172050 CEST	443	51088	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.442276001 CEST	51088	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.442790985 CEST	51088	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.442802906 CEST	443	51088	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.442820072 CEST	443	51088	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.455779076 CEST	51089	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.455811024 CEST	443	51089	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.455897093 CEST	51089	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.456517935 CEST	51089	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.456525087 CEST	443	51089	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.456546068 CEST	443	51089	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.470438004 CEST	51090	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.470444918 CEST	443	51090	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.470501900 CEST	51090	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.470835924 CEST	51090	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.470841885 CEST	443	51090	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.470859051 CEST	443	51090	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.486728907 CEST	51091	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.486752987 CEST	443	51091	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.486840963 CEST	51091	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.487194061 CEST	51091	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.487205029 CEST	443	51091	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.487242937 CEST	443	51091	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.501749039 CEST	51092	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.501786947 CEST	443	51092	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.501902103 CEST	51092	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.502234936 CEST	51092	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.502247095 CEST	443	51092	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.502270937 CEST	443	51092	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.517149925 CEST	51093	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.517180920 CEST	443	51093	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.517281055 CEST	51093	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.517476082 CEST	51093	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.517486095 CEST	443	51093	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.517507076 CEST	443	51093	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.532643080 CEST	51094	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.532675982 CEST	443	51094	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.532783031 CEST	51094	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.533122063 CEST	51094	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.533135891 CEST	443	51094	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.533184052 CEST	443	51094	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.548474073 CEST	51095	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.548523903 CEST	443	51095	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.548737049 CEST	51095	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.548932076 CEST	51095	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.548945904 CEST	443	51095	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.549015045 CEST	443	51095	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.563941956 CEST	51096	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.563978910 CEST	443	51096	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.564060926 CEST	51096	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.564280987 CEST	51096	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.564296961 CEST	443	51096	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.564359903 CEST	443	51096	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.579755068 CEST	51097	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.579802990 CEST	443	51097	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.579880953 CEST	51097	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.580135107 CEST	51097	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.580148935 CEST	443	51097	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.580199957 CEST	443	51097	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.595117092 CEST	51098	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.595148087 CEST	443	51098	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.595263004 CEST	51098	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.595463037 CEST	51098	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.595477104 CEST	443	51098	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.595535040 CEST	443	51098	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.611056089 CEST	51099	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.611092091 CEST	443	51099	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.611188889 CEST	51099	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.611470938 CEST	51099	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.611484051 CEST	443	51099	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.611548901 CEST	443	51099	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.626799107 CEST	51100	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.626856089 CEST	443	51100	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.626948118 CEST	51100	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.627243042 CEST	51100	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.627262115 CEST	443	51100	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.627324104 CEST	443	51100	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.642297029 CEST	51101	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.642357111 CEST	443	51101	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.642447948 CEST	51101	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.642672062 CEST	51101	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.642688990 CEST	443	51101	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.642745018 CEST	443	51101	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.658057928 CEST	51102	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.658083916 CEST	443	51102	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.658196926 CEST	51102	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.658548117 CEST	51102	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.658556938 CEST	443	51102	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.658613920 CEST	443	51102	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.673727036 CEST	51103	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.673782110 CEST	443	51103	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.673892975 CEST	51103	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.674171925 CEST	51103	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.674185038 CEST	443	51103	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.674241066 CEST	443	51103	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.689320087 CEST	51104	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.689359903 CEST	443	51104	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.689428091 CEST	51104	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.689773083 CEST	51104	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.689784050 CEST	443	51104	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.689835072 CEST	443	51104	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.704895020 CEST	51105	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.704950094 CEST	443	51105	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.705029011 CEST	51105	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.705261946 CEST	51105	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.705272913 CEST	443	51105	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.705318928 CEST	443	51105	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.720164061 CEST	51106	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.720180035 CEST	443	51106	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.720347881 CEST	51106	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.720561028 CEST	51106	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.720571041 CEST	443	51106	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.720609903 CEST	443	51106	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.735721111 CEST	51107	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.735760927 CEST	443	51107	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.735846043 CEST	51107	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.736040115 CEST	51107	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.736049891 CEST	443	51107	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.736088991 CEST	443	51107	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.751363039 CEST	51108	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.751405954 CEST	443	51108	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.751480103 CEST	51108	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.751673937 CEST	51108	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.751684904 CEST	443	51108	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.751758099 CEST	443	51108	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.767776966 CEST	51109	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.767829895 CEST	443	51109	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.767997026 CEST	51109	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.768341064 CEST	51109	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.768352985 CEST	443	51109	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.768393993 CEST	443	51109	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.783032894 CEST	51110	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.783061028 CEST	443	51110	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.783140898 CEST	51110	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.783755064 CEST	51110	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.783766031 CEST	443	51110	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.783817053 CEST	443	51110	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.798471928 CEST	51111	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.798508883 CEST	443	51111	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.798613071 CEST	51111	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.798882008 CEST	51111	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.798892021 CEST	443	51111	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.798943043 CEST	443	51111	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.814199924 CEST	51112	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.814287901 CEST	443	51112	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.814374924 CEST	51112	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.814591885 CEST	51112	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.814608097 CEST	443	51112	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.814650059 CEST	443	51112	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.829868078 CEST	51113	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.829925060 CEST	443	51113	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.830035925 CEST	51113	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.830224991 CEST	51113	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.830240011 CEST	443	51113	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.830303907 CEST	443	51113	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.845510960 CEST	51114	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.845552921 CEST	443	51114	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.846611977 CEST	51114	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.846894979 CEST	51114	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.846913099 CEST	443	51114	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.846959114 CEST	443	51114	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.861051083 CEST	51115	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.861076117 CEST	443	51115	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.861161947 CEST	51115	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.861391068 CEST	51115	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.861402035 CEST	443	51115	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.861444950 CEST	443	51115	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.876868963 CEST	51116	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.876918077 CEST	443	51116	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.877017975 CEST	51116	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.877326012 CEST	51116	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.877341032 CEST	443	51116	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.877418995 CEST	443	51116	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.892396927 CEST	51117	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.892436028 CEST	443	51117	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.892528057 CEST	51117	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.892759085 CEST	51117	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.892770052 CEST	443	51117	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.892843962 CEST	443	51117	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.908113003 CEST	51118	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.908149004 CEST	443	51118	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.908284903 CEST	51118	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.908483982 CEST	51118	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.908493996 CEST	443	51118	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.908549070 CEST	443	51118	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.923679113 CEST	51119	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.923739910 CEST	443	51119	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.923841000 CEST	51119	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.924143076 CEST	51119	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.924160004 CEST	443	51119	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.924206018 CEST	443	51119	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.938985109 CEST	51120	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.939033985 CEST	443	51120	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.939122915 CEST	51120	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.939371109 CEST	51120	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.939388990 CEST	443	51120	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.939450026 CEST	443	51120	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.954643011 CEST	51121	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.954679012 CEST	443	51121	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.954746962 CEST	51121	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.955169916 CEST	51121	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.955180883 CEST	443	51121	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.955271006 CEST	443	51121	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.970587969 CEST	51122	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.970617056 CEST	443	51122	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.970710039 CEST	51122	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.971059084 CEST	51122	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.971070051 CEST	443	51122	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.971120119 CEST	443	51122	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.986485958 CEST	51123	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.986526012 CEST	443	51123	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.986618996 CEST	51123	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.986965895 CEST	51123	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:26.986980915 CEST	443	51123	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:26.987095118 CEST	443	51123	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.001705885 CEST	51124	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.001739025 CEST	443	51124	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.001827002 CEST	51124	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.002094030 CEST	51124	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.002108097 CEST	443	51124	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.002167940 CEST	443	51124	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.017349958 CEST	51125	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.017398119 CEST	443	51125	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.017608881 CEST	51125	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.017888069 CEST	51125	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.017904997 CEST	443	51125	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.017926931 CEST	443	51125	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.032974005 CEST	51126	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.033031940 CEST	443	51126	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.033142090 CEST	51126	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.033402920 CEST	51126	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.033421040 CEST	443	51126	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.033462048 CEST	443	51126	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.048388958 CEST	51127	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.048410892 CEST	443	51127	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.048552036 CEST	51127	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.048757076 CEST	51127	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.048769951 CEST	443	51127	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.048829079 CEST	443	51127	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.064253092 CEST	51128	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.064295053 CEST	443	51128	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.065612078 CEST	51128	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.065948963 CEST	51128	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.065962076 CEST	443	51128	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.066010952 CEST	443	51128	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.079925060 CEST	51129	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.079956055 CEST	443	51129	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.080044031 CEST	51129	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.080284119 CEST	51129	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.080300093 CEST	443	51129	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.080348969 CEST	443	51129	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.095980883 CEST	51130	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.095998049 CEST	443	51130	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.096178055 CEST	51130	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.097001076 CEST	51130	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.097013950 CEST	443	51130	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.097131014 CEST	443	51130	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.112293959 CEST	51131	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.112315893 CEST	443	51131	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.112394094 CEST	51131	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.113348961 CEST	51131	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.113359928 CEST	443	51131	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.113424063 CEST	443	51131	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.127701044 CEST	51132	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.127743006 CEST	443	51132	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.127898932 CEST	51132	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.128233910 CEST	51132	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.128245115 CEST	443	51132	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.128298044 CEST	443	51132	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.142389059 CEST	51133	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.142426014 CEST	443	51133	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.142502069 CEST	51133	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.142785072 CEST	51133	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.142801046 CEST	443	51133	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.142862082 CEST	443	51133	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.158056021 CEST	51134	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.158090115 CEST	443	51134	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.158164024 CEST	51134	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.158497095 CEST	51134	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.158509970 CEST	443	51134	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.158565044 CEST	443	51134	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.173577070 CEST	51135	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.173604965 CEST	443	51135	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.173681974 CEST	51135	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.173926115 CEST	51135	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.173933983 CEST	443	51135	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.173968077 CEST	443	51135	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.189075947 CEST	51136	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.189111948 CEST	443	51136	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.189376116 CEST	51136	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.189711094 CEST	51136	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.189729929 CEST	443	51136	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.189769983 CEST	443	51136	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.204721928 CEST	51137	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.204775095 CEST	443	51137	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.204936981 CEST	51137	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.205240011 CEST	51137	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.205261946 CEST	443	51137	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.205334902 CEST	443	51137	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.220362902 CEST	51138	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.220423937 CEST	443	51138	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.220504999 CEST	51138	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.220712900 CEST	51138	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.220731974 CEST	443	51138	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.220751047 CEST	443	51138	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.235918045 CEST	51139	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.235949039 CEST	443	51139	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.236007929 CEST	51139	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.236316919 CEST	51139	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.236327887 CEST	443	51139	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.236370087 CEST	443	51139	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.251406908 CEST	51140	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.251440048 CEST	443	51140	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.251563072 CEST	51140	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.251893044 CEST	51140	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.251904964 CEST	443	51140	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.251956940 CEST	443	51140	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.267239094 CEST	51141	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.267292023 CEST	443	51141	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.267556906 CEST	51141	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.267736912 CEST	51141	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.267750978 CEST	443	51141	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.267802000 CEST	443	51141	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.282759905 CEST	51142	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.282804966 CEST	443	51142	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.282912970 CEST	51142	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.283139944 CEST	51142	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.283154964 CEST	443	51142	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.283211946 CEST	443	51142	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.298638105 CEST	51143	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.298661947 CEST	443	51143	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.298861980 CEST	51143	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.299103975 CEST	51143	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.299112082 CEST	443	51143	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.299146891 CEST	443	51143	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.314047098 CEST	51144	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.314102888 CEST	443	51144	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.314285994 CEST	51144	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.314518929 CEST	51144	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.314536095 CEST	443	51144	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.314588070 CEST	443	51144	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.329829931 CEST	51145	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.329870939 CEST	443	51145	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.330009937 CEST	51145	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.330249071 CEST	51145	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.330262899 CEST	443	51145	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.330288887 CEST	443	51145	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.345530033 CEST	51146	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.345566034 CEST	443	51146	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.345643997 CEST	51146	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.345974922 CEST	51146	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.345988989 CEST	443	51146	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.346052885 CEST	443	51146	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.361119986 CEST	51147	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.361155987 CEST	443	51147	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.361274958 CEST	51147	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.361500978 CEST	51147	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.361514091 CEST	443	51147	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.361599922 CEST	443	51147	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.376820087 CEST	51148	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.376851082 CEST	443	51148	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.376971006 CEST	51148	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.377281904 CEST	51148	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.377294064 CEST	443	51148	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.377397060 CEST	443	51148	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.392164946 CEST	51149	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.392200947 CEST	443	51149	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.392272949 CEST	51149	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.392474890 CEST	51149	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.392491102 CEST	443	51149	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.392611027 CEST	443	51149	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.407988071 CEST	51150	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.408027887 CEST	443	51150	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.408092976 CEST	51150	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.408406973 CEST	51150	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.408421040 CEST	443	51150	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.408442974 CEST	443	51150	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.423526049 CEST	51151	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.423547029 CEST	443	51151	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.423680067 CEST	51151	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.423902988 CEST	51151	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.423916101 CEST	443	51151	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.423943043 CEST	443	51151	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.439611912 CEST	51152	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.439654112 CEST	443	51152	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.439802885 CEST	51152	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.440068960 CEST	51152	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.440083027 CEST	443	51152	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.440149069 CEST	443	51152	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.455245972 CEST	51153	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.455286026 CEST	443	51153	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.455357075 CEST	51153	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.455938101 CEST	51153	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.455950975 CEST	443	51153	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.456007957 CEST	443	51153	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.470340014 CEST	51154	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.470381021 CEST	443	51154	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.470485926 CEST	51154	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.470722914 CEST	51154	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.470736027 CEST	443	51154	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.470779896 CEST	443	51154	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.485918999 CEST	51155	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.485969067 CEST	443	51155	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.486093998 CEST	51155	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.486459017 CEST	51155	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.486474991 CEST	443	51155	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.486531973 CEST	443	51155	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.501509905 CEST	51156	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.501570940 CEST	443	51156	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.501710892 CEST	51156	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.501946926 CEST	51156	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.501972914 CEST	443	51156	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.502084970 CEST	443	51156	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.517333031 CEST	51157	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.517386913 CEST	443	51157	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.517472982 CEST	51157	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.517721891 CEST	51157	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.517734051 CEST	443	51157	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.517762899 CEST	443	51157	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.532855988 CEST	51158	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.532880068 CEST	443	51158	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.532978058 CEST	51158	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.533227921 CEST	51158	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.533238888 CEST	443	51158	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.533305883 CEST	443	51158	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.548432112 CEST	51159	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.548485041 CEST	443	51159	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.548608065 CEST	51159	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.549129009 CEST	51159	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.549146891 CEST	443	51159	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.549218893 CEST	443	51159	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.564367056 CEST	51160	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.564410925 CEST	443	51160	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.564492941 CEST	51160	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.564754009 CEST	51160	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.564764977 CEST	443	51160	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.564834118 CEST	443	51160	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.580197096 CEST	51161	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.580250978 CEST	443	51161	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.580363035 CEST	51161	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.580744982 CEST	51161	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.580760956 CEST	443	51161	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.580818892 CEST	443	51161	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.595443964 CEST	51162	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.595474005 CEST	443	51162	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.595599890 CEST	51162	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.596069098 CEST	51162	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.596080065 CEST	443	51162	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.596201897 CEST	443	51162	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.610995054 CEST	51163	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.611021996 CEST	443	51163	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.611125946 CEST	51163	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.611397028 CEST	51163	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.611406088 CEST	443	51163	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.611454010 CEST	443	51163	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.627059937 CEST	51164	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.627098083 CEST	443	51164	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.627186060 CEST	51164	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.627484083 CEST	51164	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.627497911 CEST	443	51164	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.627530098 CEST	443	51164	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.642288923 CEST	51165	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.642332077 CEST	443	51165	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.642416954 CEST	51165	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.642621994 CEST	51165	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.642632961 CEST	443	51165	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.642669916 CEST	443	51165	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.657959938 CEST	51166	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.657993078 CEST	443	51166	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.658107996 CEST	51166	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.658571959 CEST	51166	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.658606052 CEST	443	51166	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.658646107 CEST	443	51166	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.674103975 CEST	51167	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.674146891 CEST	443	51167	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.674210072 CEST	51167	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.674571991 CEST	51167	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.674586058 CEST	443	51167	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.674647093 CEST	443	51167	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.689287901 CEST	51168	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.689315081 CEST	443	51168	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.689399958 CEST	51168	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.689690113 CEST	51168	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.689702034 CEST	443	51168	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.689764977 CEST	443	51168	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.704581022 CEST	51169	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.704607964 CEST	443	51169	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.704750061 CEST	51169	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.705178976 CEST	51169	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.705193996 CEST	443	51169	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.705239058 CEST	443	51169	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.720386028 CEST	51170	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.720418930 CEST	443	51170	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.720509052 CEST	51170	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.720777035 CEST	51170	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.720793009 CEST	443	51170	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.720841885 CEST	443	51170	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.736166954 CEST	51171	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.736222982 CEST	443	51171	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.736479998 CEST	51171	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.736566067 CEST	51171	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.736581087 CEST	443	51171	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.736649990 CEST	443	51171	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.751606941 CEST	51172	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.751665115 CEST	443	51172	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.751753092 CEST	51172	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.751964092 CEST	51172	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.751979113 CEST	443	51172	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.752044916 CEST	443	51172	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.767304897 CEST	51173	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.767349958 CEST	443	51173	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.767465115 CEST	51173	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.767703056 CEST	51173	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.767719030 CEST	443	51173	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.767795086 CEST	443	51173	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.783698082 CEST	51174	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.783711910 CEST	443	51174	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.783788919 CEST	51174	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.784256935 CEST	51174	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.784269094 CEST	443	51174	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.784321070 CEST	443	51174	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.800641060 CEST	51175	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.800678015 CEST	443	51175	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.800771952 CEST	51175	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.801207066 CEST	51175	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.801218987 CEST	443	51175	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.801265001 CEST	443	51175	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.814454079 CEST	51176	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.814495087 CEST	443	51176	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.814569950 CEST	51176	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.814922094 CEST	51176	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.814939976 CEST	443	51176	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.814961910 CEST	443	51176	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.829639912 CEST	51177	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.829679012 CEST	443	51177	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.829782009 CEST	51177	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.830003023 CEST	51177	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.830014944 CEST	443	51177	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.830033064 CEST	443	51177	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.845468044 CEST	51178	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.845482111 CEST	443	51178	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.845557928 CEST	51178	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.845896006 CEST	51178	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.845906019 CEST	443	51178	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.845988989 CEST	443	51178	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.861599922 CEST	51179	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.861664057 CEST	443	51179	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.861741066 CEST	51179	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.862126112 CEST	51179	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.862143040 CEST	443	51179	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.862243891 CEST	443	51179	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.876844883 CEST	51180	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.876893997 CEST	443	51180	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.876972914 CEST	51180	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.877280951 CEST	51180	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.877301931 CEST	443	51180	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.877355099 CEST	443	51180	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.892527103 CEST	51181	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.892565966 CEST	443	51181	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.892656088 CEST	51181	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.892930031 CEST	51181	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.892946959 CEST	443	51181	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.893002987 CEST	443	51181	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.908026934 CEST	51182	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.908042908 CEST	443	51182	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.908108950 CEST	51182	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.908463955 CEST	51182	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.908473969 CEST	443	51182	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.908510923 CEST	443	51182	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.923424006 CEST	51183	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.923471928 CEST	443	51183	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.923576117 CEST	51183	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.923856020 CEST	51183	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.923877954 CEST	443	51183	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.923913002 CEST	443	51183	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.938927889 CEST	51184	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.938954115 CEST	443	51184	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.939045906 CEST	51184	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.939286947 CEST	51184	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.939300060 CEST	443	51184	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.939369917 CEST	443	51184	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.954850912 CEST	51185	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.954885960 CEST	443	51185	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.954963923 CEST	51185	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.955178976 CEST	51185	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.955192089 CEST	443	51185	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.955250025 CEST	443	51185	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.970541000 CEST	51186	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.970566988 CEST	443	51186	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.970644951 CEST	51186	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.970979929 CEST	51186	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.970992088 CEST	443	51186	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.971059084 CEST	443	51186	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.986164093 CEST	51187	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.986195087 CEST	443	51187	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.986279964 CEST	51187	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.986591101 CEST	51187	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:27.986603975 CEST	443	51187	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:27.986654043 CEST	443	51187	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.001775980 CEST	51188	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.001817942 CEST	443	51188	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.001902103 CEST	51188	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.002110958 CEST	51188	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.002123117 CEST	443	51188	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.002310991 CEST	443	51188	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.017394066 CEST	51189	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.017433882 CEST	443	51189	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.017594099 CEST	51189	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.017795086 CEST	51189	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.017810106 CEST	443	51189	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.017863035 CEST	443	51189	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.032893896 CEST	51190	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.032906055 CEST	443	51190	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.032988071 CEST	51190	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.033185005 CEST	51190	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.033198118 CEST	443	51190	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.033252001 CEST	443	51190	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.048427105 CEST	51191	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.048458099 CEST	443	51191	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.048537970 CEST	51191	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.048790932 CEST	51191	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.048803091 CEST	443	51191	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.048846006 CEST	443	51191	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.064158916 CEST	51192	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.064198017 CEST	443	51192	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.064279079 CEST	51192	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.064614058 CEST	51192	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.064625978 CEST	443	51192	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.064682961 CEST	443	51192	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.080135107 CEST	51193	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.080193043 CEST	443	51193	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.080307007 CEST	51193	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.080558062 CEST	51193	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.080581903 CEST	443	51193	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.080626011 CEST	443	51193	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.096278906 CEST	51194	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.096323013 CEST	443	51194	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.096395969 CEST	51194	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.097001076 CEST	51194	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.097023010 CEST	443	51194	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.097074986 CEST	443	51194	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.111624002 CEST	51195	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.111676931 CEST	443	51195	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.111768007 CEST	51195	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.112209082 CEST	51195	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.112220049 CEST	443	51195	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.112287998 CEST	443	51195	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.128321886 CEST	51196	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.128376961 CEST	443	51196	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.128452063 CEST	51196	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.129101038 CEST	51196	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.129112959 CEST	443	51196	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.129169941 CEST	443	51196	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.144417048 CEST	51197	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.144484043 CEST	443	51197	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.144568920 CEST	51197	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.144948959 CEST	51197	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.144963980 CEST	443	51197	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.144999027 CEST	443	51197	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.157897949 CEST	51198	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.157938957 CEST	443	51198	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.158027887 CEST	51198	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.158255100 CEST	51198	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.158269882 CEST	443	51198	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.158313036 CEST	443	51198	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.173779964 CEST	51199	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.173820972 CEST	443	51199	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.173883915 CEST	51199	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.174160004 CEST	51199	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.174170017 CEST	443	51199	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.174202919 CEST	443	51199	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.188909054 CEST	51200	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.188945055 CEST	443	51200	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.189033985 CEST	51200	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.189397097 CEST	51200	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.189420938 CEST	443	51200	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.189444065 CEST	443	51200	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.204698086 CEST	51201	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.204746008 CEST	443	51201	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.204823017 CEST	51201	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.205166101 CEST	51201	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.205184937 CEST	443	51201	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.205234051 CEST	443	51201	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.220447063 CEST	51202	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.220496893 CEST	443	51202	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.220565081 CEST	51202	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.220864058 CEST	51202	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.220882893 CEST	443	51202	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.220963955 CEST	443	51202	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.235903978 CEST	51203	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.235946894 CEST	443	51203	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.236018896 CEST	51203	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.236272097 CEST	51203	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.236289024 CEST	443	51203	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.236344099 CEST	443	51203	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.251533031 CEST	51204	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.251563072 CEST	443	51204	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.251657963 CEST	51204	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.251967907 CEST	51204	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.251981020 CEST	443	51204	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.252084970 CEST	443	51204	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.267147064 CEST	51205	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.267215014 CEST	443	51205	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.267307043 CEST	51205	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.267529011 CEST	51205	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.267546892 CEST	443	51205	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.267620087 CEST	443	51205	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.282730103 CEST	51206	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.282754898 CEST	443	51206	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.282943964 CEST	51206	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.283087015 CEST	51206	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.283101082 CEST	443	51206	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.283154011 CEST	443	51206	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.298588037 CEST	51207	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.298639059 CEST	443	51207	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.298721075 CEST	51207	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.298954964 CEST	51207	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.298970938 CEST	443	51207	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.299027920 CEST	443	51207	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.314033031 CEST	51208	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.314101934 CEST	443	51208	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.314197063 CEST	51208	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.314459085 CEST	51208	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.314482927 CEST	443	51208	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.314529896 CEST	443	51208	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.329862118 CEST	51209	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.329900026 CEST	443	51209	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.329982042 CEST	51209	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.330212116 CEST	51209	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.330224991 CEST	443	51209	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.330275059 CEST	443	51209	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.345143080 CEST	51210	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.345176935 CEST	443	51210	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.345252991 CEST	51210	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.345422029 CEST	51210	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.345434904 CEST	443	51210	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.345489979 CEST	443	51210	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.360882044 CEST	51211	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.360908985 CEST	443	51211	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.360990047 CEST	51211	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.361222029 CEST	51211	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.361237049 CEST	443	51211	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.361303091 CEST	443	51211	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.376595020 CEST	51212	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.376651049 CEST	443	51212	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.376729965 CEST	51212	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.376966000 CEST	51212	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.376981974 CEST	443	51212	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.377044916 CEST	443	51212	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.391973972 CEST	51213	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.392004967 CEST	443	51213	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.392059088 CEST	51213	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.392291069 CEST	51213	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.392303944 CEST	443	51213	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.392366886 CEST	443	51213	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.408132076 CEST	51214	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.408160925 CEST	443	51214	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.408226967 CEST	51214	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.408514977 CEST	51214	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.408529043 CEST	443	51214	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.408581018 CEST	443	51214	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.423516035 CEST	51215	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.423547983 CEST	443	51215	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.423604965 CEST	51215	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.424005032 CEST	51215	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.424019098 CEST	443	51215	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.424067020 CEST	443	51215	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.442361116 CEST	51216	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.442404985 CEST	443	51216	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.442473888 CEST	51216	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.442727089 CEST	51216	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.442739964 CEST	443	51216	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.442792892 CEST	443	51216	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.466090918 CEST	51217	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.466150045 CEST	443	51217	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.466219902 CEST	51217	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.486062050 CEST	51217	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.486104012 CEST	443	51217	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.486202002 CEST	443	51217	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.501646996 CEST	51218	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.501682043 CEST	443	51218	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.501744986 CEST	51218	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.502033949 CEST	51218	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.502043962 CEST	443	51218	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.502130032 CEST	443	51218	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.517390966 CEST	51219	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.517448902 CEST	443	51219	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.517529011 CEST	51219	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.517791986 CEST	51219	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.517807961 CEST	443	51219	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.517855883 CEST	443	51219	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.532793045 CEST	51220	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.532830954 CEST	443	51220	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.532888889 CEST	51220	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.533890963 CEST	51220	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.533906937 CEST	443	51220	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.533934116 CEST	443	51220	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.548830986 CEST	51221	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.548877954 CEST	443	51221	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.548938990 CEST	51221	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.549165010 CEST	51221	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.549180031 CEST	443	51221	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.549226999 CEST	443	51221	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.564069033 CEST	51222	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.564102888 CEST	443	51222	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.564167023 CEST	51222	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.564404011 CEST	51222	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.564418077 CEST	443	51222	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.564462900 CEST	443	51222	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.579785109 CEST	51223	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.579809904 CEST	443	51223	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.579862118 CEST	51223	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.580116987 CEST	51223	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.580128908 CEST	443	51223	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.580184937 CEST	443	51223	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.595349073 CEST	51224	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.595387936 CEST	443	51224	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.595459938 CEST	51224	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.595705032 CEST	51224	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.595716953 CEST	443	51224	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.595771074 CEST	443	51224	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.610908031 CEST	51225	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.610989094 CEST	443	51225	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.611063004 CEST	51225	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.611301899 CEST	51225	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.611335993 CEST	443	51225	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.611381054 CEST	443	51225	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.626635075 CEST	51226	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.626696110 CEST	443	51226	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.626801014 CEST	51226	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.627016068 CEST	51226	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.627031088 CEST	443	51226	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.627075911 CEST	443	51226	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.642097950 CEST	51227	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.642116070 CEST	443	51227	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.642204046 CEST	51227	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.642399073 CEST	51227	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.642410994 CEST	443	51227	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.642457008 CEST	443	51227	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.657710075 CEST	51228	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.657756090 CEST	443	51228	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.657867908 CEST	51228	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.658206940 CEST	51228	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.658224106 CEST	443	51228	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.658274889 CEST	443	51228	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.673378944 CEST	51229	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.673455000 CEST	443	51229	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.673542976 CEST	51229	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.673755884 CEST	51229	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.673788071 CEST	443	51229	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.673829079 CEST	443	51229	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.689009905 CEST	51230	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.689039946 CEST	443	51230	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.689126015 CEST	51230	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.689404011 CEST	51230	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.689441919 CEST	443	51230	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.689465046 CEST	443	51230	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.704595089 CEST	51231	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.704627037 CEST	443	51231	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.704705954 CEST	51231	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.705157995 CEST	51231	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.705172062 CEST	443	51231	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.705214977 CEST	443	51231	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.720308065 CEST	51232	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.720343113 CEST	443	51232	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.720424891 CEST	51232	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.720626116 CEST	51232	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.720643044 CEST	443	51232	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.720685959 CEST	443	51232	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.735917091 CEST	51233	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.735965967 CEST	443	51233	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.736104012 CEST	51233	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.736388922 CEST	51233	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.736418009 CEST	443	51233	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.736457109 CEST	443	51233	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.751446962 CEST	51234	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.751473904 CEST	443	51234	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.751557112 CEST	51234	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.751760960 CEST	51234	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.751785994 CEST	443	51234	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.751848936 CEST	443	51234	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.767690897 CEST	51235	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.767760992 CEST	443	51235	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.767849922 CEST	51235	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.768122911 CEST	51235	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.768135071 CEST	443	51235	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.768187046 CEST	443	51235	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.783140898 CEST	51236	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.783190966 CEST	443	51236	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.783271074 CEST	51236	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.783571959 CEST	51236	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.783584118 CEST	443	51236	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.783617020 CEST	443	51236	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.798628092 CEST	51237	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.798693895 CEST	443	51237	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.798933029 CEST	51237	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.799060106 CEST	51237	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.799091101 CEST	443	51237	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.799141884 CEST	443	51237	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.814420938 CEST	51238	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.814481020 CEST	443	51238	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.814604998 CEST	51238	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.815023899 CEST	51238	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.815045118 CEST	443	51238	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.815135956 CEST	443	51238	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.829912901 CEST	51239	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.829960108 CEST	443	51239	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.830050945 CEST	51239	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.830481052 CEST	51239	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.830491066 CEST	443	51239	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.830523968 CEST	443	51239	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.845303059 CEST	51240	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.845341921 CEST	443	51240	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.845573902 CEST	51240	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.845894098 CEST	51240	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.845905066 CEST	443	51240	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.845933914 CEST	443	51240	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.860857964 CEST	51241	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.860904932 CEST	443	51241	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.860985994 CEST	51241	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.861198902 CEST	51241	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.861207962 CEST	443	51241	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.861237049 CEST	443	51241	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.876730919 CEST	51242	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.876746893 CEST	443	51242	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.876806021 CEST	51242	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.877074003 CEST	51242	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.877083063 CEST	443	51242	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.877110958 CEST	443	51242	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.892014980 CEST	51243	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.892043114 CEST	443	51243	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.892112970 CEST	51243	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.892391920 CEST	51243	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.892402887 CEST	443	51243	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.892429113 CEST	443	51243	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.907604933 CEST	51244	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.907643080 CEST	443	51244	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.907841921 CEST	51244	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.908121109 CEST	51244	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.908129930 CEST	443	51244	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.908153057 CEST	443	51244	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.923373938 CEST	51245	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.923423052 CEST	443	51245	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.923492908 CEST	51245	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.923702955 CEST	51245	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.923712969 CEST	443	51245	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.923741102 CEST	443	51245	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.938844919 CEST	51246	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.938863993 CEST	443	51246	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.938930035 CEST	51246	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.939153910 CEST	51246	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.939162016 CEST	443	51246	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.939194918 CEST	443	51246	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.954540968 CEST	51247	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.954581976 CEST	443	51247	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.954639912 CEST	51247	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.954847097 CEST	51247	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.954857111 CEST	443	51247	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.954884052 CEST	443	51247	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.970197916 CEST	51248	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.970251083 CEST	443	51248	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.970396042 CEST	51248	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.970633984 CEST	51248	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.970662117 CEST	443	51248	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.970824957 CEST	443	51248	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.985897064 CEST	51249	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.985934019 CEST	443	51249	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.986008883 CEST	51249	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.986228943 CEST	51249	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:28.986243010 CEST	443	51249	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:28.986277103 CEST	443	51249	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.001338005 CEST	51250	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.001352072 CEST	443	51250	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.001416922 CEST	51250	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.001662970 CEST	51250	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.001674891 CEST	443	51250	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.001708984 CEST	443	51250	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.017123938 CEST	51251	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.017163038 CEST	443	51251	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.017294884 CEST	51251	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.017527103 CEST	51251	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.017555952 CEST	443	51251	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.017597914 CEST	443	51251	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.032627106 CEST	51252	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.032702923 CEST	443	51252	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.032776117 CEST	51252	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.033019066 CEST	51252	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.033052921 CEST	443	51252	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.033097029 CEST	443	51252	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.048255920 CEST	51253	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.048284054 CEST	443	51253	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.048408031 CEST	51253	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.048618078 CEST	51253	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.048640966 CEST	443	51253	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.048690081 CEST	443	51253	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.063895941 CEST	51254	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.063908100 CEST	443	51254	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.063960075 CEST	51254	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.064217091 CEST	51254	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.064228058 CEST	443	51254	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.064295053 CEST	443	51254	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.079477072 CEST	51255	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.079505920 CEST	443	51255	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.079583883 CEST	51255	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.080070019 CEST	51255	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.080099106 CEST	443	51255	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.080142975 CEST	443	51255	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.095738888 CEST	51256	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.095789909 CEST	443	51256	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.095861912 CEST	51256	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.096148968 CEST	51256	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.096160889 CEST	443	51256	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.096188068 CEST	443	51256	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.111118078 CEST	51257	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.111156940 CEST	443	51257	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.111226082 CEST	51257	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.111535072 CEST	51257	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.111546993 CEST	443	51257	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.111586094 CEST	443	51257	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.127368927 CEST	51258	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.127404928 CEST	443	51258	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.127475023 CEST	51258	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.128011942 CEST	51258	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.128022909 CEST	443	51258	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.128053904 CEST	443	51258	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.142312050 CEST	51259	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.142350912 CEST	443	51259	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.142414093 CEST	51259	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.142741919 CEST	51259	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.142752886 CEST	443	51259	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.142791033 CEST	443	51259	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.158129930 CEST	51260	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.158166885 CEST	443	51260	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.158227921 CEST	51260	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.158715963 CEST	51260	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.158725023 CEST	443	51260	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.158745050 CEST	443	51260	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.175528049 CEST	51261	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.175570965 CEST	443	51261	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.175628901 CEST	51261	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.176224947 CEST	51261	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.176234961 CEST	443	51261	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.176251888 CEST	443	51261	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.189065933 CEST	51262	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.189074039 CEST	443	51262	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.189130068 CEST	51262	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.189460993 CEST	51262	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.189467907 CEST	443	51262	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.189483881 CEST	443	51262	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.204696894 CEST	51263	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.204722881 CEST	443	51263	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.204777002 CEST	51263	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.205064058 CEST	51263	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.205073118 CEST	443	51263	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.205099106 CEST	443	51263	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.220141888 CEST	51264	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.220163107 CEST	443	51264	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.220220089 CEST	51264	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.220524073 CEST	51264	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.220531940 CEST	443	51264	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.220556021 CEST	443	51264	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.235821962 CEST	51265	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.235852003 CEST	443	51265	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.235917091 CEST	51265	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.236165047 CEST	51265	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.236175060 CEST	443	51265	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.236195087 CEST	443	51265	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.251457930 CEST	51266	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.251466990 CEST	443	51266	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.251518965 CEST	51266	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.251763105 CEST	51266	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.251770020 CEST	443	51266	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.251791954 CEST	443	51266	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.267069101 CEST	51267	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.267087936 CEST	443	51267	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.267173052 CEST	51267	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.267443895 CEST	51267	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.267452955 CEST	443	51267	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.267491102 CEST	443	51267	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.282577991 CEST	51268	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.282598019 CEST	443	51268	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.282653093 CEST	51268	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.282857895 CEST	51268	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.282866955 CEST	443	51268	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.282917976 CEST	443	51268	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.298213005 CEST	51269	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.298258066 CEST	443	51269	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.298461914 CEST	51269	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.298744917 CEST	51269	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.298755884 CEST	443	51269	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.298784018 CEST	443	51269	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.314086914 CEST	51270	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.314132929 CEST	443	51270	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.314208984 CEST	51270	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.314412117 CEST	51270	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.314426899 CEST	443	51270	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.314488888 CEST	443	51270	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.329685926 CEST	51271	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.329731941 CEST	443	51271	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.329899073 CEST	51271	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.330092907 CEST	51271	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.330110073 CEST	443	51271	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.330157995 CEST	443	51271	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.345304966 CEST	51272	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.345397949 CEST	443	51272	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.345612049 CEST	51272	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.345781088 CEST	51272	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.345818996 CEST	443	51272	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.345854998 CEST	443	51272	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.360881090 CEST	51273	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.360912085 CEST	443	51273	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.360977888 CEST	51273	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.361193895 CEST	51273	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.361207008 CEST	443	51273	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.361254930 CEST	443	51273	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.376544952 CEST	51274	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.376554012 CEST	443	51274	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.376622915 CEST	51274	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.376921892 CEST	51274	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.376931906 CEST	443	51274	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.376976967 CEST	443	51274	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.392097950 CEST	51275	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.392183065 CEST	443	51275	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.392374039 CEST	51275	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.392501116 CEST	51275	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.392538071 CEST	443	51275	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.392581940 CEST	443	51275	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.407685995 CEST	51276	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.407720089 CEST	443	51276	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.407799959 CEST	51276	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.407999039 CEST	51276	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.408013105 CEST	443	51276	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.408041954 CEST	443	51276	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.423474073 CEST	51277	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.423512936 CEST	443	51277	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.423686028 CEST	51277	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.423794985 CEST	51277	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.423801899 CEST	443	51277	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.423847914 CEST	443	51277	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.438915014 CEST	51278	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.438956022 CEST	443	51278	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.439127922 CEST	51278	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.439237118 CEST	51278	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.439251900 CEST	443	51278	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.439302921 CEST	443	51278	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.454741955 CEST	51279	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.454770088 CEST	443	51279	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.454984903 CEST	51279	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.455121994 CEST	51279	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.455133915 CEST	443	51279	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.455187082 CEST	443	51279	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.470503092 CEST	51280	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.470550060 CEST	443	51280	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.470643044 CEST	51280	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.470885038 CEST	51280	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.470899105 CEST	443	51280	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.470954895 CEST	443	51280	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.485945940 CEST	51281	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.485986948 CEST	443	51281	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.486088991 CEST	51281	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.486294985 CEST	51281	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.486310959 CEST	443	51281	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.486341953 CEST	443	51281	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.501955032 CEST	51282	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.502018929 CEST	443	51282	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.502201080 CEST	51282	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.502432108 CEST	51282	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.502453089 CEST	443	51282	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.502484083 CEST	443	51282	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.517390013 CEST	51283	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.517426968 CEST	443	51283	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.517499924 CEST	51283	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.517838001 CEST	51283	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.517848015 CEST	443	51283	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.517966032 CEST	443	51283	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.533042908 CEST	51284	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.533094883 CEST	443	51284	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.533165932 CEST	51284	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.533634901 CEST	51284	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.533647060 CEST	443	51284	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.533715010 CEST	443	51284	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.548378944 CEST	51285	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.548485041 CEST	443	51285	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.548573971 CEST	51285	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.548835993 CEST	51285	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.548871040 CEST	443	51285	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.548929930 CEST	443	51285	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.563873053 CEST	51286	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.563900948 CEST	443	51286	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.563975096 CEST	51286	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.564188957 CEST	51286	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.564213991 CEST	443	51286	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.564269066 CEST	443	51286	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.579648018 CEST	51287	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.579673052 CEST	443	51287	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.579742908 CEST	51287	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.579974890 CEST	51287	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.579986095 CEST	443	51287	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.580040932 CEST	443	51287	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.595190048 CEST	51288	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.595213890 CEST	443	51288	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.595290899 CEST	51288	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.595489025 CEST	51288	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.595501900 CEST	443	51288	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.595534086 CEST	443	51288	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.610960007 CEST	51289	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.611021042 CEST	443	51289	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.611097097 CEST	51289	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.611383915 CEST	51289	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.611397982 CEST	443	51289	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.611428976 CEST	443	51289	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.626516104 CEST	51290	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.626538992 CEST	443	51290	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.626611948 CEST	51290	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.626833916 CEST	51290	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.626843929 CEST	443	51290	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.626897097 CEST	443	51290	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.642198086 CEST	51291	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.642232895 CEST	443	51291	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.642316103 CEST	51291	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.642574072 CEST	51291	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.642586946 CEST	443	51291	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.642642021 CEST	443	51291	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.657813072 CEST	51292	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.657857895 CEST	443	51292	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.657927036 CEST	51292	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.658224106 CEST	51292	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.658238888 CEST	443	51292	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.658317089 CEST	443	51292	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.673407078 CEST	51293	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.673515081 CEST	443	51293	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.673669100 CEST	51293	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.673908949 CEST	51293	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.673943996 CEST	443	51293	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.673985958 CEST	443	51293	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.689107895 CEST	51294	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.689145088 CEST	443	51294	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.689268112 CEST	51294	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.689502954 CEST	51294	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.689528942 CEST	443	51294	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.689560890 CEST	443	51294	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.704726934 CEST	51295	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.704756975 CEST	443	51295	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.704828978 CEST	51295	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.705082893 CEST	51295	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.705095053 CEST	443	51295	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.705125093 CEST	443	51295	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.720202923 CEST	51296	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.720240116 CEST	443	51296	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.720313072 CEST	51296	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.720532894 CEST	51296	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.720546007 CEST	443	51296	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.720608950 CEST	443	51296	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.735949993 CEST	51297	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.736000061 CEST	443	51297	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.736145973 CEST	51297	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.736449957 CEST	51297	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.736478090 CEST	443	51297	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.736526012 CEST	443	51297	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.751565933 CEST	51298	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.751596928 CEST	443	51298	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.751678944 CEST	51298	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.751898050 CEST	51298	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.751924038 CEST	443	51298	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.751965046 CEST	443	51298	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.767193079 CEST	51299	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.767225027 CEST	443	51299	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.767390966 CEST	51299	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.767570019 CEST	51299	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.767584085 CEST	443	51299	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.767632961 CEST	443	51299	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.782886982 CEST	51300	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.782919884 CEST	443	51300	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.782991886 CEST	51300	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.783229113 CEST	51300	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.783243895 CEST	443	51300	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.783293962 CEST	443	51300	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.798549891 CEST	51301	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.798590899 CEST	443	51301	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.798688889 CEST	51301	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.799149990 CEST	51301	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.799163103 CEST	443	51301	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.799187899 CEST	443	51301	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.814111948 CEST	51302	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.814140081 CEST	443	51302	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.814325094 CEST	51302	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.814477921 CEST	51302	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.814485073 CEST	443	51302	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.814590931 CEST	443	51302	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.829799891 CEST	51303	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.829832077 CEST	443	51303	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.830018997 CEST	51303	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.830215931 CEST	51303	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.830226898 CEST	443	51303	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.830286026 CEST	443	51303	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.845513105 CEST	51304	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.845555067 CEST	443	51304	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.845664978 CEST	51304	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.845962048 CEST	51304	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.845978022 CEST	443	51304	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.846049070 CEST	443	51304	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.861459017 CEST	51305	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.861515999 CEST	443	51305	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.861607075 CEST	51305	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.861902952 CEST	51305	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.861922026 CEST	443	51305	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.861978054 CEST	443	51305	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.877060890 CEST	51306	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.877146959 CEST	443	51306	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.877240896 CEST	51306	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.877532005 CEST	51306	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.877552986 CEST	443	51306	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.877594948 CEST	443	51306	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.892405987 CEST	51307	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.892433882 CEST	443	51307	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.892510891 CEST	51307	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.892796040 CEST	51307	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.892807961 CEST	443	51307	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.892859936 CEST	443	51307	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.908262968 CEST	51308	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.908328056 CEST	443	51308	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.908544064 CEST	51308	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.908896923 CEST	51308	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.908914089 CEST	443	51308	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.908972979 CEST	443	51308	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.923523903 CEST	51309	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.923573017 CEST	443	51309	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.923659086 CEST	51309	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.924154043 CEST	51309	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.924165964 CEST	443	51309	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.924212933 CEST	443	51309	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.939079046 CEST	51310	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.939096928 CEST	443	51310	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.939162970 CEST	51310	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.939445972 CEST	51310	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.939456940 CEST	443	51310	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.939501047 CEST	443	51310	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.954807043 CEST	51311	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.954833984 CEST	443	51311	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.954902887 CEST	51311	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.955389023 CEST	51311	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.955399990 CEST	443	51311	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.955441952 CEST	443	51311	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.970596075 CEST	51312	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.970644951 CEST	443	51312	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.970729113 CEST	51312	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.970969915 CEST	51312	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.970988035 CEST	443	51312	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.971040964 CEST	443	51312	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.986222982 CEST	51313	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.986275911 CEST	443	51313	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.986378908 CEST	51313	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.986610889 CEST	51313	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:29.986622095 CEST	443	51313	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:29.986659050 CEST	443	51313	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:30.001430988 CEST	51314	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:30.001468897 CEST	443	51314	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:30.001553059 CEST	51314	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:30.001775026 CEST	51314	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:30.001786947 CEST	443	51314	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:30.001888037 CEST	443	51314	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:30.017343044 CEST	51315	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:30.017395973 CEST	443	51315	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:30.017481089 CEST	51315	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:30.017781019 CEST	51315	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:30.017796040 CEST	443	51315	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:30.017879009 CEST	443	51315	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:30.032758951 CEST	51316	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:30.032821894 CEST	443	51316	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:30.032898903 CEST	51316	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:30.033133030 CEST	51316	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:30.033149004 CEST	443	51316	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:30.033205986 CEST	443	51316	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:30.048369884 CEST	51317	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:30.048404932 CEST	443	51317	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:30.048634052 CEST	51317	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:30.048944950 CEST	51317	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:30.048959970 CEST	443	51317	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:30.049005032 CEST	443	51317	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:30.063970089 CEST	51318	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:30.063987017 CEST	443	51318	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:30.064076900 CEST	51318	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:30.064268112 CEST	51318	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:30.064280033 CEST	443	51318	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:30.064321995 CEST	443	51318	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:30.079689026 CEST	51319	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:30.079736948 CEST	443	51319	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:30.079914093 CEST	51319	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:30.080184937 CEST	51319	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:30.080204010 CEST	443	51319	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:30.080245972 CEST	443	51319	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:30.095558882 CEST	51320	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:30.095588923 CEST	443	51320	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:30.095680952 CEST	51320	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:30.095927000 CEST	51320	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:30.095937014 CEST	443	51320	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:30.095983982 CEST	443	51320	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:30.111005068 CEST	51321	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:30.111076117 CEST	443	51321	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:30.111157894 CEST	51321	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:30.111401081 CEST	51321	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:30.111413956 CEST	443	51321	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:30.111468077 CEST	443	51321	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:30.126882076 CEST	51322	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:30.126907110 CEST	443	51322	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:30.126986980 CEST	51322	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:30.127321005 CEST	51322	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:30.127331972 CEST	443	51322	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:30.127415895 CEST	443	51322	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:30.142674923 CEST	51323	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:30.142698050 CEST	443	51323	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:30.142848015 CEST	51323	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:30.143147945 CEST	51323	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:30.143157959 CEST	443	51323	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:30.143210888 CEST	443	51323	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:30.158691883 CEST	51324	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:30.158762932 CEST	443	51324	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:30.158840895 CEST	51324	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:30.159312010 CEST	51324	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:30.159332991 CEST	443	51324	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:30.159380913 CEST	443	51324	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:30.173530102 CEST	51325	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:30.173566103 CEST	443	51325	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:30.173643112 CEST	51325	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:30.173971891 CEST	51325	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:30.173986912 CEST	443	51325	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:30.174046040 CEST	443	51325	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:30.189925909 CEST	51326	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:30.189950943 CEST	443	51326	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:30.190028906 CEST	51326	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:30.190404892 CEST	51326	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:30.190418959 CEST	443	51326	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:30.190498114 CEST	443	51326	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:30.205818892 CEST	51327	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:30.205897093 CEST	443	51327	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:30.205979109 CEST	51327	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:30.206401110 CEST	51327	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:30.206429958 CEST	443	51327	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:30.206485033 CEST	443	51327	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:30.220560074 CEST	51328	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:30.220630884 CEST	443	51328	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:30.220705032 CEST	51328	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:30.220993042 CEST	51328	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:30.221009016 CEST	443	51328	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:30.221076965 CEST	443	51328	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:30.236217022 CEST	51329	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:30.236329079 CEST	443	51329	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:30.236394882 CEST	51329	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:30.236731052 CEST	51329	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:30.236763954 CEST	443	51329	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:30.236812115 CEST	443	51329	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:30.251964092 CEST	51330	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:30.251991034 CEST	443	51330	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:30.252068996 CEST	51330	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:30.252608061 CEST	51330	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:30.252635002 CEST	443	51330	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:30.252679110 CEST	443	51330	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:30.267381907 CEST	51331	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:30.267447948 CEST	443	51331	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:30.267522097 CEST	51331	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:30.267779112 CEST	51331	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:30.267808914 CEST	443	51331	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:30.267848015 CEST	443	51331	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:30.282772064 CEST	51332	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:30.282799959 CEST	443	51332	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:30.282891035 CEST	51332	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:30.283138990 CEST	51332	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:30.283152103 CEST	443	51332	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:30.283196926 CEST	443	51332	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:30.298705101 CEST	51333	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:30.298744917 CEST	443	51333	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:30.298834085 CEST	51333	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:30.299092054 CEST	51333	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:30.299108982 CEST	443	51333	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:30.299155951 CEST	443	51333	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:30.314112902 CEST	51334	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:30.314124107 CEST	443	51334	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:30.314182997 CEST	51334	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:30.314455986 CEST	51334	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:30.314467907 CEST	443	51334	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:30.314516068 CEST	443	51334	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:30.329669952 CEST	51335	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:30.329693079 CEST	443	51335	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:30.329765081 CEST	51335	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:30.329996109 CEST	51335	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:30.330005884 CEST	443	51335	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:30.330049992 CEST	443	51335	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:30.345186949 CEST	51336	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:30.345212936 CEST	443	51336	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:30.345283985 CEST	51336	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:30.345515966 CEST	51336	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:30.345529079 CEST	443	51336	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:30.345572948 CEST	443	51336	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:30.360939980 CEST	51337	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:30.360979080 CEST	443	51337	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:30.361057043 CEST	51337	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:30.361285925 CEST	51337	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:30.361313105 CEST	443	51337	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:30.361352921 CEST	443	51337	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:30.376410007 CEST	51338	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:30.376441002 CEST	443	51338	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:30.376534939 CEST	51338	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:30.376766920 CEST	51338	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:30.376790047 CEST	443	51338	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:30.376882076 CEST	443	51338	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:30.392256021 CEST	51339	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:30.392281055 CEST	443	51339	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:30.392380953 CEST	51339	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:30.392637968 CEST	51339	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:30.392651081 CEST	443	51339	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:30.392712116 CEST	443	51339	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:30.407900095 CEST	51340	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:30.407959938 CEST	443	51340	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:30.408031940 CEST	51340	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:30.408246994 CEST	51340	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:30.408266068 CEST	443	51340	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:30.408312082 CEST	443	51340	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:30.423446894 CEST	51341	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:30.423490047 CEST	443	51341	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:30.423569918 CEST	51341	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:30.423804998 CEST	51341	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:30.423820972 CEST	443	51341	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:30.423875093 CEST	443	51341	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:30.439065933 CEST	51342	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:30.439105988 CEST	443	51342	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:30.439172983 CEST	51342	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:30.439424038 CEST	51342	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:30.439438105 CEST	443	51342	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:30.439476967 CEST	443	51342	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:30.454993010 CEST	51343	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:30.455034018 CEST	443	51343	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:30.455277920 CEST	51343	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:30.455437899 CEST	51343	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:30.455452919 CEST	443	51343	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:30.455493927 CEST	443	51343	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:30.470335007 CEST	51344	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:30.470382929 CEST	443	51344	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:30.470454931 CEST	51344	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:30.470721006 CEST	51344	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:30.470733881 CEST	443	51344	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:30.470769882 CEST	443	51344	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:30.486254930 CEST	51345	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:30.486299038 CEST	443	51345	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:30.486383915 CEST	51345	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:30.486722946 CEST	51345	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:30.486736059 CEST	443	51345	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:30.486783981 CEST	443	51345	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:30.501841068 CEST	51346	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:30.501899004 CEST	443	51346	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:30.501981020 CEST	51346	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:30.502271891 CEST	51346	443	192.168.2.6	157.20.182.233
Oct 14, 2024 17:23:30.502285957 CEST	443	51346	157.20.182.233	192.168.2.6
Oct 14, 2024 17:23:30.502386093 CEST	443	51346	157.20.182.233	192.168.2.6

Target ID:	1
Start time:	11:22:13
Start date:	14/10/2024
Path:	C:\Users\user\Desktop\antispam_connect_eu.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\antispam_connect_eu.exe"
Imagebase:	0x400000
File size:	3'621'376 bytes
MD5 hash:	BA115C337D529887F22C0C2AC398AB2D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SystemBC, Description: Yara detected SystemBC, Source: 00000001.00000002.3439574414.00000000063C0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	1.4%
Dynamic/Decrypted Code Coverage:	25.6%
Signature Coverage:	32.8%
Total number of Nodes:	735
Total number of Limit Nodes:	25

Executed Functions

Function 00409150 Relevance: 74.8, Strings: 59, Instructions: 1059
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

ais_cmp_pap, xrefs: 00409F5F, 00409F9F, 00409FA0
alc_shl_web, xrefs: 00409AAF, 00409AEF, 00409AF0
alc_shl_mai, xrefs: 004098CF, 0040990F, 00409910
alc_cmp_secdns, xrefs: 00409E6F, 00409EAF, 00409EB0
alc_shl_fil, xrefs: 0040982F, 0040986F, 00409870
ais_shl_web, xrefs: 00409AFF, 00409B3F, 00409B40
alc_cmp_webcam, xrefs: 0040A0EF, 0040A12F, 0040A130
ais_shl_exch, xrefs: 004097DF, 0040981F, 00409820
st, xrefs: 00409161
ais_cmp_secdns, xrefs: 00409EBF, 00409EFF, 00409F00
ais_shl_spm, xrefs: 00409A5F, 00409A9F, 00409AA0
alc_cmp_pwdman, xrefs: 004096EF, 0040972F, 00409730
ais_cmp_datasafe, xrefs: 0040A31F, 0040A35F, 0040A360
alc_shl_rsw, xrefs: 00409C8F, 00409CCF, 00409CD0
alc_cmp_rescuedisk, xrefs: 0040928F, 004092CF, 004092D0
alc_cmp_avpap, xrefs: 0040A22F, 0040A26F, 0040A270
ais_cmp_avpap, xrefs: 0040A27F, 0040A2BF, 0040A2C0
alc_shl_shp, xrefs: 0040996F, 004099AF, 004099B0
ais_cmp_fw, xrefs: 0040923F, 0040927F, 00409280
ais_cmp_webcam, xrefs: 0040A13F, 0040A17F, 0040A180
alc_cmp_pap, xrefs: 00409F0F, 00409F4F, 00409F50
ais_shl_bhv, xrefs: 00409B9F, 00409BDF, 00409BE0, 00409C3F, 00409C7F, 00409C80
alc_cmp_rdp, xrefs: 0040A18F, 0040A1CF, 0040A1D0
alc_shl_bhv, xrefs: 00409B4F, 00409B8F, 00409B90
ais_cmp_cleanup, xrefs: 0040A09F, 0040A0DF, 0040A0E0
alc_cmp_webrep, xrefs: 0040964F, 0040968F, 00409690
ais_cmp_datascan_full, xrefs: 00409FFF, 0040A03F, 0040A040
ais_cmp_webrep, xrefs: 0040969F, 004096DF, 004096E0
alc_cmp_secureline, xrefs: 0040932F, 0040936F, 00409370
alc_shl_exch, xrefs: 0040978F, 004097CF, 004097D0
ais_cmp_bpc, xrefs: 0040919F, 004091DF, 004091E0
alc_cmp_cleanup, xrefs: 0040A04F, 0040A08F, 0040A090
alc_cmp_sfzone, xrefs: 004093CF, 0040940F, 00409410
alc_cmp_fw, xrefs: 004091EF, 0040922F, 00409230
ais_shl_rsw, xrefs: 00409CDF, 00409D1F, 00409D20
alc_cmp_hds, xrefs: 00409DCF, 00409E0F, 00409E10
alc_cmp_shredder, xrefs: 0040946F, 004094AF, 004094B0
8, xrefs: 0040A324
alc_shl_spm, xrefs: 00409A0F, 00409A4F, 00409A50
alc_cmp_grimefighter, xrefs: 00409D2F, 00409D6F, 00409D70
ais_cmp_snx, xrefs: 0040955F, 0040959F, 004095A0
ais_cmp_pwdman, xrefs: 0040973F, 0040977F, 00409780
ais_cmp_grimefighter, xrefs: 00409D7F, 00409DBF, 00409DC0
ais_cmp_secureline, xrefs: 0040937F, 004093BF, 004093C0
alc_cmp_datasafe, xrefs: 0040A2CF, 0040A30F, 0040A310
ais_cmp_swhealth, xrefs: 004095FF, 0040963F, 00409640
ais_shl_mai, xrefs: 0040991F, 0040995F, 00409960
ais_cmp_rdp, xrefs: 0040A1DF, 0040A21F, 0040A220
ais_cmp_sfzone, xrefs: 0040941F, 0040945F, 00409460
alc_cmp_datascan, xrefs: 00409FAF, 00409FEF, 00409FF0
ais_cmp_hds, xrefs: 00409E1F, 00409E5F, 00409E60
ais_shl_fil, xrefs: 0040987F, 004098BF, 004098C0
ais_cmp_rescuedisk, xrefs: 004092DF, 0040931F, 00409320
alc_cmp_bpc, xrefs: 00409172, 00409190
alc_cmp_swhealth, xrefs: 004095AF, 004095EF, 004095F0
ais_cmp_shredder, xrefs: 004094BF, 004094FF, 00409500
alc_cmp_snx, xrefs: 0040950F, 0040954F, 00409550
ais_shl_shp, xrefs: 004099BF, 004099FF, 00409A00
alc_shl_idp, xrefs: 00409BEF, 00409C2F, 00409C30

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID:
String ID: 8$ais_cmp_avpap$ais_cmp_bpc$ais_cmp_cleanup$ais_cmp_datasafe$ais_cmp_datascan_full$ais_cmp_fw$ais_cmp_grimefighter$ais_cmp_hds$ais_cmp_pap$ais_cmp_pwdman$ais_cmp_rdp$ais_cmp_rescuedisk$ais_cmp_secdns$ais_cmp_secureline$ais_cmp_sfzone$ais_cmp_shredder$ais_cmp_snx$ais_cmp_swhealth$ais_cmp_webcam$ais_cmp_webrep$ais_shl_bhv$ais_shl_exch$ais_shl_fil$ais_shl_mai$ais_shl_rsw$ais_shl_shp$ais_shl_spm$ais_shl_web$alc_cmp_avpap$alc_cmp_bpc$alc_cmp_cleanup$alc_cmp_datasafe$alc_cmp_datascan$alc_cmp_fw$alc_cmp_grimefighter$alc_cmp_hds$alc_cmp_pap$alc_cmp_pwdman$alc_cmp_rdp$alc_cmp_rescuedisk$alc_cmp_secdns$alc_cmp_secureline$alc_cmp_sfzone$alc_cmp_shredder$alc_cmp_snx$alc_cmp_swhealth$alc_cmp_webcam$alc_cmp_webrep$alc_shl_bhv$alc_shl_exch$alc_shl_fil$alc_shl_idp$alc_shl_mai$alc_shl_rsw$alc_shl_shp$alc_shl_spm$alc_shl_web$st
API String ID: 0-2762059700
Opcode ID: cb6a495abe106cccc71535ba40a5a4e4191c39702a29691add52079377952b66
Instruction ID: e792d097ab61b5b121f4b32cd0d178b6244d535be70a804fde4a8c7277b654d4
Opcode Fuzzy Hash: cb6a495abe106cccc71535ba40a5a4e4191c39702a29691add52079377952b66
Instruction Fuzzy Hash: 26A2E6245103818BD7489F20D8167FA3A22FB96349F59C39DEC062B2D1EFF91D85CB5A

Function 00568410 Relevance: 43.9, APIs: 21, Strings: 4, Instructions: 190
memorysleepregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(00000000,{9C7565A2-47C2-4869-B388-8C7F9AD8E577},00000030,E57473E3,?,?), ref: 0056846B
GetClassInfoExW.USER32(00000000,?,?), ref: 00568472
GetLastError.KERNEL32(?,?), ref: 00568480
Sleep.KERNELBASE(00000001,?,?), ref: 0056848A
GetProcessHeap.KERNEL32(?,?), ref: 005684A2
HeapAlloc.KERNEL32(00000000,00000000,00000034,?,?), ref: 005684B7
asw_process_storage_allocate_connector.ANTISPAM_CONNECT_EU(?,?), ref: 005684C7
InitializeCriticalSection.KERNEL32(00000000), ref: 005684DA
GetProcessHeap.KERNEL32(?,?), ref: 005684E0
GetProcessHeap.KERNEL32(?,?), ref: 005684FE
RegisterClassExW.USER32(00000030), ref: 00568520
HeapFree.KERNEL32(?,00000000,00000000), ref: 00568554
asw_process_storage_deallocate_connector.ANTISPAM_CONNECT_EU ref: 00568564
DeleteCriticalSection.KERNEL32(?), ref: 0056857F
GetProcessHeap.KERNEL32 ref: 00568585
HeapFree.KERNEL32(00000000,00000000,?), ref: 0056859B
asw_process_storage_deallocate_connector.ANTISPAM_CONNECT_EU ref: 005685AB
GetLastError.KERNEL32 ref: 005685B0
Concurrency::scheduler_worker_creation_error::scheduler_worker_creation_error.LIBCMT ref: 005685F9
GetLastError.KERNEL32(Failed to create new process-local storage.,?,006E9084,?,006E90A4,00000000,Failed to get exiting process-local storage.,?,?), ref: 00568627
Concurrency::scheduler_worker_creation_error::scheduler_worker_creation_error.LIBCMT ref: 00568631

Strings

st, xrefs: 00568424
Failed to create new process-local storage., xrefs: 00568622
Failed to get exiting process-local storage., xrefs: 005685F0
{9C7565A2-47C2-4869-B388-8C7F9AD8E577}, xrefs: 00568464, 00568519

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: Heap$Process$ErrorLast$ClassConcurrency::scheduler_worker_creation_error::scheduler_worker_creation_errorCriticalFreeSectionasw_process_storage_deallocate_connector$AllocDeleteHandleInfoInitializeModuleRegisterSleepasw_process_storage_allocate_connector
String ID: Failed to create new process-local storage.$Failed to get exiting process-local storage.${9C7565A2-47C2-4869-B388-8C7F9AD8E577}$st
API String ID: 2785326565-3995961476
Opcode ID: 4105fbe86c6ad6b1011c5638665616f6eb28ef3bed441fbed5acf99496f9cf15
Instruction ID: aa995d550c28b485f80dd37b782890f47889fa47568899caaf51d26d8dc38a67
Opcode Fuzzy Hash: 4105fbe86c6ad6b1011c5638665616f6eb28ef3bed441fbed5acf99496f9cf15
Instruction Fuzzy Hash: 2651A371A00724AFDB10AFA4DC49BAEBBB9FF44715F104619F806A7390DF74AA048BD5

Function 0042B9A0 Relevance: 24.7, APIs: 7, Strings: 7, Instructions: 196
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSection.KERNEL32(000000BC,00408A9B,E57473E3,00000010), ref: 0042BAA1

Part of subcall function 0042EAE0: InitializeProcThreadAttributeList.KERNEL32(00000000,00000001,00000000,00000000), ref: 0042EBE1
Part of subcall function 0042EAE0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,E57473E3,00000000), ref: 0042EBEB
Part of subcall function 0042EAE0: InitializeProcThreadAttributeList.KERNEL32(00000000,00000001,00000000,00000000), ref: 0042EC51

UuidCreate.RPCRT4(?), ref: 0042BACB
GetSystemDirectoryW.KERNEL32(?,00000105), ref: 0042BAE6
LoadLibraryW.KERNELBASE(?,dbghelp.dll,0000000B,0066A5AC,00000001,?,?), ref: 0042BC33
GetProcAddress.KERNELBASE(00000000,MiniDumpWriteDump), ref: 0042BC49
GetLastError.KERNEL32 ref: 0042BC5E
GetLastError.KERNEL32(Could not retrieve system directory), ref: 0042BD04

Strings

MiniDumpWriteDump, xrefs: 0042BC43
st, xrefs: 0042B9B7
6, xrefs: 0042BCC4
MiniDumpWriteDump initialization failed, error code {}, xrefs: 0042BCB1
dbghelp.dll, xrefs: 0042BBAE
A983BBBB, xrefs: 0042BCAB
Could not retrieve system directory, xrefs: 0042BCFF

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: ErrorInitializeLastProc$AttributeListThread$AddressCreateCriticalDirectoryLibraryLoadSectionSystemUuid
String ID: 6$A983BBBB$Could not retrieve system directory$MiniDumpWriteDump$MiniDumpWriteDump initialization failed, error code {}$dbghelp.dll$st
API String ID: 337338955-85388298
Opcode ID: 0d1a51934d033d00659dfbd34b1663adc722bdacc5ea87ba835e7d58b44bf774
Instruction ID: 863158907ebaf6fbabd1a4715a26857db40362cdec6f82f5a7082ffadd0c1c4e
Opcode Fuzzy Hash: 0d1a51934d033d00659dfbd34b1663adc722bdacc5ea87ba835e7d58b44bf774
Instruction Fuzzy Hash: 69A16D70D01769CEDB20DF65C94979AB7F4FF18304F00869EE44AA7251EBB4A688CF50

Function 00429000 Relevance: 21.6, APIs: 8, Strings: 4, Instructions: 556
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

st, xrefs: 00429017, 004291DB, 00429588
asw::settings::SettingsConfig::ProductPluginUnloadFn, xrefs: 004290CE, 00429463
asw::settings::SettingsConfig::ProductPluginLoadFn, xrefs: 0042902A, 004292E5
asw::settings::SettingsConfig::Lock, xrefs: 00429667

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID:
String ID: asw::settings::SettingsConfig::Lock$asw::settings::SettingsConfig::ProductPluginLoadFn$asw::settings::SettingsConfig::ProductPluginUnloadFn$st
API String ID: 0-2274139020
Opcode ID: af8806d87fcb6a1d6c4e217bbb27c143b7806b03270e8c16fa3d9b244f70f4dd
Instruction ID: fd0a6bc00c7482e659e88405852dd2f981c08c25ce7a27c44972bb585c9c15f0
Opcode Fuzzy Hash: af8806d87fcb6a1d6c4e217bbb27c143b7806b03270e8c16fa3d9b244f70f4dd
Instruction Fuzzy Hash: D1229E71E002189FDB14DFA4D885BAEBBB1FF48314F50422EE405AB391EB786E44CB95

Function 00422120 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 296
nativememoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtAllocateVirtualMemory.NTDLL ref: 004222EE
NtProtectVirtualMemory.NTDLL(?,?,?,?,?,?,?,?,?,00418F27,?,?,0000000A), ref: 0042235D

Strings

@, xrefs: 0042233D

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: MemoryVirtual$AllocateProtect
String ID: @
API String ID: 2931642484-2766056989
Opcode ID: 80ae73c6939597b4aee474091f2fea8f8cebf260f275869ccf50d65cf99dbbd8
Instruction ID: c1419e6a16f3fe54f19ea5945325de8d8c45fad19d7f63a6b71290dc8211d24b
Opcode Fuzzy Hash: 80ae73c6939597b4aee474091f2fea8f8cebf260f275869ccf50d65cf99dbbd8
Instruction Fuzzy Hash: BCD17D71E0011A8FCF44CFACDA85ADDBBF1BF98318F149125E058FB259DB38A9548B24

Function 005ADF30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

QueryUnbiasedInterruptTime.KERNEL32(?), ref: 005ADF45
GetSystemTimes.KERNELBASE(?,?,?), ref: 005ADF57

Strings

st, xrefs: 005ADF36

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: InterruptQuerySystemTimeTimesUnbiased
String ID: st
API String ID: 3974609374-1638371401
Opcode ID: fbb11eda4a990e90756ed336cd63089b37641b39d780aa3af76c525b6e4eea44
Instruction ID: 0fc83a49b2c5b5f8261c43b46d86f5b27ff7b75e6f5c3fa46ae934697a659f27
Opcode Fuzzy Hash: fbb11eda4a990e90756ed336cd63089b37641b39d780aa3af76c525b6e4eea44
Instruction Fuzzy Hash: F71172B5E007199F8B14DF99D5848EEBBF9FB48310B10856EE856A3700DA34AA45CFA4

Function 063C12EA Relevance: 1.6, APIs: 1, Instructions: 148libraryloaderCOMMON

Download Yara Rule

APIs

LdrLoadDll.NTDLL(00000000,063C1426,063C1410,00000000,00000000,?,00000000,?,?,?,?,?,?,?,?,063C00E6), ref: 063C1439

Memory Dump Source

Source File: 00000001.00000002.3439574414.00000000063C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 063C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_63c0000_antispam_connect_eu.jbxd

Yara matches

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: ba3c15e28857d153b2f106215acd584e70f06f5c13e91f284be1bd1fd4c15150
Instruction ID: 2ce5bcafb15169ee3498bff3f1f5005f7fec8108125a5f5960efdd11c245ef1a
Opcode Fuzzy Hash: ba3c15e28857d153b2f106215acd584e70f06f5c13e91f284be1bd1fd4c15150
Instruction Fuzzy Hash: 024126359052849EDB91DB70CC956CABFB4FF02238F1881DEE4905B943D630AD4AEBD1

Function 063C133B Relevance: 1.6, APIs: 1, Instructions: 72libraryloaderCOMMON

Download Yara Rule

APIs

LdrLoadDll.NTDLL(00000000,063C1426,063C1410,00000000,00000000,?,00000000,?,?,?,?,?,?,?,?,063C00E6), ref: 063C1439

Memory Dump Source

Source File: 00000001.00000002.3439574414.00000000063C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 063C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_63c0000_antispam_connect_eu.jbxd

Yara matches

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 7aadde8765ce3d692a75598a32ed40513bd593f9fe831b5ea02b6486b4c4f884
Instruction ID: dc6ab4caf7f84253bcb9decfb38eef0650f366b90004d635070b2b54b3a22bb8
Opcode Fuzzy Hash: 7aadde8765ce3d692a75598a32ed40513bd593f9fe831b5ea02b6486b4c4f884
Instruction Fuzzy Hash: AC21927A9042949EDBA0CF54C850BD9BBB4AF06328F1880DEE59597643C2349E86EBD1

Function 063C131E Relevance: 1.6, APIs: 1, Instructions: 72libraryloaderCOMMON

Download Yara Rule

APIs

LdrLoadDll.NTDLL(00000000,063C1426,063C1410,00000000,00000000,?,00000000,?,?,?,?,?,?,?,?,063C00E6), ref: 063C1439

Memory Dump Source

Source File: 00000001.00000002.3439574414.00000000063C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 063C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_63c0000_antispam_connect_eu.jbxd

Yara matches

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 7aadde8765ce3d692a75598a32ed40513bd593f9fe831b5ea02b6486b4c4f884
Instruction ID: dc6ab4caf7f84253bcb9decfb38eef0650f366b90004d635070b2b54b3a22bb8
Opcode Fuzzy Hash: 7aadde8765ce3d692a75598a32ed40513bd593f9fe831b5ea02b6486b4c4f884
Instruction Fuzzy Hash: AC21927A9042949EDBA0CF54C850BD9BBB4AF06328F1880DEE59597643C2349E86EBD1

Function 063C1357 Relevance: 1.6, APIs: 1, Instructions: 72libraryloaderCOMMON

Download Yara Rule

APIs

LdrLoadDll.NTDLL(00000000,063C1426,063C1410,00000000,00000000,?,00000000,?,?,?,?,?,?,?,?,063C00E6), ref: 063C1439

Memory Dump Source

Source File: 00000001.00000002.3439574414.00000000063C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 063C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_63c0000_antispam_connect_eu.jbxd

Yara matches

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 7aadde8765ce3d692a75598a32ed40513bd593f9fe831b5ea02b6486b4c4f884
Instruction ID: dc6ab4caf7f84253bcb9decfb38eef0650f366b90004d635070b2b54b3a22bb8
Opcode Fuzzy Hash: 7aadde8765ce3d692a75598a32ed40513bd593f9fe831b5ea02b6486b4c4f884
Instruction Fuzzy Hash: AC21927A9042949EDBA0CF54C850BD9BBB4AF06328F1880DEE59597643C2349E86EBD1

Function 063C1374 Relevance: 1.6, APIs: 1, Instructions: 71libraryloaderCOMMON

Download Yara Rule

APIs

LdrLoadDll.NTDLL(00000000,063C1426,063C1410,00000000,00000000,?,00000000,?,?,?,?,?,?,?,?,063C00E6), ref: 063C1439

Memory Dump Source

Source File: 00000001.00000002.3439574414.00000000063C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 063C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_63c0000_antispam_connect_eu.jbxd

Yara matches

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: f38a3718dfd96cd8e40805b284780ea5a92806ee018ebddf8a35156af0d52acc
Instruction ID: 1d40096156b74f4e86119baaef23ebe955a57504c4d4b75469a4d8591ea9e44d
Opcode Fuzzy Hash: f38a3718dfd96cd8e40805b284780ea5a92806ee018ebddf8a35156af0d52acc
Instruction Fuzzy Hash: 0921A47A9042949EDBA0CF54C850BC9BBB4FF06328F1880DEE59497643C3349E86EBD1

Function 063C0D6F Relevance: 7.6, APIs: 5, Instructions: 141
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

socket.WS2_32(00000000,00000018,00000002,00000002,00000001,00000006,?,?,?,?), ref: 063C0D9D

Part of subcall function 063C12EA: LdrLoadDll.NTDLL(00000000,063C1426,063C1410,00000000,00000000,?,00000000,?,?,?,?,?,?,?,?,063C00E6), ref: 063C1439

ioctlsocket.WS2_32(00000000,00000012,00000002,?,8004667E,?,?,?), ref: 063C0E6D
connect.WS2_32(00000000,00000019,00000002,?,?,00000010,?,?), ref: 063C0E87
select.WS2_32(00000000,00000014,00000002,00000000,00000000,?,00000000,?,?,00000000,?,?,00000000,?,?), ref: 063C0EB9
ioctlsocket.WS2_32(00000000,00000012,00000002,?,8004667E,?,?,?), ref: 063C0EE2

Memory Dump Source

Source File: 00000001.00000002.3439574414.00000000063C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 063C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_63c0000_antispam_connect_eu.jbxd

Yara matches

Similarity

API ID: ioctlsocket$Loadconnectselectsocket
String ID:
API String ID: 3277669123-0
Opcode ID: bd806e00be554eab51ed27e336a941adad5525728093047653bcd6598cd4f6ea
Instruction ID: 7ff10f280b7ef43f6a916674db208fa0949a30c3feff16fef28fb6fa9605c0c9
Opcode Fuzzy Hash: bd806e00be554eab51ed27e336a941adad5525728093047653bcd6598cd4f6ea
Instruction Fuzzy Hash: 8C413471980248BAEB94FBF08C56FEE766CAF09724F004418B720F94C1DBB29E4497B5

Function 063C03DF Relevance: 6.2, APIs: 4, Instructions: 212
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,0000000A,00000001,00000000,00010000,00003000,00000004,?,?), ref: 063C0418

Part of subcall function 063C12EA: LdrLoadDll.NTDLL(00000000,063C1426,063C1410,00000000,00000000,?,00000000,?,?,?,?,?,?,?,?,063C00E6), ref: 063C1439

Part of subcall function 063C0D6F: socket.WS2_32(00000000,00000018,00000002,00000002,00000001,00000006,?,?,?,?), ref: 063C0D9D
Part of subcall function 063C0D6F: ioctlsocket.WS2_32(00000000,00000012,00000002,?,8004667E,?,?,?), ref: 063C0E6D
Part of subcall function 063C0D6F: connect.WS2_32(00000000,00000019,00000002,?,?,00000010,?,?), ref: 063C0E87

VirtualFree.KERNELBASE(00000000,0000000B,00000001,?,00000000,00008000), ref: 063C08C1

Part of subcall function 063C04B8: GetVolumeInformationA.KERNELBASE(00000000,00000005,00000001,00000000,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 063C04F0
Part of subcall function 063C04B8: select.WS2_32(00000000,00000014,00000002,00000000,?,00000000,00000000,?,?,00000000,?,0000003C,00000000), ref: 063C0553

Memory Dump Source

Source File: 00000001.00000002.3439574414.00000000063C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 063C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_63c0000_antispam_connect_eu.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFreeInformationLoadVolumeconnectioctlsocketselectsocket
String ID:
API String ID: 3169995657-0
Opcode ID: a20017e9b60a8203ebfdf4b4a7223252938f8bd95e628b86b5e293f85b498cad
Instruction ID: bc9ef01c442fb90bbd5d99a742647d2fce38e6eb7a2e17c5bb32031f3a9432a6
Opcode Fuzzy Hash: a20017e9b60a8203ebfdf4b4a7223252938f8bd95e628b86b5e293f85b498cad
Instruction Fuzzy Hash: D1518371A80354BAFBF9A7A08C06F9D766DAF55710F100058B324BA0C1C7B36E84CBE5

Function 00428580 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 131
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

st, xrefs: 00428666, 00428673, 00428676
string too long, xrefs: 00428580

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: std::invalid_argument::invalid_argument
String ID: string too long$st
API String ID: 2141394445-1401666423
Opcode ID: faeb9f235c9a5ea6756d1d1736c81f9be5eea39d864d8ea3e39dde078d4b773a
Instruction ID: 8203464df0e3af06a7f7160e5f42eaa16e3dd5cb36c6c30243e6f7994f6741d6
Opcode Fuzzy Hash: faeb9f235c9a5ea6756d1d1736c81f9be5eea39d864d8ea3e39dde078d4b773a
Instruction Fuzzy Hash: C6312B76A01219AFC714AFA4A84595FB7E8AF90350B50023FF819C7651DB34EA0486DA

Function 0040A430 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSection.KERNEL32(007585B0), ref: 0040A478
QueryUnbiasedInterruptTime.KERNEL32(?), ref: 0040A483

Part of subcall function 005ADF30: QueryUnbiasedInterruptTime.KERNEL32(?), ref: 005ADF45
Part of subcall function 005ADF30: GetSystemTimes.KERNELBASE(?,?,?), ref: 005ADF57

Strings

st, xrefs: 0040A439

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: InterruptQueryTimeUnbiased$CriticalInitializeSectionSystemTimes
String ID: st
API String ID: 2575030287-1638371401
Opcode ID: 3de9a8738ea1454848263122c9f4886927ac4e858e3aa8427baf3e8b941f597a
Instruction ID: bb38a6319885fd8498d3768352712f66d760620e02d7591f85e88ef851ea5252
Opcode Fuzzy Hash: 3de9a8738ea1454848263122c9f4886927ac4e858e3aa8427baf3e8b941f597a
Instruction Fuzzy Hash: 101181B18083459FC380DF24DC459AA77A4FB98305F00D61EF89596262FFB4A6A0CB87

Function 063C04B8 Relevance: 4.8, APIs: 3, Instructions: 313
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVolumeInformationA.KERNELBASE(00000000,00000005,00000001,00000000,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 063C04F0
select.WS2_32(00000000,00000014,00000002,00000000,?,00000000,00000000,?,?,00000000,?,0000003C,00000000), ref: 063C0553

Part of subcall function 063C0A4D: select.WS2_32(00000000,00000014,00000002,00000000,00000000,?,00000000,00000000,?,00000000,?,00000000,00000000,?,0000000A,?), ref: 063C0AAB
Part of subcall function 063C0A4D: send.WS2_32(00000000,00000015,00000002,?,?,?,00000000), ref: 063C0ACA

VirtualFree.KERNELBASE(00000000,0000000B,00000001,?,00000000,00008000), ref: 063C08C1

Part of subcall function 063C12EA: LdrLoadDll.NTDLL(00000000,063C1426,063C1410,00000000,00000000,?,00000000,?,?,?,?,?,?,?,?,063C00E6), ref: 063C1439

Memory Dump Source

Source File: 00000001.00000002.3439574414.00000000063C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 063C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_63c0000_antispam_connect_eu.jbxd

Yara matches

Similarity

API ID: select$FreeInformationLoadVirtualVolumesend
String ID:
API String ID: 2281012971-0
Opcode ID: 3e6367bd33966a99d48c6efb01a35a9541379400d7e176cbac617c4a9a300afc
Instruction ID: 50cd2d92aea5aae06fc49a5f481a9c3b9f5f1c210922130d6f178e2b5d926123
Opcode Fuzzy Hash: 3e6367bd33966a99d48c6efb01a35a9541379400d7e176cbac617c4a9a300afc
Instruction Fuzzy Hash: A5B1A570980759FAFBF9ABA08C05FA97669AF04724F00415DF328A94C1C7B76E94CBD1

Function 00408A10 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 78
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0042B9A0: InitializeCriticalSection.KERNEL32(000000BC,00408A9B,E57473E3,00000010), ref: 0042BAA1
Part of subcall function 0042B9A0: UuidCreate.RPCRT4(?), ref: 0042BACB
Part of subcall function 0042B9A0: GetSystemDirectoryW.KERNEL32(?,00000105), ref: 0042BAE6

GetModuleHandleW.KERNEL32(00000000,?,?,?,?,?,?,00000001), ref: 00408AD3

Part of subcall function 005583D0: EnterCriticalSection.KERNEL32(00000000), ref: 0055844E
Part of subcall function 005583D0: LeaveCriticalSection.KERNEL32(00000000,?,?,00000000), ref: 00558482

Strings

st, xrefs: 00408A26

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: CriticalSection$CreateDirectoryEnterHandleInitializeLeaveModuleSystemUuid
String ID: st
API String ID: 2481231655-1638371401
Opcode ID: 7c3132951d763264310e70b3726b92a84205cc7e43a14a22957bed5af43e1282
Instruction ID: b4485987310aee511008f0126f37ca08cdc027c62bf0ce2ad09339b6c5c06b52
Opcode Fuzzy Hash: 7c3132951d763264310e70b3726b92a84205cc7e43a14a22957bed5af43e1282
Instruction Fuzzy Hash: 4431ABB09007469FC700DFA5C809B9ABBF4FF45744F11866AE415AB291EBB46A84CBD2

Function 005E5061 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 57
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

st, xrefs: 005E5075, 005E50C6

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID:
String ID: st
API String ID: 0-1638371401
Opcode ID: f5a3181b77bbb4ba950a6a080c73e5a1b0060a2dbd6813379119148af974aacc
Instruction ID: eac37ca0a08ecd9d3b22a04d3fc9d48e9c9fb5b977b78f2c8a2ac7d7f4e502ad
Opcode Fuzzy Hash: f5a3181b77bbb4ba950a6a080c73e5a1b0060a2dbd6813379119148af974aacc
Instruction Fuzzy Hash: 840124337007A15FAF2A8E6EEC4999A3BD7BBC13783248125F911CB295FA31D80187D0

Function 063C0A4D Relevance: 3.1, APIs: 2, Instructions: 73
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 063C12EA: LdrLoadDll.NTDLL(00000000,063C1426,063C1410,00000000,00000000,?,00000000,?,?,?,?,?,?,?,?,063C00E6), ref: 063C1439

select.WS2_32(00000000,00000014,00000002,00000000,00000000,?,00000000,00000000,?,00000000,?,00000000,00000000,?,0000000A,?), ref: 063C0AAB
send.WS2_32(00000000,00000015,00000002,?,?,?,00000000), ref: 063C0ACA

Memory Dump Source

Source File: 00000001.00000002.3439574414.00000000063C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 063C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_63c0000_antispam_connect_eu.jbxd

Yara matches

Similarity

API ID: Loadselectsend
String ID:
API String ID: 2446010177-0
Opcode ID: 4c1dc876cd63c94d8c3776eaee565fe6de0f1505ed4fafd268c232952debd376
Instruction ID: 838113326dfc8ac4ed8bf29b56f99c0c0e88c4a22d12c8c53c1021b78fb409d5
Opcode Fuzzy Hash: 4c1dc876cd63c94d8c3776eaee565fe6de0f1505ed4fafd268c232952debd376
Instruction Fuzzy Hash: 90119035A80249FAEBA4EFE48C06FDE365CAF55761F000009B721A50C0CBB29990D7E5

Function 063C0D38 Relevance: 3.0, APIs: 2, Instructions: 25
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

shutdown.WS2_32(00000000,00000017,00000002,?,00000002,?,0000000A,?,?,063C038F,?,00000000,00000032,00000005,0000000A,00000000), ref: 063C0D52

Part of subcall function 063C12EA: LdrLoadDll.NTDLL(00000000,063C1426,063C1410,00000000,00000000,?,00000000,?,?,?,?,?,?,?,?,063C00E6), ref: 063C1439

closesocket.WS2_32(00000000,0000000E,00000002,?,?,063C038F,?,00000000,00000032,00000005,0000000A,00000000,00000032,?,00000003,?), ref: 063C0D66

Memory Dump Source

Source File: 00000001.00000002.3439574414.00000000063C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 063C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_63c0000_antispam_connect_eu.jbxd

Yara matches

Similarity

API ID: Loadclosesocketshutdown
String ID:
API String ID: 2364791254-0
Opcode ID: 5f7509d1c9114d6ff283d0fc29e97b12582e38514c6b841e40ecaa251ab71a95
Instruction ID: d4e12d01d35d052b515e848fa2461d1652284a94278bf9bcf4ec8f528d3f7982
Opcode Fuzzy Hash: 5f7509d1c9114d6ff283d0fc29e97b12582e38514c6b841e40ecaa251ab71a95
Instruction Fuzzy Hash: 09D0C22628024876E5A032F18C0BF9E790CCF9ABA1F0000187324A80C289A18C4092F1

Function 063C0602 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

select.WS2_32(00000000,00000014,00000002,00000000,?,00000000,00000000,?,?,00000000,?,0000003C,00000000), ref: 063C0553
VirtualFree.KERNELBASE(00000000,0000000B,00000001,?,00000000,00008000), ref: 063C08C1

Memory Dump Source

Source File: 00000001.00000002.3439574414.00000000063C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 063C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_63c0000_antispam_connect_eu.jbxd

Yara matches

Similarity

API ID: FreeVirtualselect
String ID:
API String ID: 1203213503-0
Opcode ID: 8fc4d7e0d68d11cc526d3315568d192897104ef88059c2d97eb2e2350b20c1cf
Instruction ID: 3c2ec57fa4f03b3f8e2ae4127035aca985e08fef4e76d16f549d4f71561051db
Opcode Fuzzy Hash: 8fc4d7e0d68d11cc526d3315568d192897104ef88059c2d97eb2e2350b20c1cf
Instruction Fuzzy Hash: 5F11EC70A8425CEEFBA9AA90CC09FAD727DAB44714F104099F218B50D0C7B75E98CFE5

Function 005E4C31 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,?,?,005C6D8D,?,?,0056925A,00000008,E57473E3), ref: 005E4C63

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 6a619c0205dd77c658ab54fbb9b4ab5f120690fed7ea9750b0e4886d0eb18ffa
Instruction ID: 763022edace4b657895669b310c53e465be9d776c556130ce168dc80966a2d94
Opcode Fuzzy Hash: 6a619c0205dd77c658ab54fbb9b4ab5f120690fed7ea9750b0e4886d0eb18ffa
Instruction Fuzzy Hash: B1E0E5312022E257D7286F679D09B5F3E48BBC9BA0F200161ECDD97580DB64CD0089E5

Function 063C141A Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3439574414.00000000063C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 063C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_63c0000_antispam_connect_eu.jbxd

Yara matches

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 6fe689979e29c5d7131882fcf3b0095295b6035271021751cd01ccdb9ade4a89
Instruction ID: bb2684311bb2a3a60d56b8729a3b9c09c42b8dfa777d05192c4d73eb74ea42cc
Opcode Fuzzy Hash: 6fe689979e29c5d7131882fcf3b0095295b6035271021751cd01ccdb9ade4a89
Instruction Fuzzy Hash: 24D0C29764519009C2D9B3FC7C6288EA734ABA317D70484ABE252C1043C514CD4AE3F2

Function 063C1431 Relevance: 1.5, APIs: 1, Instructions: 12libraryloaderCOMMON

Download Yara Rule

APIs

LdrLoadDll.NTDLL(00000000,063C1426,063C1410,00000000,00000000,?,00000000,?,?,?,?,?,?,?,?,063C00E6), ref: 063C1439

Memory Dump Source

Source File: 00000001.00000002.3439574414.00000000063C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 063C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_63c0000_antispam_connect_eu.jbxd

Yara matches

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 44ab5ad2689ad69ea57542416323bf0d9d3d66e9a1289b1fdbf5d43c69b9126c
Instruction ID: a5c5f7ee30db7c63d6e1cfd1877b0b989b5b62fbdb3e2c83cb87d731badd2a92
Opcode Fuzzy Hash: 44ab5ad2689ad69ea57542416323bf0d9d3d66e9a1289b1fdbf5d43c69b9126c
Instruction Fuzzy Hash: 45B04C6374005059D694A3A86C409AE636887E1265B10846AE215D154086659D8156A1

Function 063C0CDB Relevance: 1.3, APIs: 1, Instructions: 13sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 063C03DF: VirtualAlloc.KERNELBASE(00000000,0000000A,00000001,00000000,00010000,00003000,00000004,?,?), ref: 063C0418

Sleep.KERNELBASE(00000000,00000009,00000001,0002BF20), ref: 063C0D07

Memory Dump Source

Source File: 00000001.00000002.3439574414.00000000063C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 063C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_63c0000_antispam_connect_eu.jbxd

Yara matches

Similarity

API ID: AllocSleepVirtual
String ID:
API String ID: 503295252-0
Opcode ID: b124b803baf54d1abeeca1e759648cec95436005c8e62cbde0bd3a950018d04b
Instruction ID: b84db5a78b196059321395df7473a78468f709bf9f32f5e532212ac450b382a5
Opcode Fuzzy Hash: b124b803baf54d1abeeca1e759648cec95436005c8e62cbde0bd3a950018d04b
Instruction Fuzzy Hash: 11D0C931980264AEEBE477B04C22FDC7625AF09710F100498732DB4895CBB20D805BA0

Non-executed Functions

Function 0056EB60 Relevance: 228.1, APIs: 83, Strings: 47, Instructions: 645libraryloaderregistryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00000000,00000000,?), ref: 0056EB99
GetModuleHandleW.KERNEL32(KERNEL32.DLL,00000000,?), ref: 0056EBB9
GetCurrentProcess.KERNEL32 ref: 0056EBC9
GetProcAddress.KERNEL32(00000000,IsWow64Process2), ref: 0056EBD7
GetProcAddress.KERNEL32(00000000,Wow64EnableWow64FsRedirection), ref: 0056EC5E
GetProcAddress.KERNEL32(00000000,GetLogicalProcessorInformationEx), ref: 0056EC6F
GetProcAddress.KERNEL32(00000000,GetLogicalProcessorInformation), ref: 0056EC84
GetProcAddress.KERNEL32(00000000,GetTickCount64), ref: 0056EC95
GetProcAddress.KERNEL32(00000000,PrefetchVirtualMemory), ref: 0056ECAA
GetProcAddress.KERNEL32(00000000,GetCurrentThreadStackLimits), ref: 0056ECBB
GetModuleHandleW.KERNEL32(NTDLL.DLL), ref: 0056ECC6
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 0056ECDF
GetProcAddress.KERNEL32(RtlInitUnicodeString), ref: 0056ECF5
GetProcAddress.KERNEL32(NtOpenFile), ref: 0056ED0B
GetProcAddress.KERNEL32(NtCreateFile), ref: 0056ED1C

Part of subcall function 0056E990: GetProcessHeap.KERNEL32(00000000,00000018,00000000,?,?,0040BBA0), ref: 0056E9B1
Part of subcall function 0056E990: HeapAlloc.KERNEL32(00000000,?,0040BBA0), ref: 0056E9B8
Part of subcall function 0056E990: InitializeCriticalSectionEx.KERNEL32(00000000,00000000,02000000,?,0040BBA0), ref: 0056E9D0

GetProcAddress.KERNEL32(NtReadFile), ref: 0056ED32
GetProcAddress.KERNEL32(NtWriteFile), ref: 0056ED48
GetProcAddress.KERNEL32(NtQueryInformationFile), ref: 0056ED59
GetProcAddress.KERNEL32(NtSetInformationFile), ref: 0056ED6F
GetProcAddress.KERNEL32(NtQueryVirtualMemory), ref: 0056ED85
GetProcAddress.KERNEL32(NtQueryObject), ref: 0056ED96
GetProcAddress.KERNEL32(NtQueryVolumeInformationFile), ref: 0056EDAC
GetProcAddress.KERNEL32(NtQueryInformationProcess), ref: 0056EDBD
GetProcAddress.KERNEL32(NtQueryInformationThread), ref: 0056EDD3
GetProcAddress.KERNEL32(NtSetInformationThread), ref: 0056EDE4
GetProcAddress.KERNEL32(NtQuerySystemInformation), ref: 0056EDF5
GetProcAddress.KERNEL32(NtQueryDirectoryFile), ref: 0056EE06
GetProcAddress.KERNEL32(NtQueryEaFile), ref: 0056EE17
GetProcAddress.KERNEL32(NtClose), ref: 0056EE28
GetProcAddress.KERNEL32(NtFsControlFile), ref: 0056EE3E
GetProcAddress.KERNEL32(NtDeviceIoControlFile), ref: 0056EE54
GetProcAddress.KERNEL32(NtWaitForSingleObject), ref: 0056EE6A
GetProcAddress.KERNEL32(NtDeleteKey), ref: 0056EE80
GetProcAddress.KERNEL32(00000000,RtlSetThreadErrorMode), ref: 0056EF28
GetLastError.KERNEL32 ref: 0056EF37
SetLastError.KERNEL32(0000007E), ref: 0056EF55
GetLastError.KERNEL32 ref: 0056EFE0
SetLastError.KERNEL32(0000007E), ref: 0056EFFA
GetLastError.KERNEL32 ref: 0056F017
SetLastError.KERNEL32(0000007E), ref: 0056F028
GetLastError.KERNEL32 ref: 0056F04E
SetLastError.KERNEL32(0000007E), ref: 0056F05F
GetLastError.KERNEL32 ref: 0056F085
SetLastError.KERNEL32(0000007E), ref: 0056F096
GetLastError.KERNEL32 ref: 0056F0B3
SetLastError.KERNEL32(0000007E), ref: 0056F0C4
GetLastError.KERNEL32 ref: 0056F0E1
SetLastError.KERNEL32(0000007E), ref: 0056F0F2
GetLastError.KERNEL32 ref: 0056F10F
SetLastError.KERNEL32(0000007E), ref: 0056F120
GetLastError.KERNEL32 ref: 0056F13D
SetLastError.KERNEL32(0000007E), ref: 0056F14E
GetLastError.KERNEL32 ref: 0056F16B
RegQueryValueExW.ADVAPI32(?,00688464,00000000,00000000,00000000,?), ref: 0056F294
RegCloseKey.ADVAPI32(?), ref: 0056F2BE
GlobalMemoryStatusEx.KERNEL32(00000040), ref: 0056F2DF
GetLastError.KERNEL32 ref: 0056F2E9
InitializeSecurityDescriptor.ADVAPI32(00757454,00000001), ref: 0056F2F6
SetSecurityDescriptorDacl.ADVAPI32(00757454,00000001,00000000,00000000), ref: 0056F30B
InitializeSecurityDescriptor.ADVAPI32(00757C74,00000001), ref: 0056F33E
LeaveCriticalSection.KERNEL32(00000000,00000000,?), ref: 0056F4FC

Strings

@, xrefs: 0056F2D4
NtQueryInformationFile, xrefs: 0056ED4E
IsWow64Process, xrefs: 0056EF89
NtWriteFile, xrefs: 0056ED38
NtQuerySystemInformation, xrefs: 0056EDEA
NtQueryInformationThread, xrefs: 0056EDC3
NtDeleteKey, xrefs: 0056EE70
NtWow64GetNativeSystemInformation, xrefs: 0056F0FA
NtDeviceIoControlFile, xrefs: 0056EE44
LdrLockLoaderLock, xrefs: 0056F030, 0056F039
NtQueryVolumeInformationFile, xrefs: 0056ED9C
RtlPcToFileHeader, xrefs: 0056F002
NtQueryObject, xrefs: 0056ED8B
NtCreateFile, xrefs: 0056ED11
NtReadFile, xrefs: 0056ED22
LdrUnlockLoaderLock, xrefs: 0056F067, 0056F070
st, xrefs: 0056EB66
NtFsControlFile, xrefs: 0056EE2E
RtlNtStatusToDosError, xrefs: 0056ECD9
Wow64EnableWow64FsRedirection, xrefs: 0056EC58
NtWow64QueryVirtualMemory64, xrefs: 0056F128
NtQueryDirectoryFileEx, xrefs: 0056F09E
NtSetInformationThread, xrefs: 0056EDD9
asw, xrefs: 0056F1FA, 0056F210
NtQueryDirectoryFile, xrefs: 0056EDFB
IsWow64Process2, xrefs: 0056EBCF
NtWaitForSingleObject, xrefs: 0056EE5A
KERNEL32.DLL, xrefs: 0056EBB4
GetTickCount64, xrefs: 0056EC8F
NtWow64ReadVirtualMemory64, xrefs: 0056F156
GetLogicalProcessorInformation, xrefs: 0056EC7E
Hardware\Description\System\CentralProcessor\0, xrefs: 0056F24C
NTDLL.DLL, xrefs: 0056ECC1
NtQueryInformationProcess, xrefs: 0056EDB2
RtlGetVersion, xrefs: 0056EFCB
RtlSetThreadErrorMode, xrefs: 0056EF22
NtSetInformationFile, xrefs: 0056ED5F
aswSP, xrefs: 0056F208
NtQueryVirtualMemory, xrefs: 0056ED75
NtClose, xrefs: 0056EE1D
NtQueryEaFile, xrefs: 0056EE0C
NtOpenFile, xrefs: 0056ECFB
NtWow64QueryInformationProcess64, xrefs: 0056F0CC
GetLogicalProcessorInformationEx, xrefs: 0056EC69
RtlInitUnicodeString, xrefs: 0056ECE5
PrefetchVirtualMemory, xrefs: 0056ECA4
GetCurrentThreadStackLimits, xrefs: 0056ECB0

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: AddressProc$ErrorLast$CriticalDescriptorInitializeSectionSecurity$HandleHeapModuleProcess$AllocCloseCurrentDaclEnterGlobalLeaveMemoryQueryStatusValue
String ID: @$GetCurrentThreadStackLimits$GetLogicalProcessorInformation$GetLogicalProcessorInformationEx$GetTickCount64$Hardware\Description\System\CentralProcessor\0$IsWow64Process$IsWow64Process2$KERNEL32.DLL$LdrLockLoaderLock$LdrUnlockLoaderLock$NTDLL.DLL$NtClose$NtCreateFile$NtDeleteKey$NtDeviceIoControlFile$NtFsControlFile$NtOpenFile$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQueryEaFile$NtQueryInformationFile$NtQueryInformationProcess$NtQueryInformationThread$NtQueryObject$NtQuerySystemInformation$NtQueryVirtualMemory$NtQueryVolumeInformationFile$NtReadFile$NtSetInformationFile$NtSetInformationThread$NtWaitForSingleObject$NtWow64GetNativeSystemInformation$NtWow64QueryInformationProcess64$NtWow64QueryVirtualMemory64$NtWow64ReadVirtualMemory64$NtWriteFile$PrefetchVirtualMemory$RtlGetVersion$RtlInitUnicodeString$RtlNtStatusToDosError$RtlPcToFileHeader$RtlSetThreadErrorMode$Wow64EnableWow64FsRedirection$asw$aswSP$st
API String ID: 805521459-1893984222
Opcode ID: 49a06b0ae55f3dd3d3f324cfabef689a9b0fd31c1c5c630e812126101d343267
Instruction ID: ca767e0858141c21f015b5f1ba59af766c45c27fe2d4a4be532b080608e57d53
Opcode Fuzzy Hash: 49a06b0ae55f3dd3d3f324cfabef689a9b0fd31c1c5c630e812126101d343267
Instruction Fuzzy Hash: 5E326275E41351AFEB50AF60EC0EB5A7EB6BB14706F00D165F901A73A0DFB88940CBA5

Function 0040B3A0 Relevance: 113.4, APIs: 27, Strings: 37, Instructions: 1419comlibraryloaderCOMMON

Download Yara Rule

APIs

SetDllDirectoryW.KERNEL32 ref: 0040B3C9
GetModuleHandleW.KERNEL32(kernel32.dll,SetDefaultDllDirectories), ref: 0040B3D9
GetProcAddress.KERNEL32(00000000), ref: 0040B3E0
GetCommandLineW.KERNEL32(?,?,?,?,?,?,?,00663F60), ref: 0040B632

Part of subcall function 0040AF40: ___std_exception_destroy.LIBVCRUNTIME ref: 0040AFC6

OleInitialize.OLE32(00000000), ref: 0040B917
OleUninitialize.OLE32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00664510), ref: 0040C860
___std_exception_destroy.LIBVCRUNTIME ref: 0040C920

Part of subcall function 0056E990: GetProcessHeap.KERNEL32(00000000,00000018,00000000,?,?,0040BBA0), ref: 0056E9B1
Part of subcall function 0056E990: HeapAlloc.KERNEL32(00000000,?,0040BBA0), ref: 0056E9B8
Part of subcall function 0056E990: InitializeCriticalSectionEx.KERNEL32(00000000,00000000,02000000,?,0040BBA0), ref: 0056E9D0

Strings

The parent process is not trusted!, xrefs: 0040BF7B
The library '{}' signature is invalid!, xrefs: 0040C264
debug, xrefs: 0040B72B
Unable to initialize the COM library with error 0x{:08X}., xrefs: 0040B9A1
Unable to free the dynamic linking library with error 0x{:08X}!, xrefs: 0040C6F4
Unable to initialize aswCmnIS library with error 0x{:08X} in cmnisInit!, xrefs: 0040BCC3
kernel32.dll, xrefs: 0040B3D4
The library '{}' cannot be opened for reading with error {:08x}!, xrefs: 0040C0BE
SetDefaultDllDirectories, xrefs: 0040B3CF
D954, xrefs: 0040BAF9
Unable to initialize aswCmnIS library with error 0x{:08X} in aswcmnosDllMain!, xrefs: 0040BBEC
C26E, xrefs: 0040C207
Unable to get the full path of the dynamic linking library., xrefs: 0040BAE4
st, xrefs: 0040B3AC
Logs, xrefs: 0040B45F
Unable to retrieve the identifier of the parent process with error 0x{:08X}!, xrefs: 0040BE53
log, xrefs: 0040B52A
C26E, xrefs: 0040B847
Unable to retrieve the pointer to DllUnregisterServer with error 0x{:08X}!, xrefs: 0040C619
`?f, xrefs: 0040B55C, 0040B5D6
D954, xrefs: 0040C1E8
DllRegisterServer, xrefs: 0040C522
y, xrefs: 0040BF8A
Unable to load dynamic linking library with error 0x{:08X}, xrefs: 0040C3B9
Unable to detach from aswCmnOS with error 0x{:08X}!, xrefs: 0040C83C
D954, xrefs: 0040B82E
Unable to determine legacy product enumeration from product identifier!, xrefs: 0040C945
Unable to free the library file handle with error 0x{:08X}!, xrefs: 0040C768
D954, xrefs: 0040C600
V, xrefs: 0040BB1F
A call to cmnosFree failed with error 0x{:08X}!, xrefs: 0040C7D1
D954, xrefs: 0040BE46
Running RegSvr.exe with following command line arguments: {}, xrefs: 0040B891
C26E, xrefs: 0040BB11
Unable to retrieve the pointer to DllRegisterServer with error 0x{:08X}!, xrefs: 0040C58C
D954, xrefs: 0040C6E7
DllUnregisterServer, xrefs: 0040C5B3

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: HeapInitialize___std_exception_destroy$AddressAllocCommandCriticalDirectoryHandleLineModuleProcProcessSectionUninitialize
String ID: A call to cmnosFree failed with error 0x{:08X}!$C26E$C26E$C26E$D954$D954$D954$D954$D954$D954$DllRegisterServer$DllUnregisterServer$Logs$Running RegSvr.exe with following command line arguments: {}$SetDefaultDllDirectories$The library '{}' cannot be opened for reading with error {:08x}!$The library '{}' signature is invalid!$The parent process is not trusted!$Unable to detach from aswCmnOS with error 0x{:08X}!$Unable to determine legacy product enumeration from product identifier!$Unable to free the dynamic linking library with error 0x{:08X}!$Unable to free the library file handle with error 0x{:08X}!$Unable to get the full path of the dynamic linking library.$Unable to initialize aswCmnIS library with error 0x{:08X} in aswcmnosDllMain!$Unable to initialize aswCmnIS library with error 0x{:08X} in cmnisInit!$Unable to initialize the COM library with error 0x{:08X}.$Unable to load dynamic linking library with error 0x{:08X}$Unable to retrieve the identifier of the parent process with error 0x{:08X}!$Unable to retrieve the pointer to DllRegisterServer with error 0x{:08X}!$Unable to retrieve the pointer to DllUnregisterServer with error 0x{:08X}!$V$`?f$debug$kernel32.dll$log$y$st
API String ID: 2625536916-3453257774
Opcode ID: d8268c44dd1be47dc9484679d4fdd9360842f75853ef5c3f71e86409352f8c0b
Instruction ID: 6d1f383fcba325b59b22a52d004c5cc3412a5b265ca0856c547ea0b1623fb63d
Opcode Fuzzy Hash: d8268c44dd1be47dc9484679d4fdd9360842f75853ef5c3f71e86409352f8c0b
Instruction Fuzzy Hash: 5ED249746083519FC724DF24C884A5ABBE5BF88714F048A2EF989A7390DB74ED45CF86

Function 004426F0 Relevance: 67.4, APIs: 31, Strings: 7, Instructions: 938threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000028,00000028,E57473E3,?,?), ref: 004427B5
K32GetProcessMemoryInfo.KERNEL32(00000000,?,?), ref: 004427BC
GetTickCount.KERNEL32 ref: 00442934
GetTickCount.KERNEL32 ref: 00442940
GetTickCount.KERNEL32 ref: 00442964
GetCurrentProcess.KERNEL32(?,E57473E3,?,?), ref: 00442BCD
GetProcessHandleCount.KERNEL32(00000000,?,?), ref: 00442BD4
GetCurrentProcess.KERNEL32(?), ref: 00442D2F
GetPriorityClass.KERNEL32(00000000), ref: 00442D36
EnterCriticalSection.KERNEL32(-0000001D), ref: 00442D69
OpenThread.KERNEL32(00000040,00000000,00000004), ref: 00442E42
EnterCriticalSection.KERNEL32(-0000001D), ref: 00442E62
LeaveCriticalSection.KERNEL32(-0000001D,?), ref: 00442E7A
GetThreadPriority.KERNEL32(00000000), ref: 00442E95
GetThreadTimes.KERNEL32(00000000,?,?,?,?), ref: 00442EC5
OpenThread.KERNEL32(00000040,00000000,00000004), ref: 00442F84
EnterCriticalSection.KERNEL32(-0000001D), ref: 00442FA4
LeaveCriticalSection.KERNEL32(-0000001D,?,?), ref: 00443000
GetThreadTimes.KERNEL32(00000000,?,?,?,?), ref: 00443022
EnterCriticalSection.KERNEL32(-0000001D), ref: 004431E6
LeaveCriticalSection.KERNEL32(-0000001D,?,?), ref: 00443289
CloseHandle.KERNEL32(00000000), ref: 00443294
CallNtPowerInformation.POWRPROF(0000000F,00000000,00000000,?,00000008), ref: 004432C4
CallNtPowerInformation.POWRPROF(0000000E,00000000,00000000,?,00000008), ref: 0044334D
GetTickCount.KERNEL32 ref: 004433C1
LeaveCriticalSection.KERNEL32(-0000001D), ref: 00442DFD

Part of subcall function 004438A0: RaiseException.KERNEL32(?,?,-0000001D,00000000,E57473E3,00000000,-0000001D,?,?,00443452), ref: 004438EB

Part of subcall function 00431A00: VerSetConditionMask.NTDLL ref: 00431A6D
Part of subcall function 00431A00: VerSetConditionMask.NTDLL ref: 00431A75
Part of subcall function 00431A00: VerSetConditionMask.NTDLL ref: 00431A7D
Part of subcall function 00431A00: VerifyVersionInfoW.KERNEL32(00000000,00000023,00000000), ref: 00431AA4

LeaveCriticalSection.KERNEL32(-0000001D,?,?), ref: 00443493
CloseHandle.KERNEL32(00000000), ref: 0044349E

Strings

Thread count is {}, expected maximum is {}, but count of thread pool idle workers is {}, not dumping!, xrefs: 00442B11
Thread count is {}, expected maximum is {} !, xrefs: 00442B80
st, xrefs: 0044271B
7AB9, xrefs: 00442C91
Handle count is {}, expected maximum is {} !, xrefs: 00442CBD
C884, xrefs: 00442CA5
uwm, xrefs: 00443423

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: CriticalSection$CountLeaveProcessThread$EnterTick$ConditionCurrentHandleMask$CallCloseInfoInformationOpenPowerPriorityTimes$ClassExceptionMemoryRaiseVerifyVersion
String ID: 7AB9$C884$Handle count is {}, expected maximum is {} !$Thread count is {}, expected maximum is {} !$Thread count is {}, expected maximum is {}, but count of thread pool idle workers is {}, not dumping!$uwm$st
API String ID: 3526041402-3420685128
Opcode ID: eeaed2cdad89c0f9f87759755c5e90b17acdd2895c0f53a375874cfa00cf995d
Instruction ID: 56c4d25e3237444ea2fe4b640163c6544ffe75e89ca393359b63931a3c82c8d2
Opcode Fuzzy Hash: eeaed2cdad89c0f9f87759755c5e90b17acdd2895c0f53a375874cfa00cf995d
Instruction Fuzzy Hash: C8924870E002598FEB24DF68C944BAEBBF1BF49304F14859AE409AB391D774AE85CF54

Function 0042BE30 Relevance: 49.9, APIs: 12, Strings: 16, Instructions: 862COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,E57473E3), ref: 0042BFF8
GetModuleHandleW.KERNEL32(00000000,?,00000104,?), ref: 0042C060
GetModuleFileNameW.KERNEL32(00000000), ref: 0042C067
PathFindFileNameW.SHLWAPI(?), ref: 0042C114
PathRemoveFileSpecW.SHLWAPI(?), ref: 0042C151
___std_exception_destroy.LIBVCRUNTIME ref: 0042C241
RpcStringBindingComposeW.RPCRT4(00000000,ncalrpc,00000000,?,00000000,00000000), ref: 0042C4A5
RpcBindingFromStringBindingW.RPCRT4(00000000,00759258), ref: 0042C4BC
RpcStringFreeW.RPCRT4(00000000), ref: 0042C4D4
GetLastError.KERNEL32 ref: 0042C075

Part of subcall function 0040AF40: ___std_exception_destroy.LIBVCRUNTIME ref: 0040AFC6

Concurrency::cancel_current_task.LIBCPMT ref: 0042CE38

Strings

python.exe;pythonw.exe;, xrefs: 0042C612
CrashGuard initialized successfully, external debugger attached, xrefs: 0042CBA8
Install failed: cannot get filename of current process due to error: {}, xrefs: 0042C0C8
AvDumper, xrefs: 0042C31F
A983BBBB, xrefs: 0042BEE8
avdef://config/Common/FullDumpFraction, xrefs: 0042C1BB
CrashGuard initialized successfully, only internal dumping available, xrefs: 0042CCD3
ncalrpc, xrefs: 0042C49E
Failed to install crash hooks, xrefs: 0042CAFA
st, xrefs: 0042BE47, 004408B4
Dump path ', xrefs: 0042CDD1
Release, xrefs: 0042C1F5, 0042C268
`, xrefs: 0042CDBF
Attempting to install crashguard twice, ignored., xrefs: 0042BF1C
avcfg://settings/CrashGuard/FullDumpFraction, xrefs: 0042C1A0, 0042C1AA
avdef://config/Common/VersionType, xrefs: 0042C1FA

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: File$BindingString$ModuleNamePath___std_exception_destroy$AttributesComposeConcurrency::cancel_current_taskErrorFindFreeFromHandleLastRemoveSpec
String ID: A983BBBB$Attempting to install crashguard twice, ignored.$AvDumper$CrashGuard initialized successfully, external debugger attached$CrashGuard initialized successfully, only internal dumping available$Dump path '$Failed to install crash hooks$Install failed: cannot get filename of current process due to error: {}$Release$`$avcfg://settings/CrashGuard/FullDumpFraction$avdef://config/Common/FullDumpFraction$avdef://config/Common/VersionType$ncalrpc$python.exe;pythonw.exe;$st
API String ID: 526263671-1559707977
Opcode ID: 109b48a05316b4bd8a09fef4842c48ddda39f4a46083eb1d2eb97802593ab76c
Instruction ID: 3032f66e8f9b06a8983076109fd20c106565d05ef414c308f31d8a2735d9cc2b
Opcode Fuzzy Hash: 109b48a05316b4bd8a09fef4842c48ddda39f4a46083eb1d2eb97802593ab76c
Instruction Fuzzy Hash: 9C926870E012689FDB25DF64DC88BADB7B5AF48304F1042DAE449A7290DB74AF84CF95

Function 0042DFF0 Relevance: 47.5, APIs: 15, Strings: 12, Instructions: 240fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00431A00: VerSetConditionMask.NTDLL ref: 00431A6D
Part of subcall function 00431A00: VerSetConditionMask.NTDLL ref: 00431A75
Part of subcall function 00431A00: VerSetConditionMask.NTDLL ref: 00431A7D
Part of subcall function 00431A00: VerifyVersionInfoW.KERNEL32(00000000,00000023,00000000), ref: 00431AA4

EnterCriticalSection.KERNEL32(?), ref: 0042E057
PathAppendW.SHLWAPI(?,*-kernel-manual.*), ref: 0042E122
FindFirstFileW.KERNEL32(?,?), ref: 0042E136
FindClose.KERNEL32(00000000), ref: 0042E142
LeaveCriticalSection.KERNEL32(?), ref: 0042E149
GetLastError.KERNEL32(?,?,?,?,?,?,?,?), ref: 0042E2F4

Part of subcall function 005C90B0: RaiseException.KERNEL32(E06D7363,00000001,00000003,0042867C,?,?,?,?,0042867C,st,006E8FF4,E57473E3), ref: 005C9110

Strings

st, xrefs: 0042E007, 0042E557
NtDll Fncs not initialized, xrefs: 0042E9CF
A983BBBB, xrefs: 0042E64E
ntdll.dll, xrefs: 0042E5E9
Ignoring ntdll.dll exception: 0x{:08X}, ntdll.dll offset 0x{:08X}., xrefs: 0042E660
unp%u%ux-kernel-manual.dmp, xrefs: 0042E1CF
Dump file '{}' could not be created, error code: {}, xrefs: 0042E310
csm, xrefs: 0042E72E
A983BBBB, xrefs: 0042E09A
Reason: , xrefs: 0042E45F
Dump contains a C++ exception, its pointer is stored as Parameter[3] of the exception record. Use .ecxr to see the line of except, xrefs: 0042E8B3
*-kernel-manual.*, xrefs: 0042E112, 0042E11A

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: ConditionMask$CriticalFindSection$AppendCloseEnterErrorExceptionFileFirstInfoLastLeavePathRaiseVerifyVersion
String ID: Dump contains a C++ exception, its pointer is stored as Parameter[3] of the exception record. Use .ecxr to see the line of except$Reason: $*-kernel-manual.*$A983BBBB$A983BBBB$Dump file '{}' could not be created, error code: {}$Ignoring ntdll.dll exception: 0x{:08X}, ntdll.dll offset 0x{:08X}.$NtDll Fncs not initialized$csm$ntdll.dll$unp%u%ux-kernel-manual.dmp$st
API String ID: 1087935151-4057175747
Opcode ID: 7a271950ecb64c805a2a7bbe7cc2284f48e2a1906a6415a5fb8686622307347d
Instruction ID: 59a23631e7247ef034c30a70203f9b28b5dced01e8eb91040c54acd0cb76515d
Opcode Fuzzy Hash: 7a271950ecb64c805a2a7bbe7cc2284f48e2a1906a6415a5fb8686622307347d
Instruction Fuzzy Hash: D3919171E00228AFDB10DFA4DC49BEAB7B9BF09304F50416AF915A7281DB746A44CFA5

Function 0043DF80 Relevance: 45.8, APIs: 14, Strings: 12, Instructions: 276memorylibraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,CtrlRoutine,E57473E3,?,?), ref: 0043DFCE
GetProcAddress.KERNEL32(00000000), ref: 0043DFD5
GetCurrentThreadId.KERNEL32 ref: 0043E002

Part of subcall function 00440B40: GetModuleHandleW.KERNEL32(00000000,IsRunningInsideAvastService,E57473E3,?,?,?,?,?,?,?,?,00000000,0060E945,000000FF), ref: 00440B96
Part of subcall function 00440B40: GetProcAddress.KERNEL32(00000000), ref: 00440B9D

EnterCriticalSection.KERNEL32(00000000), ref: 0043E025
HeapFree.KERNEL32(?,00000000,?,00000000), ref: 0043E092
LeaveCriticalSection.KERNEL32(?,00000000), ref: 0043E0B1

Part of subcall function 00444C00: EnterCriticalSection.KERNEL32(00000000,E57473E3,?,?), ref: 00444C4E
Part of subcall function 00444C00: GetProcessHeap.KERNEL32 ref: 00444C5B
Part of subcall function 00444C00: HeapAlloc.KERNEL32(00000000,00000000,00000004,00000000), ref: 00444C98
Part of subcall function 00444C00: GetProcessHeap.KERNEL32 ref: 00444CBA
Part of subcall function 00444C00: HeapFree.KERNEL32(00000000,00000000,?,?), ref: 00444D0C
Part of subcall function 00444C00: HeapFree.KERNEL32(?,00000000,?,?), ref: 00444D3C

SetUnhandledExceptionFilter.KERNEL32(004440E0), ref: 0043E1D2
GetModuleHandleW.KERNEL32(Kernel32.dll,SetUnhandledExceptionFilter), ref: 0043E1EF
GetProcAddress.KERNEL32(00000000), ref: 0043E1F6
VirtualProtect.KERNEL32(00000000,00000008,00000040,00000000), ref: 0043E212
VirtualProtect.KERNEL32(00000000,00000008,00000000,00000000), ref: 0043E23E
AddVectoredExceptionHandler.KERNEL32(00000000,00436040), ref: 0043E293
SetErrorMode.KERNEL32(00008003), ref: 0043E2F6

Strings

Call to InstallGlobalHandler while being already installed., xrefs: 0043E0D7
st, xrefs: 0043DFA8
Kernel32.dll, xrefs: 0043E1EA
CtrlRoutine, xrefs: 0043DFC0
B14E, xrefs: 0043E2B2
Failed to install vectored handler., xrefs: 0043E2A5
kernel32.dll, xrefs: 0043DFC5
Failed to install global crashhandler., xrefs: 0043E169
SetUnhandledExceptionFilter, xrefs: 0043E1E5
AA71, xrefs: 0043E2C5
Already running, xrefs: 0043E322
asw::crashguard::ProcessWatcher::Singleton::v1, xrefs: 0043E04D

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: Heap$AddressCriticalFreeHandleModuleProcSection$EnterExceptionProcessProtectVirtual$AllocCurrentErrorFilterHandlerLeaveModeThreadUnhandledVectored
String ID: AA71$Already running$B14E$Call to InstallGlobalHandler while being already installed.$CtrlRoutine$Failed to install global crashhandler.$Failed to install vectored handler.$Kernel32.dll$SetUnhandledExceptionFilter$asw::crashguard::ProcessWatcher::Singleton::v1$kernel32.dll$st
API String ID: 2248969997-1300027289
Opcode ID: d9c28999aa73ef16c4041f668425c8102826f914958142a460b7b9bb27aa4024
Instruction ID: b65caaa33bce46cca810fbfc333dce6c6e45000e08ce28deaddc9f3c032268ad
Opcode Fuzzy Hash: d9c28999aa73ef16c4041f668425c8102826f914958142a460b7b9bb27aa4024
Instruction Fuzzy Hash: 95C16A70E01319AFDB14DFA5D845BAEBBB1BF08304F14911AE815B7390DB78AA41CFA5

Function 0043EA40 Relevance: 31.8, APIs: 11, Strings: 7, Instructions: 316fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,10000000,00000001,00000000,00000002,00000000,00000000,E57473E3,?,?), ref: 0043EAA9
DeviceIoControl.KERNEL32(00000000,0009C040,?,00000002,00000000,00000000,?,00000000), ref: 0043EAE4
GetCurrentProcessId.KERNEL32(?,?), ref: 0043EAEA
GetCurrentProcess.KERNEL32(?,?), ref: 0043EAF7
CloseHandle.KERNEL32(00000007,?,?,?,?,?), ref: 0043EE09

Part of subcall function 005C90B0: RaiseException.KERNEL32(E06D7363,00000001,00000003,0042867C,?,?,?,?,0042867C,st,006E8FF4,E57473E3), ref: 005C9110

Concurrency::scheduler_worker_creation_error::scheduler_worker_creation_error.LIBCMT ref: 0043EE82

Strings

6643, xrefs: 0043ED96
st, xrefs: 0043EA6B
Dumped in-process on attempts {} with flags {:x}, xrefs: 0043EDB4
NtDll Fncs not initialized, xrefs: 0043EE3F
Dumped by CrashHandler, xrefs: 0043EBC3
LdrLockLoaderLock, xrefs: 0043EE76
9451, xrefs: 0043ED7C

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: CurrentProcess$CloseConcurrency::scheduler_worker_creation_error::scheduler_worker_creation_errorControlCreateDeviceExceptionFileHandleRaise
String ID: 6643$9451$Dumped by CrashHandler$Dumped in-process on attempts {} with flags {:x}$LdrLockLoaderLock$NtDll Fncs not initialized$st
API String ID: 3402936683-223803641
Opcode ID: e2f321aa22cc06fa447afbfb0098fe8e8ea39fe0647f298e62bf8df33209923c
Instruction ID: 7506bf43a3a1f01021d35a8c2e461eaecc4b1d22f2e4e89daaacbe0fea7bc2c8
Opcode Fuzzy Hash: e2f321aa22cc06fa447afbfb0098fe8e8ea39fe0647f298e62bf8df33209923c
Instruction Fuzzy Hash: 51D19A70D01218DFDB14DFA5CC89BDEBBB5BF48304F10919AE909A7281EB746A84CF91

Function 0055E3A0 Relevance: 28.6, APIs: 13, Strings: 3, Instructions: 552registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00561C30: RegOpenKeyExW.ADVAPI32(?,?,?,?,?,?,E57473E3,00000000,?), ref: 00561CEE

Part of subcall function 00560250: RegQueryValueExW.ADVAPI32(00000000,?,00000000,?,?), ref: 005602A9

RegCloseKey.ADVAPI32(?), ref: 0055E40A
SetLastError.KERNEL32(00000000), ref: 0055E415

Part of subcall function 005C90B0: RaiseException.KERNEL32(E06D7363,00000001,00000003,0042867C,?,?,?,?,0042867C,st,006E8FF4,E57473E3), ref: 005C9110

Part of subcall function 005602F0: RegQueryValueExW.ADVAPI32(00000000,00000000,00000000,?,?,?,E57473E3,00000000,?), ref: 00560385

RegCloseKey.ADVAPI32(?), ref: 0055E501
SetLastError.KERNEL32(00000000), ref: 0055E50C
ExpandEnvironmentStringsW.KERNEL32(?,00000000,00000000,00000025,00000000), ref: 0055E59A
ExpandEnvironmentStringsW.KERNEL32(?,?,00000001,-00000001,00000000), ref: 0055E608

Strings

String environment expansion failed due to unexpected buffer size, xrefs: 0055E6D5
st, xrefs: 0055E3B4, 0055E49B, 0055E724, 0055E824, 0055E928
String environment expansion failed, xrefs: 0055E6A7

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: CloseEnvironmentErrorExpandLastQueryStringsValue$ExceptionOpenRaise
String ID: String environment expansion failed$String environment expansion failed due to unexpected buffer size$st
API String ID: 3128433759-2414521870
Opcode ID: f9f83309a66eecc219b3799fde198c85dd7d6fe9782f7969f5bb635ee6659755
Instruction ID: f1e8947f995580cd585f5a09ad13f01ba4421006d884997e117e315a25e6193a
Opcode Fuzzy Hash: f9f83309a66eecc219b3799fde198c85dd7d6fe9782f7969f5bb635ee6659755
Instruction Fuzzy Hash: 5B128170E00218AFDB14DFA4DC5ABEEBBB5FF48714F14452EE815A7281EB74AA04CB54

Function 00443950 Relevance: 26.7, APIs: 14, Strings: 1, Instructions: 415nativeCOMMON

Download Yara Rule

APIs

CreateIoCompletionPort.KERNEL32(000000FF,00000000,00000000,00000000,00000000), ref: 00443A22
CloseHandle.KERNEL32(00000000), ref: 00443A3D
GetCurrentProcess.KERNEL32 ref: 00443AEC
NtCreateWorkerFactory.NTDLL(00000000,10000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00443B09
CloseHandle.KERNEL32(00000000), ref: 00443B14

Strings

st, xrefs: 00443967

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: CloseCreateHandle$CompletionCurrentFactoryPortProcessWorker
String ID: st
API String ID: 1529459110-1638371401
Opcode ID: b0c96919d3d19ddfda59ece5e7363bfaa9c62d4fbac0d084477eaa4a3702944b
Instruction ID: d5f4e7c215f86b3f6e65f62a3ab40fe32246557bf7f575bc768083938cb2470d
Opcode Fuzzy Hash: b0c96919d3d19ddfda59ece5e7363bfaa9c62d4fbac0d084477eaa4a3702944b
Instruction Fuzzy Hash: 72F1C071E002199FEF14CFA8CD89BAEBBB1EF44715F24825AE515B7380D7386A40CB94

Function 0047F960 Relevance: 23.1, APIs: 2, Strings: 13, Instructions: 588COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?), ref: 0047FAF9
LeaveCriticalSection.KERNEL32(?,?,?), ref: 0047FB09

Part of subcall function 0047A260: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,004800E9,?,?), ref: 0047A283
Part of subcall function 0047A260: LeaveCriticalSection.KERNEL32(?,?,?,?,004800E9,?,?), ref: 0047A2F1

Strings

app.settings.EnumerateProperties, xrefs: 0047FB70
C:\BUILD\work\e0dd96435fde7cb0\framework\settings\src\property\PropertyDispatcher.cpp(319), xrefs: 00480004
C:\BUILD\work\e0dd96435fde7cb0\framework\settings\src\property\PropertyDispatcher.cpp(317), xrefs: 0047FE12
C:\BUILD\work\e0dd96435fde7cb0\framework\settings\src\property\PropertyDispatcher.cpp(314), xrefs: 0047FB24
app.settings.GetPropertyOrDefaultString, xrefs: 0047FF54
C:\BUILD\work\e0dd96435fde7cb0\framework\settings\src\property\PropertyDispatcher.cpp(315), xrefs: 0047FC20
st, xrefs: 0047F988
C:\BUILD\work\e0dd96435fde7cb0\framework\settings\src\property\PropertyDispatcher.cpp(316), xrefs: 0047FD19
app.settings.GetPropertyOrDefaultInt64, xrefs: 0047FE5B
C:\BUILD\work\e0dd96435fde7cb0\framework\settings\src\property\PropertyDispatcher.cpp(318), xrefs: 0047FF0B
app.settings.GetPropertyOrDefaultInt32, xrefs: 0047FD62
app.settings.GetPropertyOrDefaultBlob, xrefs: 0047FC69
app.settings.GetPropertyOrDefaultStringVector, xrefs: 0048004D

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: C:\BUILD\work\e0dd96435fde7cb0\framework\settings\src\property\PropertyDispatcher.cpp(314)$C:\BUILD\work\e0dd96435fde7cb0\framework\settings\src\property\PropertyDispatcher.cpp(315)$C:\BUILD\work\e0dd96435fde7cb0\framework\settings\src\property\PropertyDispatcher.cpp(316)$C:\BUILD\work\e0dd96435fde7cb0\framework\settings\src\property\PropertyDispatcher.cpp(317)$C:\BUILD\work\e0dd96435fde7cb0\framework\settings\src\property\PropertyDispatcher.cpp(318)$C:\BUILD\work\e0dd96435fde7cb0\framework\settings\src\property\PropertyDispatcher.cpp(319)$app.settings.EnumerateProperties$app.settings.GetPropertyOrDefaultBlob$app.settings.GetPropertyOrDefaultInt32$app.settings.GetPropertyOrDefaultInt64$app.settings.GetPropertyOrDefaultString$app.settings.GetPropertyOrDefaultStringVector$st
API String ID: 3168844106-1802754960
Opcode ID: dceee1d3c8e6aca4ddc2eef5a6155e1c6455f83e6b35a97e38ab2f35aa261a31
Instruction ID: ef26497f2c272f438586853e5bd2e0cd3842b092366dfc1577168be721cd2e07
Opcode Fuzzy Hash: dceee1d3c8e6aca4ddc2eef5a6155e1c6455f83e6b35a97e38ab2f35aa261a31
Instruction Fuzzy Hash: 99221671D002089BDB14DFA4CC89BEEBBB1EF55304F24831EE415B7292D7786A89CB94

Function 00574ED0 Relevance: 21.7, APIs: 3, Strings: 9, Instructions: 748COMMON

Download Yara Rule

APIs

_strncpy.LIBCMT ref: 005755AA
_strncpy.LIBCMT ref: 0057570A
_strncpy.LIBCMT ref: 0057584A

Strings

ignA, xrefs: 0057580F
st, xrefs: 00574ED9
ASWS, xrefs: 00575563
ASWSig2A, xrefs: 0057504A, 0057511F, 005754B6
ASWSig3A, xrefs: 0057509A, 0057517A, 00575619
ASWS, xrefs: 00575803
ASWSignA, xrefs: 00574FF3
-->, xrefs: 00574FC8
ASWS, xrefs: 005756C6

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: _strncpy
String ID: -->$ASWS$ASWS$ASWS$ASWSig2A$ASWSig3A$ASWSignA$ignA$st
API String ID: 2961919466-649454849
Opcode ID: 19abf18f59c86d1bac6e2ea95b13c11db5a2e9c9a8e72e1e797296e31d6212e7
Instruction ID: 44bbcbbb547a2540a1d6d1c4b76a1eaf32287812edf1b5f1a6dd33670d30836f
Opcode Fuzzy Hash: 19abf18f59c86d1bac6e2ea95b13c11db5a2e9c9a8e72e1e797296e31d6212e7
Instruction Fuzzy Hash: A5523735A006988EDF218F28A8407A9BF72BF52310F98C1D5C48D5B282F7B19D83EB55

Function 00570C30 Relevance: 19.8, Strings: 15, Instructions: 1018COMMON

Download Yara Rule

Strings

auls, xrefs: 0057125A
Micr, xrefs: 005713A8
osof, xrefs: 005713B4
Auth, xrefs: 00570FEE
Genu, xrefs: 005710E2
aurH, xrefs: 005712CD
Hygo, xrefs: 00570FD2
ntel, xrefs: 005710F5
Sh, xrefs: 00570FE3
cAMD, xrefs: 00570FFC
st, xrefs: 00570C4C
t Hv, xrefs: 005713C6
Cent, xrefs: 005710D7
ai , xrefs: 0057109B
uine, xrefs: 005710BC

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID:
String ID: Sh$Auth$Cent$Genu$Hygo$Micr$ai $auls$aurH$cAMD$ntel$osof$t Hv$uine$st
API String ID: 0-2333499656
Opcode ID: c4018921c4d2c2733a9219c4c6a76820288ac1ed368c0b73154c8763716f5cd8
Instruction ID: 769687bb6b14d06f9b56f436c7e2169f4d63f3e79d5532229fd354146de55c25
Opcode Fuzzy Hash: c4018921c4d2c2733a9219c4c6a76820288ac1ed368c0b73154c8763716f5cd8
Instruction Fuzzy Hash: 51823371D14A088AEB34CFAED94439CBEB5BF99314F34C62ED469A7292D7744880EF44

Function 0043E570 Relevance: 19.4, APIs: 5, Strings: 6, Instructions: 132memorylibraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,SetUnhandledExceptionFilter,E57473E3), ref: 0043E5B9
GetProcAddress.KERNEL32(00000000), ref: 0043E5C0
VirtualProtect.KERNEL32(00000000,00000008,00000040,?), ref: 0043E5DC
VirtualProtect.KERNEL32(00000000,00000008,00000000,00000000), ref: 0043E5FB
SetUnhandledExceptionFilter.KERNEL32(?,E57473E3), ref: 0043E614

Strings

AA71B14E, xrefs: 0043E64E
st, xrefs: 0043E584
KERNEL32.DLL, xrefs: 0043E5B4
~, xrefs: 0043E65A
SetUnhandledExceptionFilter, xrefs: 0043E5AF
CrashGuard global exception handler uninstalled, xrefs: 0043E679

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: ProtectVirtual$AddressExceptionFilterHandleModuleProcUnhandled
String ID: AA71B14E$CrashGuard global exception handler uninstalled$KERNEL32.DLL$SetUnhandledExceptionFilter$~$st
API String ID: 2655839047-1400092599
Opcode ID: 8ecde05cdaada4c0a5d92a3be17f4af39a8ced0da78fec51810ddd52f3792c69
Instruction ID: 9307c56cbbeed81ab9c18480738abe3b39d9533faed69e88b6c59f21c1d8ab2a
Opcode Fuzzy Hash: 8ecde05cdaada4c0a5d92a3be17f4af39a8ced0da78fec51810ddd52f3792c69
Instruction Fuzzy Hash: 4C5169B4E007099FCB20DF95D845BAEBBB6FF58310F10521AE416A3390DB78AA45CF94

Function 00443500 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 184processnativesynchronizationCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(E57473E3,?), ref: 0044353E
WaitForSingleObject.KERNEL32(?,00000000), ref: 00443646
NtClose.NTDLL ref: 0044365A
GetCurrentProcessId.KERNEL32(E57473E3,?), ref: 004436A2
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 004436AE
Process32FirstW.KERNEL32(00000000,0000022C), ref: 004436E3
Process32NextW.KERNEL32(00000000,0000022C), ref: 00443700
CloseHandle.KERNEL32(00000000), ref: 00443713

Strings

list too long, xrefs: 00443737
st, xrefs: 00443517

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: CloseCurrentProcessProcess32$CreateFirstHandleNextObjectSingleSnapshotToolhelp32Wait
String ID: list too long$st
API String ID: 3506629132-635111152
Opcode ID: b02814731c77e0bf697fbd031689fdcf9f5b8d0cf1f1d7a9dfb9723d0fd05a3b
Instruction ID: 4d095e95f116fa5f11760951c1e5d9b8c90b9c939a63114d6cdc9cdc47555a77
Opcode Fuzzy Hash: b02814731c77e0bf697fbd031689fdcf9f5b8d0cf1f1d7a9dfb9723d0fd05a3b
Instruction Fuzzy Hash: F061A2B1A01219EFEB209F54CC49BAEBBB5FF45711F1041AAE909A7390D7355E40CF94

Function 0056F720 Relevance: 16.0, APIs: 5, Strings: 4, Instructions: 206libraryloaderCOMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 0056F73A
GetVersionExW.KERNEL32(0000011C), ref: 0056F79D
GetVersionExW.KERNEL32(0000011C), ref: 0056F7B8
GetModuleHandleW.KERNEL32(NTDLL.DLL,RtlGetVersion,00000000), ref: 0056F7D3
GetProcAddress.KERNEL32(00000000), ref: 0056F7DA

Strings

st, xrefs: 0056F729
V, xrefs: 0056FA72
NTDLL.DLL, xrefs: 0056F7CE
RtlGetVersion, xrefs: 0056F7C9

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: Version$AddressHandleInfoModuleProcSystem
String ID: NTDLL.DLL$RtlGetVersion$st$V
API String ID: 335284197-3708612193
Opcode ID: 4953a54e82679027c38113b7dae22ee7a900cef8cab1175fe941c259d6e1b9a5
Instruction ID: 54866c55b355e480e058861d5414b8600809b03f9d7fc385bebfe2364658eb0e
Opcode Fuzzy Hash: 4953a54e82679027c38113b7dae22ee7a900cef8cab1175fe941c259d6e1b9a5
Instruction Fuzzy Hash: 6371DD74E0411887EF388E94F859BE97BA7FB05300F2445BAE64E97291E6384EC09F56

Function 00494E20 Relevance: 12.7, APIs: 1, Strings: 6, Instructions: 411COMMON

Download Yara Rule

APIs

RtlDllShutdownInProgress.NTDLL ref: 00495380

Strings

st, xrefs: 00494E4B
CFBE, xrefs: 0049527D
_lt, xrefs: 00495259
ag, xrefs: 0049508D
2CC0, xrefs: 0049526C
added generic storage for scheme {} and location {}, xrefs: 0049528F

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: ProgressShutdown
String ID: 2CC0$CFBE$_lt$added generic storage for scheme {} and location {}$ag$st
API String ID: 396724402-151691309
Opcode ID: 1cf02a5aa410441d214f1d73d8306c2b2d74ec8b6d417a2d8e1d43c34636a9bd
Instruction ID: da5cc93fe92293f93652995a473c7485470a90d3ba8323c0cb3d2de990c97d90
Opcode Fuzzy Hash: 1cf02a5aa410441d214f1d73d8306c2b2d74ec8b6d417a2d8e1d43c34636a9bd
Instruction Fuzzy Hash: B2025A70D00619CFDF11CFA4C844B9EBBB5BF48314F1482AAE805A7351EB78AA85CF91

Function 0042D190 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 86COMMON

Download Yara Rule

APIs

RemoveVectoredExceptionHandler.KERNEL32(?), ref: 0042D1B4
RpcBindingFree.RPCRT4(00759258), ref: 0042D2BA

Strings

AA71, xrefs: 0042D1EE
Failed to uninstall crash hooks, xrefs: 0042D276
Failed to uninstall vectored handler., xrefs: 0042D1FB
B14E, xrefs: 0042D1DE
C, xrefs: 0042D20A

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: BindingExceptionFreeHandlerRemoveVectored
String ID: AA71$B14E$C$Failed to uninstall crash hooks$Failed to uninstall vectored handler.
API String ID: 2810669235-3727787859
Opcode ID: 91e73a5d0a9638baf235a3412a12ea7ef71d4cbfc819b6e756c8e88adaf519e6
Instruction ID: 2a61512f43f128a375490009b0c6379495069fd7d3a76add77d213d1cbb08575
Opcode Fuzzy Hash: 91e73a5d0a9638baf235a3412a12ea7ef71d4cbfc819b6e756c8e88adaf519e6
Instruction Fuzzy Hash: 4831D470A08351EFD314DF55E444796BBE1FF84318F044A1EE88847350E7B8E588CBA6

Function 0054E210 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 83librarynativeloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(ntdll.dll,NtQueryInformationProcess,?,?,?,?,0042EBCF), ref: 0054E25D
GetProcAddress.KERNEL32(00000000), ref: 0054E264

Part of subcall function 005C6DF0: AcquireSRWLockExclusive.KERNEL32(00755B64,?,?,0040B088,007567F8), ref: 005C6DFA
Part of subcall function 005C6DF0: ReleaseSRWLockExclusive.KERNEL32(00755B64,?,0040B088,007567F8), ref: 005C6E2D
Part of subcall function 005C6DF0: WakeAllConditionVariable.KERNEL32(00755B60,?,0040B088,007567F8), ref: 005C6E38

GetCurrentProcess.KERNEL32(0000003D,?,00000001,?,?,?,?,?,0042EBCF), ref: 0054E2AA
NtQueryInformationProcess.NTDLL ref: 0054E2B9

Part of subcall function 005C6E41: AcquireSRWLockExclusive.KERNEL32(00755B64,?,?,?,0040B061,007567F8,E57473E3,E57473E3,0060B741,000000FF,?,0040FB81,?,?), ref: 005C6E4C
Part of subcall function 005C6E41: ReleaseSRWLockExclusive.KERNEL32(00755B64,?,0040B061,007567F8,E57473E3,E57473E3,0060B741,000000FF,?,0040FB81,?,?), ref: 005C6E86

Strings

st, xrefs: 0054E219
ntdll.dll, xrefs: 0054E258
NtQueryInformationProcess, xrefs: 0054E253

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: ExclusiveLock$AcquireProcessRelease$AddressConditionCurrentHandleInformationModuleProcQueryVariableWake
String ID: NtQueryInformationProcess$ntdll.dll$st
API String ID: 3691736339-3305882183
Opcode ID: f93dfad78f2f27743f15416faed049d6804d1c007f8c078d0dea9a70e4b5e6de
Instruction ID: becdbda4c27c86056eed45dc770272d4587ab1f1056907d8e19acbbbda7fb9f5
Opcode Fuzzy Hash: f93dfad78f2f27743f15416faed049d6804d1c007f8c078d0dea9a70e4b5e6de
Instruction Fuzzy Hash: 25214DB16053105FC600EB74AC47EFABB99FB88715F004569F95A8B241DF71A905C7D3

Function 005EBD3E Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 183COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 005E4579: GetLastError.KERNEL32(00000010,00000000,005EAC01,006E8748,0000000C,005E499C,0000000C,?,005D7AED,00000000,0000000C,?,?,00000000), ref: 005E457D
Part of subcall function 005E4579: SetLastError.KERNEL32(00000000,00000000), ref: 005E461F

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 005EBE4A
IsValidCodePage.KERNEL32(00000000), ref: 005EBE93
IsValidLocale.KERNEL32(?,00000001), ref: 005EBEA2
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 005EBEEA
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 005EBF09

Strings

st, xrefs: 005EBD46

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID: st
API String ID: 415426439-1638371401
Opcode ID: 14712fc2af29a30d47fb773d9807794e926f61a98c2a60699ed14a90d3319ae3
Instruction ID: c2a8642c7d524083e52b838764f49dbe6eae00f61a29f56362a9541978d9b0c1
Opcode Fuzzy Hash: 14712fc2af29a30d47fb773d9807794e926f61a98c2a60699ed14a90d3319ae3
Instruction Fuzzy Hash: 1951A57190028AABFF18DFA6CC45AFB7BB9FF44702F044429E694E7150D7709A448B61

Function 005EB3BF Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 257COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 005E4579: GetLastError.KERNEL32(00000010,00000000,005EAC01,006E8748,0000000C,005E499C,0000000C,?,005D7AED,00000000,0000000C,?,?,00000000), ref: 005E457D
Part of subcall function 005E4579: SetLastError.KERNEL32(00000000,00000000), ref: 005E461F

GetACP.KERNEL32(?,?,?,?,?,?,005E03C4,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 005EB480
IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,005E03C4,?,?,?,00000055,?,-00000050,?,?), ref: 005EB4AB
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 005EB614

Strings

st, xrefs: 005EB5CB
utf8, xrefs: 005EB57D

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: ErrorLast$CodeInfoLocalePageValid
String ID: utf8$st
API String ID: 607553120-2537435558
Opcode ID: 836fc5ddc74f3b186195d2f3d951e5ef625ccd2c7bb63836f55bb9cee7d483e5
Instruction ID: 639d64e339cc25cc000da4e0fa91a630f7a01e1c54fa321eaafc6b243ff2a82c
Opcode Fuzzy Hash: 836fc5ddc74f3b186195d2f3d951e5ef625ccd2c7bb63836f55bb9cee7d483e5
Instruction Fuzzy Hash: 0971FA71A00382ABFB2CAB76CC46B677BA9FF84712F14442AF585D7181FB70D9408751

Function 005EBB69 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,005EBE87,00000002,00000000,?,?,?,005EBE87,?,00000000), ref: 005EBC02
GetLocaleInfoW.KERNEL32(?,20001004,005EBE87,00000002,00000000,?,?,?,005EBE87,?,00000000), ref: 005EBC2B
GetACP.KERNEL32(?,?,005EBE87,?,00000000), ref: 005EBC40

Strings

ACP, xrefs: 005EBB87
OCP, xrefs: 005EBBBD

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 166c23e9e08c5d907d5721d2248729b8af755fed265b4a6d53d189f9ae41e721
Instruction ID: 4022def3c8b71b02673241fd42fa4729bed97341a92a027b93c15c6d62b46fe8
Opcode Fuzzy Hash: 166c23e9e08c5d907d5721d2248729b8af755fed265b4a6d53d189f9ae41e721
Instruction Fuzzy Hash: 1721F971604185A7F73C8F56C940A977BBBFB50B63F668464E58AD7114EB32CE40C350

Function 0054E9D0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000000,E57473E3,00000030,00000000,00000000,00000000,00000000,00000000,00000000,?,E57473E3,00000000,00000030,E57473E3,00000000), ref: 0054EA2F
GetLastError.KERNEL32(AllocateAndInitializeSid), ref: 0054EA52
Concurrency::scheduler_worker_creation_error::scheduler_worker_creation_error.LIBCMT ref: 0054EA5C

Strings

st, xrefs: 0054E9E5
AllocateAndInitializeSid, xrefs: 0054EA4D

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: AllocateConcurrency::scheduler_worker_creation_error::scheduler_worker_creation_errorErrorInitializeLast
String ID: AllocateAndInitializeSid$st
API String ID: 2048164807-2959059828
Opcode ID: 9ffb2ff71cc6c9bd1320a6eb0461822f80d7baa99b4fb4490cb6f76d6d9f509e
Instruction ID: 76bc70157177f2a1ab1be03dcb1a4a835a558e6c7ba287612bf56e3c5a6d8e66
Opcode Fuzzy Hash: 9ffb2ff71cc6c9bd1320a6eb0461822f80d7baa99b4fb4490cb6f76d6d9f509e
Instruction Fuzzy Hash: D611AD72900259EFCB10DF98DC45F9ABBBAFB08710F00861AF815A7291D7B5A510CB94

Function 00577E70 Relevance: 8.0, APIs: 4, Strings: 1, Instructions: 513memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00003000,00000004), ref: 005780A5
GetLastError.KERNEL32 ref: 005780B3
VirtualFree.KERNEL32(00000000,00000000,00008000,00000000,00000000,00000000,?), ref: 005780FA
GetLastError.KERNEL32 ref: 00578104

Strings

@, xrefs: 0057829B

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: ErrorLastVirtual$AllocFree
String ID: @
API String ID: 2325269287-2766056989
Opcode ID: 73254a11654fbe0e6e3bccf9955b1ac684cd7eac0915f472581db70a9aa3a069
Instruction ID: 517b4826b33b38f618e529254884407169831de2101912cbed5aa729d8968ed7
Opcode Fuzzy Hash: 73254a11654fbe0e6e3bccf9955b1ac684cd7eac0915f472581db70a9aa3a069
Instruction Fuzzy Hash: A512B170644B428FD720CF29E88876BBFE1BF88304F54892DE98A87741DB71E844DB55

Function 0042A800 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 252memoryCOMMON

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,00000000,0000002C,E57473E3,?,00000018,?,?,?,?,0060CA2D,000000FF,?,0042A587,?,?), ref: 0042A852
asw_process_storage_allocate_connector.ANTISPAM_CONNECT_EU(?,?,?,?,0060CA2D,000000FF,?,0042A587,?,?), ref: 0042A862
GetProcessHeap.KERNEL32(0042A587), ref: 0042A8C5

Strings

st, xrefs: 0042A814

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: Heap$AllocProcessasw_process_storage_allocate_connector
String ID: st
API String ID: 793428038-1638371401
Opcode ID: 9d9ca18209de4c86262faca8723013c18e854a5ccecb9ddea95433b9b5400c96
Instruction ID: c00d7db5f104d4f7a6093ca131a6543842a2388ea7e66612371cd29e405fc0b1
Opcode Fuzzy Hash: 9d9ca18209de4c86262faca8723013c18e854a5ccecb9ddea95433b9b5400c96
Instruction Fuzzy Hash: D491AFB0B006258FCB14CF26D590B6BB7F2BF88310B59C56AD8499B341D739E852CB96

Function 005EB7E0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 005E4579: GetLastError.KERNEL32(00000010,00000000,005EAC01,006E8748,0000000C,005E499C,0000000C,?,005D7AED,00000000,0000000C,?,?,00000000), ref: 005E457D
Part of subcall function 005E4579: SetLastError.KERNEL32(00000000,00000000), ref: 005E461F

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 005EB834
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 005EB87E
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 005EB944

Strings

st, xrefs: 005EB7EB

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: InfoLocale$ErrorLast
String ID: st
API String ID: 661929714-1638371401
Opcode ID: 42658469e375557823377f577400af0d5ce0fe17b9ace2f8c5101087c8b55d58
Instruction ID: 9de92ba70687f250e6307fcf3b3a48bd9769b4d598a38d662d0b174991575b56
Opcode Fuzzy Hash: 42658469e375557823377f577400af0d5ce0fe17b9ace2f8c5101087c8b55d58
Instruction Fuzzy Hash: C46160715502579BEF289F2ACC86BAB7BA8FF04312F10407AE985D6286E734DD80DB50

Function 005D3073 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 005D316B
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 005D3175
UnhandledExceptionFilter.KERNEL32(-00000328,?,?,?,?,?,?), ref: 005D3182

Strings

st, xrefs: 005D307E

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID: st
API String ID: 3906539128-1638371401
Opcode ID: 77d4dda35b6d7a3ba9cdeb7e0f867ec94e084eb54c57ee76d38ef75ad1b1908d
Instruction ID: 2563941b451bafdf1433903fde08b1f6be5411ccd116df386c96865ff6a238e5
Opcode Fuzzy Hash: 77d4dda35b6d7a3ba9cdeb7e0f867ec94e084eb54c57ee76d38ef75ad1b1908d
Instruction Fuzzy Hash: 1D31C675901229ABCB21DF68D989BCDBBB4BF48310F5041DAE41CA7250E7709F858F55

Function 0054D670 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 57libraryCOMMON

Download Yara Rule

APIs

LdrUnlockLoaderLock.NTDLL ref: 0054D6B9
Concurrency::scheduler_worker_creation_error::scheduler_worker_creation_error.LIBCMT ref: 0054D6E2

Strings

LdrUnlockLoaderLock, xrefs: 0054D6D9
st, xrefs: 0054D687

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: Concurrency::scheduler_worker_creation_error::scheduler_worker_creation_errorLoaderLockUnlock
String ID: LdrUnlockLoaderLock$st
API String ID: 45294159-1866180445
Opcode ID: 074a907875d0e54cf9186ff0d75dfdb9a4acbba8af8d6dc16f10a7c5667d3416
Instruction ID: 13a8d6971573f75c8809a1de272431ae9a2f1dfc72fb24f458afa35802c2d346
Opcode Fuzzy Hash: 074a907875d0e54cf9186ff0d75dfdb9a4acbba8af8d6dc16f10a7c5667d3416
Instruction Fuzzy Hash: 89018471A05258EBCB00DB95DC45FDABFBCFB05B68F10056AF415E3691DB7559008AA0

Function 0043F020 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 53COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,E57473E3,?,?,00000001), ref: 0043F064
CheckRemoteDebuggerPresent.KERNEL32(00000000,?,?,00000001), ref: 0043F06B
RaiseException.KERNEL32(60AA0003,00000000,00000000,00000000), ref: 0043F08D

Strings

st, xrefs: 0043F039

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: CheckCurrentDebuggerExceptionPresentProcessRaiseRemote
String ID: st
API String ID: 2110000299-1638371401
Opcode ID: aac6d171fe4db84179cc483c46a254372e8803faa268a3395422a2e0d4b20466
Instruction ID: c79245fb1fa7582302a36f1ccc424b0bf68f1a9f8cbb042b4f689daedf96019e
Opcode Fuzzy Hash: aac6d171fe4db84179cc483c46a254372e8803faa268a3395422a2e0d4b20466
Instruction Fuzzy Hash: 91119E71A04349AFDB15CFA8CC49BAABBB8FB08710F10052EE402A2280D7785944CBA5

Function 00469900 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 276COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00469B90
InitializeCriticalSection.KERNEL32(00000000,?,00000000,00000000,?,?,?,?,?,?,?,?,?,006122DD,000000FF), ref: 00469BE8

Strings

st, xrefs: 00469914

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: Concurrency::cancel_current_taskCriticalInitializeSection
String ID: st
API String ID: 1186975558-1638371401
Opcode ID: 5575e437baf050f392783ca76566a79c8d36e0eaef22487163bc5dadf837272b
Instruction ID: 9a445833066cbddab628e724b68b023457ac56344bdd2bfbfdb253ed19985493
Opcode Fuzzy Hash: 5575e437baf050f392783ca76566a79c8d36e0eaef22487163bc5dadf837272b
Instruction Fuzzy Hash: 76A15D71E002199BCB14DFA8D9806AEFBF5BF88300F15862EE446A7341EB74AD41CB95

Function 0055D690 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 210COMMON

Download Yara Rule

APIs

ExpandEnvironmentStringsW.KERNEL32(?,0040B70A,00000000,?,00000000), ref: 0055D80B
GetLastError.KERNEL32 ref: 0055D831

Strings

st, xrefs: 0055D6B8

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: EnvironmentErrorExpandLastStrings
String ID: st
API String ID: 4064601616-1638371401
Opcode ID: 9fce0e3f555b6576c5bb7cf660ef94aa130a75bc55e79982212d8ad591746f91
Instruction ID: 055ba8d3a0bb1c853c662a84dfc7edcdb2927170d454ffe3b130afd27ccfc40f
Opcode Fuzzy Hash: 9fce0e3f555b6576c5bb7cf660ef94aa130a75bc55e79982212d8ad591746f91
Instruction Fuzzy Hash: C4819372E102099BCF24DFA9C551BEEB7B1FF98705F10851EE815B7240EB34AA49CB94

Function 00548D50 Relevance: 5.3, Strings: 4, Instructions: 326COMMON

Download Yara Rule

Strings

st, xrefs: 00548D7B
Software\, xrefs: 00548E05, 0054900F
reg-key, xrefs: 00548E4B
product-reg-key, xrefs: 0054905B

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID:
String ID: Software\$product-reg-key$reg-key$st
API String ID: 0-2043067855
Opcode ID: f373af4eaa578a56a504449646ddd4980cb393dbb48e402a7ac3cbb850de4466
Instruction ID: 445e68322ae8136c9a7b9caa97823406732333ea6a73030ae471e0f0dcb5ba82
Opcode Fuzzy Hash: f373af4eaa578a56a504449646ddd4980cb393dbb48e402a7ac3cbb850de4466
Instruction Fuzzy Hash: 27D1C070D10258DBDB14DFA0C845BEEBBB4BF54308F10869EE459A7192EF746B88CB61

Function 00447250 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00447272
DeviceIoControl.KERNEL32(000000FF,00070020,00000000,00000000,?,00000058,?,00000000), ref: 004472A0

Strings

st, xrefs: 00447259

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: ControlCountDeviceTick
String ID: st
API String ID: 2693983885-1638371401
Opcode ID: d5e67434e227e5dcf7e15948fad4809c7b299ef3c801b700eaeac3c4aca0d3c6
Instruction ID: 6b1ea0efc021347d47825272ff9662e9eb9294606ad3cf3b540210f2af91af28
Opcode Fuzzy Hash: d5e67434e227e5dcf7e15948fad4809c7b299ef3c801b700eaeac3c4aca0d3c6
Instruction Fuzzy Hash: 6D21E970A08B409FD324CF28C895A66B7F5FB88714F105A1EF9DA92790EB70B985CB45

Function 00438E40 Relevance: 4.2, Strings: 3, Instructions: 434COMMON

Download Yara Rule

Strings

st, xrefs: 00438E54, 00439064, 00439259
+, xrefs: 00439280
%, xrefs: 00439271

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID:
String ID: %$+$st
API String ID: 0-2703749754
Opcode ID: 8e7747795f038b26299f27893b1284a85a1cb975f724e3e0e071cfb12bbb427f
Instruction ID: 526d66b92baf6ef966f0434ca870c1ff345d140e552d69c03b6dbe14aad0eed4
Opcode Fuzzy Hash: 8e7747795f038b26299f27893b1284a85a1cb975f724e3e0e071cfb12bbb427f
Instruction Fuzzy Hash: 4BF1E331D006099FDB19DF64DC41AAFBBB6FF89300F04422EF815AB281E7789915CB95

Function 005D6EAE Relevance: 4.1, Strings: 3, Instructions: 388COMMON

Download Yara Rule

Strings

`?f, xrefs: 005D70FC, 005D722B, 005D7102
st, xrefs: 005D6EB6
0, xrefs: 005D7043

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID:
String ID: 0$`?f$st
API String ID: 0-2634753914
Opcode ID: 05de1811ba40c5042d58e36e2f7da8375c7ed42378907a6bf5bfe06fc9eab775
Instruction ID: 3b8adee6c28721ed50b713260b0d1cfca2271a34c38a30bbb8ac992a8e976772
Opcode Fuzzy Hash: 05de1811ba40c5042d58e36e2f7da8375c7ed42378907a6bf5bfe06fc9eab775
Instruction Fuzzy Hash: BFE1AD74604A0A8FCB34CF6CC484AAEBBB1FF49310B244A5FE4569B391E731AD46CB51

Function 005EBA40 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 005E4579: GetLastError.KERNEL32(00000010,00000000,005EAC01,006E8748,0000000C,005E499C,0000000C,?,005D7AED,00000000,0000000C,?,?,00000000), ref: 005E457D
Part of subcall function 005E4579: SetLastError.KERNEL32(00000000,00000000), ref: 005E461F

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 005EBA94

Strings

st, xrefs: 005EBA4B

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID: st
API String ID: 3736152602-1638371401
Opcode ID: f7c889d2fe66caee80d47cfffa9c5dd115a6b946895d86d87bc139b37b5670e0
Instruction ID: 9c4ab70641946228276d015a7326eb9620bde475644f81fff8a0568551ce4cb3
Opcode Fuzzy Hash: f7c889d2fe66caee80d47cfffa9c5dd115a6b946895d86d87bc139b37b5670e0
Instruction Fuzzy Hash: C021B332610297ABEF2C9E26DC45ABB3BACFF44315B14007AF942C6151EB74DD408B90

Function 005EB5C0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

Part of subcall function 005E4579: GetLastError.KERNEL32(00000010,00000000,005EAC01,006E8748,0000000C,005E499C,0000000C,?,005D7AED,00000000,0000000C,?,?,00000000), ref: 005E457D
Part of subcall function 005E4579: SetLastError.KERNEL32(00000000,00000000), ref: 005E461F

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 005EB614

Strings

st, xrefs: 005EB5CB
utf8, xrefs: 005EB57D

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID: utf8$st
API String ID: 3736152602-2537435558
Opcode ID: 707a2d375277b47ccd5f0fd0917ce8d824a038949615fa07da40597d444f3ac5
Instruction ID: 1243d05c9f02582477d2ac4b3c713912ab2f059d6cd181ffc2293342f0a764da
Opcode Fuzzy Hash: 707a2d375277b47ccd5f0fd0917ce8d824a038949615fa07da40597d444f3ac5
Instruction Fuzzy Hash: 13F0CD32600245ABE718AB75DC4DEFB37ACEB84311F10407AB542D7241EB749D058750

Function 005E4DCD Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 005E25A1: EnterCriticalSection.KERNEL32(?,?,005E33AD,00000000,006E8508,0000000C,005E3374,E57473E3,?,005E5736,E57473E3,?,005E4717,00000001,00000364,?), ref: 005E25B0

EnumSystemLocalesW.KERNEL32(005E4DC0,00000001,006E85E8,0000000C,005E522F,00000000), ref: 005E4E05

Strings

st, xrefs: 005E4E0D

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID: st
API String ID: 1272433827-1638371401
Opcode ID: 60f0e389d96cf4df40b238e0030ec9baf0caf935f55a8fe872742eea872fd5d5
Instruction ID: 329399ee9395777bd3d43f289f8e1a8e00b475a22377d8639bfc4f072b197bb0
Opcode Fuzzy Hash: 60f0e389d96cf4df40b238e0030ec9baf0caf935f55a8fe872742eea872fd5d5
Instruction Fuzzy Hash: 9BF04976A00385DFD704EF99E846B9C7BF1FB88725F00812AF8109B2A0CBB55A008F40

Function 00467BD0 Relevance: 3.4, Strings: 2, Instructions: 874COMMON

Download Yara Rule

Strings

st, xrefs: 00467BF8, 00467D96, 00467F36, 004680D6, 00468276, 00468416
Tf, xrefs: 00467C1D

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: CloseHandle___std_exception_destroy
String ID: Tf$st
API String ID: 3514858835-4092660372
Opcode ID: 18737b2e3e5bd85d5f34cda4a828af973c1acf19a9bb648bcb1eea6f818ac8c6
Instruction ID: b45ef7caf2522254082bac1780546e172c461e0703aaac8bcdd4d76e510bc4d2
Opcode Fuzzy Hash: 18737b2e3e5bd85d5f34cda4a828af973c1acf19a9bb648bcb1eea6f818ac8c6
Instruction Fuzzy Hash: 9762A275E005199FCB04DF68D854BAEBBB2FF45324F14825EE825A7390EB396E018BC5

Function 00422AC0 Relevance: 2.7, Strings: 2, Instructions: 233COMMON

Download Yara Rule

Strings

d, xrefs: 00422B6E
st, xrefs: 00422AC6

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID:
String ID: d$st
API String ID: 0-3760083187
Opcode ID: 4b98425bdf64419711ef1fe7fcabada32360b28ec8feebd64886810ba80443cb
Instruction ID: 453da6f0e8b3bab633fd34a550090ea38d9e49121b0f65bf340a5770d95fce64
Opcode Fuzzy Hash: 4b98425bdf64419711ef1fe7fcabada32360b28ec8feebd64886810ba80443cb
Instruction Fuzzy Hash: 9181A571F016199FDB04CFB9E98169EBBF2EF88310F68822EE415E7381DA745942CB54

Function 00425DB0 Relevance: 2.7, Strings: 2, Instructions: 188COMMON

Download Yara Rule

Strings

st, xrefs: 00425DB6
d, xrefs: 00425E33

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID:
String ID: d$st
API String ID: 0-3760083187
Opcode ID: 8e52e75a1496c6bf1eff34d76dd23aa89a53d73dc5e35be287c71b07bce39ce7
Instruction ID: 40e4c6d5ce705678e15e758e4c822fc530ae86c99dc5199753077688bc1cfddc
Opcode Fuzzy Hash: 8e52e75a1496c6bf1eff34d76dd23aa89a53d73dc5e35be287c71b07bce39ce7
Instruction Fuzzy Hash: 40510632F016199FDB04CB6DE884AEEFBB2EF94310F55827EE845A7345DA349906C790

Function 004254E0 Relevance: 1.8, Strings: 1, Instructions: 587COMMON

Download Yara Rule

Strings

gfff, xrefs: 00425AC5

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID:
String ID: gfff
API String ID: 0-1553575800
Opcode ID: 23206858ba60e779bb444173aafe6ad77bb788fabc28d80fdc8ed3ece1e7e2e4
Instruction ID: e8fbbf0a6da095b6a260581d5b18e8f9c8590f453c0c841d62efa510609aa1fb
Opcode Fuzzy Hash: 23206858ba60e779bb444173aafe6ad77bb788fabc28d80fdc8ed3ece1e7e2e4
Instruction Fuzzy Hash: 8B226075F00529CBDF08CFA9E8916AEB7F2FB88314FA4813ED415E7340D67999428B94

Function 005E3D24 Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000000), ref: 005E3F51

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: e281410656bbe1fbdb1a09ba6bc86ad2a9c8e8c40647ec21e574c7cebb111d70
Instruction ID: 6ba60d41f66479d1dd78f5a7a7bce8b937e9440e7239df4b96a6ad60f8836dfb
Opcode Fuzzy Hash: e281410656bbe1fbdb1a09ba6bc86ad2a9c8e8c40647ec21e574c7cebb111d70
Instruction Fuzzy Hash: C0B139316106499FD719CF29C48AB657FA0FF45364F258698E8E9CF2A1C335EA91CB40

Function 005464C0 Relevance: 1.6, Strings: 1, Instructions: 384COMMON

Download Yara Rule

Strings

st, xrefs: 005464E8, 005469B7

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID:
String ID: st
API String ID: 0-1638371401
Opcode ID: 72bf5a2cd8f4b9f292ef30f2532a3147bbe6da2fbcb1f0969b9ad40006f81396
Instruction ID: 50593f6296c7d419a1b0e9139a125d0ede4ec880b68f709b0c152a9fbb578299
Opcode Fuzzy Hash: 72bf5a2cd8f4b9f292ef30f2532a3147bbe6da2fbcb1f0969b9ad40006f81396
Instruction Fuzzy Hash: E2F147B0D10259DBDF14CFA5C8557EEFBB0FF55308F10861AE415AB281E7B8A988CB91

Function 0046C9D0 Relevance: 1.6, Strings: 1, Instructions: 332COMMON

Download Yara Rule

Strings

st, xrefs: 0046C9D6

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID:
String ID: st
API String ID: 0-1638371401
Opcode ID: 4d3fe75ace1044844c4ffb653ec75a2daed6ba5080f68644ef33683b30adf399
Instruction ID: 97310b8b25ccd25c49248557d8eb3bef18522953a28b10f8307ba2113440b4a2
Opcode Fuzzy Hash: 4d3fe75ace1044844c4ffb653ec75a2daed6ba5080f68644ef33683b30adf399
Instruction Fuzzy Hash: 6DB1E271B006098FCB14DF69D0D176DBBB1EF99320F2442AEE85A5B382CB346A55C7D1

Function 005EB6B2 Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 005E4579: GetLastError.KERNEL32(00000010,00000000,005EAC01,006E8748,0000000C,005E499C,0000000C,?,005D7AED,00000000,0000000C,?,?,00000000), ref: 005E457D
Part of subcall function 005E4579: SetLastError.KERNEL32(00000000,00000000), ref: 005E461F

EnumSystemLocalesW.KERNEL32(005EB7E0,00000001,00000000,?,-00000050,?,005EBE1E,00000000,?,?,?,00000055,?), ref: 005EB724

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 7678eb77b403034a84d38ab528b78879c7db5c04c79d068e15f1fe315f5e9e2d
Instruction ID: 8c57daa790fae923a5be759712226c53656a8908dec389f7d1fff971caa36912
Opcode Fuzzy Hash: 7678eb77b403034a84d38ab528b78879c7db5c04c79d068e15f1fe315f5e9e2d
Instruction Fuzzy Hash: E611C23A6007059FEB1C9F3AC8955BBBB92FFC435AB19442DE98687A40D771A942CB40

Function 005EBC6F Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 005E4579: GetLastError.KERNEL32(00000010,00000000,005EAC01,006E8748,0000000C,005E499C,0000000C,?,005D7AED,00000000,0000000C,?,?,00000000), ref: 005E457D
Part of subcall function 005E4579: SetLastError.KERNEL32(00000000,00000000), ref: 005E461F

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,005EBAEA,00000000,00000000,?), ref: 005EBC9B

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: afbb9318ead07f23f58da62be4cabdbc12c858ee0a3d0b426b1c8b981b187a9d
Instruction ID: bd3ed36618ecbfcc94a7e3e3b77c2577fcaab3928c3b9ff4dc5f9dd554de32b2
Opcode Fuzzy Hash: afbb9318ead07f23f58da62be4cabdbc12c858ee0a3d0b426b1c8b981b187a9d
Instruction Fuzzy Hash: 11F0DB76904193BBEB2C5A62CC466BB7B54FB40755F154425AD85A3140EF70ED41C690

Function 005EB74D Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 005E4579: GetLastError.KERNEL32(00000010,00000000,005EAC01,006E8748,0000000C,005E499C,0000000C,?,005D7AED,00000000,0000000C,?,?,00000000), ref: 005E457D
Part of subcall function 005E4579: SetLastError.KERNEL32(00000000,00000000), ref: 005E461F

EnumSystemLocalesW.KERNEL32(005EBA40,00000001,?,?,-00000050,?,005EBDE2,-00000050,?,?,?,00000055,?,-00000050,?,?), ref: 005EB797

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: eb1f9eb5111e2fee92a01bfa9a42e2e99f1501dc06e726e4e0a89e237c5f6217
Instruction ID: 131aa2172599c8da92e15f06657701b1cde80dc32d2da6ec2d2de41466cc819a
Opcode Fuzzy Hash: eb1f9eb5111e2fee92a01bfa9a42e2e99f1501dc06e726e4e0a89e237c5f6217
Instruction Fuzzy Hash: 58F046362003445FEB285F369C85A7B7F91FFC0369B04403DFA824BA90C771AC41C650

Function 005EB667 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 005E4579: GetLastError.KERNEL32(00000010,00000000,005EAC01,006E8748,0000000C,005E499C,0000000C,?,005D7AED,00000000,0000000C,?,?,00000000), ref: 005E457D
Part of subcall function 005E4579: SetLastError.KERNEL32(00000000,00000000), ref: 005E461F

EnumSystemLocalesW.KERNEL32(005EB5C0,00000001,?,?,?,005EBE40,-00000050,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 005EB69E

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 42228f45f9b5547b1e0c031f3780dfb45a680e0db0cb19a1f7e9ba3e76ea4cf7
Instruction ID: ec4ec2269b8815b696a475b4c5c59e461912169ec17e373f328be9cfcaed7080
Opcode Fuzzy Hash: 42228f45f9b5547b1e0c031f3780dfb45a680e0db0cb19a1f7e9ba3e76ea4cf7
Instruction Fuzzy Hash: 77F0AB3630028597EB089F37D859A6BBF90FFC1711B0B406DFA058B250C731D882CB90

Function 005E5333 Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,?,?,005E0F2A,?,20001004,00000000,00000002,?,?,005E052C), ref: 005E5367

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 9f7353c1430ceaa87dbf3acceafbc333f4d54a098205168466823d9a49c73bc8
Instruction ID: 600cd50b9049af3e5126085ed5ef4284bafc2170a494bd7e001d72c5f0490074
Opcode Fuzzy Hash: 9f7353c1430ceaa87dbf3acceafbc333f4d54a098205168466823d9a49c73bc8
Instruction Fuzzy Hash: 72E0D8311006A8BBCF063F51DC05EAE3F16FF44762F048410FD4425260DB7189209AD0

Function 005709C0 Relevance: 1.4, Strings: 1, Instructions: 178COMMON

Download Yara Rule

Strings

st, xrefs: 005709F0

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID:
String ID: st
API String ID: 0-1638371401
Opcode ID: 57a74ac10bd82f541e21f61ab97435b3ed807c3cb5151852c701a79b64bf2a58
Instruction ID: c0ec4d4d5ba039378108c5e965506bc8824fce062910e4ebed057a5a10121b48
Opcode Fuzzy Hash: 57a74ac10bd82f541e21f61ab97435b3ed807c3cb5151852c701a79b64bf2a58
Instruction Fuzzy Hash: A9614772D14219CBEB24CFA9D84179DFBB5FB48724F34926ED419A7382D778A9408F80

Function 00422EF0 Relevance: 1.4, Strings: 1, Instructions: 161COMMON

Download Yara Rule

Strings

st, xrefs: 00422EF6

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID:
String ID: st
API String ID: 0-1638371401
Opcode ID: cbc12e165e2715ae0bd252e016e417224b8217fe3ed3ef15781b7d007f81d146
Instruction ID: 9c55f735bb7ffa466a1cca54a4cd6ca3963bb4b707f1f76c83e09a8daa0538c5
Opcode Fuzzy Hash: cbc12e165e2715ae0bd252e016e417224b8217fe3ed3ef15781b7d007f81d146
Instruction Fuzzy Hash: 9A510431F102199FCB18CFADE8C16AEF7B6EF88310B54827EE456E7345DA7499068750

Function 00426C20 Relevance: 1.4, Strings: 1, Instructions: 154COMMON

Download Yara Rule

Strings

st, xrefs: 00426C26

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID:
String ID: st
API String ID: 0-1638371401
Opcode ID: a042c8736efd4955fec484bea195f87d39ec5efd7c2c14b15b2d9db6ebec1ec2
Instruction ID: fd7c1f085d419061465d710560a9b631203045e262d47ca27759044875d9dff9
Opcode Fuzzy Hash: a042c8736efd4955fec484bea195f87d39ec5efd7c2c14b15b2d9db6ebec1ec2
Instruction Fuzzy Hash: BE519472F012298BCF14DFADD9842ADB7B6AF88310F56813ED819EB350D6349D018B95

Function 00426140 Relevance: 1.4, Strings: 1, Instructions: 132COMMON

Download Yara Rule

Strings

st, xrefs: 00426146

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID:
String ID: st
API String ID: 0-1638371401
Opcode ID: 0d5139c10fd49bcd07ba6333f29c8912cf2c378c05b5bd62668fbe2c4506b8ca
Instruction ID: e7fd46066aedaf61c91c5c7c8da301d94b978d58c2efbba0d50892027806de4d
Opcode Fuzzy Hash: 0d5139c10fd49bcd07ba6333f29c8912cf2c378c05b5bd62668fbe2c4506b8ca
Instruction Fuzzy Hash: ED418731705166CFCF1C8E6C68612FEBBA5EB95310B9501AFD8C29B303DA249907C3B1

Function 005E6D05 Relevance: 1.3, Strings: 1, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Strings

st, xrefs: 005E6D1F, 005E6D22

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID:
String ID: st
API String ID: 0-1638371401
Opcode ID: f7b00193a3df4d78682e171e370f1833d2cf5878c60932ed781a549e9712db76
Instruction ID: 1c1ac7644a74b59aa89a8c50f0046b5d8728accf5d93e2312694fad18109a141
Opcode Fuzzy Hash: f7b00193a3df4d78682e171e370f1833d2cf5878c60932ed781a549e9712db76
Instruction Fuzzy Hash: BFE08C32A11268EBCB18DB8DCA08D8AFBECFB84B94B5144A6B641D3100C670DE00C7D0

Function 00426420 Relevance: .6, Instructions: 561COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35a8660b0408b38d332fadccc7967902d97518f7955bdba3e0276ec371268046
Instruction ID: 403a572ad41c5830eeb0d1b26db4cab19e3697d10caa3c66cd8877d84b1f77c9
Opcode Fuzzy Hash: 35a8660b0408b38d332fadccc7967902d97518f7955bdba3e0276ec371268046
Instruction Fuzzy Hash: E7126E32F0112A8FCF18CEADD8916EDF7B2AF88310F55826AD815E7390DA759D45CB90

Function 005C3510 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a19be8e952a6120f04893493a18d196b6d8a2008cd8c587b59b820166e997fe
Instruction ID: aaaf6fe39f022e4fa8acf0816b84d4029de4e9a851491e241a5d8c2b91ed9d67
Opcode Fuzzy Hash: 5a19be8e952a6120f04893493a18d196b6d8a2008cd8c587b59b820166e997fe
Instruction Fuzzy Hash: C5E06D336001292A671CE9B68C62DBFB68A97C8250B05C22DB90B9B281C8746D0186D1

Function 005E1602 Relevance: .0, Instructions: 12COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01c8111d4a5a0fc900bffe0ede1350969a9d59952648b8852eaf4ba0db25322f
Instruction ID: 20824bc4343ad2920f35efa5578d8b2f8afc4596b1e442c8dcc5d2cca59a7703
Opcode Fuzzy Hash: 01c8111d4a5a0fc900bffe0ede1350969a9d59952648b8852eaf4ba0db25322f
Instruction Fuzzy Hash: 2EC08C34500D8046CE2D8D1193713A43775F3E17C2FC8348CCC830FA42C52E9C82D600

Function 004225E0 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc9155624a92deb76681d0523cd77545ecf9ae5d3cb298f117a5d799081be8d1
Instruction ID: 62512f01c2862f595500b8c7bd7e1bff6dfd311c73d69dd0917b0512a8c5c603
Opcode Fuzzy Hash: bc9155624a92deb76681d0523cd77545ecf9ae5d3cb298f117a5d799081be8d1
Instruction Fuzzy Hash: 77C00879651A40CFCB55CF08D294E01B7F4FB49750B1644D1E9158B722C234E900DA11

Function 0042DAB0 Relevance: 45.9, APIs: 13, Strings: 13, Instructions: 381processfilesynchronizationCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,E57473E3,?,?), ref: 0042DB15
PathAppendW.SHLWAPI(?,?), ref: 0042DBB9
GetSystemTimeAsFileTime.KERNEL32(?), ref: 0042DBD9
PathAppendW.SHLWAPI(?,?), ref: 0042DC2B
SHCreateDirectory.SHELL32(00000000,?), ref: 0042DC42
GetCurrentProcessId.KERNEL32 ref: 0042DD82
GetCurrentThreadId.KERNEL32 ref: 0042DD8D
CreateProcessW.KERNEL32(?,?,00000000,00000000,00000000,08000400,00000000,00000000,?,?), ref: 0042DE60
GetLastError.KERNEL32 ref: 0042DE6A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 0042DED4
GetExitCodeProcess.KERNEL32(?,?), ref: 0042DEEB
GetLastError.KERNEL32 ref: 0042DEF5
LeaveCriticalSection.KERNEL32(?), ref: 0042DFC4

Strings

Failed to get exit code from dumper process, error: {}, xrefs: 0042DF2D
unp%u%ui-unhandled.mdmp, xrefs: 0042DBFA
"%s" --pid %d --exception_ptr %p --thread_id %d --dump_level %d --dump_file "%s" --comment "%s" --min_interval %d, xrefs: 0042DDE9
`?f, xrefs: 0042DDC2
st, xrefs: 0042DAD8
Process dumper filename was not set, xrefs: 0042DF80
A983, xrefs: 0042DF97
unp%u%ux-kernel-manual.dmp, xrefs: 0042DBEB, 0042DC08
avDump.exe, xrefs: 0042DCA4
BBBB, xrefs: 0042DF8D
unp%u%ui-manual.mdmp, xrefs: 0042DBF5
Failed to start process dumper at '{}' due to error: {}, xrefs: 0042DEA9
Comment exceeded maximum size and was removed., xrefs: 0042DD11

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: Process$AppendCreateCriticalCurrentErrorLastPathSectionTime$CodeDirectoryEnterExitFileLeaveObjectSingleSystemThreadWait
String ID: "%s" --pid %d --exception_ptr %p --thread_id %d --dump_level %d --dump_file "%s" --comment "%s" --min_interval %d$A983$BBBB$Comment exceeded maximum size and was removed.$Failed to get exit code from dumper process, error: {}$Failed to start process dumper at '{}' due to error: {}$Process dumper filename was not set$`?f$avDump.exe$unp%u%ui-manual.mdmp$unp%u%ui-unhandled.mdmp$unp%u%ux-kernel-manual.dmp$st
API String ID: 1888481106-1778537290
Opcode ID: 44f4343a675ebda1b68794431c1ff441158815863c8b3ca2536f5d4bfbdb6926
Instruction ID: ef64578cc03ccec2709483fe7a0a9f541234438c0d8b83eed15d59f7186439c1
Opcode Fuzzy Hash: 44f4343a675ebda1b68794431c1ff441158815863c8b3ca2536f5d4bfbdb6926
Instruction Fuzzy Hash: A3F18D71E006189FDB14DFA4D845BEEBBB5FF48300F50412AE916AB380E774A945CFA5

Function 0055C6D0 Relevance: 43.9, APIs: 3, Strings: 22, Instructions: 121libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,E57473E3,00000001), ref: 0055C6F9
GetProcAddress.KERNEL32(00000000,on_avast_dll_unload), ref: 0055C705
GetModuleHandleW.KERNEL32(00000000,00000001), ref: 0055C713

Strings

ProductId, xrefs: 0055C786
piriform, xrefs: 0055CD58, 0055CD6F, 0055CD70
prf, xrefs: 0055CD49
Privax, xrefs: 0055CBF2, 0055CC0F, 0055CC10
Avast, xrefs: 0055CA55
avira, xrefs: 0055CE38, 0055CE4F, 0055CE50
Piriform, xrefs: 0055CCD2, 0055CCEF, 0055CCF0
avg, xrefs: 0055CB6B, 0055CB82, 0055CB83
avast, xrefs: 0055CA99, 0055CAB0, 0055CAB1
ModuleId, xrefs: 0055C719, 0055C767
Avira, xrefs: 0055CDB2, 0055CDCF, 0055CDD0
st, xrefs: 0055C6E6
privax, xrefs: 0055CC78, 0055CC8F, 0055CC90
`?f, xrefs: 0055C72F
avr, xrefs: 0055CE29
AVG Technologies, xrefs: 0055CB5C
Avast Software, xrefs: 0055CA2C, 0055CA43, 0055CA44
AVG, xrefs: 0055CB0F, 0055CB26, 0055CB27
pvx, xrefs: 0055CC69
asw, xrefs: 0055CA8A
Avg, xrefs: 0055CBB8
on_avast_dll_unload, xrefs: 0055C6FF

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: HandleModule$AddressProc
String ID: AVG$AVG Technologies$Avast$Avast Software$Avg$Avira$ModuleId$Piriform$Privax$ProductId$`?f$asw$avast$avg$avira$avr$on_avast_dll_unload$piriform$prf$privax$pvx$st
API String ID: 1883125708-497633949
Opcode ID: 467c8f427f70a25123b90b6f3e2ca639eb70aa9f572b8e420f167b39f1e0500e
Instruction ID: 63dd0070cbdaff34dd93a95f03daade99097ee25adf1dead9b2a2050940c5355
Opcode Fuzzy Hash: 467c8f427f70a25123b90b6f3e2ca639eb70aa9f572b8e420f167b39f1e0500e
Instruction Fuzzy Hash: E7310671E003056BDB10EBA4DC15BEE7BB9FB04715F10812AFC01A7781EB759A09C7A4

Function 00569C00 Relevance: 40.5, APIs: 12, Strings: 11, Instructions: 231libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(ntdll,?,00000000,0000000C), ref: 00569C4C
GetProcAddress.KERNEL32(00000000,RtlGetVersion), ref: 00569C67
GetModuleHandleW.KERNEL32(kernel32,?,00000000,0000000C), ref: 00569C87
GetProcAddress.KERNEL32(00000000,IsWow64Process2), ref: 00569C97
GetCurrentProcess.KERNEL32(ntdll,RtlGetVersion,?,00000000,0000000C), ref: 00569CB5
GetModuleHandleW.KERNEL32(kernel32,?,00000000,0000000C), ref: 00569D57
GetProcAddress.KERNEL32(00000000,GetProductInfo), ref: 00569D6E
GetLastError.KERNEL32(?,00000000,0000000C), ref: 00569D7A
GetLastError.KERNEL32(?,00000000,0000000C), ref: 00569DC6
GetLastError.KERNEL32(?,006E90A4,00000000,GetModuleHandleW ({}),00000015,ntdll,?,00000000,0000000C), ref: 00569DEE
GetLastError.KERNEL32(Unable to determine native architecture of the system!,?,006E90A4,00000000,?,GetProcAddress ({}),00000013,?,00000000,0000000C), ref: 00569E1B
Concurrency::scheduler_worker_creation_error::scheduler_worker_creation_error.LIBCMT ref: 00569E25

Strings

st, xrefs: 00569C19
kernel32, xrefs: 00569C82, 00569D4B, 00569D50
GetProcAddress ({}), xrefs: 00569D82, 00569DF6
ntdll, xrefs: 00569C47, 00569CB4, 00569DCF
GetProductInfo, xrefs: 00569D61, 00569D8A, 00569DFE
Unable to determine native architecture of the system!, xrefs: 00569E16
GetModuleHandleW ({}), xrefs: 00569DD2
xPh, xrefs: 00569C40
IsWow64Process2, xrefs: 00569C91
8~h, xrefs: 00569D67
RtlGetVersion, xrefs: 00569C5A, 00569CB0

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: ErrorLast$AddressHandleModuleProc$Concurrency::scheduler_worker_creation_error::scheduler_worker_creation_errorCurrentProcess
String ID: 8~h$GetModuleHandleW ({})$GetProcAddress ({})$GetProductInfo$IsWow64Process2$RtlGetVersion$Unable to determine native architecture of the system!$kernel32$ntdll$xPh$st
API String ID: 3541558775-1824815594
Opcode ID: ff6328db67efd1d652e966d80c3d2926d6e3664fb495f5277af2fec8eac6aba5
Instruction ID: c754fdc00fb4956a309b7922800071e53a2adfd389fcbba41874a34f63523fdd
Opcode Fuzzy Hash: ff6328db67efd1d652e966d80c3d2926d6e3664fb495f5277af2fec8eac6aba5
Instruction Fuzzy Hash: 5271F575A00309ABCB20EFA4DC49AAEBBBDFF44711F108629F512D7280DB719D05CBA1

Function 00443F20 Relevance: 38.9, APIs: 11, Strings: 11, Instructions: 368sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(?), ref: 00443F92
GetEnvironmentVariableW.KERNEL32(ASW_CRASH_SIGNAL_EVENT,?,00000010,E57473E3), ref: 00444005
SetEvent.KERNEL32(00000000,?), ref: 00444089
Sleep.KERNEL32(000000FF), ref: 00444091

Strings

stoul argument out of range, xrefs: 004440C6
5D6B7BEF, xrefs: 004441B6
4307, xrefs: 00443F5D
st, xrefs: 00443FE4, 004440F4
invalid stoul argument, xrefs: 004440BC
5D6B7BEF, xrefs: 0044438A
ASW_CRASH_SIGNAL_EVENT, xrefs: 00444000
User-initiated crash in {} ms, xrefs: 00443F72
D, xrefs: 004443E1
Saved a crash when system is shutting down., xrefs: 0044438D
Attempted to dump when CrashGuard is being destroyed, xrefs: 004441DE

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: Sleep$EnvironmentEventVariable
String ID: 4307$5D6B7BEF$5D6B7BEF$ASW_CRASH_SIGNAL_EVENT$Attempted to dump when CrashGuard is being destroyed$D$Saved a crash when system is shutting down.$User-initiated crash in {} ms$invalid stoul argument$stoul argument out of range$st
API String ID: 602883183-3611807059
Opcode ID: bee1914439147c52e8601d152e2cb193c404e8114bef2c612036ee040cb897e7
Instruction ID: 9c5c59b3a5104afd3a2c21285d0534bff78adfd1cf02bd8bef788828ac4268f8
Opcode Fuzzy Hash: bee1914439147c52e8601d152e2cb193c404e8114bef2c612036ee040cb897e7
Instruction Fuzzy Hash: 29E19C70A00358DFDB10DFA8D885B9EBBB6FF88310F04415EE905AB381DB78A945CB95

Function 00573970 Relevance: 37.1, APIs: 20, Strings: 1, Instructions: 341fileCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00000000,E57473E3,?,?,?), ref: 00573A30
LeaveCriticalSection.KERNEL32(00000000,?,?,E57473E3,?,?,?), ref: 00573A88
GetCurrentProcess.KERNEL32(?,?,E57473E3,?,?,?), ref: 00573AA3
GetCurrentProcess.KERNEL32 ref: 00573AAB
DuplicateHandle.KERNEL32(00000000,?,00000000,?,00000000,00000000,00000002), ref: 00573AC1
GetLastError.KERNEL32 ref: 00573ACB
MapViewOfFile.KERNEL32(?,000F003F,?,?,?,?,?,E57473E3,?,?,?), ref: 00573B40
UnmapViewOfFile.KERNEL32(00000000), ref: 00573B9F
CloseHandle.KERNEL32(?), ref: 00573BA8

Strings

st, xrefs: 00573984

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: CriticalCurrentFileHandleProcessSectionView$CloseDuplicateEnterErrorLastLeaveUnmap
String ID: st
API String ID: 3068198506-1638371401
Opcode ID: 8129771b661e81215fe8670c8e85811dc4154913c0eed0299764f1b019f77f63
Instruction ID: 38bc58ecb6eb9861b271f749bf20c95617c9c635a014562e44f317adb72cc2dc
Opcode Fuzzy Hash: 8129771b661e81215fe8670c8e85811dc4154913c0eed0299764f1b019f77f63
Instruction Fuzzy Hash: F6D14D70E002199FDB15CFA8E985AAEBFF5FF48750F148169E809A7350DB749E40EB90

Function 00440F90 Relevance: 35.3, APIs: 13, Strings: 7, Instructions: 301libraryloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(E57473E3,?), ref: 00441038
GetNativeSystemInfo.KERNEL32(?), ref: 00441107
GetCurrentProcess.KERNEL32 ref: 00441125
GetCurrentProcess.KERNEL32 ref: 0044112D
DuplicateHandle.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000002), ref: 00441141
GetCurrentProcess.KERNEL32(00000104,00000000,00000000), ref: 00441221
QueryFullProcessImageNameW.KERNEL32(00000000,00000000,?,?), ref: 0044122F
GetModuleHandleW.KERNEL32(kernel32.dll,QueryThreadCycleTime), ref: 00441356
GetProcAddress.KERNEL32(00000000), ref: 0044135D
GetModuleHandleW.KERNEL32(ntdll.dll,NtGetNextThread), ref: 00441373
GetProcAddress.KERNEL32(00000000), ref: 0044137A
GetModuleHandleW.KERNEL32(ntdll.dll,RtlGetNtGlobalFlags), ref: 00441390
GetProcAddress.KERNEL32(00000000), ref: 00441397

Strings

st, xrefs: 00440FB8
RtlGetNtGlobalFlags, xrefs: 00441380
ntdll.dll, xrefs: 00441368, 00441385
kernel32.dll, xrefs: 00441351
QueryThreadCycleTime, xrefs: 0044134C
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\, xrefs: 004412FD
NtGetNextThread, xrefs: 00441363

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: Process$CurrentHandle$AddressModuleProc$DuplicateFullImageInfoNameNativeQuerySystem
String ID: NtGetNextThread$QueryThreadCycleTime$RtlGetNtGlobalFlags$SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\$kernel32.dll$ntdll.dll$st
API String ID: 2732670080-4178847312
Opcode ID: f045041949270f770a03c2fca271d02c055c545d57608aa3929547110925ee39
Instruction ID: 2785cd96c50a4f69b55d084322cffd7310dbac21ec58bdb433d93b10ba009f2b
Opcode Fuzzy Hash: f045041949270f770a03c2fca271d02c055c545d57608aa3929547110925ee39
Instruction Fuzzy Hash: 9DD12BB0A00715EFEB04DFA5C899B9ABBB4FF08304F10821AE415AB791D779A954CFD4

Function 00441420 Relevance: 35.3, APIs: 11, Strings: 9, Instructions: 298threadsynchronizationwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 0054E300: GetCurrentThread.KERNEL32 ref: 0054E33C
Part of subcall function 0054E300: OpenThreadToken.ADVAPI32(00000000,00000028,00000001,?), ref: 0054E348
Part of subcall function 0054E300: GetLastError.KERNEL32 ref: 0054E352
Part of subcall function 0054E300: ImpersonateSelf.ADVAPI32(00000002), ref: 0054E361
Part of subcall function 0054E300: GetCurrentThread.KERNEL32 ref: 0054E36B
Part of subcall function 0054E300: OpenThreadToken.ADVAPI32(00000000,00000028,00000001,?), ref: 0054E377

Part of subcall function 0054E630: LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 0054E4F9

GetModuleHandleW.KERNEL32(verifier.dll,00000001), ref: 0044157F

Part of subcall function 00447310: GetTickCount.KERNEL32 ref: 00447328
Part of subcall function 00447310: GetSystemTimes.KERNEL32(?,?,?,?,?), ref: 0044733F
Part of subcall function 00447310: GetProcessTimes.KERNEL32(00000001,?,?,?,?,?,?), ref: 00447364

Part of subcall function 00447250: GetTickCount.KERNEL32 ref: 00447272
Part of subcall function 00447250: DeviceIoControl.KERNEL32(000000FF,00070020,00000000,00000000,?,00000058,?,00000000), ref: 004472A0

GetCurrentProcess.KERNEL32 ref: 004415BC
GetPriorityClass.KERNEL32(00000000), ref: 004415C3

Part of subcall function 00431A00: VerSetConditionMask.NTDLL ref: 00431A6D
Part of subcall function 00431A00: VerSetConditionMask.NTDLL ref: 00431A75
Part of subcall function 00431A00: VerSetConditionMask.NTDLL ref: 00431A7D
Part of subcall function 00431A00: VerifyVersionInfoW.KERNEL32(00000000,00000023,00000000), ref: 00431AA4

OpenThread.KERNEL32(00000040,00000000,?,00000010), ref: 00441604
GetThreadPriority.KERNEL32(00000000), ref: 00441621
CloseHandle.KERNEL32(?), ref: 004417C3
WaitForSingleObject.KERNEL32(?,00007530), ref: 004417FD
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0044181D

Strings

SeDebugPrivilege, xrefs: 00441532
C884, xrefs: 004416AA
st, xrefs: 0044144C
Detected a hang in GUI thread through IsHungAppWindow+SendMessageCallback. Attempting to dump process..., xrefs: 004416FD
C884, xrefs: 0044147D
7AB9, xrefs: 004416BF
verifier.dll, xrefs: 0044157A
7AB9, xrefs: 00441487
Process monitoring installed., xrefs: 004414A2

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: Thread$ConditionCurrentMaskOpen$CountHandlePriorityProcessTickTimesToken$ClassCloseControlDeviceErrorImpersonateInfoLastLookupMessageModuleObjectPeekPrivilegeSelfSingleSystemValueVerifyVersionWait
String ID: 7AB9$7AB9$C884$C884$Detected a hang in GUI thread through IsHungAppWindow+SendMessageCallback. Attempting to dump process...$Process monitoring installed.$SeDebugPrivilege$verifier.dll$st
API String ID: 1977944374-1543037946
Opcode ID: a616ac6e092f4c30f92d29d7568ec74788df126abb188c15945063e5e40fa3ac
Instruction ID: fff0fedecd40cc6ce9997bc8fbc72bccbcd2c10763cb89b97744334af8d6cc68
Opcode Fuzzy Hash: a616ac6e092f4c30f92d29d7568ec74788df126abb188c15945063e5e40fa3ac
Instruction Fuzzy Hash: 64C17C70E003589FEF14CFA4C845BDEBBB5BF04704F14815AE419AB391DBB8AA84CB95

Function 00434DE0 Relevance: 31.7, APIs: 7, Strings: 11, Instructions: 237COMMON

Download Yara Rule

APIs

RtlDllShutdownInProgress.NTDLL ref: 00434E16
GetCurrentProcess.KERNEL32 ref: 00434E2A
GetProcessId.KERNEL32(00000000), ref: 00434E31
GetEnvironmentVariableW.KERNEL32(?,?,00000020), ref: 00434E90
GetLastError.KERNEL32 ref: 00434E9E
GetModuleHandleW.KERNEL32(00000000), ref: 00434F5E

Strings

st, xrefs: 00434DF7
0A76, xrefs: 00434EE1
Crash handler is already resident in this process. Enabling only manual dumping from this binary., xrefs: 0043517B
F, xrefs: 00435088
S, xrefs: 0043516C
Crash handler installed successfully process-wide from module , xrefs: 0043509A
CrashHandlerInstalled-, xrefs: 00434E45
Crash handler installed multiple times from this binary, ignoring additional install request, xrefs: 0043514B
0A2C, xrefs: 00434ED1
Could not access environment variables, crash handler will be installed anyway., xrefs: 00434F1A
Installing crashguard from DLL instead of executable. Crashes in global destruction cannot be handled., xrefs: 00434FDA

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: Process$CurrentEnvironmentErrorHandleLastModuleProgressShutdownVariable
String ID: 0A2C$0A76$Could not access environment variables, crash handler will be installed anyway.$Crash handler installed multiple times from this binary, ignoring additional install request$Crash handler installed successfully process-wide from module $Crash handler is already resident in this process. Enabling only manual dumping from this binary.$CrashHandlerInstalled-$F$Installing crashguard from DLL instead of executable. Crashes in global destruction cannot be handled.$S$st
API String ID: 3779136858-1740756050
Opcode ID: c5da47137ab72691658e3c1b655557139db3b3485d1212653228fd75c7f9d0c9
Instruction ID: c5226583d8af7c060ea3d1ca6bd0ac16f964f7459a21727648d6c9c6b067a0c8
Opcode Fuzzy Hash: c5da47137ab72691658e3c1b655557139db3b3485d1212653228fd75c7f9d0c9
Instruction Fuzzy Hash: C5B13974D002689BDB14DFA4DC45BDEBBB5BF18314F40409EE44AA7281EB786A88CF65

Function 004351F0 Relevance: 28.2, APIs: 6, Strings: 10, Instructions: 249COMMON

Download Yara Rule

APIs

RtlDllShutdownInProgress.NTDLL ref: 00435220

Strings

st, xrefs: 00435207
Uninstall failed to read from environment block. Error: , xrefs: 00435362
Uninstall from module , xrefs: 0043545E
w, xrefs: 0043544C
0A76, xrefs: 004352EF
ignored since CrashHandler was installed by module , xrefs: 004354A5
Calling Uninstall when crash handler is not installed., xrefs: 0043532A
0A2C, xrefs: 004352DF
CrashHandlerInstalled-, xrefs: 00435259
q, xrefs: 00435350

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: ProgressShutdown
String ID: ignored since CrashHandler was installed by module $0A2C$0A76$Calling Uninstall when crash handler is not installed.$CrashHandlerInstalled-$Uninstall failed to read from environment block. Error: $Uninstall from module $q$w$st
API String ID: 396724402-1259972540
Opcode ID: 4325cc9fcee3b36a3470cddad9d330820f48b8c3a57ca86681edf3533cfb2fa4
Instruction ID: 0543fb1f2168d9ea52426382fa3f2bd26aeb1c5eb7c905cfb95184ece0d30ebd
Opcode Fuzzy Hash: 4325cc9fcee3b36a3470cddad9d330820f48b8c3a57ca86681edf3533cfb2fa4
Instruction Fuzzy Hash: 17A1B071D002189FDB14EFA4DC45BDEB7B5BF18314F10419AE409A7381EB78AA88CF96

Function 004420E0 Relevance: 26.7, APIs: 7, Strings: 8, Instructions: 405COMMON

Download Yara Rule

APIs

K32EnumProcesses.KERNEL32(00000000,00000000,?,00000018,00000002,00428560,?), ref: 004422E2
GetLastError.KERNEL32 ref: 004422F0

Part of subcall function 005C6E41: AcquireSRWLockExclusive.KERNEL32(00755B64,?,?,?,0040B061,007567F8,E57473E3,E57473E3,0060B741,000000FF,?,0040FB81,?,?), ref: 005C6E4C
Part of subcall function 005C6E41: ReleaseSRWLockExclusive.KERNEL32(00755B64,?,0040B061,007567F8,E57473E3,E57473E3,0060B741,000000FF,?,0040FB81,?,?), ref: 005C6E86

OpenProcess.KERNEL32(00001000,00000000,00000000), ref: 004423CC
QueryFullProcessImageNameW.KERNEL32(00000000,00000000,?,00000104,00000108), ref: 00442453
GetCurrentProcessId.KERNEL32(00000104,00000000), ref: 004424E3

Part of subcall function 005C6DF0: AcquireSRWLockExclusive.KERNEL32(00755B64,?,?,0040B088,007567F8), ref: 005C6DFA
Part of subcall function 005C6DF0: ReleaseSRWLockExclusive.KERNEL32(00755B64,?,0040B088,007567F8), ref: 005C6E2D
Part of subcall function 005C6DF0: WakeAllConditionVariable.KERNEL32(00755B60,?,0040B088,007567F8), ref: 005C6E38

Strings

st, xrefs: 0044210C
{}ToolsSvc.exe, xrefs: 00442185
aswEngSrv.exe, xrefs: 004421E4
Cause: Process watcher, connected to previous dump, xrefs: 004425AC, 004425DC
Connected process dump unsuccessful, error code {}, xrefs: 00442636
7AB9, xrefs: 00442618
C884, xrefs: 0044260E
Unable to enumerate processes, error code {}, xrefs: 00442328

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: ExclusiveLock$Process$AcquireRelease$ConditionCurrentEnumErrorFullImageLastNameOpenProcessesQueryVariableWake
String ID: 7AB9$C884$Cause: Process watcher, connected to previous dump$Connected process dump unsuccessful, error code {}$Unable to enumerate processes, error code {}$aswEngSrv.exe${}ToolsSvc.exe$st
API String ID: 4034688761-957302427
Opcode ID: 235cf02efd65d3c362f685f21f7f8a0f057fd052a88a31d6a77273cca7d0c982
Instruction ID: ad1310760ec02b24f4dade7132bf6fe897c7d905af2c4fa8a5d216f44b43ec11
Opcode Fuzzy Hash: 235cf02efd65d3c362f685f21f7f8a0f057fd052a88a31d6a77273cca7d0c982
Instruction Fuzzy Hash: 8B027A70E00218EFEB10CFA4D945BDDBBB1BF58304F60816AE415BB281EBB46A45CF95

Function 0055A1A0 Relevance: 24.8, APIs: 8, Strings: 6, Instructions: 260COMMON

Download Yara Rule

APIs

FindFirstVolumeW.KERNEL32(?,00000040,E57473E3,?,?), ref: 0055A1FF
QueryDosDeviceW.KERNEL32(?,?,00000104,?,?,?), ref: 0055A29C
FindNextVolumeW.KERNEL32(00000000,?,00000040,?,?), ref: 0055A309
GetLastError.KERNEL32(?,?), ref: 0055A317
FindVolumeClose.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,?,?), ref: 0055A4EC
GetLastError.KERNEL32(?,?), ref: 0055A51A
GetLastError.KERNEL32(Unable to enumerate volumes!,?,?), ref: 0055A533
Concurrency::scheduler_worker_creation_error::scheduler_worker_creation_error.LIBCMT ref: 0055A540

Strings

Unable to convert NT path '{}' to a volume GUID path!, xrefs: 0055A526, 0055A55C
\\?\, xrefs: 0055A270
st, xrefs: 0055A1CB, 0055A82C
Unable to enumerate volumes!, xrefs: 0055A52E
hJf, xrefs: 0055A8B5
\Device\LanmanRedirector\, xrefs: 0055A871

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: ErrorFindLastVolume$CloseConcurrency::scheduler_worker_creation_error::scheduler_worker_creation_errorDeviceFirstNextQuery
String ID: Unable to convert NT path '{}' to a volume GUID path!$Unable to enumerate volumes!$\Device\LanmanRedirector\$\\?\$hJf$st
API String ID: 1638443985-1447451196
Opcode ID: 44d373bfa9b97a2c48ef4e03b35661e01fb55d5f71ff77771adc60ea270163f2
Instruction ID: db188327a25eea2fd89f4a124d033b51deac7ff0a44d1ccb5a5d2071655187bc
Opcode Fuzzy Hash: 44d373bfa9b97a2c48ef4e03b35661e01fb55d5f71ff77771adc60ea270163f2
Instruction Fuzzy Hash: 9EB180709012599BCB24DF64CD99BEDB7B8BF54304F4442DEE809A6291EB705B88CF51

Function 00444C00 Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 149memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00568410: GetModuleHandleW.KERNEL32(00000000,{9C7565A2-47C2-4869-B388-8C7F9AD8E577},00000030,E57473E3,?,?), ref: 0056846B
Part of subcall function 00568410: GetClassInfoExW.USER32(00000000,?,?), ref: 00568472
Part of subcall function 00568410: GetLastError.KERNEL32(?,?), ref: 00568480
Part of subcall function 00568410: Sleep.KERNELBASE(00000001,?,?), ref: 0056848A
Part of subcall function 00568410: GetProcessHeap.KERNEL32(?,?), ref: 005684A2
Part of subcall function 00568410: HeapAlloc.KERNEL32(00000000,00000000,00000034,?,?), ref: 005684B7
Part of subcall function 00568410: InitializeCriticalSection.KERNEL32(00000000), ref: 005684DA
Part of subcall function 00568410: GetProcessHeap.KERNEL32(?,?), ref: 005684E0
Part of subcall function 00568410: GetProcessHeap.KERNEL32(?,?), ref: 005684FE
Part of subcall function 00568410: RegisterClassExW.USER32(00000030), ref: 00568520
Part of subcall function 00568410: HeapFree.KERNEL32(?,00000000,00000000), ref: 00568554
Part of subcall function 00568410: DeleteCriticalSection.KERNEL32(?), ref: 0056857F
Part of subcall function 00568410: GetProcessHeap.KERNEL32 ref: 00568585

EnterCriticalSection.KERNEL32(00000000,E57473E3,?,?), ref: 00444C4E
GetProcessHeap.KERNEL32 ref: 00444C5B

Part of subcall function 00428A30: GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,E57473E3,00000000,00479677), ref: 00428A3A
Part of subcall function 00428A30: HeapAlloc.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,E57473E3,00000000,00479677), ref: 00428A82

HeapAlloc.KERNEL32(00000000,00000000,00000004,00000000), ref: 00444C98
asw_process_storage_allocate_connector.ANTISPAM_CONNECT_EU ref: 00444CA8
GetProcessHeap.KERNEL32 ref: 00444CBA
HeapFree.KERNEL32(00000000,00000000,?,?), ref: 00444D0C
asw_process_storage_deallocate_connector.ANTISPAM_CONNECT_EU ref: 00444D1C
HeapFree.KERNEL32(?,00000000,?,?), ref: 00444D3C
asw_process_storage_deallocate_connector.ANTISPAM_CONNECT_EU ref: 00444D4C
HeapFree.KERNEL32(?,00000000,?,?), ref: 00444D7A
asw_process_storage_deallocate_connector.ANTISPAM_CONNECT_EU ref: 00444D8A

Part of subcall function 005C90B0: RaiseException.KERNEL32(E06D7363,00000001,00000003,0042867C,?,?,?,?,0042867C,st,006E8FF4,E57473E3), ref: 005C9110

LeaveCriticalSection.KERNEL32(?,?), ref: 00444D92

Strings

st, xrefs: 00444C28
asw::crashguard::ProcessWatcher::Singleton::v1, xrefs: 00444CE4

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: Heap$Process$CriticalFreeSection$Allocasw_process_storage_deallocate_connector$Class$DeleteEnterErrorExceptionHandleInfoInitializeLastLeaveModuleRaiseRegisterSleepasw_process_storage_allocate_connector
String ID: asw::crashguard::ProcessWatcher::Singleton::v1$st
API String ID: 3690541070-805479441
Opcode ID: ea4de351046a08742d53d5a0026fc74fd39ca0882cf6e33987389baa8ac3b2cd
Instruction ID: d710e2b5c54bf2bae4736702ac9d220fdbe0be7378c1cf99a022a458905b6b82
Opcode Fuzzy Hash: ea4de351046a08742d53d5a0026fc74fd39ca0882cf6e33987389baa8ac3b2cd
Instruction Fuzzy Hash: D951B1B0D01218DFDB00DFA4DD4ABAEBBB5FF84315F144129E815B7390EB796A008B96

Function 0042AF40 Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 149memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00568410: GetModuleHandleW.KERNEL32(00000000,{9C7565A2-47C2-4869-B388-8C7F9AD8E577},00000030,E57473E3,?,?), ref: 0056846B
Part of subcall function 00568410: GetClassInfoExW.USER32(00000000,?,?), ref: 00568472
Part of subcall function 00568410: GetLastError.KERNEL32(?,?), ref: 00568480
Part of subcall function 00568410: Sleep.KERNELBASE(00000001,?,?), ref: 0056848A
Part of subcall function 00568410: GetProcessHeap.KERNEL32(?,?), ref: 005684A2
Part of subcall function 00568410: HeapAlloc.KERNEL32(00000000,00000000,00000034,?,?), ref: 005684B7
Part of subcall function 00568410: InitializeCriticalSection.KERNEL32(00000000), ref: 005684DA
Part of subcall function 00568410: GetProcessHeap.KERNEL32(?,?), ref: 005684E0
Part of subcall function 00568410: GetProcessHeap.KERNEL32(?,?), ref: 005684FE
Part of subcall function 00568410: RegisterClassExW.USER32(00000030), ref: 00568520
Part of subcall function 00568410: HeapFree.KERNEL32(?,00000000,00000000), ref: 00568554
Part of subcall function 00568410: DeleteCriticalSection.KERNEL32(?), ref: 0056857F
Part of subcall function 00568410: GetProcessHeap.KERNEL32 ref: 00568585

EnterCriticalSection.KERNEL32(00000000,E57473E3,00000000), ref: 0042AF8E
GetProcessHeap.KERNEL32 ref: 0042AF9B

Part of subcall function 00428A30: GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,E57473E3,00000000,00479677), ref: 00428A3A
Part of subcall function 00428A30: HeapAlloc.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,E57473E3,00000000,00479677), ref: 00428A82

HeapAlloc.KERNEL32(00000000,00000000,00000004,00000000), ref: 0042AFD8
asw_process_storage_allocate_connector.ANTISPAM_CONNECT_EU ref: 0042AFE8
GetProcessHeap.KERNEL32 ref: 0042AFFA
HeapFree.KERNEL32(00000000,00000000,?,?), ref: 0042B04C
asw_process_storage_deallocate_connector.ANTISPAM_CONNECT_EU ref: 0042B05C
HeapFree.KERNEL32(?,00000000,?,?), ref: 0042B07C
asw_process_storage_deallocate_connector.ANTISPAM_CONNECT_EU ref: 0042B08C
HeapFree.KERNEL32(?,00000000,?,?), ref: 0042B0BA
asw_process_storage_deallocate_connector.ANTISPAM_CONNECT_EU ref: 0042B0CA

Part of subcall function 005C90B0: RaiseException.KERNEL32(E06D7363,00000001,00000003,0042867C,?,?,?,?,0042867C,st,006E8FF4,E57473E3), ref: 005C9110

LeaveCriticalSection.KERNEL32(?,?), ref: 0042B0D2

Strings

st, xrefs: 0042AF68
asw::settings::SettingsConfig::Lock, xrefs: 0042B024

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: Heap$Process$CriticalFreeSection$Allocasw_process_storage_deallocate_connector$Class$DeleteEnterErrorExceptionHandleInfoInitializeLastLeaveModuleRaiseRegisterSleepasw_process_storage_allocate_connector
String ID: asw::settings::SettingsConfig::Lock$st
API String ID: 3690541070-1819676044
Opcode ID: c3869b99bb10997de23738380ca779a35628be8f4a6b582b9ab2cda6c6545b86
Instruction ID: 69d342e53c8c6517c09758aad6dc0533a71876b81366fb2a1bf5bf1cd64aafde
Opcode Fuzzy Hash: c3869b99bb10997de23738380ca779a35628be8f4a6b582b9ab2cda6c6545b86
Instruction Fuzzy Hash: 6C51B071E01228DFCB01DFA4DD49BAEBBB5EF44704F144129E811A7390DB796E44CB96

Function 0054D830 Relevance: 24.6, APIs: 7, Strings: 7, Instructions: 119COMMON

Download Yara Rule

APIs

Part of subcall function 0054E9D0: AllocateAndInitializeSid.ADVAPI32(?,00000000,E57473E3,00000030,00000000,00000000,00000000,00000000,00000000,00000000,?,E57473E3,00000000,00000030,E57473E3,00000000), ref: 0054EA2F

DuplicateToken.ADVAPI32(00000000,00000001,00000000,00000000,00000002,00000020,00000220,?,?,00000000,00000030,E57473E3,00000000,?), ref: 0054D8A6
CheckTokenMembership.ADVAPI32(00000000,?,?,?,?,00000000,00000030,E57473E3,00000000,?), ref: 0054D8C5
CloseHandle.KERNEL32(00000000,?,?,00000000,00000030,E57473E3,00000000,?), ref: 0054D8E2
GetLastError.KERNEL32(Unable to duplicate the access token!,?,?,00000000,00000030,E57473E3,00000000,?), ref: 0054D95F
Concurrency::scheduler_worker_creation_error::scheduler_worker_creation_error.LIBCMT ref: 0054D969
GetLastError.KERNEL32(Unable to check token membership!,?,006E90A4,00000000,?,?,00000000,00000030,E57473E3,00000000,?), ref: 0054D981
Concurrency::scheduler_worker_creation_error::scheduler_worker_creation_error.LIBCMT ref: 0054D98B

Strings

st, xrefs: 0054D844, 0054DB24
Unable to retrieve the size of user SID!, xrefs: 0054DACA
Unable to duplicate the access token!, xrefs: 0054D95A
Unable to check token membership!, xrefs: 0054D97C
Unable to open current thread token!, xrefs: 0054DBE7
Unable to retrieve the user SID!, xrefs: 0054DAEC
Unable to open default process token!, xrefs: 0054DC09

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: Concurrency::scheduler_worker_creation_error::scheduler_worker_creation_errorErrorLastToken$AllocateCheckCloseDuplicateHandleInitializeMembership
String ID: Unable to check token membership!$Unable to duplicate the access token!$Unable to open current thread token!$Unable to open default process token!$Unable to retrieve the size of user SID!$Unable to retrieve the user SID!$st
API String ID: 4249512730-986312637
Opcode ID: 763e86e91353ae5fe84573540e1c7fc5a55bc9735ec17a23b5609ee5ba25e99b
Instruction ID: 6cc4a15bfc4afd07d76d426647f035d9fc38f9b02bd15c40f945e7bd3178d409
Opcode Fuzzy Hash: 763e86e91353ae5fe84573540e1c7fc5a55bc9735ec17a23b5609ee5ba25e99b
Instruction Fuzzy Hash: 87413A71A00219AFDB10DF94CD49BEEBBB9FF48714F54011AE805B7280DBB56E04CBA5

Function 0054E300 Relevance: 24.6, APIs: 10, Strings: 4, Instructions: 73threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 0054E33C
OpenThreadToken.ADVAPI32(00000000,00000028,00000001,?), ref: 0054E348
GetLastError.KERNEL32 ref: 0054E352
ImpersonateSelf.ADVAPI32(00000002), ref: 0054E361
GetCurrentThread.KERNEL32 ref: 0054E36B
OpenThreadToken.ADVAPI32(00000000,00000028,00000001,?), ref: 0054E377
GetLastError.KERNEL32(Unable to assign the process impersonation token to the thread!), ref: 0054E39C
Concurrency::scheduler_worker_creation_error::scheduler_worker_creation_error.LIBCMT ref: 0054E3A6
GetLastError.KERNEL32(Unable to obtain the thread access token!), ref: 0054E3BE
Concurrency::scheduler_worker_creation_error::scheduler_worker_creation_error.LIBCMT ref: 0054E3C8

Strings

st, xrefs: 0054E315, 0054E644
Unable to adjust token privilege '{}'!, xrefs: 0054E568
Unable to assign the process impersonation token to the thread!, xrefs: 0054E397
Unable to obtain the thread access token!, xrefs: 0054E3B9

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: Thread$ErrorLast$Concurrency::scheduler_worker_creation_error::scheduler_worker_creation_errorCurrentOpenToken$ImpersonateSelf
String ID: Unable to adjust token privilege '{}'!$Unable to assign the process impersonation token to the thread!$Unable to obtain the thread access token!$st
API String ID: 3581119537-402105861
Opcode ID: 1d61b735ac10e542653dd818b174b578291981f086090b33b8118cdc2bc1674f
Instruction ID: 3081ac8ddc037e536c0298f6f189fc3d177d41bc89a3f1f89c34f253480cc4b9
Opcode Fuzzy Hash: 1d61b735ac10e542653dd818b174b578291981f086090b33b8118cdc2bc1674f
Instruction Fuzzy Hash: A7218E31A40664ABDB10AFA4DC0EFDA7BADFB08B15F00451DF516E32D2DBB995048BA1

Function 00446C70 Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 276registryfileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,00000080,00000003,00000000,00000003,00000000,00000000,?,E57473E3,?), ref: 00446D33
DeviceIoControl.KERNEL32(00000000,Function_00160000,00000000,00000000,?,00000020,?,00000000), ref: 00446D77
CreateFileW.KERNEL32(?,00000080,00000003,00000000,00000003,00000000,00000000,?,?,?,?,?,E57473E3,?), ref: 00446DC3

Part of subcall function 0054DB10: GetCurrentThread.KERNEL32 ref: 0054DB50
Part of subcall function 0054DB10: OpenThreadToken.ADVAPI32(00000000,0000000A,00000001,00000000), ref: 0054DB5F
Part of subcall function 0054DB10: GetLastError.KERNEL32 ref: 0054DB69
Part of subcall function 0054DB10: GetCurrentProcess.KERNEL32 ref: 0054DB76
Part of subcall function 0054DB10: OpenProcessToken.ADVAPI32(00000000,0000000A,00000000), ref: 0054DB83
Part of subcall function 0054DB10: CloseHandle.KERNEL32(00000000), ref: 0054DB9F

CloseHandle.KERNEL32(00000000,?,?,?,?,?,E57473E3,?), ref: 00447133

Part of subcall function 0055F230: RegCreateKeyExW.ADVAPI32(?,?,00000000,00000000,?,?,00000000,00000000,00000000,E57473E3,00000000,?), ref: 0055F2B5
Part of subcall function 0055F230: RegCreateKeyExW.ADVAPI32(?,?,00000000,00000000,?,?,00000000,?,00000000,?), ref: 0055F339
Part of subcall function 0055F230: RegCloseKey.ADVAPI32(?), ref: 0055F367
Part of subcall function 0055F230: SetLastError.KERNEL32(00000000), ref: 0055F372

RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,E57473E3,?), ref: 00446E89
SetLastError.KERNEL32(00000000,?,?,?,?,?,?,?,?,E57473E3,?), ref: 00446E94
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,E57473E3,?), ref: 00446F5E
SetLastError.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,E57473E3,?), ref: 00446F69
RegCloseKey.ADVAPI32(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,E57473E3,?), ref: 00447062
SetLastError.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,E57473E3,?), ref: 00447071
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,E57473E3,?), ref: 0044707F
CloseHandle.KERNEL32(00000000,?,E57473E3,?), ref: 00447143

Strings

st, xrefs: 00446C9C

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: Close$ErrorLast$CreateHandle$CurrentFileOpenProcessThreadToken$ControlDevice
String ID: st
API String ID: 2389474233-1638371401
Opcode ID: 5abec125693760fdc2b911200e15a0d1ca1964322192394ce48ef64d89106fcf
Instruction ID: aa501fd81b9d2efb20920065810a6325b42bfa28577ff82436f2f4c3c06037cb
Opcode Fuzzy Hash: 5abec125693760fdc2b911200e15a0d1ca1964322192394ce48ef64d89106fcf
Instruction Fuzzy Hash: 48C18CB0D043589BEB21DF64CC45BAEB7B8BF09304F00459AE949A7381EB74AB85CF55

Function 00418B00 Relevance: 23.0, APIs: 7, Strings: 6, Instructions: 250COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00418B89
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00418BD5
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 00418CAD
std::_Lockit::~_Lockit.LIBCPMT ref: 00418D42
Concurrency::cancel_current_task.LIBCPMT ref: 00418D67
Concurrency::cancel_current_task.LIBCPMT ref: 00418D6C
Concurrency::cancel_current_task.LIBCPMT ref: 00418D71

Strings

false, xrefs: 00418C5B, 00418F7D
st, xrefs: 00418B19, 00418D99
true, xrefs: 00418C85, 00418F84
bad locale name, xrefs: 00418D5D
Argument not found., xrefs: 00418E0E
nan, xrefs: 0041901E, 004190A8, 0041913B

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: std::_$Concurrency::cancel_current_task$Locinfo::_Lockit$Locinfo_ctorLocinfo_dtorLockit::_Lockit::~_
String ID: Argument not found.$bad locale name$false$nan$true$st
API String ID: 3559308103-3449486371
Opcode ID: 8b846d76508897104d911ce6737857f0be0c1ad5c23e92481ee5887ec299fdb0
Instruction ID: 82a433d1795e45afa657e801616486a3fa49745d552d9e9be5349e744eea2889
Opcode Fuzzy Hash: 8b846d76508897104d911ce6737857f0be0c1ad5c23e92481ee5887ec299fdb0
Instruction Fuzzy Hash: 359159B0D013499ADB20DFA8D945BDEBBF4AF54300F14416EE805A7381EB79AA44CBA1

Function 0043E350 Relevance: 22.9, APIs: 4, Strings: 9, Instructions: 152COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,?,0000001C,?,E57473E3,?,?), ref: 0043E3C4
GetModuleHandleW.KERNEL32(ole32.dll), ref: 0043E3D3
GetModuleHandleW.KERNEL32(combase.dll), ref: 0043E3E3
RevertToSelf.ADVAPI32(?,E57473E3,?,?), ref: 0043E42F

Strings

AA71, xrefs: 0043E45C
Warning: STATUS_THREADPOOL_HANDLE_EXCEPTION exception was dispatched., xrefs: 0043E54C
combase.dll, xrefs: 0043E3DE
Warning: STATUS_CALLBACK_RETURNED_WHILE_IMPERSONATING exception was dispatched., xrefs: 0043E491
st, xrefs: 0043E364
B14E, xrefs: 0043E505
B14E, xrefs: 0043E44A
AA71, xrefs: 0043E517
ole32.dll, xrefs: 0043E3CE

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: HandleModule$QueryRevertSelfVirtual
String ID: AA71$AA71$B14E$B14E$Warning: STATUS_CALLBACK_RETURNED_WHILE_IMPERSONATING exception was dispatched.$Warning: STATUS_THREADPOOL_HANDLE_EXCEPTION exception was dispatched.$combase.dll$ole32.dll$st
API String ID: 205307313-1709894243
Opcode ID: b5927a964ce152938aec90a43cde9e2240b758d6a94534da2c00b7d52a526ea4
Instruction ID: 67ec2f5022b9fe3415e6ab32dd0308cf668c65c0752fd11b269417b6f38d0f2f
Opcode Fuzzy Hash: b5927a964ce152938aec90a43cde9e2240b758d6a94534da2c00b7d52a526ea4
Instruction Fuzzy Hash: D1516A70A01218DFDB10DFA5C884AAEB7B5FF5C314F10616AE905AB381D778AD41CF65

Function 0042AAB0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 149memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00568410: GetModuleHandleW.KERNEL32(00000000,{9C7565A2-47C2-4869-B388-8C7F9AD8E577},00000030,E57473E3,?,?), ref: 0056846B
Part of subcall function 00568410: GetClassInfoExW.USER32(00000000,?,?), ref: 00568472
Part of subcall function 00568410: GetLastError.KERNEL32(?,?), ref: 00568480
Part of subcall function 00568410: Sleep.KERNELBASE(00000001,?,?), ref: 0056848A
Part of subcall function 00568410: GetProcessHeap.KERNEL32(?,?), ref: 005684A2
Part of subcall function 00568410: HeapAlloc.KERNEL32(00000000,00000000,00000034,?,?), ref: 005684B7
Part of subcall function 00568410: InitializeCriticalSection.KERNEL32(00000000), ref: 005684DA
Part of subcall function 00568410: GetProcessHeap.KERNEL32(?,?), ref: 005684E0
Part of subcall function 00568410: GetProcessHeap.KERNEL32(?,?), ref: 005684FE
Part of subcall function 00568410: RegisterClassExW.USER32(00000030), ref: 00568520
Part of subcall function 00568410: HeapFree.KERNEL32(?,00000000,00000000), ref: 00568554
Part of subcall function 00568410: DeleteCriticalSection.KERNEL32(?), ref: 0056857F
Part of subcall function 00568410: GetProcessHeap.KERNEL32 ref: 00568585

EnterCriticalSection.KERNEL32(00000000,E57473E3,00000000,00568380), ref: 0042AB01
GetProcessHeap.KERNEL32 ref: 0042AB0E

Part of subcall function 00428A30: GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,E57473E3,00000000,00479677), ref: 00428A3A
Part of subcall function 00428A30: HeapAlloc.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,E57473E3,00000000,00479677), ref: 00428A82

HeapAlloc.KERNEL32(00000000,00000000,00000004,00000000), ref: 0042AB4B
asw_process_storage_allocate_connector.ANTISPAM_CONNECT_EU ref: 0042AB5B
GetProcessHeap.KERNEL32 ref: 0042AB6D
HeapFree.KERNEL32(00000000,00000000,?,?), ref: 0042ABBD
asw_process_storage_deallocate_connector.ANTISPAM_CONNECT_EU ref: 0042ABCD
HeapFree.KERNEL32(?,00000000,?,?), ref: 0042ABED
asw_process_storage_deallocate_connector.ANTISPAM_CONNECT_EU ref: 0042ABFD
HeapFree.KERNEL32(?,00000000,?,?), ref: 0042AC2B
asw_process_storage_deallocate_connector.ANTISPAM_CONNECT_EU ref: 0042AC3B

Part of subcall function 005C90B0: RaiseException.KERNEL32(E06D7363,00000001,00000003,0042867C,?,?,?,?,0042867C,st,006E8FF4,E57473E3), ref: 005C9110

LeaveCriticalSection.KERNEL32(?,?), ref: 0042AC43

Strings

st, xrefs: 0042AAD8

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: Heap$Process$CriticalFreeSection$Allocasw_process_storage_deallocate_connector$Class$DeleteEnterErrorExceptionHandleInfoInitializeLastLeaveModuleRaiseRegisterSleepasw_process_storage_allocate_connector
String ID: st
API String ID: 3690541070-1638371401
Opcode ID: e7cf41f62531938a4bce04e6fe36056495923f48c81b3d943cc3ceaae75c14d8
Instruction ID: cd096a8acb69d6631e34ab62ab5a47bb08054eeb3f6944b9cc8d0232975e1948
Opcode Fuzzy Hash: e7cf41f62531938a4bce04e6fe36056495923f48c81b3d943cc3ceaae75c14d8
Instruction Fuzzy Hash: 5451CD70E00228DFCB00DFA4DC49BAEBBB2BF44304F144129E801A7390DB796E11CB9A

Function 0054DC30 Relevance: 22.8, APIs: 10, Strings: 3, Instructions: 91threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 0054DC70
OpenThreadToken.ADVAPI32(00000000,0000000A,00000001,00000000), ref: 0054DC7F
GetLastError.KERNEL32 ref: 0054DC89
GetCurrentProcess.KERNEL32 ref: 0054DC96
OpenProcessToken.ADVAPI32(00000000,0000000A,00000000), ref: 0054DCA3
CloseHandle.KERNEL32(00000000), ref: 0054DCBF
GetLastError.KERNEL32(Unable to open current thread token!), ref: 0054DD0C
Concurrency::scheduler_worker_creation_error::scheduler_worker_creation_error.LIBCMT ref: 0054DD16
GetLastError.KERNEL32(Unable to open default process token!,?,006E90A4,00000000), ref: 0054DD2E
Concurrency::scheduler_worker_creation_error::scheduler_worker_creation_error.LIBCMT ref: 0054DD38

Strings

st, xrefs: 0054DC44
Unable to open current thread token!, xrefs: 0054DD07
Unable to open default process token!, xrefs: 0054DD29

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: ErrorLast$Concurrency::scheduler_worker_creation_error::scheduler_worker_creation_errorCurrentOpenProcessThreadToken$CloseHandle
String ID: Unable to open current thread token!$Unable to open default process token!$st
API String ID: 1773969159-2978746600
Opcode ID: b6bab3a3567c1c2e3e1ae0c8b762b32ad2f13e57f5b89f8a98f467b5ec4e4a2d
Instruction ID: 1c6b3195906ce670c38f8d0c158da60e341cad31148265ad287a70d712baa5fb
Opcode Fuzzy Hash: b6bab3a3567c1c2e3e1ae0c8b762b32ad2f13e57f5b89f8a98f467b5ec4e4a2d
Instruction Fuzzy Hash: A8318971A40249AFDB14ABA0DC8EFEEBB79FF44714F500119F102E6291DBB49A04CBA1

Function 00576C90 Relevance: 22.8, APIs: 8, Strings: 5, Instructions: 77filelibraryloaderCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00757F98,00000000,00000000,00757F98,0040BEF3), ref: 00576C96
CreateFileW.KERNEL32(00000000,00000000), ref: 00576CBF
CreateFileW.KERNEL32(00000000,00000000), ref: 00576D0D
CreateFileW.KERNEL32(00000000,00000000), ref: 00576D39
GetModuleHandleW.KERNEL32(kernel32.dll), ref: 00576D47
GetProcAddress.KERNEL32(00000000,GetNamedPipeClientProcessId), ref: 00576D59
GetProcAddress.KERNEL32(00000000,GetNamedPipeServerProcessId), ref: 00576D68
LeaveCriticalSection.KERNEL32(00757F98), ref: 00576D79

Strings

GetNamedPipeClientProcessId, xrefs: 00576D53
kernel32.dll, xrefs: 00576D42
tfh, xrefs: 00576D2B
GetNamedPipeServerProcessId, xrefs: 00576D5F
fh, xrefs: 00576CFF

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: CreateFile$AddressCriticalProcSection$EnterHandleLeaveModule
String ID: GetNamedPipeClientProcessId$GetNamedPipeServerProcessId$kernel32.dll$tfh$fh
API String ID: 412012347-169274759
Opcode ID: f1c8c3286e496d294b7ab1dabc85191112a2ddb33032e984969cd82d6098dbb5
Instruction ID: ab62dc3c7fadac8568fa38cb2fc0ff87d3d354444f7809ac2fc207c3c1ee4195
Opcode Fuzzy Hash: f1c8c3286e496d294b7ab1dabc85191112a2ddb33032e984969cd82d6098dbb5
Instruction Fuzzy Hash: B121A470A40B11BEE3312B70BC0EF1679F9FB44B25F208719F656A66D0DBB0E6019A95

Function 0042D710 Relevance: 21.2, APIs: 6, Strings: 6, Instructions: 249fileCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,E57473E3,?,?), ref: 0042D781
PathAppendW.SHLWAPI(?,?), ref: 0042D8BC
SHCreateDirectory.SHELL32(00000000,?), ref: 0042D8D3
LeaveCriticalSection.KERNEL32(?), ref: 0042DA60

Strings

st, xrefs: 0042D73B
unp%u%ui-unhandled.mdmp, xrefs: 0042D88B
A983, xrefs: 0042D7BE
BBBB, xrefs: 0042D7B4
unp%u%ux-kernel-manual.dmp, xrefs: 0042D87B, 0042D899
unp%u%ui-manual.mdmp, xrefs: 0042D886

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: CriticalSection$AppendCreateDirectoryEnterLeavePath
String ID: A983$BBBB$unp%u%ui-manual.mdmp$unp%u%ui-unhandled.mdmp$unp%u%ux-kernel-manual.dmp$st
API String ID: 651574149-3509401162
Opcode ID: d0c28f7b429cd3d1c5a1a9ba4a8019da9bf30be93551c624455807e195625443
Instruction ID: 05a4845c8dee55909d3d481ccb0b3939354edf43c7d9f95b27a050bde8f0b16d
Opcode Fuzzy Hash: d0c28f7b429cd3d1c5a1a9ba4a8019da9bf30be93551c624455807e195625443
Instruction Fuzzy Hash: 9EB17BB0E002199FDB14DFA4C845BEEBBB4BF48304F50416AE819A7381EB74AA54CF91

Function 00559540 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 138COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00008000,00000000,E57473E3,?,?), ref: 00559637
K32GetMappedFileNameW.KERNEL32(00000000,00400000,?,00000000), ref: 00559645
GetLastError.KERNEL32(Unable to retrieve the path of the module!), ref: 005597AD
Concurrency::scheduler_worker_creation_error::scheduler_worker_creation_error.LIBCMT ref: 005597B7
GetLastError.KERNEL32(Unable to get the path of the module!,?,006E90A4,00000000), ref: 005597CF
Concurrency::scheduler_worker_creation_error::scheduler_worker_creation_error.LIBCMT ref: 005597D9
GetLastError.KERNEL32(Unable to store the path of the module!,?,006E90A4,00000000), ref: 005597F1
Concurrency::scheduler_worker_creation_error::scheduler_worker_creation_error.LIBCMT ref: 005597FB

Strings

Unable to get the path of the module!, xrefs: 005597CA
st, xrefs: 00559569
Unable to retrieve the path of the module!, xrefs: 005597A8
Unable to store the path of the module!, xrefs: 005597EC

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: Concurrency::scheduler_worker_creation_error::scheduler_worker_creation_errorErrorLast$CurrentFileMappedNameProcess
String ID: Unable to get the path of the module!$Unable to retrieve the path of the module!$Unable to store the path of the module!$st
API String ID: 3252908632-610202592
Opcode ID: 93725f17d45443f3d69cffcf03c1f78806a0987852691755e8c160c9254f4f7b
Instruction ID: f47827aa6af82f3dbf5352d97a580054ffaf0b6f5ae73ffd9d4f63f824a8d41d
Opcode Fuzzy Hash: 93725f17d45443f3d69cffcf03c1f78806a0987852691755e8c160c9254f4f7b
Instruction Fuzzy Hash: 91517C71D01248EACB04EFA4D959BDEBBB5FF48304F10425EE405B7281EB756A48CB95

Function 0054D700 Relevance: 21.1, APIs: 5, Strings: 7, Instructions: 105libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(ntdll), ref: 0054D738
GetProcAddress.KERNEL32(00000000,NtQueryInformationProcess), ref: 0054D74F
GetLastError.KERNEL32 ref: 0054D76F
GetLastError.KERNEL32(?,006E90A4,00000000,GetModuleHandleW ({}),00000015,ntdll), ref: 0054D797
Concurrency::scheduler_worker_creation_error::scheduler_worker_creation_error.LIBCMT ref: 0054D818

Strings

st, xrefs: 0054D719, 0054D7C9
GetProcAddress ({}), xrefs: 0054D79F
ntdll, xrefs: 0054D72C, 0054D778
GetModuleHandleW ({}), xrefs: 0054D77B
Unable to retrieve basic process information!, xrefs: 0054D80E
NtQueryInformationProcess, xrefs: 0054D742, 0054D748
xPh, xrefs: 0054D731

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: ErrorLast$AddressConcurrency::scheduler_worker_creation_error::scheduler_worker_creation_errorHandleModuleProc
String ID: GetModuleHandleW ({})$GetProcAddress ({})$NtQueryInformationProcess$Unable to retrieve basic process information!$ntdll$xPh$st
API String ID: 2317602325-4015651349
Opcode ID: 24f3731ab066f6b51a8bde017dd8b31ca3594d740a61bc1714307bd3cd7cf760
Instruction ID: 5a733e561cd8be1e1ca05a7bd37048ed999ea37a19255e4744915e1ce443362e
Opcode Fuzzy Hash: 24f3731ab066f6b51a8bde017dd8b31ca3594d740a61bc1714307bd3cd7cf760
Instruction Fuzzy Hash: 5731A671A00308AFD710EBA5DC4AEAEBBB9FF44714F40451DB511A7281EF70A60587E6

Function 0044A280 Relevance: 19.7, APIs: 8, Strings: 3, Instructions: 426libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 0048CC70: EnterCriticalSection.KERNEL32(0492B9D8,E57473E3,00000000,00000010), ref: 0048CCD6
Part of subcall function 0048CC70: LeaveCriticalSection.KERNEL32(0492B9D8), ref: 0048CCED

InitializeCriticalSection.KERNEL32(?), ref: 0044A4C8

Part of subcall function 0047F960: EnterCriticalSection.KERNEL32(?,?,?), ref: 0047FAF9
Part of subcall function 0047F960: LeaveCriticalSection.KERNEL32(?,?,?), ref: 0047FB09

InitializeCriticalSection.KERNEL32(?,?,?,?,?), ref: 0044A510
InitializeCriticalSection.KERNEL32(?), ref: 0044A6CB
InitializeCriticalSection.KERNEL32(?), ref: 0044A6F6
GetModuleHandleW.KERNEL32(00000000,00000002,config,00000006), ref: 0044A7B0
GetProcAddress.KERNEL32(00000000,IsRunningInsideAvastService), ref: 0044A7C0
GetModuleHandleW.KERNEL32(00000000,00000002,config,00000006), ref: 0044A7E9
GetProcAddress.KERNEL32(00000000,IsRunningInsideAvastService), ref: 0044A7F9

Strings

st, xrefs: 0044A2AD
config, xrefs: 0044A78F
IsRunningInsideAvastService, xrefs: 0044A7BA, 0044A7F3

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: CriticalSection$Initialize$AddressEnterHandleLeaveModuleProc
String ID: IsRunningInsideAvastService$config$st
API String ID: 3586029248-770483753
Opcode ID: fb15a8bdc4fe2ed2f3ba854fe4ceb4c35e8fc979262785f0ba2d1f876bd8d001
Instruction ID: ba162c308adbdcaba925be0e4c73af335c44937acd20fa8a959e3bd3da58ef2b
Opcode Fuzzy Hash: fb15a8bdc4fe2ed2f3ba854fe4ceb4c35e8fc979262785f0ba2d1f876bd8d001
Instruction Fuzzy Hash: D62235B0900705DFD710CF64C484B9ABBF5BF08318F14855EE59AAB391DBB8AA48CF95

Function 00572FE0 Relevance: 19.5, APIs: 9, Strings: 2, Instructions: 293COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(00000000,00000000,00628F36,00000000,?,?,?,?,?,?,?,?), ref: 005730A8
GetLastError.KERNEL32(?,?,?,?,?,?,?,?), ref: 005730B3

Strings

st, xrefs: 00572FE6
FILE:, xrefs: 00573069

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID: FILE:$st
API String ID: 2976181284-1692901217
Opcode ID: 3ffacfb8919580b29d4966dba7dfc2b6d2379e4306f2634c3f81d9b8230cd002
Instruction ID: c054dbb66ffbd57db74512e6856537cb3e4565c9636c6916c75dddbef029f377
Opcode Fuzzy Hash: 3ffacfb8919580b29d4966dba7dfc2b6d2379e4306f2634c3f81d9b8230cd002
Instruction Fuzzy Hash: 4BA1D875A002099BDF209FA4EC89BEDBFB5FF48320F548129F909B3291DB755A44EB50

Function 005735E0 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 290fileCOMMON

Download Yara Rule

APIs

CreateFileMappingW.KERNEL32(000000FF,00757448,?,?,?,00000000,E57473E3,00000000,?), ref: 005737DC
GetLastError.KERNEL32 ref: 005737EE
GetLastError.KERNEL32 ref: 005737F4
GetLastError.KERNEL32 ref: 00573801
MapViewOfFile.KERNEL32(?,?,?,?,?), ref: 00573836
GetLastError.KERNEL32 ref: 00573843
CloseHandle.KERNEL32(?), ref: 0057384D
CloseHandle.KERNEL32(?), ref: 00573862
LeaveCriticalSection.KERNEL32(00000000,?), ref: 00573921

Strings

st, xrefs: 0057360B

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: ErrorLast$CloseFileHandle$CreateCriticalLeaveMappingSectionView
String ID: st
API String ID: 2089499544-1638371401
Opcode ID: 5a4f1529930c35d7c1d8532b6acca650a9281927c30da619e2f4929434cbc891
Instruction ID: a1311c8b79546f7f9b536cbb6963c31f354eddc222c077a32c72d074d0c8b689
Opcode Fuzzy Hash: 5a4f1529930c35d7c1d8532b6acca650a9281927c30da619e2f4929434cbc891
Instruction Fuzzy Hash: D4B17FB1E012199FDB18CF95E9447ADBFF2FF88720F148119E815A7390DB719E01AB90

Function 00432230 Relevance: 19.5, APIs: 9, Strings: 2, Instructions: 230COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 004322B3
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 004322FF
__Getctype.LIBCPMT ref: 00432318
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 00432334
std::_Lockit::~_Lockit.LIBCPMT ref: 004323C9
std::_Lockit::_Lockit.LIBCPMT ref: 00432436
std::_Lockit::_Lockit.LIBCPMT ref: 00432459
std::_Lockit::~_Lockit.LIBCPMT ref: 00432479
std::_Lockit::~_Lockit.LIBCPMT ref: 0043250D

Strings

st, xrefs: 0043225A, 00432414
bad locale name, xrefs: 004323E7

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Locinfo::_$GetctypeLocinfo_ctorLocinfo_dtor
String ID: bad locale name$st
API String ID: 810752134-2289111497
Opcode ID: 380e1adad396c41ec83c7b9071d65293fec204132b23940c1cbb07d0dd7f700d
Instruction ID: 2140292c6385ee8aaee51bc1966c7d6b14433e968a6a9a3469e008297a2e7721
Opcode Fuzzy Hash: 380e1adad396c41ec83c7b9071d65293fec204132b23940c1cbb07d0dd7f700d
Instruction Fuzzy Hash: 2481D2B1D002499FDB10DFA8D945B9EBBB4FF58310F14816AEC05A7381EB78AA05CB95

Function 0043AB60 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 183COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0043AB96
std::_Lockit::_Lockit.LIBCPMT ref: 0043ABB8
std::_Lockit::~_Lockit.LIBCPMT ref: 0043ABD8
std::_Lockit::~_Lockit.LIBCPMT ref: 0043ABFF
std::_Lockit::_Lockit.LIBCPMT ref: 0043AC78
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 0043ACC4
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 0043ACDE
std::_Lockit::~_Lockit.LIBCPMT ref: 0043AD73
std::_Facet_Register.LIBCPMT ref: 0043AD80

Strings

st, xrefs: 0043AB74
bad locale name, xrefs: 0043ADA4

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Locinfo::_$Facet_Locinfo_ctorLocinfo_dtorRegister
String ID: bad locale name$st
API String ID: 3375549084-2289111497
Opcode ID: 81b8c040c65242bbb388c3860b360fd5fbf14eee6784fb5a6296731327cb7199
Instruction ID: 83acb539149c8f3cc8ff2b3e53bd2e191c294a2961a55a864c22e109857d6705
Opcode Fuzzy Hash: 81b8c040c65242bbb388c3860b360fd5fbf14eee6784fb5a6296731327cb7199
Instruction Fuzzy Hash: 0071AFB0D002199FDF10DFA4D849B9EBFB4BF48314F18515AE845AB341EB78AD05CB96

Function 0043EEA0 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 111memorylibraryloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,E57473E3,?,00000000,?,006C4378,000000FE,?,0042C522,?,00000000), ref: 0043EEE2
CheckRemoteDebuggerPresent.KERNEL32(00000000,?,006C4378,000000FE,?,0042C522,?,00000000), ref: 0043EEE9
GetModuleHandleW.KERNEL32(kernel32.dll,IsDebuggerPresent,?,?,?,?,?,006C4378,000000FE,?,0042C522,?), ref: 0043EF51
GetProcAddress.KERNEL32(00000000), ref: 0043EF58
VirtualProtect.KERNEL32(00000000,00000008,00000080,00000000), ref: 0043EF85
VirtualProtect.KERNEL32(00000000,00000008,00000000,00000000), ref: 0043EFAE
GetCurrentProcess.KERNEL32(00000000,00000008), ref: 0043EFB7
FlushInstructionCache.KERNEL32(00000000), ref: 0043EFBE

Strings

IsDebuggerPresent, xrefs: 0043EF47
st, xrefs: 0043EEB9
kernel32.dll, xrefs: 0043EF4C

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$AddressCacheCheckDebuggerFlushHandleInstructionModulePresentProcRemote
String ID: IsDebuggerPresent$kernel32.dll$st
API String ID: 1864433975-3265389178
Opcode ID: aa09a9a045d83c3e5b97d72618f596eb4972207d6e12ce8fdfd67a460890731a
Instruction ID: 29e59505d74ddf618f7592f846f50e88a05c06d5da0c98fb5368466291e2351c
Opcode Fuzzy Hash: aa09a9a045d83c3e5b97d72618f596eb4972207d6e12ce8fdfd67a460890731a
Instruction Fuzzy Hash: BD41EE71901715FBDB209FA5C809BAEBBB9FF08700F10541AF842A73C0CB799A05CBA5

Function 004883E0 Relevance: 17.9, APIs: 4, Strings: 6, Instructions: 447COMMON

Download Yara Rule

Strings

servers.def, xrefs: 004887A5
04A4, xrefs: 00488490
st, xrefs: 0048840C
paths.ini_store configuration is empty, settings ini store folder to asw::instup::GetDataDirectory., xrefs: 004884CE
053F, xrefs: 0048847B
config.def, xrefs: 0048885F

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: ___std_exception_destroy
String ID: 04A4$053F$config.def$paths.ini_store configuration is empty, settings ini store folder to asw::instup::GetDataDirectory.$servers.def$st
API String ID: 4194217158-2208545500
Opcode ID: 40f4216640a997920cf70068d2fef6f9e548808c5729f00f8ec9736b2d69c257
Instruction ID: 3e00aa5328b3f5e09d1196bd779e084c65f97fdad28fc7638a90da82777a5eb5
Opcode Fuzzy Hash: 40f4216640a997920cf70068d2fef6f9e548808c5729f00f8ec9736b2d69c257
Instruction Fuzzy Hash: 1F126F70D00619DFDB14EFA4D845BAEBBB5BF08308F44459EE409A7251EB34AE84CFA5

Function 0049C0D0 Relevance: 17.8, APIs: 6, Strings: 4, Instructions: 297fileCOMMON

Download Yara Rule

APIs

GetFileSizeEx.KERNEL32(00000000,?,E57473E3,?,?), ref: 0049C15C
ReadFile.KERNEL32(?,?,?,00000000,?), ref: 0049C1EF
GetLastError.KERNEL32(get_file_content: GetFileSizeEx), ref: 0049C277
Concurrency::scheduler_worker_creation_error::scheduler_worker_creation_error.LIBCMT ref: 0049C281
GetLastError.KERNEL32(get_file_content: ReadFile,006E90A4,006E90A4,00000000), ref: 0049C299
Concurrency::scheduler_worker_creation_error::scheduler_worker_creation_error.LIBCMT ref: 0049C2A3

Strings

get_file_content, xrefs: 0049C266
st, xrefs: 0049C0F8, 0049C2D4
get_file_content: ReadFile, xrefs: 0049C294
get_file_content: GetFileSizeEx, xrefs: 0049C272

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: Concurrency::scheduler_worker_creation_error::scheduler_worker_creation_errorErrorFileLast$ReadSize
String ID: get_file_content$get_file_content: GetFileSizeEx$get_file_content: ReadFile$st
API String ID: 1173113360-53712598
Opcode ID: ad1008747915528b5e839081975c598b92c26564dde383561d388467673f5b56
Instruction ID: 0584c5d1bb5d1c1741e2de54257cd6993d671eb15712f34369d3688126fa581d
Opcode Fuzzy Hash: ad1008747915528b5e839081975c598b92c26564dde383561d388467673f5b56
Instruction Fuzzy Hash: 6CA1C271A002099FCF14DFA9DC85BAEBBB6FF88714F14422EF415A7391EB7469408B94

Function 00441850 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 273registrytimeCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?,00000000,?), ref: 004419FF
RegCloseKey.ADVAPI32(?), ref: 00441B75
SetLastError.KERNEL32(00000000), ref: 00441B80
RegCloseKey.ADVAPI32(?,?), ref: 00441BDE
SetLastError.KERNEL32(00000000), ref: 00441BE9
RegCloseKey.ADVAPI32(?,?), ref: 00441C3F
SetLastError.KERNEL32(00000000), ref: 00441C4A
RegCloseKey.ADVAPI32(?,?), ref: 00441C6A
SetLastError.KERNEL32(00000000), ref: 00441C75

Strings

st, xrefs: 00441867

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: CloseErrorLast$Time$FileSystem
String ID: st
API String ID: 108130482-1638371401
Opcode ID: f76076f82fd359a35a1ee7c8e484330b37e02985f04e90077c3f34ac5abfb0b1
Instruction ID: b65262fd4d7659f543eb23d5a53b2a59ace325af5d234d356a8aa41376c6096a
Opcode Fuzzy Hash: f76076f82fd359a35a1ee7c8e484330b37e02985f04e90077c3f34ac5abfb0b1
Instruction Fuzzy Hash: 14C15DB0D002589BEB24DF64DC95BDEBBB4BF05304F0445DAD409A7291EB38AB88CF95

Function 004355D0 Relevance: 17.6, APIs: 3, Strings: 7, Instructions: 104COMMON

Download Yara Rule

APIs

Part of subcall function 0042D190: RemoveVectoredExceptionHandler.KERNEL32(?), ref: 0042D1B4

GetCurrentProcess.KERNEL32(E57473E3), ref: 00435611
GetProcessId.KERNEL32(00000000), ref: 00435618
SetEnvironmentVariableW.KERNEL32(?,00000000), ref: 0043565D

Strings

st, xrefs: 004355E7
CrashGuard uninstallation failed., xrefs: 00435726
st, xrefs: 0043570B
CrashGuard uninstalled successfully, xrefs: 004356B0
CrashHandlerInstalled-, xrefs: 00435629
0A2C, xrefs: 0043567F
0A76, xrefs: 00435689

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: Process$CurrentEnvironmentExceptionHandlerRemoveVariableVectored
String ID: 0A2C$0A76$CrashGuard uninstallation failed.$CrashGuard uninstalled successfully$CrashHandlerInstalled-$st$st
API String ID: 3061529791-2093527942
Opcode ID: 9e582e4f27fdd2499ec91e88f277eaff58780c98ba5157ff4b7bc5c382138b3b
Instruction ID: c4e0fd2b91eeae5cf0c642ff3d22099e9c78c55ee846bcc303aadbd96de0217f
Opcode Fuzzy Hash: 9e582e4f27fdd2499ec91e88f277eaff58780c98ba5157ff4b7bc5c382138b3b
Instruction Fuzzy Hash: CD4124B5D10218EBCB04DFA4E895BDEBBB5FF18314F50512AE406A3280EB34AA49CF51

Function 00494AC0 Relevance: 16.0, APIs: 4, Strings: 5, Instructions: 205COMMON

Download Yara Rule

APIs

RtlDllShutdownInProgress.NTDLL ref: 00494B64
RtlDllShutdownInProgress.NTDLL ref: 00494BEC
RtlDllShutdownInProgress.NTDLL ref: 00494CE3
RtlDllShutdownInProgress.NTDLL ref: 00494D2B

Strings

st, xrefs: 00494AE8
CFBE, xrefs: 00494C97
_lt, xrefs: 00494C73
2CC0, xrefs: 00494C86
added location storage for scheme {} and location {}, xrefs: 00494CA9

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: ProgressShutdown
String ID: 2CC0$CFBE$_lt$added location storage for scheme {} and location {}$st
API String ID: 396724402-2721421850
Opcode ID: 84520eae6878ee6f68a7843d680d975c9480ca6914576ed9d52e5a643a415d4a
Instruction ID: 2e18c0ca1ac919bdc6f1f383e52c84b0599c77d1a552c691874706e01b88971c
Opcode Fuzzy Hash: 84520eae6878ee6f68a7843d680d975c9480ca6914576ed9d52e5a643a415d4a
Instruction Fuzzy Hash: EC818F71D006588BCF01DFA4C844B9EBBB1BF98314F15825AE8156B381EB74AA46CFD5

Function 0056A2E0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 127COMMON

Download Yara Rule

APIs

GetEnvironmentVariableW.KERNEL32(?,00000000,00008000,(~h), ref: 0056A34B
GetLastError.KERNEL32 ref: 0056A3A2
___std_exception_copy.LIBVCRUNTIME ref: 0056A404
___std_exception_destroy.LIBVCRUNTIME ref: 0056A417
___std_exception_copy.LIBVCRUNTIME ref: 0056A421
___std_exception_destroy.LIBVCRUNTIME ref: 0056A434

Strings

st, xrefs: 0056A308, 0056A3D6
(~h, xrefs: 0056A312
Unable to retrieve environment variable '{}'!, xrefs: 0056A3AE

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: ___std_exception_copy___std_exception_destroy$EnvironmentErrorLastVariable
String ID: (~h$Unable to retrieve environment variable '{}'!$st
API String ID: 3835028096-198485480
Opcode ID: 02cf8d06ebeb433d5820eb9eafaaee85b067a624becf174e4b828607ba3e2b36
Instruction ID: a51851e65cc78681e3f70ba9837091164e436d49986d8e875910d88562464b31
Opcode Fuzzy Hash: 02cf8d06ebeb433d5820eb9eafaaee85b067a624becf174e4b828607ba3e2b36
Instruction Fuzzy Hash: B84182B1D00219ABDB10DF95DC46BAFBBB8FF54710F50466AF815A3241EB7466048BE1

Function 0044B1B0 Relevance: 15.9, APIs: 2, Strings: 7, Instructions: 123COMMON

Download Yara Rule

APIs

Part of subcall function 00478840: ___std_exception_destroy.LIBVCRUNTIME ref: 00478716

InitOnceBeginInitialize.KERNEL32(?,00000000,?,00000000), ref: 0044B296
InitOnceComplete.KERNEL32(?,00000000,00000000), ref: 0044B2B0

Strings

C:\BUILD\work\e0dd96435fde7cb0\framework\settings\src\property\SettingsModule.cpp(121), xrefs: 0044B5F6
st, xrefs: 0044B1C4, 0044B54A
C:\BUILD\work\e0dd96435fde7cb0\framework\settings\src\property\SettingsModule.cpp(129), xrefs: 0044B8EC
event_routing.rpc.endpoint.initialized, xrefs: 0044B623
app.settings.AnnounceRegisteredNotifications2, xrefs: 0044B918
C:\BUILD\work\e0dd96435fde7cb0\framework\settings\src\property\SettingsModule.cpp(126), xrefs: 0044B798
app.settings.AnnounceRegisteredNotifications, xrefs: 0044B7D5

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: InitOnce$BeginCompleteInitialize___std_exception_destroy
String ID: C:\BUILD\work\e0dd96435fde7cb0\framework\settings\src\property\SettingsModule.cpp(121)$C:\BUILD\work\e0dd96435fde7cb0\framework\settings\src\property\SettingsModule.cpp(126)$C:\BUILD\work\e0dd96435fde7cb0\framework\settings\src\property\SettingsModule.cpp(129)$app.settings.AnnounceRegisteredNotifications$app.settings.AnnounceRegisteredNotifications2$event_routing.rpc.endpoint.initialized$st
API String ID: 621198455-1012040845
Opcode ID: 5fc9ec691073388ddff6d8755c0420ef7c7c4be372066d8aa8abaf36cf4c18d2
Instruction ID: c7162f66f08467aeb5ff62355c9b3f4e5d558f05621c5598ca40f3f8316cf5a3
Opcode Fuzzy Hash: 5fc9ec691073388ddff6d8755c0420ef7c7c4be372066d8aa8abaf36cf4c18d2
Instruction Fuzzy Hash: 1D41C135A006159FDB11DFA4C8487AEB7B5FF48320F14416AE812A7380DB38AE02CFD5

Function 0044F8D0 Relevance: 15.5, APIs: 2, Strings: 8, Instructions: 470COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,E57473E3,?,?), ref: 0044F91D
LeaveCriticalSection.KERNEL32(?,?,?), ref: 0044F92F

Part of subcall function 0047A6E0: EnterCriticalSection.KERNEL32(?,E57473E3,?,FB5F81E8,?,?,0061392D,000000FF,?,0048210A,?), ref: 0047A724
Part of subcall function 0047A6E0: LeaveCriticalSection.KERNEL32(?), ref: 0047A770

Strings

C:\BUILD\work\e0dd96435fde7cb0\framework\settings\src\property\SettingsModule.cpp(870), xrefs: 0044FBF8
st, xrefs: 0044F8FA, 0044FD8B
C:\BUILD\work\e0dd96435fde7cb0\framework\settings\src\property\SettingsModule.cpp(857), xrefs: 0044F949
C:\BUILD\work\e0dd96435fde7cb0\framework\settings\src\property\SettingsModule.cpp(860), xrefs: 0044FA9C
app.settings.PropertyChanged, xrefs: 0044FAC6
app.settings.ServerReady, xrefs: 0044FC2D
://, xrefs: 0044FDD5
app.settings.PropertyChangedValue, xrefs: 0044F97B

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: ://$C:\BUILD\work\e0dd96435fde7cb0\framework\settings\src\property\SettingsModule.cpp(857)$C:\BUILD\work\e0dd96435fde7cb0\framework\settings\src\property\SettingsModule.cpp(860)$C:\BUILD\work\e0dd96435fde7cb0\framework\settings\src\property\SettingsModule.cpp(870)$app.settings.PropertyChanged$app.settings.PropertyChangedValue$app.settings.ServerReady$st
API String ID: 3168844106-3275285010
Opcode ID: 78f95e8de9a79c84ef8c5b815638726ce0912a3e553a9baec1d4dee5794d5adb
Instruction ID: 2d92a0a82b1b1fd6cd9fb37f81a367405e5b49946ceb742e4f6a51cb32263f94
Opcode Fuzzy Hash: 78f95e8de9a79c84ef8c5b815638726ce0912a3e553a9baec1d4dee5794d5adb
Instruction Fuzzy Hash: FA02D071D002089FDB14DFA4CC85BAEBBB5EF45314F24825EE815AB381DB386A49CB95

Function 0043FFF0 Relevance: 15.3, APIs: 1, Strings: 9, Instructions: 340COMMON

Download Yara Rule

Strings

Missing precision specifier., xrefs: 00440140
Can not switch from manual to automatic indexing, xrefs: 00440154, 00440481
Dynamic width or precision index too large., xrefs: 0044015E, 0044048B
Format specifier requires numeric argument., xrefs: 00440495
Can not switch from automatic to manual indexing, xrefs: 0044014A, 00440477
Invalid format string., xrefs: 00440172, 0044049F
Precision not allowed for this argument type., xrefs: 00440168
invalid fill character '{', xrefs: 0044046D
}, xrefs: 00440198

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: ___std_exception_copy
String ID: Can not switch from automatic to manual indexing$Can not switch from manual to automatic indexing$Dynamic width or precision index too large.$Format specifier requires numeric argument.$Invalid format string.$Missing precision specifier.$Precision not allowed for this argument type.$invalid fill character '{'$}
API String ID: 2659868963-3288817845
Opcode ID: 53665883319cf515956fa3f0178627a5cd3f35013fbf14687e4d59805e1c7716
Instruction ID: c46a8c864dffbf7ff972898bfbfa01143ef3820e2598968d237bc96f8e47e335
Opcode Fuzzy Hash: 53665883319cf515956fa3f0178627a5cd3f35013fbf14687e4d59805e1c7716
Instruction Fuzzy Hash: B2B17C306002548BEB34DF2CD48466EBBE2EF41304F68856FDA858B346DB7E9D95C789

Function 00419B10 Relevance: 14.4, APIs: 1, Strings: 7, Instructions: 383COMMON

Download Yara Rule

APIs

___std_fs_convert_narrow_to_wide@20.LIBCPMT ref: 00419D01

Part of subcall function 005C5314: MultiByteToWideChar.KERNEL32(?,00000008,00000000,00000001,?,00000001,?,?,00419D06,000004E4,?,00000001,?,00000001,00000000), ref: 005C5329
Part of subcall function 005C5314: GetLastError.KERNEL32(?,00419D06,000004E4,?,00000001,?,00000001,00000000), ref: 005C5335

Strings

\x{, xrefs: 00419E33
st, xrefs: 00419B16
pJf, xrefs: 00419CD4
LJf, xrefs: 00419B79
\u{, xrefs: 00419D80
dJf, xrefs: 00419C1A
XJf, xrefs: 00419BCA

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: ByteCharErrorLastMultiWide___std_fs_convert_narrow_to_wide@20
String ID: LJf$XJf$\u{$\x{$dJf$pJf$st
API String ID: 426171095-1278816893
Opcode ID: dfccd92820f5192c0759ffcec555e2c7e163905a35283ff2e47e8c57fe38ed37
Instruction ID: ff949f950aeeea426ea420f2bf978502aef12da6ddd81afcbd46b11c4b3b4cd2
Opcode Fuzzy Hash: dfccd92820f5192c0759ffcec555e2c7e163905a35283ff2e47e8c57fe38ed37
Instruction Fuzzy Hash: DDE1AC74A046489FCB25CF58D4E09EEBBF2BF49300B18444EE89A5B751CB34BD82CB94

Function 004E1420 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 205COMMON

Download Yara Rule

Strings

st, xrefs: 004E12B9, 004E1644

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID:
String ID: st
API String ID: 0-1638371401
Opcode ID: 060d4e76ab5843c21c66e201a5992f1e4148940ac37eff56f4bc4182fbd0ef25
Instruction ID: 06ba55d45dd86e1b44766c21a9023f277f943f2c0882f67e5b71a86e8feae9a6
Opcode Fuzzy Hash: 060d4e76ab5843c21c66e201a5992f1e4148940ac37eff56f4bc4182fbd0ef25
Instruction Fuzzy Hash: D261DF71A001058FCB04DF69C885AAEBBF5FF44315F14026EE915AB3A2EB39E941CB95

Function 005C8580 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 170COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 005C85B7
___except_validate_context_record.LIBVCRUNTIME ref: 005C85BF
_ValidateLocalCookies.LIBCMT ref: 005C8648
__IsNonwritableInCurrentImage.LIBCMT ref: 005C8673
_ValidateLocalCookies.LIBCMT ref: 005C86C8

Strings

st, xrefs: 005C8632, 005C86AF
csm, xrefs: 005C865D
csm, xrefs: 005C86F3

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm$csm$st
API String ID: 1170836740-139177000
Opcode ID: dc4d6e274c683c2e60a4eaee88c32e9710c2443fff58becd850c42b4f0fa0fcb
Instruction ID: 6242eee5ac10b2534f4a6f992e4ef7aee303973a2794e3caa2815aa3b056f036
Opcode Fuzzy Hash: dc4d6e274c683c2e60a4eaee88c32e9710c2443fff58becd850c42b4f0fa0fcb
Instruction Fuzzy Hash: F1517D34A002059FCB14DFA8C845FAE7FA5FF95325F24849DE8155B2A2DB32EA41CB91

Function 0054B250 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 157fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00497A50: CreateFileW.KERNEL32(00616B8E,?,00000007,00000000,?,08000000,00000000), ref: 00497ADA
Part of subcall function 00497A50: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00616B8E,000000FF,?,0054B2E6), ref: 00497AF4
Part of subcall function 00497A50: CloseHandle.KERNEL32(00000064,?,?,?,?,?,?,?,?,?,?,?,?,00616B8E,000000FF), ref: 00497B4C

LockFileEx.KERNEL32(00000000,00000000,00000000,000000FF,00000000,?), ref: 0054B342
UnlockFileEx.KERNEL32(?,00000000,FFFFFFFF,00000000,?), ref: 0054B36E
SetLastError.KERNEL32(00000000,?), ref: 0054B385
CloseHandle.KERNEL32(00000000), ref: 0054B3DD
GetLastError.KERNEL32(couldn't obtain shared file lock), ref: 0054B42E
Concurrency::scheduler_worker_creation_error::scheduler_worker_creation_error.LIBCMT ref: 0054B438

Part of subcall function 0049C0D0: GetFileSizeEx.KERNEL32(00000000,?,E57473E3,?,?), ref: 0049C15C
Part of subcall function 0049C0D0: ReadFile.KERNEL32(?,?,?,00000000,?), ref: 0049C1EF

Strings

st, xrefs: 0054B279
couldn't obtain shared file lock, xrefs: 0054B429

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: File$ErrorLast$CloseHandle$Concurrency::scheduler_worker_creation_error::scheduler_worker_creation_errorCreateLockReadSizeUnlock
String ID: couldn't obtain shared file lock$st
API String ID: 2755012231-3417236694
Opcode ID: 9c13d2c8b4cb57f8c4269b17ae376bd766658d5564c3f648eeec71ba9f210171
Instruction ID: a5c288d1fa3ab7bac1b3e8bf308af2080329980c0ff89b5d8e67492804601ebb
Opcode Fuzzy Hash: 9c13d2c8b4cb57f8c4269b17ae376bd766658d5564c3f648eeec71ba9f210171
Instruction Fuzzy Hash: 73518C71D00208ABEF00DFA4DD49BDEBBB5FF58314F208259E415B7281EB745A04CBA1

Function 00440D10 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 151threadCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(?,?,?,?,006E90A4,006E90A4,000010DD,Already running,?,?,?,?,?,?,00000000,0060E945), ref: 00440D23
GetCurrentThreadId.KERNEL32 ref: 00440D2F

Part of subcall function 005C5A36: WaitForSingleObjectEx.KERNEL32(000010DD,000000FF,00000000,?,?,?,00440D46,?,00000000,00000000,?,?,006E90A4,006E90A4,000010DD,Already running), ref: 005C5A42
Part of subcall function 005C5A36: GetExitCodeThread.KERNEL32(000010DD,?,?,?,?,00440D46,?,00000000,00000000,?,?,006E90A4,006E90A4,000010DD,Already running), ref: 005C5A5B
Part of subcall function 005C5A36: CloseHandle.KERNEL32(000010DD,?,?,?,00440D46,?,00000000,00000000,?,?,006E90A4,006E90A4,000010DD,Already running), ref: 005C5A6D

std::_Throw_Cpp_error.LIBCPMT ref: 00440D5A
std::_Throw_Cpp_error.LIBCPMT ref: 00440D61
std::_Throw_Cpp_error.LIBCPMT ref: 00440D68
DeviceIoControl.KERNEL32(?,00070060,00000000,00000000,00000000,00000000,?,00000000), ref: 00440E16
CloseHandle.KERNEL32(?), ref: 00440E1F

Strings

st, xrefs: 00440D87

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$CloseHandleThread$CodeControlCurrentDeviceEventExitObjectSingleWait
String ID: st
API String ID: 170390471-1638371401
Opcode ID: b540210003ee5943da11bd242c4cdaaecdbb5728a81620c94ac9cd7b3fab0d4d
Instruction ID: 6948a86d367029e035efe420fe93fc4227a4241ed4da7cc9ef42a54d5458b83e
Opcode Fuzzy Hash: b540210003ee5943da11bd242c4cdaaecdbb5728a81620c94ac9cd7b3fab0d4d
Instruction Fuzzy Hash: D951CE70A006149FDB209F64CC45BAABBB5FF04724F10426EE916973D1EB74AE55CBC4

Function 005C5ED0 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 56libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,00000000,?,?,005C5E54,00000000,005C6047,E57473E3,00000000,?,0060BD60,000000FF,?,004704EE,00000000), ref: 005C5EFC
GetProcAddress.KERNEL32(00000000,WaitOnAddress), ref: 005C5F0F
GetProcAddress.KERNEL32(00000000,WakeByAddressSingle), ref: 005C5F1E
GetProcAddress.KERNEL32(00000000,WakeByAddressAll), ref: 005C5F2C

Strings

WakeByAddressSingle, xrefs: 005C5F15
api-ms-win-core-synch-l1-2-0.dll, xrefs: 005C5EF7
WakeByAddressAll, xrefs: 005C5F24
WaitOnAddress, xrefs: 005C5F09

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: WaitOnAddress$WakeByAddressAll$WakeByAddressSingle$api-ms-win-core-synch-l1-2-0.dll
API String ID: 667068680-629889153
Opcode ID: d67d7394b41328355a61b9c53d1d9aba0ab7beb4dc0e892baf53c8c3881c4623
Instruction ID: 3609df7c02142f16223b9bd7f154cc31e7ce235221a19d5386001a0251913eb0
Opcode Fuzzy Hash: d67d7394b41328355a61b9c53d1d9aba0ab7beb4dc0e892baf53c8c3881c4623
Instruction Fuzzy Hash: 310104B1B00B106FE7145BE99C85F5A7FAAF784702B10802DF905D7340EEB4D9418794

Function 0054D9A0 Relevance: 14.0, APIs: 5, Strings: 3, Instructions: 47COMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000001(TokenIntegrityLevel),00000000,00000000,?,E57473E3,00000000,00000000), ref: 0054D9DF
GetLastError.KERNEL32(Unable to retrieve the size of user SID!,?,TokenIntegrityLevel,00000000,00000000,?,E57473E3,00000000,00000000), ref: 0054DACF
Concurrency::scheduler_worker_creation_error::scheduler_worker_creation_error.LIBCMT ref: 0054DAD9
GetLastError.KERNEL32(Unable to retrieve the user SID!,?,006E90A4,00000000,?,TokenIntegrityLevel,00000000,00000000,?,E57473E3,00000000,00000000), ref: 0054DAF1
Concurrency::scheduler_worker_creation_error::scheduler_worker_creation_error.LIBCMT ref: 0054DAFB

Strings

st, xrefs: 0054D9B4
Unable to retrieve the size of user SID!, xrefs: 0054DACA
Unable to retrieve the user SID!, xrefs: 0054DAEC

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: Concurrency::scheduler_worker_creation_error::scheduler_worker_creation_errorErrorLast$InformationToken
String ID: Unable to retrieve the size of user SID!$Unable to retrieve the user SID!$st
API String ID: 1232016407-1647245869
Opcode ID: a782e89a91b47aaac184a3575ecfd6f44f6e97e698c29d82b0e924ff8f9c238c
Instruction ID: 678ab8a02b6315cdf9f7a7b91bedcb481e7723fc4e9cedbf7184842055b9098f
Opcode Fuzzy Hash: a782e89a91b47aaac184a3575ecfd6f44f6e97e698c29d82b0e924ff8f9c238c
Instruction Fuzzy Hash: 6C017171950258BAD710EBE5CC8AFEE7B7DFF04B10F500529B611E6181DBB4A50886A5

Function 004E12B0 Relevance: 12.7, APIs: 6, Strings: 1, Instructions: 434COMMON

Download Yara Rule

Strings

st, xrefs: 004E12B9, 004E1644

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: CloseHandle___std_exception_copy
String ID: st
API String ID: 2865405598-1638371401
Opcode ID: a7e8bfee637c18b7097ab45302370d375ff0f46a24d308d80b0ac29be6023092
Instruction ID: 123b2ecc7332f682f6d30cb37866faefeaa15ce490cb5319756080ec4680ec07
Opcode Fuzzy Hash: a7e8bfee637c18b7097ab45302370d375ff0f46a24d308d80b0ac29be6023092
Instruction Fuzzy Hash: EBF1E071A002059FCB04DF68C885AAEBBF5FF88315F14466EE815D73A1EB34EA41CB85

Function 00435F10 Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 270COMMON

Download Yara Rule

APIs

Part of subcall function 0042E540: RtlDllShutdownInProgress.NTDLL ref: 0042E5A1

GetCurrentProcessId.KERNEL32(?,?,?,E57473E3), ref: 00435F88

Strings

st, xrefs: 00435F24, 00436054
st, xrefs: 0043601F
76360A74, xrefs: 0043611D
Cause: VectoredExceptionHandler, xrefs: 00435FB8
Processing VectoredExceptionHandler when CrashGuard is being destroyed, xrefs: 00436148
6, xrefs: 00436129

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: CurrentProcessProgressShutdown
String ID: 6$76360A74$Cause: VectoredExceptionHandler$Processing VectoredExceptionHandler when CrashGuard is being destroyed$st$st
API String ID: 1089700221-2177268916
Opcode ID: 9186de3c273ba6b010879ff2fdd515f21bf47e4287baca22883e77e657c4df97
Instruction ID: 025acf5cb3422c895faba650311028236b8240cf24035a997bb538c6e6bf0609
Opcode Fuzzy Hash: 9186de3c273ba6b010879ff2fdd515f21bf47e4287baca22883e77e657c4df97
Instruction Fuzzy Hash: 74A1B374E00219DFCF14DFA4C984AAEBBB5EF48314F15815AE816AB391DB38AD05CF94

Function 0055A800 Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 224COMMON

Download Yara Rule

APIs

FindVolumeClose.KERNEL32(00000000,?,?,006E90A4,00000057,E57473E3,?,?), ref: 0055AB2B

Part of subcall function 005598F0: SHGetFolderPathW.SHELL32(00000000,00000024,00000000,00000000,?,E57473E3,?,?), ref: 00559959
Part of subcall function 005598F0: GetWindowsDirectoryW.KERNEL32(?,00000104), ref: 0055997E

Strings

st, xrefs: 0055A1CB, 0055A82C
hJf, xrefs: 0055A926
\SystemRoot\, xrefs: 0055A94B
hJf, xrefs: 0055A8B5
\Device\Mup\, xrefs: 0055A8F1
\Device\LanmanRedirector\, xrefs: 0055A871

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: CloseDirectoryFindFolderPathVolumeWindows
String ID: \Device\LanmanRedirector\$\Device\Mup\$\SystemRoot\$hJf$hJf$st
API String ID: 3371243582-98419755
Opcode ID: fd9779d89869ebe0037f27fee4d1ab5a8697db9f91f08abc0e6830b11889c7b0
Instruction ID: ad0ec052bac7b6b559607f267959e6d0a7cf332d6a3286f9534d17524b3ed634
Opcode Fuzzy Hash: fd9779d89869ebe0037f27fee4d1ab5a8697db9f91f08abc0e6830b11889c7b0
Instruction Fuzzy Hash: A0818DB0D01218EFCF00EFA4D995ADDBBB5BF58304F10462EE805A7281EB746A48CB95

Function 0055D1F0 Relevance: 12.5, APIs: 2, Strings: 5, Instructions: 219COMMON

Download Yara Rule

Strings

`?f, xrefs: 0055D433
Unable to determine product identifier from resources!, xrefs: 0055D457
There is no resource section in module, xrefs: 0055D20F
StringFileInfo, xrefs: 0055D2DC
Resource section is empty, xrefs: 0055D238

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID:
String ID: Resource section is empty$StringFileInfo$There is no resource section in module$Unable to determine product identifier from resources!$`?f
API String ID: 0-97874727
Opcode ID: 07f8f203ee1605de7bcd068e5bc52fdf063721680441f291982a7a244eac2f1c
Instruction ID: 83acb2cb38f9c2827ded6134cd2efd9bcbe3626dcd8c5c3aad6062ae5114bcbf
Opcode Fuzzy Hash: 07f8f203ee1605de7bcd068e5bc52fdf063721680441f291982a7a244eac2f1c
Instruction Fuzzy Hash: F981D533D001258BCB20CF68D8916ADFBB1FF85325F19875AEC64AB2D1E774A945C7A0

Function 0042BD70 Relevance: 12.5, APIs: 3, Strings: 4, Instructions: 211COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?), ref: 0042BD88
DeleteCriticalSection.KERNEL32(?), ref: 0042BDF3
GetFileAttributesW.KERNEL32(?,E57473E3), ref: 0042BFF8
GetModuleHandleW.KERNEL32(00000000,?,00000104,?), ref: 0042C060
GetModuleFileNameW.KERNEL32(00000000), ref: 0042C067
GetLastError.KERNEL32 ref: 0042C075

Part of subcall function 0040AF40: ___std_exception_destroy.LIBVCRUNTIME ref: 0040AFC6

Concurrency::cancel_current_task.LIBCPMT ref: 0042CE38
SetEvent.KERNEL32(?,E57473E3,00000000,00000018,?,00000000,0060E500,000000FF,?,?,006E8EF0,00000000), ref: 004408D9

Strings

st, xrefs: 0042BE47, 004408B4
O, xrefs: 0042BEF4
Attempting to install crashguard twice, ignored., xrefs: 0042BF1C
A983BBBB, xrefs: 0042BEE8

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: FileModule$AttributesConcurrency::cancel_current_taskCriticalDeleteErrorEventFreeHandleLastLibraryNameSection___std_exception_destroy
String ID: A983BBBB$Attempting to install crashguard twice, ignored.$O$st
API String ID: 3968876001-2121903204
Opcode ID: 4c49c13ae46a3599271ecd4236ff4d096fb6187c29a28150d10ae819f3ef2da1
Instruction ID: 665bf2fc1b51ba773ff5acac262fde549f3e06fed9ec4f729e3fddd7da069b72
Opcode Fuzzy Hash: 4c49c13ae46a3599271ecd4236ff4d096fb6187c29a28150d10ae819f3ef2da1
Instruction Fuzzy Hash: 84818B70A006249FDB24DF25DC44BAABBB5FF48320F10469EE45A97790DB78AE40CF94

Function 005598F0 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 202COMMON

Download Yara Rule

APIs

SHGetFolderPathW.SHELL32(00000000,00000024,00000000,00000000,?,E57473E3,?,?), ref: 00559959
GetWindowsDirectoryW.KERNEL32(?,00000104), ref: 0055997E
GetSystemDirectoryW.KERNEL32(?,00000104), ref: 005599AD
GetLastError.KERNEL32(00000000,006E90A4,00000000,Unable to retrieve a path of the known folder ({})!,00000033,?), ref: 00559B68
GetLastError.KERNEL32(?,006E90A4,000000EA,Unable to retrieve a path of the known folder ({})!,00000033,?,?,006E90A4,00000000,Unable to retrieve a path of the known folder ({})!,00000033,?), ref: 00559BC8

Strings

st, xrefs: 0055991C
Unable to retrieve a path of the known folder ({})!, xrefs: 00559B46, 00559B77, 00559BA2, 00559BD7, 00559C02

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: DirectoryErrorLast$FolderPathSystemWindows
String ID: Unable to retrieve a path of the known folder ({})!$st
API String ID: 1744653567-2104566928
Opcode ID: 631a6c30878384889666483b7d85a7754d3e7a16f4c58afcd045680629623dda
Instruction ID: 8091603cc27b5574c638e42ee542a5884a26cb39387ea2135a66b29c187b6816
Opcode Fuzzy Hash: 631a6c30878384889666483b7d85a7754d3e7a16f4c58afcd045680629623dda
Instruction Fuzzy Hash: 4561D871A103149ADB20DF64DC5EB9D7B79FF48711F00425AF905A7190EBB4AB48CBA1

Function 00432400 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 199COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00432436
std::_Lockit::_Lockit.LIBCPMT ref: 00432459
std::_Lockit::~_Lockit.LIBCPMT ref: 00432479

Part of subcall function 00432230: std::_Lockit::_Lockit.LIBCPMT ref: 004322B3
Part of subcall function 00432230: std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 004322FF
Part of subcall function 00432230: __Getctype.LIBCPMT ref: 00432318
Part of subcall function 00432230: std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 00432334

std::_Facet_Register.LIBCPMT ref: 004324EB
std::_Lockit::~_Lockit.LIBCPMT ref: 0043250D
Concurrency::cancel_current_task.LIBCPMT ref: 00432530

Strings

st, xrefs: 0043225A, 00432414, 00432557

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_$Locinfo::_Lockit::~_$Concurrency::cancel_current_taskFacet_GetctypeLocinfo_ctorLocinfo_dtorRegister
String ID: st
API String ID: 490166356-1638371401
Opcode ID: c6ddab9d961208a598fd13c43f63f440e984d8de60d1902b12e3e3bfadcc1f9a
Instruction ID: 9f787dd875c87dca23dd7f7630b44fc0541f63835ce1fb36d6d413449dc5bd46
Opcode Fuzzy Hash: c6ddab9d961208a598fd13c43f63f440e984d8de60d1902b12e3e3bfadcc1f9a
Instruction Fuzzy Hash: 8561F171A00215DFCB01DF58D984BAEBBB5FF88324F14815AE802A7391DB78AE01CF95

Function 0042EAE0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 178memorythreadCOMMON

Download Yara Rule

APIs

Part of subcall function 0054E210: GetModuleHandleW.KERNEL32(ntdll.dll,NtQueryInformationProcess,?,?,?,?,0042EBCF), ref: 0054E25D
Part of subcall function 0054E210: GetProcAddress.KERNEL32(00000000), ref: 0054E264
Part of subcall function 0054E210: GetCurrentProcess.KERNEL32(0000003D,?,00000001,?,?,?,?,?,0042EBCF), ref: 0054E2AA
Part of subcall function 0054E210: NtQueryInformationProcess.NTDLL ref: 0054E2B9

InitializeProcThreadAttributeList.KERNEL32(00000000,00000001,00000000,00000000), ref: 0042EBE1
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,E57473E3,00000000), ref: 0042EBEB
InitializeProcThreadAttributeList.KERNEL32(00000000,00000001,00000000,00000000), ref: 0042EC51
UpdateProcThreadAttribute.KERNEL32(00000000,00000000,0002000B,000000E0,00000004,00000000,00000000), ref: 0042EC6F
GetProcessHeap.KERNEL32(00000008,?,?,?,?,?,?,?,?,?,?,?,?,?,?,E57473E3), ref: 0042ECE8
HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,E57473E3,00000000), ref: 0042ECEF

Strings

st, xrefs: 0042EAF4

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: Proc$AttributeProcessThread$HeapInitializeList$AddressAllocCurrentErrorHandleInformationLastModuleQueryUpdate
String ID: st
API String ID: 760766545-1638371401
Opcode ID: ef8ab3167b96684b0058a82301e616b5fc9647a5beeb7f7bba49771b66572fce
Instruction ID: a3e439505cbb1cb550bea50f09bffe28fcae649367827ab171c9adb3412e6a43
Opcode Fuzzy Hash: ef8ab3167b96684b0058a82301e616b5fc9647a5beeb7f7bba49771b66572fce
Instruction Fuzzy Hash: 7A51A271A00219AFEB14DFA5DC49FAEBBB9BB44700F50411AF514A72C0DB79A944CB98

Function 005C6AA6 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 175COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000001,?,00000000,00000000,?,?,?,00000001,?,?,?), ref: 005C6AEF
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,00000000), ref: 005C6B5A
LCMapStringEx.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 005C6B77
LCMapStringEx.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000,00000000), ref: 005C6BB6
LCMapStringEx.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 005C6C15
WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,?,00000000,00000000), ref: 005C6C38

Strings

st, xrefs: 005C6AAC

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: ByteCharMultiStringWide
String ID: st
API String ID: 2829165498-1638371401
Opcode ID: 68f4ecb0a426320e8b740e7244e4a4832d223cbf288e7853a44bfa7c4317e447
Instruction ID: c1e939611e88d5d824ca57c4a7f2f16b26c1bcebfdeec1501964a4b83959e3ec
Opcode Fuzzy Hash: 68f4ecb0a426320e8b740e7244e4a4832d223cbf288e7853a44bfa7c4317e447
Instruction Fuzzy Hash: 1F519A7260021AAFEF209FA4CC49FAA7FAAFF44754F10842DF914E6160DB348E10DB90

Function 0055D470 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 164registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000002,00000000,00000000,00000001,?,E57473E3,00000000,0040B70A), ref: 0055D4F9
SetLastError.KERNEL32(00000000), ref: 0055D504
RegQueryValueExW.ADVAPI32(80000002,SetupLog,00000000,?,?,?,E57473E3,00000000,0040B70A), ref: 0055D545
RegQueryValueExW.ADVAPI32(00000000,SetupLog,00000000,00000200,00000000,00000200), ref: 0055D5D4
SetLastError.KERNEL32(00000000), ref: 0055D644

Strings

st, xrefs: 0055D487
SetupLog, xrefs: 0055D53F, 0055D5C9

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: ErrorLastQueryValue$Open
String ID: SetupLog$st
API String ID: 2022092440-3582198603
Opcode ID: 661af6019f8dcd16cee56e17080b183357fa58c30d10b9f551a69a8ef8c21392
Instruction ID: 78b228478be72bf03eb79cc53c0211a1486576ef018047ed70f97b67b11119e9
Opcode Fuzzy Hash: 661af6019f8dcd16cee56e17080b183357fa58c30d10b9f551a69a8ef8c21392
Instruction Fuzzy Hash: 0B519B72A40219AFDB34DF64DC99BAEBBF5FB44305F10459AE80A97241E7706E44CF60

Function 00427680 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 158COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00427709
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 0042775E
__Getctype.LIBCPMT ref: 00427777
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 004277C1
std::_Lockit::~_Lockit.LIBCPMT ref: 0042785F

Strings

st, xrefs: 004276AD
bad locale name, xrefs: 0042787D

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: std::_$Locinfo::_Lockit$GetctypeLocinfo_ctorLocinfo_dtorLockit::_Lockit::~_
String ID: bad locale name$st
API String ID: 1840309910-2289111497
Opcode ID: a14c5f28b4ecb8cdfaa144090490d8728cd3d7823188321564d23ec61059bf28
Instruction ID: a3457925ecb1e107709929a3cbd74cd6730b0bdec1373af774d8258cad069f35
Opcode Fuzzy Hash: a14c5f28b4ecb8cdfaa144090490d8728cd3d7823188321564d23ec61059bf28
Instruction Fuzzy Hash: 6051D5B1D047598FEB20DFA8D845B8EBBB4BF54304F14816AD848A7342FB35EA44CB51

Function 004E15D0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 156COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 004E1621
EnterCriticalSection.KERNEL32(?,E57473E3,?,?,?,?,?,?,?,?,00000001,?,?,?,module_task_container), ref: 004E166A
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,00000001,?,?,?,module_task_container), ref: 004E1674
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,00000001,?,?,?,module_task_container), ref: 004E16B7
ResetEvent.KERNEL32(?), ref: 004E1767
LeaveCriticalSection.KERNEL32(?), ref: 004E1793

Strings

st, xrefs: 004E12B9, 004E1644

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Concurrency::cancel_current_taskEventReset
String ID: st
API String ID: 3669082664-1638371401
Opcode ID: 735980742fa7f409d438ddd4423ed786e762b75733c5b250f017acb63f00b2e0
Instruction ID: f78b6978a3fa964a6d9ec73b3b88b7161c43a80f209ecbd8fc8a5b390879a536
Opcode Fuzzy Hash: 735980742fa7f409d438ddd4423ed786e762b75733c5b250f017acb63f00b2e0
Instruction Fuzzy Hash: AD51A171A001058FCB18DF68C885BAEBBF5FF48315F14016EE9159B392EB39E951CB84

Function 0056FC20 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 139registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(?,Software\AVAST Software\Avast,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 0056FD5F

Strings

st, xrefs: 0056FC26
Software\AVAST Software\Avast, xrefs: 0056FD5D
HKEY_CLASSES_ROOT, xrefs: 0056FCDE
HKEY_LOCAL_MACHINE, xrefs: 0056FC61
HKEY_USERS, xrefs: 0056FD1B
HKEY_CURRENT_USER, xrefs: 0056FCA1

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: Open
String ID: HKEY_CLASSES_ROOT$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$Software\AVAST Software\Avast$st
API String ID: 71445658-799725632
Opcode ID: 1b0e681733c7b94911dd728a1a328e393c92ff04ea0d7e6b3db28a5cc48ba12d
Instruction ID: c0c65091daca8654dd1cd6428bc3a7fe5f078846cc6579b72b7191dcdbf4b4a0
Opcode Fuzzy Hash: 1b0e681733c7b94911dd728a1a328e393c92ff04ea0d7e6b3db28a5cc48ba12d
Instruction Fuzzy Hash: BF41B222F1410696EB24AF68E8527B67AB6FB75758F940479DC0BCF214F722EE40C390

Function 0042D000 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 122COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,E57473E3,?,?), ref: 0042D03A
GetFileAttributesW.KERNEL32(?,?), ref: 0042D0AD

Strings

st, xrefs: 0042D019
Process dumper doesn't exist in path ', xrefs: 0042D117
A983, xrefs: 0042D0DF
A983BBBB, xrefs: 0042D0E6
BBBB, xrefs: 0042D0F0

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: AttributesFile
String ID: A983$A983BBBB$BBBB$Process dumper doesn't exist in path '$st
API String ID: 3188754299-1693531748
Opcode ID: 6af60018d0a80ff8f4db977fde7e002055e2aa5a2d9268c26f67e5c887a22db6
Instruction ID: 66e738e29b092d00056769d6a3c263240f4be19bd180e219205e69f573d93102
Opcode Fuzzy Hash: 6af60018d0a80ff8f4db977fde7e002055e2aa5a2d9268c26f67e5c887a22db6
Instruction Fuzzy Hash: F741D471E002149BCB14DF68E841BEEB3B5EF49324F50065FE81167391EB39AE45CBA9

Function 005371B0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(0000000C,?,E57473E3,?,?,?,?), ref: 00537214
GetModuleHandleExW.KERNEL32(00000000,tasks.dll,00000000,?,?,E57473E3,?,?,?,?), ref: 00537257
GetLastError.KERNEL32(?,?,E57473E3,?,?,?,?), ref: 00537262
GetProcAddress.KERNEL32(00000000,get_this_taskcancellation), ref: 0053728D

Strings

tasks.dll, xrefs: 0053724C
st, xrefs: 005371C6
get_this_taskcancellation, xrefs: 00537286

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: AddressCriticalErrorHandleInitializeLastModuleProcSection
String ID: get_this_taskcancellation$tasks.dll$st
API String ID: 3324567923-744623146
Opcode ID: 30474838077528b8eab7703fdcdd49d50c290bb2b07375a5f2185487610b980b
Instruction ID: 45056b0e1a6610a66b964672a3015ea3bdea06153bcfc7424cb7cc52fa4f3d79
Opcode Fuzzy Hash: 30474838077528b8eab7703fdcdd49d50c290bb2b07375a5f2185487610b980b
Instruction Fuzzy Hash: 0A319AB1A04755EFE7109F68D809B4AFFF9FB44B10F10816AE80997391EBB59A00CBD1

Function 0054DB10 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 61threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 0054DB50
OpenThreadToken.ADVAPI32(00000000,0000000A,00000001,00000000), ref: 0054DB5F
GetLastError.KERNEL32 ref: 0054DB69
GetCurrentProcess.KERNEL32 ref: 0054DB76
OpenProcessToken.ADVAPI32(00000000,0000000A,00000000), ref: 0054DB83
CloseHandle.KERNEL32(00000000), ref: 0054DB9F
GetLastError.KERNEL32(Unable to open current thread token!), ref: 0054DBEC
Concurrency::scheduler_worker_creation_error::scheduler_worker_creation_error.LIBCMT ref: 0054DBF6
GetLastError.KERNEL32(Unable to open default process token!,?,006E90A4,00000000), ref: 0054DC0E
Concurrency::scheduler_worker_creation_error::scheduler_worker_creation_error.LIBCMT ref: 0054DC18

Strings

st, xrefs: 0054D844, 0054DB24

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: ErrorLast$Concurrency::scheduler_worker_creation_error::scheduler_worker_creation_errorCurrentOpenProcessThreadToken$CloseHandle
String ID: st
API String ID: 1773969159-1638371401
Opcode ID: 0c0f2117e6aa92848be7f4665d262fdf432895c8c2f21c5db3f2869fd1434394
Instruction ID: 90869f6e8b76bdceb8eedd5319d49bcdb709ed998ff8220638eb832db98896dd
Opcode Fuzzy Hash: 0c0f2117e6aa92848be7f4665d262fdf432895c8c2f21c5db3f2869fd1434394
Instruction Fuzzy Hash: 91119071A00209AFEB14DFA4D88ABEEBBB9FB04715F000129F50697280DB745A04CBA1

Function 00459550 Relevance: 12.2, APIs: 4, Strings: 4, Instructions: 231COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00000004,E57473E3,0000001C,00000000,?,?,?,?,?,?,?,00000000,00610BC5,000000FF,?,00463E0C), ref: 0045959C
LeaveCriticalSection.KERNEL32(?), ref: 004595D7

Part of subcall function 005C90B0: RaiseException.KERNEL32(E06D7363,00000001,00000003,0042867C,?,?,?,?,0042867C,st,006E8FF4,E57473E3), ref: 005C9110

EnterCriticalSection.KERNEL32(00000001), ref: 004596A4
LeaveCriticalSection.KERNEL32(?), ref: 004596EA

Strings

st, xrefs: 00459564, 00459644
asw::serialization::ConcreteData<struct asw::settings::GetPropertyOrDefaultBlobOutput>::GetSerializedData: Not a serializeable data., xrefs: 0045975A
asw::serialization::ConcreteData<struct asw::settings::GetPropertyOrDefaultBlobOutput>::GetSerializedData: Invalid data., xrefs: 0045972C
asw::serialization::ConcreteData<struct asw::settings::GetPropertyOrDefaultBlobOutput>::Value: Invalid data., xrefs: 004595FC

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: CriticalSection$EnterLeave$ExceptionRaise
String ID: asw::serialization::ConcreteData<struct asw::settings::GetPropertyOrDefaultBlobOutput>::GetSerializedData: Invalid data.$asw::serialization::ConcreteData<struct asw::settings::GetPropertyOrDefaultBlobOutput>::GetSerializedData: Not a serializeable data.$asw::serialization::ConcreteData<struct asw::settings::GetPropertyOrDefaultBlobOutput>::Value: Invalid data.$st
API String ID: 513142475-1767071267
Opcode ID: b0128e693a05a58af42f367786fb2869fc222943839ade7307219c20008593a9
Instruction ID: a540742479e7dddfe10387cb198116221d9314353211e9fd9ce3ecb3aaf31fed
Opcode Fuzzy Hash: b0128e693a05a58af42f367786fb2869fc222943839ade7307219c20008593a9
Instruction Fuzzy Hash: F1818C71A00219EFCB04DFA4C985BEEBBF9FF49314F10012AE805A7741DB75AA55CBA4

Function 00481BA0 Relevance: 12.2, APIs: 4, Strings: 4, Instructions: 231COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00000004,E57473E3,0000001C,00000000,?,?,?,?,?,?,?,00000000,00610BC5,000000FF,?,00482502), ref: 00481BEC
LeaveCriticalSection.KERNEL32(?), ref: 00481C27

Part of subcall function 005C90B0: RaiseException.KERNEL32(E06D7363,00000001,00000003,0042867C,?,?,?,?,0042867C,st,006E8FF4,E57473E3), ref: 005C9110

EnterCriticalSection.KERNEL32(?), ref: 00481CF4
LeaveCriticalSection.KERNEL32(?), ref: 00481D3A

Strings

st, xrefs: 00481BB4, 00481C94
asw::serialization::ConcreteData<struct asw::settings::EnumeratePropertiesInput>::GetSerializedData: Invalid data., xrefs: 00481D7C
asw::serialization::ConcreteData<struct asw::settings::EnumeratePropertiesInput>::Value: Invalid data., xrefs: 00481C4C
asw::serialization::ConcreteData<struct asw::settings::EnumeratePropertiesInput>::GetSerializedData: Not a serializeable data., xrefs: 00481DAA

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: CriticalSection$EnterLeave$ExceptionRaise
String ID: asw::serialization::ConcreteData<struct asw::settings::EnumeratePropertiesInput>::GetSerializedData: Invalid data.$asw::serialization::ConcreteData<struct asw::settings::EnumeratePropertiesInput>::GetSerializedData: Not a serializeable data.$asw::serialization::ConcreteData<struct asw::settings::EnumeratePropertiesInput>::Value: Invalid data.$st
API String ID: 513142475-3538913150
Opcode ID: 9cd7ecb127afaa4bb1a997b29395c1796740f84b2e450206c0d2d9fa1ebcb0b3
Instruction ID: 0b994f26921be058d75459661d536fba00bc925dfa37f217c0355c4fb59cac4e
Opcode Fuzzy Hash: 9cd7ecb127afaa4bb1a997b29395c1796740f84b2e450206c0d2d9fa1ebcb0b3
Instruction Fuzzy Hash: B781AF71A00219AFCB04DFA4C885FEEBBF9FF49314F10012AE805A7750DB74AA55CBA4

Function 00458C00 Relevance: 12.2, APIs: 4, Strings: 4, Instructions: 231COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00000004,E57473E3,0000001C,00000000,?,?,?,?,?,?,?,00000000,00610BC5,000000FF,?,00463C8C), ref: 00458C4C
LeaveCriticalSection.KERNEL32(?), ref: 00458C87

Part of subcall function 005C90B0: RaiseException.KERNEL32(E06D7363,00000001,00000003,0042867C,?,?,?,?,0042867C,st,006E8FF4,E57473E3), ref: 005C9110

EnterCriticalSection.KERNEL32(00000001), ref: 00458D54
LeaveCriticalSection.KERNEL32(?), ref: 00458D9A

Strings

asw::serialization::ConcreteData<struct asw::settings::GetPropertyOrDefaultInt64Output>::GetSerializedData: Invalid data., xrefs: 00458DDC
asw::serialization::ConcreteData<struct asw::settings::GetPropertyOrDefaultInt64Output>::GetSerializedData: Not a serializeable data., xrefs: 00458E0A
st, xrefs: 00458C14, 00458CF4
asw::serialization::ConcreteData<struct asw::settings::GetPropertyOrDefaultInt64Output>::Value: Invalid data., xrefs: 00458CAC

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: CriticalSection$EnterLeave$ExceptionRaise
String ID: asw::serialization::ConcreteData<struct asw::settings::GetPropertyOrDefaultInt64Output>::GetSerializedData: Invalid data.$asw::serialization::ConcreteData<struct asw::settings::GetPropertyOrDefaultInt64Output>::GetSerializedData: Not a serializeable data.$asw::serialization::ConcreteData<struct asw::settings::GetPropertyOrDefaultInt64Output>::Value: Invalid data.$st
API String ID: 513142475-2616395522
Opcode ID: 2a7b8a31743a730eca99415197b85c03f025b7cca92c84a41b26c84b5f93c915
Instruction ID: 430dba31c9afc28bd00bfaa89c0e6b09f53d23af34311b7920a68618ccddd3e0
Opcode Fuzzy Hash: 2a7b8a31743a730eca99415197b85c03f025b7cca92c84a41b26c84b5f93c915
Instruction Fuzzy Hash: BB818B71A00219AFCB04DFA4C985BEEBBF9FF49314F10012EE805A7741DB75AA45CBA5

Function 0056F520 Relevance: 12.1, APIs: 8, Instructions: 75memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00000000,0056EAE6,00000000,?,?,0040BBA0), ref: 0056F52A
DeleteCriticalSection.KERNEL32(00000000,00000000,0056EAE6,00000000,?,?,0040BBA0), ref: 0056F54F
GetProcessHeap.KERNEL32(00000000,00000000,?,0040BBA0), ref: 0056F558
HeapFree.KERNEL32(00000000,?,0040BBA0), ref: 0056F55F
CloseHandle.KERNEL32(00000000,00000000,0056EAE6,00000000,?,?,0040BBA0), ref: 0056F58A
GetLastError.KERNEL32(?,0040BBA0), ref: 0056F594
FreeLibrary.KERNEL32(0056EAE6,00000000,?,?,0040BBA0), ref: 0056F606
LeaveCriticalSection.KERNEL32(00000000,0056EAE6,00000000,?,?,0040BBA0), ref: 0056F639

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: CriticalSection$FreeHeap$CloseDeleteEnterErrorHandleLastLeaveLibraryProcess
String ID:
API String ID: 138383524-0
Opcode ID: b6f9ea59b94627f406903b33d0a600799470c527e95e67f753d5929f0e8a7f85
Instruction ID: 88308d6bf2fc586ac77de0cc3808190d83dc8a8ed31c9174d017c02a80baa587
Opcode Fuzzy Hash: b6f9ea59b94627f406903b33d0a600799470c527e95e67f753d5929f0e8a7f85
Instruction Fuzzy Hash: 11219771E023218BDB619F34FD0979A3BA5BB14716F04D15AE401E72B0DFBC9900CBA9

Function 00476170 Relevance: 10.9, APIs: 3, Strings: 3, Instructions: 397COMMON

Download Yara Rule

APIs

Part of subcall function 004753A0: CloseHandle.KERNEL32(?), ref: 004754F1

Part of subcall function 00557CE0: ___std_exception_copy.LIBVCRUNTIME ref: 00557D6F

Part of subcall function 00539860: CloseHandle.KERNEL32(?), ref: 005399B1

EnterCriticalSection.KERNEL32(00000000,E57473E3,?,?,?,?,?,00000000,006134C6,000000FF,?,00474E15), ref: 0047649D
LeaveCriticalSection.KERNEL32(00000000,?,?,?,?,00000000,006134C6,000000FF,?,00474E15), ref: 004764D6
___std_exception_destroy.LIBVCRUNTIME ref: 004765F5

Strings

st, xrefs: 00476187, 00476457
XEo, xrefs: 00476372
Eo, xrefs: 00476410

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: CloseCriticalHandleSection$EnterLeave___std_exception_copy___std_exception_destroy
String ID: XEo$Eo$st
API String ID: 1432197461-2548929252
Opcode ID: 418b46a693d7594e0aee9a89e73b07d178972a8577b25a0bef3f6caecc638b3b
Instruction ID: 33f30ea99b044352bd298369863361f5adc3a21f549b76cfe3f7b0ad6f3579f8
Opcode Fuzzy Hash: 418b46a693d7594e0aee9a89e73b07d178972a8577b25a0bef3f6caecc638b3b
Instruction Fuzzy Hash: 66E1C274A006159FCB00EF64D898A6EBBB6FF88324F15415EE51AA7391DB38AD01CFC4

Function 00475C90 Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 300synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 0040ACA0: CloseHandle.KERNEL32(?,E57473E3,?,?,?,?,00475410,?,E57473E3,?), ref: 0040AD00
Part of subcall function 0040ACA0: LeaveCriticalSection.KERNEL32(?,E57473E3,?), ref: 0040AD3A

WaitForSingleObject.KERNEL32(?,000000FF,?,E57473E3,000000FF,00000000), ref: 00475DB3
CloseHandle.KERNEL32(?), ref: 00475DCA
___std_exception_destroy.LIBVCRUNTIME ref: 00476004

Part of subcall function 005583D0: EnterCriticalSection.KERNEL32(00000000), ref: 0055844E
Part of subcall function 005583D0: LeaveCriticalSection.KERNEL32(00000000,?,?,00000000), ref: 00558482

Part of subcall function 00557BF0: SetEvent.KERNEL32(?,E57473E3,?,00000000,0040ED03,0075904C,E57473E3,?,00000000,?,?,00000000,0060B9F0,000000FF,?,invalid string position), ref: 00557C4A
Part of subcall function 00557BF0: CloseHandle.KERNEL32(?,?,?,00000000,0060B9F0,000000FF,?,invalid string position,00419371), ref: 00557C64
Part of subcall function 00557BF0: LeaveCriticalSection.KERNEL32(0060B9F0,?,?,00000000,0060B9F0), ref: 00557C86

Strings

st, xrefs: 00475CB8, 00475E77
lifetime_object must be allocated on static memory (static or global variable or member of such a variable)., xrefs: 00475DFC, 00475E2A
Attempt to unload a module which is still used by another, xrefs: 00475FAB

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: CriticalSection$CloseHandleLeave$EnterEventObjectSingleWait___std_exception_destroy
String ID: Attempt to unload a module which is still used by another$lifetime_object must be allocated on static memory (static or global variable or member of such a variable).$st
API String ID: 1073078398-1870731318
Opcode ID: 989a39074116378cd48bd50095cdf38de0f642f8a6476cba6c72d72e41d7dae2
Instruction ID: 01b46c5a084381349719915aac64e20188e4b6c488b5d92c3b535e642000f40e
Opcode Fuzzy Hash: 989a39074116378cd48bd50095cdf38de0f642f8a6476cba6c72d72e41d7dae2
Instruction Fuzzy Hash: 61B18D70A006099FCB15DFA4D849BEEFBB5BF44324F14816EE419A7390DB78AE04CB95

Function 00478140 Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 284synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 0040ACA0: CloseHandle.KERNEL32(?,E57473E3,?,?,?,?,00475410,?,E57473E3,?), ref: 0040AD00
Part of subcall function 0040ACA0: LeaveCriticalSection.KERNEL32(?,E57473E3,?), ref: 0040AD3A

WaitForSingleObject.KERNEL32(00000001,000000FF,?,E57473E3,?,?), ref: 00478263
CloseHandle.KERNEL32(00000001), ref: 0047827A
___std_exception_destroy.LIBVCRUNTIME ref: 004784A4

Part of subcall function 005583D0: EnterCriticalSection.KERNEL32(00000000), ref: 0055844E
Part of subcall function 005583D0: LeaveCriticalSection.KERNEL32(00000000,?,?,00000000), ref: 00558482

Part of subcall function 00557BF0: SetEvent.KERNEL32(?,E57473E3,?,00000000,0040ED03,0075904C,E57473E3,?,00000000,?,?,00000000,0060B9F0,000000FF,?,invalid string position), ref: 00557C4A
Part of subcall function 00557BF0: CloseHandle.KERNEL32(?,?,?,00000000,0060B9F0,000000FF,?,invalid string position,00419371), ref: 00557C64
Part of subcall function 00557BF0: LeaveCriticalSection.KERNEL32(0060B9F0,?,?,00000000,0060B9F0), ref: 00557C86

Strings

st, xrefs: 00478168, 00478327
lifetime_object must be allocated on static memory (static or global variable or member of such a variable)., xrefs: 004782AC, 004782DA
Attempt to unload a module which is still used by another, xrefs: 0047845B

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: CriticalSection$CloseHandleLeave$EnterEventObjectSingleWait___std_exception_destroy
String ID: Attempt to unload a module which is still used by another$lifetime_object must be allocated on static memory (static or global variable or member of such a variable).$st
API String ID: 1073078398-1870731318
Opcode ID: 9884b2e3a36313c8633d033b2bb58c10f38a8cc679a4176c1967e7eef3a18c3e
Instruction ID: 247c2a3397d8305a75a2da4429e743c635f4d75c2280da263a6377a09b8091ba
Opcode Fuzzy Hash: 9884b2e3a36313c8633d033b2bb58c10f38a8cc679a4176c1967e7eef3a18c3e
Instruction Fuzzy Hash: ADB18F709006499FCB00DFA4C859BEEFBB5FF44314F14816EE819A7391DB786A04CB95

Function 004734E0 Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 284synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 0040ACA0: CloseHandle.KERNEL32(?,E57473E3,?,?,?,?,00475410,?,E57473E3,?), ref: 0040AD00
Part of subcall function 0040ACA0: LeaveCriticalSection.KERNEL32(?,E57473E3,?), ref: 0040AD3A

WaitForSingleObject.KERNEL32(?,000000FF,?,E57473E3,000000FF,00000000), ref: 00473603
CloseHandle.KERNEL32(?), ref: 0047361A
___std_exception_destroy.LIBVCRUNTIME ref: 00473844

Part of subcall function 005583D0: EnterCriticalSection.KERNEL32(00000000), ref: 0055844E
Part of subcall function 005583D0: LeaveCriticalSection.KERNEL32(00000000,?,?,00000000), ref: 00558482

Part of subcall function 00557BF0: SetEvent.KERNEL32(?,E57473E3,?,00000000,0040ED03,0075904C,E57473E3,?,00000000,?,?,00000000,0060B9F0,000000FF,?,invalid string position), ref: 00557C4A
Part of subcall function 00557BF0: CloseHandle.KERNEL32(?,?,?,00000000,0060B9F0,000000FF,?,invalid string position,00419371), ref: 00557C64
Part of subcall function 00557BF0: LeaveCriticalSection.KERNEL32(0060B9F0,?,?,00000000,0060B9F0), ref: 00557C86

Strings

st, xrefs: 00473508, 004736C7
lifetime_object must be allocated on static memory (static or global variable or member of such a variable)., xrefs: 0047364C, 0047367A
Attempt to unload a module which is still used by another, xrefs: 004737FB

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: CriticalSection$CloseHandleLeave$EnterEventObjectSingleWait___std_exception_destroy
String ID: Attempt to unload a module which is still used by another$lifetime_object must be allocated on static memory (static or global variable or member of such a variable).$st
API String ID: 1073078398-1870731318
Opcode ID: 58d16e8ee32596103e1ed955a1e757f1ec915a4308e119cd734b059f94721ab8
Instruction ID: e7a4740a6343ad20d60fb62bc330b27d9b03b1dd8ebf7dfa21755464ddc15e1e
Opcode Fuzzy Hash: 58d16e8ee32596103e1ed955a1e757f1ec915a4308e119cd734b059f94721ab8
Instruction Fuzzy Hash: 56B17CB0E002099FCB15DFA4C945BEEFBB5BF44325F14816AE419A7390DB78AA04CB95

Function 004744B0 Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 284synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 0040ACA0: CloseHandle.KERNEL32(?,E57473E3,?,?,?,?,00475410,?,E57473E3,?), ref: 0040AD00
Part of subcall function 0040ACA0: LeaveCriticalSection.KERNEL32(?,E57473E3,?), ref: 0040AD3A

WaitForSingleObject.KERNEL32(?,000000FF,?,E57473E3,?,?), ref: 004745D3
CloseHandle.KERNEL32(?), ref: 004745EA
___std_exception_destroy.LIBVCRUNTIME ref: 00474814

Part of subcall function 005583D0: EnterCriticalSection.KERNEL32(00000000), ref: 0055844E
Part of subcall function 005583D0: LeaveCriticalSection.KERNEL32(00000000,?,?,00000000), ref: 00558482

Part of subcall function 00557BF0: SetEvent.KERNEL32(?,E57473E3,?,00000000,0040ED03,0075904C,E57473E3,?,00000000,?,?,00000000,0060B9F0,000000FF,?,invalid string position), ref: 00557C4A
Part of subcall function 00557BF0: CloseHandle.KERNEL32(?,?,?,00000000,0060B9F0,000000FF,?,invalid string position,00419371), ref: 00557C64
Part of subcall function 00557BF0: LeaveCriticalSection.KERNEL32(0060B9F0,?,?,00000000,0060B9F0), ref: 00557C86

Strings

st, xrefs: 004744D8, 00474697
lifetime_object must be allocated on static memory (static or global variable or member of such a variable)., xrefs: 0047461C, 0047464A
Attempt to unload a module which is still used by another, xrefs: 004747CB

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: CriticalSection$CloseHandleLeave$EnterEventObjectSingleWait___std_exception_destroy
String ID: Attempt to unload a module which is still used by another$lifetime_object must be allocated on static memory (static or global variable or member of such a variable).$st
API String ID: 1073078398-1870731318
Opcode ID: 7a46bc2c168339462485ada41cce3901658793768e16dfd126bfc4219e3b8035
Instruction ID: e9c3ad1a0a83e2dc1d2262dadca814c40d5cd8ea234cf3fc35547e2f69c3fc80
Opcode Fuzzy Hash: 7a46bc2c168339462485ada41cce3901658793768e16dfd126bfc4219e3b8035
Instruction Fuzzy Hash: AFB18E70E002499FCB04DFA4D845BEEFBB5BF84324F14816EE419A7390DB78AA04CB95

Function 00440180 Relevance: 10.8, APIs: 1, Strings: 6, Instructions: 266COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000), ref: 004404BA

Strings

Can not switch from manual to automatic indexing, xrefs: 00440154, 00440481
Dynamic width or precision index too large., xrefs: 0044015E, 0044048B
Format specifier requires numeric argument., xrefs: 00440495
Can not switch from automatic to manual indexing, xrefs: 0044014A, 00440477
Invalid format string., xrefs: 00440172, 0044049F
}, xrefs: 00440198

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: CloseHandle
String ID: Can not switch from automatic to manual indexing$Can not switch from manual to automatic indexing$Dynamic width or precision index too large.$Format specifier requires numeric argument.$Invalid format string.$}
API String ID: 2962429428-261514470
Opcode ID: 60d3ecf363d465f9ef880bf91d4c7f106019c7f8ea9793558bc4b21b0e15a3da
Instruction ID: 8839f0f4304d69664c979d431a92a65cbcf576b5866e60c428916b89048cb8ef
Opcode Fuzzy Hash: 60d3ecf363d465f9ef880bf91d4c7f106019c7f8ea9793558bc4b21b0e15a3da
Instruction Fuzzy Hash: 7D9139316002508FEB34DF2CC4C466ABBE2AF45304F28C4AFD7858B386D6BD9C958799

Function 004A7240 Relevance: 10.8, APIs: 2, Strings: 4, Instructions: 256COMMON

Download Yara Rule

Strings

449B, xrefs: 004A73E0
st, xrefs: 004A7254, 004A7318
none of the cached keys matched for deletion of {}, xrefs: 004A73F3
BCD6, xrefs: 004A73FB

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: ExclusiveLockRelease
String ID: 449B$BCD6$none of the cached keys matched for deletion of {}$st
API String ID: 1766480654-796329464
Opcode ID: 5cc768497769ec48928c1f4affc0f043185fbf4e863c0aeb882f3063e7738455
Instruction ID: 3abbe753029830a39b6836f0dc2ab0dd32c20a217d417b1e867a8d016b614597
Opcode Fuzzy Hash: 5cc768497769ec48928c1f4affc0f043185fbf4e863c0aeb882f3063e7738455
Instruction Fuzzy Hash: 6DA17AB1D006089FCB10DFA8C885B9EFBF5FF49310F14826AE815AB391E734A904CB95

Function 0044AEA0 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 206COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?,00000000,?), ref: 0044B071
DeleteCriticalSection.KERNEL32(?), ref: 0044B08E

Part of subcall function 00449110: EnterCriticalSection.KERNEL32(?), ref: 00449123
Part of subcall function 00449110: LeaveCriticalSection.KERNEL32(?), ref: 00449158
Part of subcall function 00449110: DeleteCriticalSection.KERNEL32(?), ref: 00449178

Part of subcall function 0047A260: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,004800E9,?,?), ref: 0047A283
Part of subcall function 0047A260: LeaveCriticalSection.KERNEL32(?,?,?,?,004800E9,?,?), ref: 0047A2F1

DeleteCriticalSection.KERNEL32(?), ref: 0044B0DC
___std_exception_destroy.LIBVCRUNTIME ref: 0044B186

Strings

st, xrefs: 0044AEB6
st, xrefs: 0044AF53

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: CriticalSection$Delete$EnterLeave$___std_exception_destroy
String ID: st$st
API String ID: 2468837968-562346131
Opcode ID: 1c2e6ecddfe1457dfc1cead6df80ac2e2884b3645467705f256a734cbfb4c6ae
Instruction ID: 444b15a91a2557b609d3aa268d1c79a36bf32f8e900a3a455831e16784f6c216
Opcode Fuzzy Hash: 1c2e6ecddfe1457dfc1cead6df80ac2e2884b3645467705f256a734cbfb4c6ae
Instruction Fuzzy Hash: 1691AE747001168FD704DF24C895AAAF7A5FF05329F0482AEE91AA73A1DB35AD16CF84

Function 0055FAD0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 159registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(?,?,E57473E3,00000000,?), ref: 0055FB99
SetLastError.KERNEL32(00000000), ref: 0055FBA4
RegSetValueExW.ADVAPI32(?,00000001,00000000,?,?,?), ref: 0055FC37
RegCloseKey.ADVAPI32(?), ref: 0055FC63
SetLastError.KERNEL32(00000000), ref: 0055FC6E

Part of subcall function 0055F230: RegCreateKeyExW.ADVAPI32(?,?,00000000,00000000,?,?,00000000,00000000,00000000,E57473E3,00000000,?), ref: 0055F2B5
Part of subcall function 0055F230: RegCreateKeyExW.ADVAPI32(?,?,00000000,00000000,?,?,00000000,?,00000000,?), ref: 0055F339
Part of subcall function 0055F230: RegCloseKey.ADVAPI32(?), ref: 0055F367
Part of subcall function 0055F230: SetLastError.KERNEL32(00000000), ref: 0055F372

Strings

st, xrefs: 0055FAFB, 0055FCA9

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: CloseErrorLast$Create$Value
String ID: st
API String ID: 1002417207-1638371401
Opcode ID: 1be57ab1ea249554baaaf01c2e42228411661c06b1b4000fb89f9b7624776c96
Instruction ID: 5d62c05d294b95bdf0a6ef5fecfbba4f10dd7733406d11fbc303e3f9efb9c08a
Opcode Fuzzy Hash: 1be57ab1ea249554baaaf01c2e42228411661c06b1b4000fb89f9b7624776c96
Instruction Fuzzy Hash: 0451C2B0D04609AFDB10DF68CD49B9EBBB4FF44305F0046AAEC19A7241DB75AA44CF91

Function 00571D40 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 152libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(NTDLL.DLL,RtlPcToFileHeader), ref: 00571DE3
GetProcAddress.KERNEL32(00000000), ref: 00571DEA

Strings

st, xrefs: 00571D46
Software\AVAST Software\Avast, xrefs: 00571EE2, 00571EF6
RtlPcToFileHeader, xrefs: 00571DD9
NTDLL.DLL, xrefs: 00571DDE

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: NTDLL.DLL$RtlPcToFileHeader$Software\AVAST Software\Avast$st
API String ID: 1646373207-2154031723
Opcode ID: 9e0ed57ddda565edb6f91a295685724c90a222b91227c817df4a9948fb45fcfc
Instruction ID: aea52a88950b057c9280b3cba23ed4be13fc3878cbabddaab0c07ccb61789bf0
Opcode Fuzzy Hash: 9e0ed57ddda565edb6f91a295685724c90a222b91227c817df4a9948fb45fcfc
Instruction Fuzzy Hash: 01510131E016169FCB10DFA8E8419BEBBB6FF94340B158229EC09A7250EF30ED05CB94

Function 004408A0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 149threadCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(?,E57473E3,00000000,00000018,?,00000000,0060E500,000000FF,?,?,006E8EF0,00000000), ref: 004408D9
std::_Throw_Cpp_error.LIBCPMT ref: 0044094D
GetCurrentThreadId.KERNEL32 ref: 0044099A
EnterCriticalSection.KERNEL32(00000021,E57473E3,?,00000001,?,0060E500,000000FF,?,?,006E8EF0,00000000), ref: 004409AA
LeaveCriticalSection.KERNEL32(00000021,?,000000FF,?,00000001,?,0060E500,000000FF,?,?), ref: 00440A01

Part of subcall function 005C5A18: CloseHandle.KERNEL32(00000000,?,000000FF,006E9540,00000000,00000001,000000FF,?,?,006E8EF0,00000000), ref: 005C5A1E

Strings

st, xrefs: 0042BE47, 004408B4, 00440974

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: CriticalSection$CloseCpp_errorCurrentEnterEventHandleLeaveThreadThrow_std::_
String ID: st
API String ID: 3036890819-1638371401
Opcode ID: 7d0e51bf35129f25ca5087514e8ef885ca97055f8d3c7660b5a89e66a9d3b38c
Instruction ID: c666381b00647414c662496133eebe011c810fc3c7485261a9d048619449719d
Opcode Fuzzy Hash: 7d0e51bf35129f25ca5087514e8ef885ca97055f8d3c7660b5a89e66a9d3b38c
Instruction Fuzzy Hash: 6541E071A006099FEB10DF55C884B6AFBB6FF48324F10422EE516A7391DB38AE51CBD4

Function 0040A780 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 146COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,00474D01,00000000,00000000,00000000,00000000,E57473E3,?), ref: 0040A836
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,00474D01,?,?,00000000,00000000,00000000,00000000), ref: 0040A8A1
___std_exception_copy.LIBVCRUNTIME ref: 0040A92E

Strings

st, xrefs: 0040A796
to_narrow<wchar_t>::WideCharToMultiByte, xrefs: 0040A8D9
to_narrow<wchar_t> invalid arguments, xrefs: 0040A8F4

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: ByteCharMultiWide$___std_exception_copy
String ID: to_narrow<wchar_t> invalid arguments$to_narrow<wchar_t>::WideCharToMultiByte$st
API String ID: 1431341520-719104169
Opcode ID: 72d5aa4992e3e74a1055194a230ba79fa7d7a8fcc5342ca35a010de71458ad26
Instruction ID: e64e68b59ac2389cdb60bc1bdcab72bd74c8cd01dcdbfff7db84d0088f33dd11
Opcode Fuzzy Hash: 72d5aa4992e3e74a1055194a230ba79fa7d7a8fcc5342ca35a010de71458ad26
Instruction Fuzzy Hash: 1151C471A00706ABD714EF95CC05BAABBB5BF44704F10822AE501B77C0E7B9A951C799

Function 00440B40 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 141libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,IsRunningInsideAvastService,E57473E3,?,?,?,?,?,?,?,?,00000000,0060E945,000000FF), ref: 00440B96
GetProcAddress.KERNEL32(00000000), ref: 00440B9D
std::_Throw_Cpp_error.LIBCPMT ref: 00440CDA

Strings

st, xrefs: 00440B68
Already running, xrefs: 00440CDF
IsRunningInsideAvastService, xrefs: 00440B86

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: AddressCpp_errorHandleModuleProcThrow_std::_
String ID: Already running$IsRunningInsideAvastService$st
API String ID: 2541276777-491051411
Opcode ID: b2bb0a4205bc5867ec5613ae676d7df7d74ce744eaa355c700455b6897f6a380
Instruction ID: af913d2c96814ba3546f7d7748e63a47611fe6cf38db753a4911a69ae6952b3c
Opcode Fuzzy Hash: b2bb0a4205bc5867ec5613ae676d7df7d74ce744eaa355c700455b6897f6a380
Instruction Fuzzy Hash: 78518CB0D00705DFEB10DFA9C845B9ABBF4AF58710F14822AE905AB381D7B8A944CB95

Function 004880D0 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 121COMMON

Download Yara Rule

APIs

Part of subcall function 00488260: EnterCriticalSection.KERNEL32(0492B9D8,E57473E3,?,?), ref: 004882BB
Part of subcall function 00488260: LeaveCriticalSection.KERNEL32(0492B9D8), ref: 004882D1

std::_Throw_Cpp_error.LIBCPMT ref: 0048824C
std::_Throw_Cpp_error.LIBCPMT ref: 00488257

Part of subcall function 005C5CBC: ReleaseSRWLockExclusive.KERNEL32(004A74AD,?,004A74B5,?,00000000,?,?), ref: 005C5CD0

Part of subcall function 0040AF40: ___std_exception_destroy.LIBVCRUNTIME ref: 0040AFC6

Strings

Accessing ConfigDef path that was not configured., xrefs: 004881DB
04A4, xrefs: 004881A6
st, xrefs: 004880E4
053F, xrefs: 00488194

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: Cpp_errorCriticalSectionThrow_std::_$EnterExclusiveLeaveLockRelease___std_exception_destroy
String ID: 04A4$053F$Accessing ConfigDef path that was not configured.$st
API String ID: 638403012-3560788373
Opcode ID: e43e56b134ae30bb15f2cf08cecd150c554b554b17e17b04fa5476f12a230b63
Instruction ID: 6e13f7a2b09f4280fece8c0cd36cdb83fad3f6873ae7239bf2c26798991b9863
Opcode Fuzzy Hash: e43e56b134ae30bb15f2cf08cecd150c554b554b17e17b04fa5476f12a230b63
Instruction Fuzzy Hash: A3417CB1E006099FDB00DFA4D9457AEBBB1FF48324F10466EE815A7380EB786A41CF95

Function 00428A30 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,E57473E3,00000000,00479677), ref: 00428A3A
HeapAlloc.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,E57473E3,00000000,00479677), ref: 00428A82
asw_process_storage_allocate_connector.ANTISPAM_CONNECT_EU(?,?,?,?,?,?,?,?,?,E57473E3,00000000,00479677), ref: 00428A92
HeapFree.KERNEL32(?,00000000,00000000,E57473E3,?,?,00000000,Function_0020BDE0,000000FF,?,?,006E9084,?,006E9084,?), ref: 00428B2D
asw_process_storage_deallocate_connector.ANTISPAM_CONNECT_EU(?,00000000,00000000,E57473E3,?,?,00000000,Function_0020BDE0,000000FF,?,?,006E9084,?,006E9084,?), ref: 00428B3D

Strings

st, xrefs: 00428B03

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: Heap$AllocFreeProcessasw_process_storage_allocate_connectorasw_process_storage_deallocate_connector
String ID: st
API String ID: 2684591750-1638371401
Opcode ID: c11c20ee9b12b0e4e912f00f3a5e51ccb5aa3f9682171848597c2b313704ca8a
Instruction ID: 3143e85cd16b4a17c2333d970c5aac0fc6f0c1ce69c2b1c3bfc7442b5b9b46e1
Opcode Fuzzy Hash: c11c20ee9b12b0e4e912f00f3a5e51ccb5aa3f9682171848597c2b313704ca8a
Instruction Fuzzy Hash: 033135717013149FC7249F69EC46BAFB7A9EF80310F00452EE95693790DF79A8008B98

Function 005C5CDA Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 116threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 005C5CEE
AcquireSRWLockExclusive.KERNEL32(?,?,004A7356,?,E57473E3,?,?), ref: 005C5D0D
AcquireSRWLockExclusive.KERNEL32(?,?,?,?,004A7356,?,E57473E3,?,?), ref: 005C5D3B
TryAcquireSRWLockExclusive.KERNEL32(?,?,?,?,004A7356,?,E57473E3,?,?), ref: 005C5D96
TryAcquireSRWLockExclusive.KERNEL32(?,?,?,?,004A7356,?,E57473E3,?,?), ref: 005C5DAD

Strings

st, xrefs: 005C5CE0

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: AcquireExclusiveLock$CurrentThread
String ID: st
API String ID: 66001078-1638371401
Opcode ID: 36a7fb5c7140e1c5897c3159b900a957034043c32fa97d887e279da60b47abeb
Instruction ID: 7ae3dda6439a535e75981c48c31a23ffecfa1d5de3ef2a62cb58acd65260442f
Opcode Fuzzy Hash: 36a7fb5c7140e1c5897c3159b900a957034043c32fa97d887e279da60b47abeb
Instruction Fuzzy Hash: D541F575500B069FCB20DFE5C889EAABBB5FB08311B604A2DE45797650E770FAC5CB90

Function 00497A50 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 114fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00616B8E,?,00000007,00000000,?,08000000,00000000), ref: 00497ADA
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00616B8E,000000FF,?,0054B2E6), ref: 00497AF4
CloseHandle.KERNEL32(00000064,?,?,?,?,?,?,?,?,?,?,?,?,00616B8E,000000FF), ref: 00497B4C
Concurrency::scheduler_worker_creation_error::scheduler_worker_creation_error.LIBCMT ref: 00497B87

Part of subcall function 005C90B0: RaiseException.KERNEL32(E06D7363,00000001,00000003,0042867C,?,?,?,?,0042867C,st,006E8FF4,E57473E3), ref: 005C9110

Strings

couldn't open file, xrefs: 00497B7E
st, xrefs: 00497A64

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: CloseConcurrency::scheduler_worker_creation_error::scheduler_worker_creation_errorCreateErrorExceptionFileHandleLastRaise
String ID: couldn't open file$st
API String ID: 3108472653-833766103
Opcode ID: 8e5eb01d2cfcc304877a2ffad9b2614d49fbc47536ce4a523863b541a430e3c4
Instruction ID: b3332acd7d5997831df064de3391b710bacc3364300a7dd1b41fa415a5b005dc
Opcode Fuzzy Hash: 8e5eb01d2cfcc304877a2ffad9b2614d49fbc47536ce4a523863b541a430e3c4
Instruction Fuzzy Hash: A0415FB19002089FDF10DFA8D985BDEBBF5EB48324F20462EF415E7391DA35AA05CB94

Function 00487E80 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 91COMMON

Download Yara Rule

APIs

Part of subcall function 00488260: EnterCriticalSection.KERNEL32(0492B9D8,E57473E3,?,?), ref: 004882BB
Part of subcall function 00488260: LeaveCriticalSection.KERNEL32(0492B9D8), ref: 004882D1

std::_Throw_Cpp_error.LIBCPMT ref: 00487F97
std::_Throw_Cpp_error.LIBCPMT ref: 00487FA2

Part of subcall function 005C5CBC: ReleaseSRWLockExclusive.KERNEL32(004A74AD,?,004A74B5,?,00000000,?,?), ref: 005C5CD0

Strings

st, xrefs: 00487E94
04A4, xrefs: 00487F50
053F, xrefs: 00487F3B
Accessing SettingsIni path that was not configured., xrefs: 00487F5A

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: Cpp_errorCriticalSectionThrow_std::_$EnterExclusiveLeaveLockRelease
String ID: 04A4$053F$Accessing SettingsIni path that was not configured.$st
API String ID: 838010812-3832094640
Opcode ID: c5331e25ab83eb4483dbd40d36385ba029f50449a894a52f844b5e7485ed3264
Instruction ID: 22bffba267320bb56c9cec6119e0413d4e395d55645245ea22984be4c4bd3d8e
Opcode Fuzzy Hash: c5331e25ab83eb4483dbd40d36385ba029f50449a894a52f844b5e7485ed3264
Instruction Fuzzy Hash: 5131A7B1D007499BDB00DFA4D842B9EBBB4FB49314F10422EE405A7380E7B8AA45CB95

Function 005E4F96 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,?,?,E57473E3,?,005E50A3,00000008,0056925A,?,00000000), ref: 005E5057

Strings

api-ms-, xrefs: 005E4FED
ext-ms-, xrefs: 005E5001

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 1717b020548c4922ddf0fb86adb01961af09c4cf769f567811c172be3090b17c
Instruction ID: 46f5486a5433c34176d4efb0365d5ffdc9d276fc9eee9e740bf2fe8232536b6b
Opcode Fuzzy Hash: 1717b020548c4922ddf0fb86adb01961af09c4cf769f567811c172be3090b17c
Instruction Fuzzy Hash: 77213536A016A1ABD7359B22DC48A5A3B69FF457B4F515121F942A73C0FB34EE00CAD0

Function 0056FB50 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000104,00758A80,0056EA21,00000000), ref: 0056FB7F
GetModuleFileNameW.KERNEL32(00000000,00000000,00008000), ref: 0056FBA6
GetFileAttributesW.KERNEL32(?), ref: 0056FBB1
SetLastError.KERNEL32(00000008), ref: 0056FBE1
GetLastError.KERNEL32 ref: 0056FBE7

Strings

st, xrefs: 0056FB59

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: File$ErrorLastModuleName$Attributes
String ID: st
API String ID: 3321126157-1638371401
Opcode ID: 11d04eb38d85b4694a96a014bbf1e586acf2bb3a99a9d7e7ccade5ad27f885a3
Instruction ID: 94780a795210c70c2b2015dd9a4f36d62d7726cc80397e3f1e40d1e845c8c0d2
Opcode Fuzzy Hash: 11d04eb38d85b4694a96a014bbf1e586acf2bb3a99a9d7e7ccade5ad27f885a3
Instruction Fuzzy Hash: 2011E7B1A001285BD7209B28EC45AEA7B6AFF80750F104279F916D3291DE349F85CBE1

Function 00558640 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,?,00558532), ref: 0055865D
CloseHandle.KERNEL32(00000000,?,?,00558532), ref: 0055867D
GetLastError.KERNEL32(?,?,00558532), ref: 00558691
Concurrency::scheduler_worker_creation_error::scheduler_worker_creation_error.LIBCMT ref: 005586A0
CloseHandle.KERNEL32(00000000), ref: 005586CE

Strings

Cannot create event, xrefs: 00558697

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: CloseHandle$Concurrency::scheduler_worker_creation_error::scheduler_worker_creation_errorCreateErrorEventLast
String ID: Cannot create event
API String ID: 135146951-3475436419
Opcode ID: 848df13e946df7064c62b4ddb1c77c453ae1d494a07b2a0a9e25c40e445ab503
Instruction ID: fb91fae6a3232c15edeae291bc0821e9418adafa5156dc6187004895eb97a88f
Opcode Fuzzy Hash: 848df13e946df7064c62b4ddb1c77c453ae1d494a07b2a0a9e25c40e445ab503
Instruction Fuzzy Hash: CF014732B013225BCB10A7BC9C19AB77BEDAB48302B044479BD09F3240EF65DC048BE6

Function 00411950 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 53fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000), ref: 00411982
GetLastError.KERNEL32 ref: 0041198F
DeviceIoControl.KERNEL32(00000000,B2D601B0,00000000,00000000,00000000,00000000,?,00000000), ref: 004119B8
GetLastError.KERNEL32 ref: 004119C2
CloseHandle.KERNEL32(00000000), ref: 004119C9

Strings

st, xrefs: 00411956

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: ErrorLast$CloseControlCreateDeviceFileHandle
String ID: st
API String ID: 1177325624-1638371401
Opcode ID: a88c6f4b93687855ee1b730ca228d015a21552cce66a73e0b75882d66f43b718
Instruction ID: 18125c19f204f0f4997d60b9cda80751a0f191ef212296b7ef58fa088811f342
Opcode Fuzzy Hash: a88c6f4b93687855ee1b730ca228d015a21552cce66a73e0b75882d66f43b718
Instruction Fuzzy Hash: 7C01B570B402147BE710AB64AC4AFED77A8EB08711F500159FA02AB2D0DB646B0586DA

Function 005E1624 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,E57473E3,00000000,?,00000000,0060BDE0,000000FF,?,005E15B4,?,?,005E1588,00000000), ref: 005E1659
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 005E166B
FreeLibrary.KERNEL32(00000000,?,00000000,0060BDE0,000000FF,?,005E15B4,?,?,005E1588,00000000), ref: 005E168D

Strings

st, xrefs: 005E1639
mscoree.dll, xrefs: 005E1652
CorExitProcess, xrefs: 005E1663

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll$st
API String ID: 4061214504-2845880688
Opcode ID: d711485fa719c65f3f58b37a779cc916f78ca5f0bb86c755d959899791f62e40
Instruction ID: e138e9f2e4844e571e15532b9276250ad54841cd3ecb4a67547a11c42fc8b28c
Opcode Fuzzy Hash: d711485fa719c65f3f58b37a779cc916f78ca5f0bb86c755d959899791f62e40
Instruction Fuzzy Hash: 1301D671900669EFDB059F90CC06BEEBBBAFB04B15F054229F811A27D0DB749A00CA94

Function 00572AC0 Relevance: 9.4, APIs: 2, Strings: 4, Instructions: 390COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000,?,?,?,E57473E3,?,00000000), ref: 00572F7A
CloseHandle.KERNEL32(00000000,?,?,?,E57473E3,?,00000000), ref: 00572F87

Strings

st, xrefs: 00572AEB
\\.\, xrefs: 00572B34
\??\, xrefs: 00572B66, 00572B7E
\\?\UNC\, xrefs: 00572B1A

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: CloseHandle
String ID: \??\$\\.\$\\?\UNC\$st
API String ID: 2962429428-1024471370
Opcode ID: 89fd403bd25f8fe02de28c49dbaf034f2af882516eb373b3b44d934f89eb68b0
Instruction ID: c9dae2ba49bd601f6c2fdd8525db5764ed9f3e912841b0b06944870e8ed06c5d
Opcode Fuzzy Hash: 89fd403bd25f8fe02de28c49dbaf034f2af882516eb373b3b44d934f89eb68b0
Instruction Fuzzy Hash: 79E14CB5A002189FDB24CF64DD85BAEBBB5FF48310F248169E909A7391DB74AD40DF90

Function 00450D50 Relevance: 9.3, APIs: 4, Strings: 2, Instructions: 296COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,E57473E3,?,?), ref: 00450DE1
LeaveCriticalSection.KERNEL32(?,?,?), ref: 00450E49
EnterCriticalSection.KERNEL32(?), ref: 00450FAC
LeaveCriticalSection.KERNEL32(?), ref: 00451079

Strings

st, xrefs: 00450D7B
8D, xrefs: 00450E83, 0045116D

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: 8D$st
API String ID: 3168844106-510773117
Opcode ID: 549691341ea3d3eef1fef3fe4bb2098922c38c113ed6dd24af9d8046c6c7b5e1
Instruction ID: 675c28a011baad46dbf57c3b724dd7b956f039fdbf22f261a7358bd9d6f1ac70
Opcode Fuzzy Hash: 549691341ea3d3eef1fef3fe4bb2098922c38c113ed6dd24af9d8046c6c7b5e1
Instruction Fuzzy Hash: 6BD15A70E002299FDB20DF64C885B9EBBB5FF49314F14419AE509A7391DB35AE94CF84

Function 00471480 Relevance: 9.2, APIs: 2, Strings: 3, Instructions: 471COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 004719AA

Part of subcall function 0040AB10: ___std_exception_copy.LIBVCRUNTIME ref: 0040AB58
Part of subcall function 0040AB10: ___std_exception_destroy.LIBVCRUNTIME ref: 0040AB68
Part of subcall function 0040AB10: ___std_exception_copy.LIBVCRUNTIME ref: 0040AB72
Part of subcall function 0040AB10: ___std_exception_destroy.LIBVCRUNTIME ref: 0040AB85

___std_exception_copy.LIBVCRUNTIME ref: 00471A08

Strings

st, xrefs: 004714AD, 004719D7
: ', xrefs: 00471570
' data type expected but no data returned., xrefs: 0047160E

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: ___std_exception_copy___std_exception_destroy
String ID: ' data type expected but no data returned.$: '$st
API String ID: 2970364248-2075308875
Opcode ID: 62326109ffe3062d127176d065201c8f479489e2d27c2fbd5f479928b79448cc
Instruction ID: e684ef76e36671f6dc7e31988ed7160fb7c15bf09a996053b862d781509e230e
Opcode Fuzzy Hash: 62326109ffe3062d127176d065201c8f479489e2d27c2fbd5f479928b79448cc
Instruction Fuzzy Hash: E312F570D00245DFDB08CF68C944BAEBBB5FF45314F14829EE419AB792D778AA84CB91

Function 004760A0 Relevance: 9.2, APIs: 3, Strings: 2, Instructions: 456COMMON

Download Yara Rule

Strings

st, xrefs: 00476187, 00476457
Eo, xrefs: 00476410

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID:
String ID: Eo$st
API String ID: 0-3200818722
Opcode ID: 35714e654416520f338952be97cc14c5fd7541cba8f5b6bd68ebf1cd7c68d8e2
Instruction ID: ca5f506d5208c64f216fab8fbb5d672bf6e92324fbf0180a541e46beef320795
Opcode Fuzzy Hash: 35714e654416520f338952be97cc14c5fd7541cba8f5b6bd68ebf1cd7c68d8e2
Instruction Fuzzy Hash: ADF1B474A006159FCB04EF64D898A6EBBB6FF88324F15415EE51AA7391DB38AD01CFC4

Function 0056E990 Relevance: 9.1, APIs: 6, Instructions: 112memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000018,00000000,?,?,0040BBA0), ref: 0056E9B1
HeapAlloc.KERNEL32(00000000,?,0040BBA0), ref: 0056E9B8
InitializeCriticalSectionEx.KERNEL32(00000000,00000000,02000000,?,0040BBA0), ref: 0056E9D0

Part of subcall function 0056F720: GetSystemInfo.KERNEL32(?), ref: 0056F73A
Part of subcall function 0056F720: GetVersionExW.KERNEL32(0000011C), ref: 0056F79D
Part of subcall function 0056F720: GetVersionExW.KERNEL32(0000011C), ref: 0056F7B8
Part of subcall function 0056F720: GetModuleHandleW.KERNEL32(NTDLL.DLL,RtlGetVersion,00000000), ref: 0056F7D3
Part of subcall function 0056F720: GetProcAddress.KERNEL32(00000000), ref: 0056F7DA

DeleteCriticalSection.KERNEL32(00000000,00000000,?,?,0040BBA0), ref: 0056EAFA
GetProcessHeap.KERNEL32(00000000,00000000,?,0040BBA0), ref: 0056EB03
HeapFree.KERNEL32(00000000,?,0040BBA0), ref: 0056EB0A

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: Heap$CriticalProcessSectionVersion$AddressAllocDeleteFreeHandleInfoInitializeModuleProcSystem
String ID:
API String ID: 75439370-0
Opcode ID: f28373fea56cab2daf6bf35ead9b873bf06be8d98224a740f8fca327c48d73c9
Instruction ID: c0aae5f689e1a9bf31ffc758a887f85ef2d30a3f53ad52736e1c18f05c17737c
Opcode Fuzzy Hash: f28373fea56cab2daf6bf35ead9b873bf06be8d98224a740f8fca327c48d73c9
Instruction Fuzzy Hash: 30418276B023104BDBA09F65FC4A6953BA0F754713F04C52BE906B77A0DFF858448B9A

Function 00474830 Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 327COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 004748D5
CloseHandle.KERNEL32(?), ref: 00474B75

Strings

st, xrefs: 00474847, 004749DB, 00474C3B
lifetime_object must be allocated on static memory (static or global variable or member of such a variable)., xrefs: 00474BD7
Binary Serialization Module already unloaded., xrefs: 0047492F

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: CloseHandle___std_exception_destroy
String ID: Binary Serialization Module already unloaded.$lifetime_object must be allocated on static memory (static or global variable or member of such a variable).$st
API String ID: 3514858835-593806565
Opcode ID: 2462b68685b772cc831573da57224c08d0aea46941095a55a10aa08dee1b3c07
Instruction ID: 8b494e8ab7614665e813c1324dd8e5adee2a8d25d9b7af1af53f4065bd232bed
Opcode Fuzzy Hash: 2462b68685b772cc831573da57224c08d0aea46941095a55a10aa08dee1b3c07
Instruction Fuzzy Hash: 9BC19170D002489FCB00DFA5D885BEEBBB5FF88324F14856EE815A7391DB795A04CB95

Function 005CB3DA Relevance: 9.1, APIs: 6, Instructions: 60COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,005CB3D1,005C887F,00604DCC), ref: 005CB3E8
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 005CB3F6
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 005CB40F
SetLastError.KERNEL32(00000000,005CB3D1,005C887F,00604DCC), ref: 005CB461

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 4f4b7aa38a6c28fbe2826a2aea79c7e94e50b1124a701fff4c916060fb848cbb
Instruction ID: ae7ba57635fd3c0d0a5fcb592a13643228dd8ae6f35ee2d769ed4ba2ebb79a4f
Opcode Fuzzy Hash: 4f4b7aa38a6c28fbe2826a2aea79c7e94e50b1124a701fff4c916060fb848cbb
Instruction Fuzzy Hash: 0A01B93221D7569DFB2817B86CCAE672F5AFB51B75F20022FF524452E3EF514C025244

Function 00539B90 Relevance: 9.1, APIs: 1, Strings: 4, Instructions: 310COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00539C35

Strings

Tasks module already destroyed, xrefs: 00539C8F
st, xrefs: 00539BA7, 00539D27
lkp, xrefs: 00539CE0
Attempt to unload a module which is still used by another, xrefs: 00539E5B

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: ___std_exception_destroy
String ID: Attempt to unload a module which is still used by another$Tasks module already destroyed$lkp$st
API String ID: 4194217158-1398982892
Opcode ID: e885c23fea283eef95afa0c9e3495bc22340910098dd0eff56fcb4f4c663be9e
Instruction ID: ff39f769edef86320919ee3ffaa19ba6a00c4a071e8ae6c50a8c8784940a8652
Opcode Fuzzy Hash: e885c23fea283eef95afa0c9e3495bc22340910098dd0eff56fcb4f4c663be9e
Instruction Fuzzy Hash: 9AB1AF71A002159FCB04EFA4D859AAEBFBABF88324F14452DE416A7381DF749E05CB91

Function 00578680 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 254COMMON

Download Yara Rule

APIs

DeviceIoControl.KERNEL32(00000000,B2D601C0,?,00000019,00000000,00000000,?,?), ref: 00578828
GetLastError.KERNEL32 ref: 00578836
GetCurrentProcess.KERNEL32(00000000,?,00000000,?,?), ref: 005789F3
GetLastError.KERNEL32 ref: 00578A0C

Strings

st, xrefs: 0057869C

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: ErrorLast$ControlCurrentDeviceProcess
String ID: st
API String ID: 2047509940-1638371401
Opcode ID: 46ce79a3734994cce12261ace1c73b20cddded6ebebb7c8f26d23b2aef02ca8d
Instruction ID: f4f31d4b17322576f4faec8bd0dcafb80da203a2c792e43edd45c5dbfc2df064
Opcode Fuzzy Hash: 46ce79a3734994cce12261ace1c73b20cddded6ebebb7c8f26d23b2aef02ca8d
Instruction Fuzzy Hash: 0FB15B71D402288BDB24CF18D8887A9BBB1BF58314F2485DAD94DA7341DB70AE85DF85

Function 005602F0 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 204registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.ADVAPI32(00000000,00000000,00000000,?,?,?,E57473E3,00000000,?), ref: 00560385
RegQueryValueExW.ADVAPI32(?,00000000,00000000,?,?,00000100,00000100,00000000), ref: 005604BD

Part of subcall function 005C90B0: RaiseException.KERNEL32(E06D7363,00000001,00000003,0042867C,?,?,?,?,0042867C,st,006E8FF4,E57473E3), ref: 005C9110

Strings

st, xrefs: 0056031B
8sh, xrefs: 005604F5
Cannot query registry data due to '{}' value changed too often, xrefs: 0056059F, 0056087D

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: QueryValue$ExceptionRaise
String ID: 8sh$Cannot query registry data due to '{}' value changed too often$st
API String ID: 3553633616-1015644340
Opcode ID: b21a17087cd34b63ed4f414d92227c331044b449738d05d949e1d6462d340e8c
Instruction ID: 40512ee37be6fdb3cbeb6496c65246f9a2fd529bfd4f7281195e8971abcc65c4
Opcode Fuzzy Hash: b21a17087cd34b63ed4f414d92227c331044b449738d05d949e1d6462d340e8c
Instruction Fuzzy Hash: 29914A71D01219DBDB14DFA8C9457EEFBB1FF58304F10469AE809B7291EB746A84CB90

Function 0055A590 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 204COMMON

Download Yara Rule

APIs

GetVolumePathNamesForVolumeNameW.KERNEL32(?,00000000,00000000,?,?,?,0000005C,00000004,E57473E3,?,00000000), ref: 0055A63C
GetVolumePathNamesForVolumeNameW.KERNEL32(?,00000000,00000000,00000000,00000000), ref: 0055A67B
GetLastError.KERNEL32 ref: 0055A7C8

Strings

st, xrefs: 0055A5B8
Unable to retrieve volume paths for volume '{}'!, xrefs: 0055A7D4

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: Volume$NameNamesPath$ErrorLast
String ID: Unable to retrieve volume paths for volume '{}'!$st
API String ID: 1243668693-3533243218
Opcode ID: 959b79a4f2a0253d1d89a23c3a1791a97dd1e5cb4523ba1e289b6694acb20024
Instruction ID: 21d978da1722609e9996eb0cffceddf7b94b9fe89b5da2c5be574ad0b6a5dc2e
Opcode Fuzzy Hash: 959b79a4f2a0253d1d89a23c3a1791a97dd1e5cb4523ba1e289b6694acb20024
Instruction Fuzzy Hash: F8718670D10248DFDB14DFA5D895BEEBBB4FF58304F14821EE805AB141EB74AA48CB91

Function 0053E7F0 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 202synchronizationCOMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(00758948,E57473E3,00758948,?,?,?,00000000,Function_0020B9F0,000000FF,?,?,006E8EF0,E57473E3,lifetime_object must be allocated on static memory (static or global variable or member of such a variable).,?,006E8EF0), ref: 0053EA27

Part of subcall function 0040ACA0: CloseHandle.KERNEL32(?,E57473E3,?,?,?,?,00475410,?,E57473E3,?), ref: 0040AD00
Part of subcall function 0040ACA0: LeaveCriticalSection.KERNEL32(?,E57473E3,?), ref: 0040AD3A

WaitForSingleObject.KERNEL32(00000001,000000FF,?,E57473E3,?,?), ref: 0053E913
CloseHandle.KERNEL32(00000001,?,?), ref: 0053E92A

Part of subcall function 005583D0: EnterCriticalSection.KERNEL32(00000000), ref: 0055844E
Part of subcall function 005583D0: LeaveCriticalSection.KERNEL32(00000000,?,?,00000000), ref: 00558482

Part of subcall function 00557BF0: SetEvent.KERNEL32(?,E57473E3,?,00000000,0040ED03,0075904C,E57473E3,?,00000000,?,?,00000000,0060B9F0,000000FF,?,invalid string position), ref: 00557C4A
Part of subcall function 00557BF0: CloseHandle.KERNEL32(?,?,?,00000000,0060B9F0,000000FF,?,invalid string position,00419371), ref: 00557C64
Part of subcall function 00557BF0: LeaveCriticalSection.KERNEL32(0060B9F0,?,?,00000000,0060B9F0), ref: 00557C86

Strings

st, xrefs: 0053E818, 0053E9D5
lifetime_object must be allocated on static memory (static or global variable or member of such a variable)., xrefs: 0053E95C, 0053E98A

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: CriticalSection$CloseHandleLeave$DeleteEnterEventObjectSingleWait
String ID: lifetime_object must be allocated on static memory (static or global variable or member of such a variable).$st
API String ID: 1727174650-2580301956
Opcode ID: 8c543ca234d50c39f54ad88fe15c159ad4c83a56ede5fe84958ef9257a20cd3a
Instruction ID: 48f4bf83d1e4c55c187ebfd2f1387aacc16858498965204d8a160a773c9cd0b8
Opcode Fuzzy Hash: 8c543ca234d50c39f54ad88fe15c159ad4c83a56ede5fe84958ef9257a20cd3a
Instruction Fuzzy Hash: 52718071D00649EFCB00DF95C945BAEFBF8FF15710F10826AE815A7281EB74AA44CBA1

Function 005608A0 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 197registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.ADVAPI32(00000000,E57473E3,00000000,00000000,?,0055E866,E57473E3), ref: 00560938

Part of subcall function 005C90B0: RaiseException.KERNEL32(E06D7363,00000001,00000003,0042867C,?,?,?,?,0042867C,st,006E8FF4,E57473E3), ref: 005C9110

Strings

st, xrefs: 005608B7
Cannot query registry data due to '{}' value changed too often, xrefs: 00560B07
8sh, xrefs: 00560A8A

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: ExceptionQueryRaiseValue
String ID: 8sh$Cannot query registry data due to '{}' value changed too often$st
API String ID: 2993521683-1015644340
Opcode ID: bc0777116a4f85ae46961b4692c5e655564590cbad0b1b7435108b4e0424d4d3
Instruction ID: 9ff9381cc699e46acdaf21615f084e587e2b8afe35247bc2f42ac29518416515
Opcode Fuzzy Hash: bc0777116a4f85ae46961b4692c5e655564590cbad0b1b7435108b4e0424d4d3
Instruction Fuzzy Hash: EF810871E002199FDB14DF99C945BAEBBB5FF48300F108199E819A7391EB746E84CF91

Function 0042E540 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 187COMMON

Download Yara Rule

APIs

RtlDllShutdownInProgress.NTDLL ref: 0042E5A1

Strings

st, xrefs: 0042E007, 0042E354, 0042E557
NtDll Fncs not initialized, xrefs: 0042E99B, 0042E9CF
csm, xrefs: 0042E72E
Dump contains a C++ exception, its pointer is stored as Parameter[3] of the exception record. Use .ecxr to see the line of except, xrefs: 0042E8B3

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: ProgressShutdown
String ID: Dump contains a C++ exception, its pointer is stored as Parameter[3] of the exception record. Use .ecxr to see the line of except$NtDll Fncs not initialized$csm$st
API String ID: 396724402-2983994507
Opcode ID: a4c1448a47abb262fc032e914a7f792e6cdb1dde3378c61b3caa6f5acec59597
Instruction ID: 8c3d99e26b59d7dfc1cf69f3ed148b33c152eebd34b6bc06f40d3f5b7605427f
Opcode Fuzzy Hash: a4c1448a47abb262fc032e914a7f792e6cdb1dde3378c61b3caa6f5acec59597
Instruction Fuzzy Hash: 4471BB70E00268CFDB14CFA9C854BEDBBB1FF48304F50425AE445AB391D778AA84CB98

Function 00568680 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 187libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,onexit_register_connector_avast_2,?,00000000), ref: 00568725
GetProcAddress.KERNEL32(00000000), ref: 0056872C

Strings

st, xrefs: 00568694
onexit_register_connector_avast_2, xrefs: 0056871A
onexit_register_connector_avast_2 export not found, xrefs: 00568890

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: onexit_register_connector_avast_2$onexit_register_connector_avast_2 export not found$st
API String ID: 1646373207-3487778685
Opcode ID: 2f52e4cf3f400d8c92ccdb35bdd805e58c2ec9b46d77719f77ed0045792af003
Instruction ID: dcfe556cbc3ea71d0587f8660adf36b246ac2a1a4175db3bc85659b29e9d01ef
Opcode Fuzzy Hash: 2f52e4cf3f400d8c92ccdb35bdd805e58c2ec9b46d77719f77ed0045792af003
Instruction Fuzzy Hash: E2718070A006199FCB01DF64C8847ADBBF6FF88324F15825AE815AB351EB75AE45CF90

Function 0055EC50 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 178registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00561C30: RegOpenKeyExW.ADVAPI32(?,?,?,?,?,?,E57473E3,00000000,?), ref: 00561CEE

RegQueryInfoKeyW.ADVAPI32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0055ED93

Part of subcall function 0055DFF0: ___std_exception_copy.LIBVCRUNTIME ref: 0055E12F

RegCloseKey.ADVAPI32(?), ref: 0055EEB2
SetLastError.KERNEL32(00000000), ref: 0055EEBD

Strings

st, xrefs: 0055EC7B
`ph, xrefs: 0055EE32

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: CloseErrorInfoLastOpenQuery___std_exception_copy
String ID: `ph$st
API String ID: 157364203-3020759199
Opcode ID: e0b8512ae5d74de41574edb18d9472911cb3df1e56090344f49954dde1ec56ea
Instruction ID: 7a16245ae4081dacf933c55335560fe29e6dbce4615758aa53ff4bcec29fd429
Opcode Fuzzy Hash: e0b8512ae5d74de41574edb18d9472911cb3df1e56090344f49954dde1ec56ea
Instruction Fuzzy Hash: 3A7170B1D002599BDB24DF68C945B9EBBF4FF48304F10859AE819B7241EB755E84CFA0

Function 00539860 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 175synchronizationCOMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?,E57473E3,?,00000000,00000000,Function_0020BDE0,000000FF,?,?,006E8EF0,?,lifetime_object must be allocated on static memory (static or global variable or member of such a variable).,?,006E8EF0,?,lifetime_object must be allocated on static memory (static or global variable or member of such a variable).), ref: 00539A76

Part of subcall function 0040ACA0: CloseHandle.KERNEL32(?,E57473E3,?,?,?,?,00475410,?,E57473E3,?), ref: 0040AD00
Part of subcall function 0040ACA0: LeaveCriticalSection.KERNEL32(?,E57473E3,?), ref: 0040AD3A

WaitForSingleObject.KERNEL32(?,000000FF,?,E57473E3,?,00000000), ref: 0053999A
CloseHandle.KERNEL32(?), ref: 005399B1

Part of subcall function 005583D0: EnterCriticalSection.KERNEL32(00000000), ref: 0055844E
Part of subcall function 005583D0: LeaveCriticalSection.KERNEL32(00000000,?,?,00000000), ref: 00558482

Part of subcall function 00557BF0: SetEvent.KERNEL32(?,E57473E3,?,00000000,0040ED03,0075904C,E57473E3,?,00000000,?,?,00000000,0060B9F0,000000FF,?,invalid string position), ref: 00557C4A
Part of subcall function 00557BF0: CloseHandle.KERNEL32(?,?,?,00000000,0060B9F0,000000FF,?,invalid string position,00419371), ref: 00557C64
Part of subcall function 00557BF0: LeaveCriticalSection.KERNEL32(0060B9F0,?,?,00000000,0060B9F0), ref: 00557C86

Strings

st, xrefs: 00539888, 00539A53
lifetime_object must be allocated on static memory (static or global variable or member of such a variable)., xrefs: 005399E5, 00539A13

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: CriticalSection$CloseHandleLeave$DeleteEnterEventObjectSingleWait
String ID: lifetime_object must be allocated on static memory (static or global variable or member of such a variable).$st
API String ID: 1727174650-2580301956
Opcode ID: e41c19552672be5ad16807b8491c2ee6ec1bcbfe619e44ff263631727213fac9
Instruction ID: d5cacec1872b4a093300bbef146ca95e92a0fb916e7b73e8873200012e93cb65
Opcode Fuzzy Hash: e41c19552672be5ad16807b8491c2ee6ec1bcbfe619e44ff263631727213fac9
Instruction Fuzzy Hash: E261BF71D042489FCB00DF94DC45BDEBBB5FF49725F14412EE811AB281DBB85A08CBA5

Function 00570090 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 172COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 005700F9
GetCurrentProcess.KERNEL32(00000000,?), ref: 005702A6
GetProcessAffinityMask.KERNEL32(00000000), ref: 005702AD

Strings

st, xrefs: 00570099

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: Process$AffinityCurrentErrorLastMask
String ID: st
API String ID: 429512979-1638371401
Opcode ID: 09d859e17a5691865a1e3a0d8b33c3cf100b0ccdeeec6abd320743c7f9be2e87
Instruction ID: 8901184c48c40b1a5c73e877523f6284a84b7afbf799bd47625a328d2668dba7
Opcode Fuzzy Hash: 09d859e17a5691865a1e3a0d8b33c3cf100b0ccdeeec6abd320743c7f9be2e87
Instruction Fuzzy Hash: ED61D3759092288BCB249B24DC8C7A9BFF5BF05301F1891DAD84EE7281DA348E80AF50

Function 0055FD20 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 158registryCOMMON

Download Yara Rule

APIs

RegQueryMultipleValuesW.ADVAPI32(?,?,?,00000000,00000000,E57473E3,?,?), ref: 0055FDFC
RegCloseKey.ADVAPI32(?), ref: 0055FEE5
SetLastError.KERNEL32(00000000), ref: 0055FEF0

Strings

st, xrefs: 0055FD48
Hrh, xrefs: 0055FE57

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: CloseErrorLastMultipleQueryValues
String ID: Hrh$st
API String ID: 3522168389-4066128984
Opcode ID: d68b24dc415a940569a8436d471f31af7f24c8e95cd6d0d19ae20de65ed99485
Instruction ID: 78acc85dd3aaaeff86a6e26d43c4f5df267c10570554a5e9e53918fe00498176
Opcode Fuzzy Hash: d68b24dc415a940569a8436d471f31af7f24c8e95cd6d0d19ae20de65ed99485
Instruction Fuzzy Hash: 7D5117B1D002199FDB14CFA9C855BAEFBB5FF48314F14822AE815B7381DB75A944CBA0

Function 004753A0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 155synchronizationCOMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00475597

Part of subcall function 0040ACA0: CloseHandle.KERNEL32(?,E57473E3,?,?,?,?,00475410,?,E57473E3,?), ref: 0040AD00
Part of subcall function 0040ACA0: LeaveCriticalSection.KERNEL32(?,E57473E3,?), ref: 0040AD3A

WaitForSingleObject.KERNEL32(?,000000FF,?,E57473E3,?), ref: 004754DA
CloseHandle.KERNEL32(?), ref: 004754F1

Part of subcall function 005583D0: EnterCriticalSection.KERNEL32(00000000), ref: 0055844E
Part of subcall function 005583D0: LeaveCriticalSection.KERNEL32(00000000,?,?,00000000), ref: 00558482

Part of subcall function 00557BF0: SetEvent.KERNEL32(?,E57473E3,?,00000000,0040ED03,0075904C,E57473E3,?,00000000,?,?,00000000,0060B9F0,000000FF,?,invalid string position), ref: 00557C4A
Part of subcall function 00557BF0: CloseHandle.KERNEL32(?,?,?,00000000,0060B9F0,000000FF,?,invalid string position,00419371), ref: 00557C64
Part of subcall function 00557BF0: LeaveCriticalSection.KERNEL32(0060B9F0,?,?,00000000,0060B9F0), ref: 00557C86

Strings

st, xrefs: 004753C8
lifetime_object must be allocated on static memory (static or global variable or member of such a variable)., xrefs: 00475525, 00475553

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: CriticalSection$CloseHandleLeave$EnterEventObjectSingleWait___std_exception_destroy
String ID: lifetime_object must be allocated on static memory (static or global variable or member of such a variable).$st
API String ID: 1073078398-2580301956
Opcode ID: a5dddbba1dafe3be70a766fd682c4f183294580ea0e208b0286809a3b8300b9b
Instruction ID: 13fdb1ae46addbee99e0bb0ec8c035d06e0a452e1f2bec7cde0012e137088b23
Opcode Fuzzy Hash: a5dddbba1dafe3be70a766fd682c4f183294580ea0e208b0286809a3b8300b9b
Instruction Fuzzy Hash: 5F51B470D007489FCB00DFA5D849BDEBBF5EF44714F10852AE8157B281DBB95A48CBA5

Function 00573370 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 154fileCOMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,?,?,00000000,?,?,?,?,00579B2E,00000000,?), ref: 00573465
GetLastError.KERNEL32(?,00579B2E,00000000,?), ref: 00573470
ReadFile.KERNEL32(?,00000000,?,00000000,00000000,?,00579B2E,00000000,?), ref: 00573489
GetLastError.KERNEL32(?,00579B2E,00000000,?), ref: 00573493

Strings

st, xrefs: 00573376

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: ErrorFileLast$PointerRead
String ID: st
API String ID: 2170121939-1638371401
Opcode ID: ae4188d8a98283b7f831c00281ad08df50f31e0d0a722047377d585ffa69b136
Instruction ID: 28cc627e7328429c1f5a9b139c4f9f677966bd2ee5adf585358bddcfce08eb46
Opcode Fuzzy Hash: ae4188d8a98283b7f831c00281ad08df50f31e0d0a722047377d585ffa69b136
Instruction Fuzzy Hash: B9414771B002199BDF15DFA5EC48AAEBBB9FF44321F108569ED19E7250DB31DE00AB90

Function 0055E470 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 150registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00561C30: RegOpenKeyExW.ADVAPI32(?,?,?,?,?,?,E57473E3,00000000,?), ref: 00561CEE

Part of subcall function 005602F0: RegQueryValueExW.ADVAPI32(00000000,00000000,00000000,?,?,?,E57473E3,00000000,?), ref: 00560385

RegCloseKey.ADVAPI32(?), ref: 0055E501
SetLastError.KERNEL32(00000000), ref: 0055E50C
ExpandEnvironmentStringsW.KERNEL32(?,00000000,00000000,00000025,00000000), ref: 0055E59A
ExpandEnvironmentStringsW.KERNEL32(?,?,00000001,-00000001,00000000), ref: 0055E608

Strings

st, xrefs: 0055E3B4, 0055E49B, 0055E724, 0055E824, 0055E928

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: EnvironmentExpandStrings$CloseErrorLastOpenQueryValue
String ID: st
API String ID: 2357329694-1638371401
Opcode ID: 4b69a84fefd8469d751fe168c25a49320ac5a4f2da4757402a1da42b2613f3dc
Instruction ID: a631cc534c5b01f48b1c002946b764537df255701a4bbd404fbb359a28e47748
Opcode Fuzzy Hash: 4b69a84fefd8469d751fe168c25a49320ac5a4f2da4757402a1da42b2613f3dc
Instruction Fuzzy Hash: 36518370D10314AFDB24DF64E959BAEBBF5FF54715F54462EE842A3280E7309A08CB91

Function 0055F230 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 134registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.ADVAPI32(?,?,00000000,00000000,?,?,00000000,00000000,00000000,E57473E3,00000000,?), ref: 0055F2B5
RegCreateKeyExW.ADVAPI32(?,?,00000000,00000000,?,?,00000000,?,00000000,?), ref: 0055F339
RegCloseKey.ADVAPI32(?), ref: 0055F367
SetLastError.KERNEL32(00000000), ref: 0055F372

Strings

st, xrefs: 0055F25B

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: Create$CloseErrorLast
String ID: st
API String ID: 3551974399-1638371401
Opcode ID: f692e2648718709b66c36c8c34f6983d0559e82c6e0dcd2bb28c2e464dc446cc
Instruction ID: f7f86abdca63ad48ab35832455ba4635008b71231908de55401c86844e02451a
Opcode Fuzzy Hash: f692e2648718709b66c36c8c34f6983d0559e82c6e0dcd2bb28c2e464dc446cc
Instruction Fuzzy Hash: 0E514DB0D042199FDB24DF68CD89BAEBBF5FB48700F10456AE919A7380D7716A44CF94

Function 00573DA0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 122fileCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00000000,?,?,?,?,?,?), ref: 00573E0D
LeaveCriticalSection.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 00573EB0
UnmapViewOfFile.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 00573EBB
CloseHandle.KERNEL32(00000007,?,?,?,?,?,?,?,?,?), ref: 00573ECC

Strings

st, xrefs: 00573DA6

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: CriticalSection$CloseEnterFileHandleLeaveUnmapView
String ID: st
API String ID: 3874137090-1638371401
Opcode ID: c4b6b0fb8b7037afd41091a278315ff7c41aff0f0a99f09668ca4447f13bec55
Instruction ID: 82423fe83b647a0ea9344bc0e7c99935ece0157f6d634852f2ea7601265c0ce8
Opcode Fuzzy Hash: c4b6b0fb8b7037afd41091a278315ff7c41aff0f0a99f09668ca4447f13bec55
Instruction Fuzzy Hash: FF418131A00309DFDB11DFA4E884EAEBBBEFB45321F00C599D90997251DB74EE45AB90

Function 00435C40 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 114COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(E57473E3), ref: 00435C79

Strings

st, xrefs: 00435D71, 00435D25, 00435D43, 00435D46
Cause: Manual dump - , xrefs: 00435CF0
st, xrefs: 00435C56
Cause: Manual dump, xrefs: 00435D4C, 00435D59

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: CurrentProcess
String ID: Cause: Manual dump$Cause: Manual dump - $st$st
API String ID: 2050909247-3063993858
Opcode ID: b2d00c3cebf421f03b2a2e7e202c06d20de688a012d09316d261879281673f41
Instruction ID: aa050adf17fa8e9d952234f24a7ffc19040b44c64320b95b61e5725815d9b090
Opcode Fuzzy Hash: b2d00c3cebf421f03b2a2e7e202c06d20de688a012d09316d261879281673f41
Instruction Fuzzy Hash: C4416971D002199BCF00CFA4D845BEFBBB5FF58314F50821AE821B7290EB789A41CB90

Function 00435AC0 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 113COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(E57473E3), ref: 00435AF9

Strings

st, xrefs: 00435BEE, 00435BA5, 00435BC3, 00435BC6
Cause: Manual dump - , xrefs: 00435B70
st, xrefs: 00435AD6
Cause: Manual dump, xrefs: 00435BCC, 00435BD6

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: CurrentProcess
String ID: Cause: Manual dump$Cause: Manual dump - $st$st
API String ID: 2050909247-3063993858
Opcode ID: 4b7bcde7c55f90a2af5d5905523f83c55c90213c9b548090e6eddaedf4b6a220
Instruction ID: dd2c9b9f3cd6b98f52d5c46e9407380b654a0fbeb5025403983ae6ffe69075fc
Opcode Fuzzy Hash: 4b7bcde7c55f90a2af5d5905523f83c55c90213c9b548090e6eddaedf4b6a220
Instruction Fuzzy Hash: 4E415971D002199BCB00DFA4D945BEFBBB5FF58314F20421EE821B7290EB78AA45CB90

Function 0056A450 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 0040A780: WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,00474D01,00000000,00000000,00000000,00000000,E57473E3,?), ref: 0040A836
Part of subcall function 0040A780: WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,00474D01,?,?,00000000,00000000,00000000,00000000), ref: 0040A8A1

___std_exception_copy.LIBVCRUNTIME ref: 0056A4C6
___std_exception_destroy.LIBVCRUNTIME ref: 0056A4D9
___std_exception_copy.LIBVCRUNTIME ref: 0056A4E3
___std_exception_destroy.LIBVCRUNTIME ref: 0056A4F6

Strings

st, xrefs: 0056A464

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: ByteCharMultiWide___std_exception_copy___std_exception_destroy
String ID: st
API String ID: 2337458698-1638371401
Opcode ID: 1f1aca103269c7b493bac3068c0c1c8ed2564f327cb69e72363e956d635ea06f
Instruction ID: ffabdb7d0306539619f36e72c9d7aaabe71cae62bbf69fee704c3a71dcea1d48
Opcode Fuzzy Hash: 1f1aca103269c7b493bac3068c0c1c8ed2564f327cb69e72363e956d635ea06f
Instruction Fuzzy Hash: FD318FB2D002189FCF04DBE8DC85ADEBBB9FF55314F50862AF815B7641EB7496048BA1

Function 00561DF0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 96COMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,E57473E3,00000000,00000000,E57473E3,?,?,?,E57473E3,00000000,?), ref: 00561E26
GetLastError.KERNEL32(Call to CreateEvent failed,?,?,E57473E3,00000000), ref: 00561E52
Concurrency::scheduler_worker_creation_error::scheduler_worker_creation_error.LIBCMT ref: 00561E5C

Strings

st, xrefs: 00561E05, 00561E86
Call to CreateEvent failed, xrefs: 00561E4D

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: Concurrency::scheduler_worker_creation_error::scheduler_worker_creation_errorCreateErrorEventLast
String ID: Call to CreateEvent failed$st
API String ID: 3279163882-1903728657
Opcode ID: 6c0445e1d0a4d1d2cce104f59dd02d91884160c24ba18efe6e9e899d25fed2ac
Instruction ID: e0ca23ecf7a848f567c45c213a038db02b357451f77ce6404a962d70e671debc
Opcode Fuzzy Hash: 6c0445e1d0a4d1d2cce104f59dd02d91884160c24ba18efe6e9e899d25fed2ac
Instruction Fuzzy Hash: 5D414D71900759EBCB00DFA8C905BDABBF8FF19704F10861AE854A7681E7B4A644CBA1

Function 0042A4B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 92memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042A2D0: GetProcessHeap.KERNEL32(?,?,?,?,0042A52E,00000000,E57473E3,006691F0,?), ref: 0042A2E4
Part of subcall function 0042A2D0: HeapAlloc.KERNEL32(?,00000000,005C8A31,?,?,?,?,?,0042A52E,00000000,E57473E3,006691F0,?), ref: 0042A31A

Part of subcall function 00568410: GetModuleHandleW.KERNEL32(00000000,{9C7565A2-47C2-4869-B388-8C7F9AD8E577},00000030,E57473E3,?,?), ref: 0056846B
Part of subcall function 00568410: GetClassInfoExW.USER32(00000000,?,?), ref: 00568472
Part of subcall function 00568410: GetLastError.KERNEL32(?,?), ref: 00568480
Part of subcall function 00568410: Sleep.KERNELBASE(00000001,?,?), ref: 0056848A
Part of subcall function 00568410: GetProcessHeap.KERNEL32(?,?), ref: 005684A2
Part of subcall function 00568410: HeapAlloc.KERNEL32(00000000,00000000,00000034,?,?), ref: 005684B7
Part of subcall function 00568410: InitializeCriticalSection.KERNEL32(00000000), ref: 005684DA
Part of subcall function 00568410: GetProcessHeap.KERNEL32(?,?), ref: 005684E0
Part of subcall function 00568410: GetProcessHeap.KERNEL32(?,?), ref: 005684FE
Part of subcall function 00568410: RegisterClassExW.USER32(00000030), ref: 00568520
Part of subcall function 00568410: HeapFree.KERNEL32(?,00000000,00000000), ref: 00568554
Part of subcall function 00568410: DeleteCriticalSection.KERNEL32(?), ref: 0056857F
Part of subcall function 00568410: GetProcessHeap.KERNEL32 ref: 00568585

GetProcessHeap.KERNEL32(00000000,E57473E3,006691F0,?), ref: 0042A54F

Part of subcall function 0042A800: HeapAlloc.KERNEL32(?,00000000,0000002C,E57473E3,?,00000018,?,?,?,?,0060CA2D,000000FF,?,0042A587,?,?), ref: 0042A852
Part of subcall function 0042A800: GetProcessHeap.KERNEL32(0042A587), ref: 0042A8C5

HeapFree.KERNEL32(?,00000000,?,?,?), ref: 0042A5A8
asw_process_storage_deallocate_connector.ANTISPAM_CONNECT_EU ref: 0042A5B8

Strings

st, xrefs: 0042A4DA
asw::settings::SettingsConfig::StorePathIni, xrefs: 0042A39A

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: Heap$Process$Alloc$ClassCriticalFreeSection$DeleteErrorHandleInfoInitializeLastModuleRegisterSleepasw_process_storage_deallocate_connector
String ID: asw::settings::SettingsConfig::StorePathIni$st
API String ID: 2958687374-2238818579
Opcode ID: 19596cf864419892d0a8086c70b8130d6c1bdf0710603b74083f013f29691c67
Instruction ID: 882311d15f47d24e7fc0e9a3db90137ea5568777d2ade39d877401da0f3c3fdf
Opcode Fuzzy Hash: 19596cf864419892d0a8086c70b8130d6c1bdf0710603b74083f013f29691c67
Instruction Fuzzy Hash: 4B317CB0E00618DFCB00CF59D885B9EFBF8FF48714F10811AE814A7350D775AA508B95

Function 0040ACA0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 00557B50: InitializeCriticalSection.KERNEL32(00000000,00000000,0040ED03,0075904C,E57473E3,?,00000000,?,?,00000000,0060B9F0,000000FF,?,invalid string position,00419371), ref: 00557B79
Part of subcall function 00557B50: DeleteCriticalSection.KERNEL32(00000000,?,?,00000000,0060B9F0,000000FF,?,invalid string position,00419371,?,00000000,00000000,?,00000000), ref: 00557B93
Part of subcall function 00557B50: EnterCriticalSection.KERNEL32(00000000,?,00000000,?,0060B9F0,?,00557C31,E57473E3,?,00000000,0040ED03,0075904C,E57473E3,?,00000000), ref: 00557BDD

CloseHandle.KERNEL32(?,E57473E3,?,?,?,?,00475410,?,E57473E3,?), ref: 0040AD00
LeaveCriticalSection.KERNEL32(?,E57473E3,?), ref: 0040AD3A
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,?,00475410,?,E57473E3,?), ref: 0040AD68
LeaveCriticalSection.KERNEL32(?), ref: 0040AD7D

Strings

st, xrefs: 0040ACB4

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: CriticalSection$Leave$CloseCreateDeleteEnterEventHandleInitialize
String ID: st
API String ID: 3435541109-1638371401
Opcode ID: f63940fdc515aa8fc0cd3a309fc9a715f45738ac17c9f73fb10e3e534dc33b6e
Instruction ID: 3567bde80ff37c1b3335d5cbd4ba91f4fd0ffa8ae961c3a5ab7a499b6b534981
Opcode Fuzzy Hash: f63940fdc515aa8fc0cd3a309fc9a715f45738ac17c9f73fb10e3e534dc33b6e
Instruction Fuzzy Hash: 7031DE71D0031AABDB218F54C845BAEFBB2FF45B11F20422AE5157B2C0E7792990CBD1

Function 005C6094 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 85COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(-00751A80,E57473E3,?,00000000,00000004,000000FF,?,?,?,0047D36F,?,?,?,?,?,0047CD0C), ref: 005C60D9
SleepConditionVariableSRW.KERNEL32(00000000,-00751A80,00000000,00000000,?,00000000), ref: 005C6116
ReleaseSRWLockExclusive.KERNEL32(-00751A80), ref: 005C6150
ReleaseSRWLockExclusive.KERNEL32(-00751A80,?,00000000), ref: 005C617A

Strings

st, xrefs: 005C60AA

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: ExclusiveLock$Release$AcquireConditionSleepVariable
String ID: st
API String ID: 3114648011-1638371401
Opcode ID: ac2e2c0269d73ccd5b9af971b2b581db8289e370b489ac12a6da1a8562ed05ae
Instruction ID: e23cc506699de9071259b7d9d4c1c8200ce29f247cf0cd57b0bb9fb358d52497
Opcode Fuzzy Hash: ac2e2c0269d73ccd5b9af971b2b581db8289e370b489ac12a6da1a8562ed05ae
Instruction Fuzzy Hash: 77310A719002199FCB14CF59C945BAABBF5FF48311F14852EE816E7391D735EA41CBA0

Function 00429D40 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 85memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00568410: GetModuleHandleW.KERNEL32(00000000,{9C7565A2-47C2-4869-B388-8C7F9AD8E577},00000030,E57473E3,?,?), ref: 0056846B
Part of subcall function 00568410: GetClassInfoExW.USER32(00000000,?,?), ref: 00568472
Part of subcall function 00568410: GetLastError.KERNEL32(?,?), ref: 00568480
Part of subcall function 00568410: Sleep.KERNELBASE(00000001,?,?), ref: 0056848A
Part of subcall function 00568410: GetProcessHeap.KERNEL32(?,?), ref: 005684A2
Part of subcall function 00568410: HeapAlloc.KERNEL32(00000000,00000000,00000034,?,?), ref: 005684B7
Part of subcall function 00568410: InitializeCriticalSection.KERNEL32(00000000), ref: 005684DA
Part of subcall function 00568410: GetProcessHeap.KERNEL32(?,?), ref: 005684E0
Part of subcall function 00568410: GetProcessHeap.KERNEL32(?,?), ref: 005684FE
Part of subcall function 00568410: RegisterClassExW.USER32(00000030), ref: 00568520
Part of subcall function 00568410: HeapFree.KERNEL32(?,00000000,00000000), ref: 00568554
Part of subcall function 00568410: DeleteCriticalSection.KERNEL32(?), ref: 0056857F
Part of subcall function 00568410: GetProcessHeap.KERNEL32 ref: 00568585

EnterCriticalSection.KERNEL32(00000000), ref: 00429D90

Part of subcall function 0042A2D0: GetProcessHeap.KERNEL32(?,?,?,?,0042A52E,00000000,E57473E3,006691F0,?), ref: 0042A2E4
Part of subcall function 0042A2D0: HeapAlloc.KERNEL32(?,00000000,005C8A31,?,?,?,?,?,0042A52E,00000000,E57473E3,006691F0,?), ref: 0042A31A

HeapFree.KERNEL32(?,00000000,?,00000000,?,00000000), ref: 00429E00
asw_process_storage_deallocate_connector.ANTISPAM_CONNECT_EU ref: 00429E10
LeaveCriticalSection.KERNEL32(?,00000000,?,00000000), ref: 00429E18

Strings

st, xrefs: 00429D68

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: Heap$Process$CriticalSection$AllocClassFree$DeleteEnterErrorHandleInfoInitializeLastLeaveModuleRegisterSleepasw_process_storage_deallocate_connector
String ID: st
API String ID: 2271701472-1638371401
Opcode ID: 21353ee84b95b5d96b5f3914d7240ef3dffcf232b6ebd285e6d4dd2e4d37bc8e
Instruction ID: cfe6f51351f21e2c383533453a5906a36e42470de4f6dcc31c1a9d3068743b69
Opcode Fuzzy Hash: 21353ee84b95b5d96b5f3914d7240ef3dffcf232b6ebd285e6d4dd2e4d37bc8e
Instruction Fuzzy Hash: 8931D471E002189FDB10DFA9DC46BAEBBF5EF44710F14422AE805B3391DB755E108BA5

Function 00557BF0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 84COMMON

Download Yara Rule

APIs

Part of subcall function 00557B50: InitializeCriticalSection.KERNEL32(00000000,00000000,0040ED03,0075904C,E57473E3,?,00000000,?,?,00000000,0060B9F0,000000FF,?,invalid string position,00419371), ref: 00557B79
Part of subcall function 00557B50: DeleteCriticalSection.KERNEL32(00000000,?,?,00000000,0060B9F0,000000FF,?,invalid string position,00419371,?,00000000,00000000,?,00000000), ref: 00557B93
Part of subcall function 00557B50: EnterCriticalSection.KERNEL32(00000000,?,00000000,?,0060B9F0,?,00557C31,E57473E3,?,00000000,0040ED03,0075904C,E57473E3,?,00000000), ref: 00557BDD

SetEvent.KERNEL32(?,E57473E3,?,00000000,0040ED03,0075904C,E57473E3,?,00000000,?,?,00000000,0060B9F0,000000FF,?,invalid string position), ref: 00557C4A
CloseHandle.KERNEL32(?,?,?,00000000,0060B9F0,000000FF,?,invalid string position,00419371), ref: 00557C64
LeaveCriticalSection.KERNEL32(0060B9F0,?,?,00000000,0060B9F0), ref: 00557C86

Strings

st, xrefs: 00557C04
asw::lifetime::impl::lifetime_creation_monitor_holder::set_created, xrefs: 00557CA9

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: CriticalSection$CloseDeleteEnterEventHandleInitializeLeave
String ID: asw::lifetime::impl::lifetime_creation_monitor_holder::set_created$st
API String ID: 3040484998-1118438279
Opcode ID: 4a5cbec6a3daedf2d1ee549541e114e2bfc32ecf72bbd5eab9679b16334fbc5a
Instruction ID: 5266068e1e844d0436182f641600fa0b4ce72a9ce106f5dee01f4608910de2a3
Opcode Fuzzy Hash: 4a5cbec6a3daedf2d1ee549541e114e2bfc32ecf72bbd5eab9679b16334fbc5a
Instruction Fuzzy Hash: C121D331904609EFCB10DF64D959F9EFFB5FF14710F10422AE811A3291EB346944CB90

Function 00429C50 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 80memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00568410: GetModuleHandleW.KERNEL32(00000000,{9C7565A2-47C2-4869-B388-8C7F9AD8E577},00000030,E57473E3,?,?), ref: 0056846B
Part of subcall function 00568410: GetClassInfoExW.USER32(00000000,?,?), ref: 00568472
Part of subcall function 00568410: GetLastError.KERNEL32(?,?), ref: 00568480
Part of subcall function 00568410: Sleep.KERNELBASE(00000001,?,?), ref: 0056848A
Part of subcall function 00568410: GetProcessHeap.KERNEL32(?,?), ref: 005684A2
Part of subcall function 00568410: HeapAlloc.KERNEL32(00000000,00000000,00000034,?,?), ref: 005684B7
Part of subcall function 00568410: InitializeCriticalSection.KERNEL32(00000000), ref: 005684DA
Part of subcall function 00568410: GetProcessHeap.KERNEL32(?,?), ref: 005684E0
Part of subcall function 00568410: GetProcessHeap.KERNEL32(?,?), ref: 005684FE
Part of subcall function 00568410: RegisterClassExW.USER32(00000030), ref: 00568520
Part of subcall function 00568410: HeapFree.KERNEL32(?,00000000,00000000), ref: 00568554
Part of subcall function 00568410: DeleteCriticalSection.KERNEL32(?), ref: 0056857F
Part of subcall function 00568410: GetProcessHeap.KERNEL32 ref: 00568585

EnterCriticalSection.KERNEL32(00000000,E57473E3), ref: 00429C9D

Part of subcall function 0042A2D0: GetProcessHeap.KERNEL32(?,?,?,?,0042A52E,00000000,E57473E3,006691F0,?), ref: 0042A2E4
Part of subcall function 0042A2D0: HeapAlloc.KERNEL32(?,00000000,005C8A31,?,?,?,?,?,0042A52E,00000000,E57473E3,006691F0,?), ref: 0042A31A

HeapFree.KERNEL32(?,00000000,?,00000000), ref: 00429CFF
asw_process_storage_deallocate_connector.ANTISPAM_CONNECT_EU ref: 00429D0F
LeaveCriticalSection.KERNEL32(00000000,00000000), ref: 00429D17

Strings

st, xrefs: 00429C78

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: Heap$Process$CriticalSection$AllocClassFree$DeleteEnterErrorHandleInfoInitializeLastLeaveModuleRegisterSleepasw_process_storage_deallocate_connector
String ID: st
API String ID: 2271701472-1638371401
Opcode ID: 3cc00d79a3485824a9820a35dd8a1ce8f643c1a0531e09299f9e27a9b4448031
Instruction ID: 8cb0389d6a016780024ab530e9319adcce7963ac9fa782ab1bdbfa53fc76095b
Opcode Fuzzy Hash: 3cc00d79a3485824a9820a35dd8a1ce8f643c1a0531e09299f9e27a9b4448031
Instruction Fuzzy Hash: E821F671E002149FDB00DB69DC46BAEBBF5FB48710F10422AE815B3391DB756E10CBA5

Function 00431A00 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

VerSetConditionMask.NTDLL ref: 00431A6D
VerSetConditionMask.NTDLL ref: 00431A75
VerSetConditionMask.NTDLL ref: 00431A7D
VerifyVersionInfoW.KERNEL32(00000000,00000023,00000000), ref: 00431AA4

Strings

st, xrefs: 00431A0C

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersion
String ID: st
API String ID: 2793162063-1638371401
Opcode ID: ef5ca64d68922db44a3160d2f60204cecf584bc2ff1adcc5a1eb0d4e8d801f75
Instruction ID: 3bce682d7f1656d3421a30d2c0506fe9b8483230324067ca672ed68818bf8d81
Opcode Fuzzy Hash: ef5ca64d68922db44a3160d2f60204cecf584bc2ff1adcc5a1eb0d4e8d801f75
Instruction Fuzzy Hash: 7E114FB16443406FE324DF65EC0AFABB6ECEF88B14F00491DB589D62C2E77456148B96

Function 0040AB10 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 0040AB58
___std_exception_destroy.LIBVCRUNTIME ref: 0040AB68
___std_exception_copy.LIBVCRUNTIME ref: 0040AB72
___std_exception_destroy.LIBVCRUNTIME ref: 0040AB85

Strings

st, xrefs: 0040AB16

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: ___std_exception_copy___std_exception_destroy
String ID: st
API String ID: 2970364248-1638371401
Opcode ID: ca610d681fa444d2aa0fc654e49aea6872fe64093317b3131c5fa2ec02fb85ad
Instruction ID: c0d7ba5198bab8db58f419e21128c239df63de06a3f0b2fe1670abe55225c36b
Opcode Fuzzy Hash: ca610d681fa444d2aa0fc654e49aea6872fe64093317b3131c5fa2ec02fb85ad
Instruction Fuzzy Hash: 781152B1D0020EABCB00EFA4D8459DEBBB9BF95314F40466AE415A3201EB70A758CBE1

Function 00485D60 Relevance: 7.8, APIs: 2, Strings: 3, Instructions: 339COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(0492B9D8,00670228,?,?,?,?,?,E57473E3,00000000,00000010), ref: 0048608A
LeaveCriticalSection.KERNEL32(0492B9D8,?,?,?,?,?,E57473E3,00000000,00000010), ref: 004860A4

Strings

st, xrefs: 00485D8B
config, xrefs: 00486002, 00486032
avast5, xrefs: 0048613E

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: avast5$config$st
API String ID: 3168844106-117695524
Opcode ID: 92fdd3ace19b2ca00503d584823f45c0e11d1e4c1a6559e8ebceb6cc2cd2d0ae
Instruction ID: d035a0b0815d1d3e4de9440b74a909e9e543ad11b9d4ca42613b23a07076c35c
Opcode Fuzzy Hash: 92fdd3ace19b2ca00503d584823f45c0e11d1e4c1a6559e8ebceb6cc2cd2d0ae
Instruction Fuzzy Hash: B1F164B0C00758DFDB10DFA9C944B9EBBF4BF19308F10865EE449A7251EB75AA84CB94

Function 004506D0 Relevance: 7.8, APIs: 4, Strings: 1, Instructions: 296COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00000101,E57473E3,00756B10,?), ref: 00450761
LeaveCriticalSection.KERNEL32(?), ref: 004507C9
EnterCriticalSection.KERNEL32(00000101), ref: 00450935
LeaveCriticalSection.KERNEL32(?), ref: 00450A02

Strings

st, xrefs: 004506FB

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: st
API String ID: 3168844106-1638371401
Opcode ID: 154abb70c703dc59650a75dcd528ec55dff9ed6b867ea5c3ed93227183744e10
Instruction ID: 4637d6d9823478ec109fb24005e0e70582637fbf9c73b9291df26b6fbb85a0e6
Opcode Fuzzy Hash: 154abb70c703dc59650a75dcd528ec55dff9ed6b867ea5c3ed93227183744e10
Instruction Fuzzy Hash: B6D14874E002199FDB10CF64C995BAEBBB5FF49314F14419AE809AB391DB34AE84CF84

Function 004364F0 Relevance: 7.8, APIs: 4, Strings: 1, Instructions: 292COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,E57473E3,?,?), ref: 00436581
LeaveCriticalSection.KERNEL32(?), ref: 004365E9
EnterCriticalSection.KERNEL32(?), ref: 00436743
LeaveCriticalSection.KERNEL32(?), ref: 00436810

Strings

st, xrefs: 0043651B

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: st
API String ID: 3168844106-1638371401
Opcode ID: b8a22326b36e9022cfa5026235c061a78b98dabf517b4a18407d73579aec7081
Instruction ID: 2763a89aa14e2c3ba988520cecc56d32dbe7220898c7716c24c73807b32a5ad3
Opcode Fuzzy Hash: b8a22326b36e9022cfa5026235c061a78b98dabf517b4a18407d73579aec7081
Instruction Fuzzy Hash: EBD16870E002199FDB24CF64C885BAEBBB5FF49314F14819AE519A7390DB34AE94CF84

Function 0040A990 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 137COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,?,?,00000000,00000000,E57473E3), ref: 0040AA2D
MultiByteToWideChar.KERNEL32(?,00000000,?,?,?,?,00000000,00000000,?,?,00000000,00000000,E57473E3), ref: 0040AA94

Strings

st, xrefs: 0040A9A6
to_wide<char> invalid arguments, xrefs: 0040AAE7
to_wide<char>::MultiByteToWideChar, xrefs: 0040AACC

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: ByteCharMultiWide
String ID: to_wide<char> invalid arguments$to_wide<char>::MultiByteToWideChar$st
API String ID: 626452242-3708913769
Opcode ID: a444f0a0a05c7e627c760d4ab09194784c4feed6b6c77b213bea39612b1f4cca
Instruction ID: 969cb2cc0490e6725b8663134d97dd24fbba91c3dce1277f35efc852d3d18e45
Opcode Fuzzy Hash: a444f0a0a05c7e627c760d4ab09194784c4feed6b6c77b213bea39612b1f4cca
Instruction Fuzzy Hash: EA41C270A00306ABDB14DF65C905BAFBBB5FF94314F10422AE815A37C0DBB9A954CB99

Function 00449190 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00000000,E57473E3,?,?,?,?,?), ref: 004491D8
LeaveCriticalSection.KERNEL32(00000000,?,?,?), ref: 004491EC
LeaveCriticalSection.KERNEL32(00000000,?,?,?), ref: 00449264

Strings

st, xrefs: 004491A7

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: CriticalSection$Leave$Enter
String ID: st
API String ID: 2978645861-1638371401
Opcode ID: ce78d27429da242608dff368c08dd109c80df4df84179068a37592858226859b
Instruction ID: b9357a5d3509f9611570cddf6207999b1f47390542613987c8a56f2b2c3a63e4
Opcode Fuzzy Hash: ce78d27429da242608dff368c08dd109c80df4df84179068a37592858226859b
Instruction Fuzzy Hash: 50310271A04244AFEB05CF54D8847ABFBF9FF89314F14419AD80A9B391C7B9AD40CB94

Function 005C4614 Relevance: 7.5, APIs: 5, Instructions: 44COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 005C461B
std::_Lockit::_Lockit.LIBCPMT ref: 005C4626
std::_Lockit::~_Lockit.LIBCPMT ref: 005C4694

Part of subcall function 005C4777: std::locale::_Locimp::_Locimp.LIBCPMT ref: 005C478F

std::locale::_Setgloballocale.LIBCPMT ref: 005C4641
_Yarn.LIBCPMT ref: 005C4657

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_SetgloballocaleYarn
String ID:
API String ID: 1088826258-0
Opcode ID: 4e37edb7f89966586a422837c9e5f5f414903ac27af793a8baf80f941b279956
Instruction ID: 0bcdbffaae502711e1913f227a985b9f896fb8966f7f6483b6a9331085ab6f30
Opcode Fuzzy Hash: 4e37edb7f89966586a422837c9e5f5f414903ac27af793a8baf80f941b279956
Instruction Fuzzy Hash: 5A014C756002229FD706EBA09869E7D7FA2FBC5751B54440CE80257391DF786E42CFC5

Function 0055EEF0 Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 291registryCOMMON

Download Yara Rule

APIs

RegEnumValueW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,00000000,0055EE01,?,E57473E3,?,?), ref: 0055EFE3
RegOpenKeyExW.ADVAPI32(?,?,?,?,00000000,E57473E3,?,00000000), ref: 0055F1B3

Strings

st, xrefs: 0055EF04, 0055F168
,ph, xrefs: 0055F1DD

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: EnumOpenValue
String ID: ,ph$st
API String ID: 2571532894-2170870510
Opcode ID: bb6b1d5a816d5af6420ff32e5e6f364e4705908f4ba026bc7d1e0ea66af84edf
Instruction ID: 55de098a1ddfd82783dd7f20b574469eba066e1de1f3cc416b939f19b49de774
Opcode Fuzzy Hash: bb6b1d5a816d5af6420ff32e5e6f364e4705908f4ba026bc7d1e0ea66af84edf
Instruction Fuzzy Hash: FFB15070A006099FCB18DF68D995BAEBBF5FF88304F14452EE815E7391DB31AA45CB90

Function 0053E520 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 224synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 0040ACA0: CloseHandle.KERNEL32(?,E57473E3,?,?,?,?,00475410,?,E57473E3,?), ref: 0040AD00
Part of subcall function 0040ACA0: LeaveCriticalSection.KERNEL32(?,E57473E3,?), ref: 0040AD3A

WaitForSingleObject.KERNEL32(00000001,000000FF,?,E57473E3,00000000,?), ref: 0053E65A
CloseHandle.KERNEL32(00000001), ref: 0053E671

Part of subcall function 005583D0: EnterCriticalSection.KERNEL32(00000000), ref: 0055844E
Part of subcall function 005583D0: LeaveCriticalSection.KERNEL32(00000000,?,?,00000000), ref: 00558482

Part of subcall function 00557BF0: SetEvent.KERNEL32(?,E57473E3,?,00000000,0040ED03,0075904C,E57473E3,?,00000000,?,?,00000000,0060B9F0,000000FF,?,invalid string position), ref: 00557C4A
Part of subcall function 00557BF0: CloseHandle.KERNEL32(?,?,?,00000000,0060B9F0,000000FF,?,invalid string position,00419371), ref: 00557C64
Part of subcall function 00557BF0: LeaveCriticalSection.KERNEL32(0060B9F0,?,?,00000000,0060B9F0), ref: 00557C86

Strings

st, xrefs: 0053E548
lifetime_object must be allocated on static memory (static or global variable or member of such a variable)., xrefs: 0053E6A5, 0053E6D3

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: CriticalSection$CloseHandleLeave$EnterEventObjectSingleWait
String ID: lifetime_object must be allocated on static memory (static or global variable or member of such a variable).$st
API String ID: 3951272266-2580301956
Opcode ID: b2b0acbea3f9d8fd3ab1d95aa8140bf747cff2f26837501fdfd3cd0286039162
Instruction ID: ce33aa06c1e383a2c5a6e0c194473ab2f50d8cbf410585b17dd7a74ea991847b
Opcode Fuzzy Hash: b2b0acbea3f9d8fd3ab1d95aa8140bf747cff2f26837501fdfd3cd0286039162
Instruction Fuzzy Hash: CE818B709013488FCB00DFA4D846B9EBFF5BF55314F14456EE815A72C1DBB49909CB96

Function 0047A540 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 206COMMON

Download Yara Rule

Strings

st, xrefs: 0047A6F4

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID:
String ID: st
API String ID: 0-1638371401
Opcode ID: a21a3486a26ddd8f8ca66ebb22d8ed8149845de031753505593cce6d2fc79334
Instruction ID: 9ba794068bea14631655523c7d471e4756044e550878852041ba5566f61ff66a
Opcode Fuzzy Hash: a21a3486a26ddd8f8ca66ebb22d8ed8149845de031753505593cce6d2fc79334
Instruction Fuzzy Hash: 3161E3756002059FC714CF68C984AAEBBF5FF88310F14C26EE81A8B791D735EA51CB96

Function 005ED204 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 202COMMONLIBRARYCODE

Download Yara Rule

APIs

__freea.LIBCMT ref: 005ED3B3

Part of subcall function 005E4C31: RtlAllocateHeap.NTDLL(00000000,?,?,?,005C6D8D,?,?,0056925A,00000008,E57473E3), ref: 005E4C63

__freea.LIBCMT ref: 005ED3C8
__freea.LIBCMT ref: 005ED3D8

Strings

st, xrefs: 005ED20B

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: __freea$AllocateHeap
String ID: st
API String ID: 2243444508-1638371401
Opcode ID: 368200b88a4dfc3a659b74196554e62d2cf0b624575d215b911dcc9d3ce60729
Instruction ID: dcc17b69f3d2cea143eae0635f7737336ecb8faaeded086534efb4730fcb0e56
Opcode Fuzzy Hash: 368200b88a4dfc3a659b74196554e62d2cf0b624575d215b911dcc9d3ce60729
Instruction Fuzzy Hash: 0951947260028AAFDF295F668C85EBF3EB9FB48354B150928FD48D7151EA70CD109671

Function 004749B0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 179synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 0040ACA0: CloseHandle.KERNEL32(?,E57473E3,?,?,?,?,00475410,?,E57473E3,?), ref: 0040AD00
Part of subcall function 0040ACA0: LeaveCriticalSection.KERNEL32(?,E57473E3,?), ref: 0040AD3A

WaitForSingleObject.KERNEL32(?,000000FF,?,E57473E3,?,?), ref: 00474B5E
CloseHandle.KERNEL32(?), ref: 00474B75

Part of subcall function 00474830: ___std_exception_destroy.LIBVCRUNTIME ref: 004748D5

Strings

st, xrefs: 00474847, 004749DB, 00474C3B
lifetime_object must be allocated on static memory (static or global variable or member of such a variable)., xrefs: 00474BA9, 00474BD7

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: CloseHandle$CriticalLeaveObjectSectionSingleWait___std_exception_destroy
String ID: lifetime_object must be allocated on static memory (static or global variable or member of such a variable).$st
API String ID: 2425685172-2580301956
Opcode ID: 9c22f1ea1d8db6c476366e89273aad4b6c24989240e7a98fb4e6137891a799d0
Instruction ID: c7053dc392c22ea50209db2bb3b1686eae217244fe6844417d601e79dd6cb74a
Opcode Fuzzy Hash: 9c22f1ea1d8db6c476366e89273aad4b6c24989240e7a98fb4e6137891a799d0
Instruction Fuzzy Hash: 93716E70D002489FCB00DFA4C845BEEBBB5FF89324F14866AE81577391DBB96905CB95

Function 0054EBC0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 176COMMON

Download Yara Rule

APIs

Part of subcall function 0054E9D0: AllocateAndInitializeSid.ADVAPI32(?,00000000,E57473E3,00000030,00000000,00000000,00000000,00000000,00000000,00000000,?,E57473E3,00000000,00000030,E57473E3,00000000), ref: 0054EA2F

EqualSid.ADVAPI32(00000000,00000000,?,00000001,00000012,00000000,E57473E3,00000000,?,00000000), ref: 0054EC2F

Part of subcall function 0054E9D0: GetLastError.KERNEL32(AllocateAndInitializeSid), ref: 0054EA52
Part of subcall function 0054E9D0: Concurrency::scheduler_worker_creation_error::scheduler_worker_creation_error.LIBCMT ref: 0054EA5C

EqualSid.ADVAPI32(00000000,00000000,00000000,00000001,00000013,00000000), ref: 0054EC5E
EqualSid.ADVAPI32(00000000,00000000,00000000,00000001,00000014,00000000), ref: 0054EC85

Strings

st, xrefs: 0054EBD7

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: Equal$AllocateConcurrency::scheduler_worker_creation_error::scheduler_worker_creation_errorErrorInitializeLast
String ID: st
API String ID: 770698399-1638371401
Opcode ID: 6c4b517adf8ca49ad4c81722100187054fcf6b0a7950b4dd015586e5562b6da9
Instruction ID: 9e42b3b660a8ee9b4c7d13488ce6cf43ec0dd5adafeea5c19121a492863bc8a5
Opcode Fuzzy Hash: 6c4b517adf8ca49ad4c81722100187054fcf6b0a7950b4dd015586e5562b6da9
Instruction Fuzzy Hash: B9612571E002199FDB10CFA8C889BEEBBBABF48314F144159E915A7390DB756E458F90

Function 00447A00 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 170synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 0040ACA0: CloseHandle.KERNEL32(?,E57473E3,?,?,?,?,00475410,?,E57473E3,?), ref: 0040AD00
Part of subcall function 0040ACA0: LeaveCriticalSection.KERNEL32(?,E57473E3,?), ref: 0040AD3A

WaitForSingleObject.KERNEL32(?,000000FF,?,E57473E3), ref: 00447B3A
CloseHandle.KERNEL32(?), ref: 00447B51

Part of subcall function 005583D0: EnterCriticalSection.KERNEL32(00000000), ref: 0055844E
Part of subcall function 005583D0: LeaveCriticalSection.KERNEL32(00000000,?,?,00000000), ref: 00558482

Part of subcall function 00557BF0: SetEvent.KERNEL32(?,E57473E3,?,00000000,0040ED03,0075904C,E57473E3,?,00000000,?,?,00000000,0060B9F0,000000FF,?,invalid string position), ref: 00557C4A
Part of subcall function 00557BF0: CloseHandle.KERNEL32(?,?,?,00000000,0060B9F0,000000FF,?,invalid string position,00419371), ref: 00557C64
Part of subcall function 00557BF0: LeaveCriticalSection.KERNEL32(0060B9F0,?,?,00000000,0060B9F0), ref: 00557C86

Strings

st, xrefs: 00447A28, 00447BF3
lifetime_object must be allocated on static memory (static or global variable or member of such a variable)., xrefs: 00447B85, 00447BB3

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: CriticalSection$CloseHandleLeave$EnterEventObjectSingleWait
String ID: lifetime_object must be allocated on static memory (static or global variable or member of such a variable).$st
API String ID: 3951272266-2580301956
Opcode ID: b1e8c1c71396e246af1b4630961197572c9995d6a5318e029f621b7a5ada1200
Instruction ID: f66398a62285aa096de47d61c7e2471e8e0da0f0ac22ff2084a48a090284d959
Opcode Fuzzy Hash: b1e8c1c71396e246af1b4630961197572c9995d6a5318e029f621b7a5ada1200
Instruction Fuzzy Hash: 1461AFB0D042889FDB10DFA4C845BDEBBF9FB04714F50466EE811A7381DBB96908CBA5

Function 00536F60 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 170synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 0040ACA0: CloseHandle.KERNEL32(?,E57473E3,?,?,?,?,00475410,?,E57473E3,?), ref: 0040AD00
Part of subcall function 0040ACA0: LeaveCriticalSection.KERNEL32(?,E57473E3,?), ref: 0040AD3A

WaitForSingleObject.KERNEL32(00000001,000000FF,?,E57473E3,?,?), ref: 0053709A
CloseHandle.KERNEL32(00000001), ref: 005370B1

Part of subcall function 005583D0: EnterCriticalSection.KERNEL32(00000000), ref: 0055844E
Part of subcall function 005583D0: LeaveCriticalSection.KERNEL32(00000000,?,?,00000000), ref: 00558482

Part of subcall function 00557BF0: SetEvent.KERNEL32(?,E57473E3,?,00000000,0040ED03,0075904C,E57473E3,?,00000000,?,?,00000000,0060B9F0,000000FF,?,invalid string position), ref: 00557C4A
Part of subcall function 00557BF0: CloseHandle.KERNEL32(?,?,?,00000000,0060B9F0,000000FF,?,invalid string position,00419371), ref: 00557C64
Part of subcall function 00557BF0: LeaveCriticalSection.KERNEL32(0060B9F0,?,?,00000000,0060B9F0), ref: 00557C86

Strings

st, xrefs: 00536F88, 00537153
lifetime_object must be allocated on static memory (static or global variable or member of such a variable)., xrefs: 005370E5, 00537113

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: CriticalSection$CloseHandleLeave$EnterEventObjectSingleWait
String ID: lifetime_object must be allocated on static memory (static or global variable or member of such a variable).$st
API String ID: 3951272266-2580301956
Opcode ID: 0a5d325e04bcaf0c4e3f6d969125406e3dcf93a9b39f5b5efd7676fd8bb1595e
Instruction ID: b512f59751ee5a3495b2d4dfffa1460614af868344028f76a7b41a21e37108bd
Opcode Fuzzy Hash: 0a5d325e04bcaf0c4e3f6d969125406e3dcf93a9b39f5b5efd7676fd8bb1595e
Instruction Fuzzy Hash: 816191B0D043499FDB10DFA4C849BDEBBF4FB04714F60416EE811A7291DBB95A08CBA5

Function 0047A5B0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 165COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0047A6CD
EnterCriticalSection.KERNEL32(?,E57473E3,?,FB5F81E8,?,?,0061392D,000000FF,?,0048210A,?), ref: 0047A724
LeaveCriticalSection.KERNEL32(?), ref: 0047A770

Strings

st, xrefs: 0047A6F4

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: CriticalSection$Concurrency::cancel_current_taskEnterLeave
String ID: st
API String ID: 4224942163-1638371401
Opcode ID: cfe63b3a39cfb9eab2be4aeae982e7ac9b00cb072f8d64e1bea4dd350fd56823
Instruction ID: 4b4b339e71a35c519cfb268f7544aea439ef246f31148975770df9077a8130f2
Opcode Fuzzy Hash: cfe63b3a39cfb9eab2be4aeae982e7ac9b00cb072f8d64e1bea4dd350fd56823
Instruction Fuzzy Hash: EF51E375A002059FC714CF68C984B9EBBF5EF88300F18C26EE8099B381D735EA15CB96

Function 0042A2D0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(?,?,?,?,0042A52E,00000000,E57473E3,006691F0,?), ref: 0042A2E4
HeapAlloc.KERNEL32(?,00000000,005C8A31,?,?,?,?,?,0042A52E,00000000,E57473E3,006691F0,?), ref: 0042A31A
asw_process_storage_allocate_connector.ANTISPAM_CONNECT_EU(?,?,?,?,?,0042A52E,00000000,E57473E3,006691F0,?), ref: 0042A32A

Strings

asw::settings::SettingsConfig::StorePathIni, xrefs: 0042A39A

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: Heap$AllocProcessasw_process_storage_allocate_connector
String ID: asw::settings::SettingsConfig::StorePathIni
API String ID: 793428038-2404271632
Opcode ID: 06ae2ae97d2ad6b33ea57fe8a168717decfc40f836b900625a3d462d4a0a4ef4
Instruction ID: 3cd5a3b52a926e79ed3906cd10169d9e8dc2dde19fabf9dbedd959ab6fd6a092
Opcode Fuzzy Hash: 06ae2ae97d2ad6b33ea57fe8a168717decfc40f836b900625a3d462d4a0a4ef4
Instruction Fuzzy Hash: 5741F531B042214FC720EF65E885677BBAABF51314B84452EEC95C7301DB66EC18C79A

Function 005561B0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 153COMMON

Download Yara Rule

APIs

InitOnceBeginInitialize.KERNEL32(00759040,00000000,?,00000000,E57473E3,?,00000000,?,?,00758780,00627165,000000FF,?,0055614C,00758780,00758780), ref: 005561F8

Part of subcall function 005572B0: InitializeCriticalSection.KERNEL32(00000028,00000000,?,0055625C,0000004C), ref: 00557335

InitOnceComplete.KERNEL32(00759040,00000000,00000000,00759040,0000004C), ref: 005562C6

Strings

st, xrefs: 005561C4
Singleton already destroyed, xrefs: 00556344

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: InitInitializeOnce$BeginCompleteCriticalSection
String ID: Singleton already destroyed$st
API String ID: 1264858881-3868547501
Opcode ID: 635d4999f9e4f9bb9d64c1d10725b9cd387b86ad9008c29fd1f507c96f70cfa1
Instruction ID: 6baa0eb3f6a3d04e72dcc2eb37a1449722c1e98a35fee774e74316859f724ba2
Opcode Fuzzy Hash: 635d4999f9e4f9bb9d64c1d10725b9cd387b86ad9008c29fd1f507c96f70cfa1
Instruction Fuzzy Hash: 34518BB0E0161ADFCB10DF94C844B9EBFB5FF48711F14821AE909A7281DBB89944CB94

Function 00569F30 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 153COMMON

Download Yara Rule

APIs

InitOnceBeginInitialize.KERNEL32(007591D4,00000000,?,00000000,E57473E3,?,?,?,?,?,00628DA8,000000FF,?,00569E56,?), ref: 00569F78

Part of subcall function 00569C00: GetModuleHandleW.KERNEL32(ntdll,?,00000000,0000000C), ref: 00569C4C
Part of subcall function 00569C00: GetProcAddress.KERNEL32(00000000,RtlGetVersion), ref: 00569C67
Part of subcall function 00569C00: GetModuleHandleW.KERNEL32(kernel32,?,00000000,0000000C), ref: 00569C87
Part of subcall function 00569C00: GetProcAddress.KERNEL32(00000000,IsWow64Process2), ref: 00569C97
Part of subcall function 00569C00: GetCurrentProcess.KERNEL32(ntdll,RtlGetVersion,?,00000000,0000000C), ref: 00569CB5

InitOnceComplete.KERNEL32(007591D4,00000000,00000000,007591D4), ref: 0056A046

Strings

st, xrefs: 00569F44
Singleton already destroyed, xrefs: 0056A0C4

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: AddressHandleInitModuleOnceProc$BeginCompleteCurrentInitializeProcess
String ID: Singleton already destroyed$st
API String ID: 2071351503-3868547501
Opcode ID: 39f0e5e239f7e72ce36dd4b10a476167b8caa708390cb05efe4e57329d18338f
Instruction ID: 54d73cc64b5a8c8817d6b1ee9cd74ae615e88750720b1112ce371072aff67d20
Opcode Fuzzy Hash: 39f0e5e239f7e72ce36dd4b10a476167b8caa708390cb05efe4e57329d18338f
Instruction Fuzzy Hash: 71519E70A0172ADFDB10DF94C848B9DFFB5FF44720F14815AE905AB280DBB9AA40CB95

Function 00476440 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 004753A0: CloseHandle.KERNEL32(?), ref: 004754F1

Part of subcall function 00557CE0: ___std_exception_copy.LIBVCRUNTIME ref: 00557D6F

Part of subcall function 00539860: CloseHandle.KERNEL32(?), ref: 005399B1

EnterCriticalSection.KERNEL32(00000000,E57473E3,?,?,?,?,?,00000000,006134C6,000000FF,?,00474E15), ref: 0047649D
LeaveCriticalSection.KERNEL32(00000000,?,?,?,?,00000000,006134C6,000000FF,?,00474E15), ref: 004764D6
___std_exception_destroy.LIBVCRUNTIME ref: 004765F5

Strings

st, xrefs: 00476187, 00476457

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: CloseCriticalHandleSection$EnterLeave___std_exception_copy___std_exception_destroy
String ID: st
API String ID: 1432197461-1638371401
Opcode ID: 883cc3d2d0e32acc77f91e5fd0285364898c0916bbffb877910d108f8312e856
Instruction ID: fd7b9aa2e2c7b680321cf4090d63db6cf7d241e8dda9a094c77e7e4306c1a96a
Opcode Fuzzy Hash: 883cc3d2d0e32acc77f91e5fd0285364898c0916bbffb877910d108f8312e856
Instruction Fuzzy Hash: EE51D174A006159FCB00DF68D89879EBBF6FF48325F14825AE8199B391DB789D04CF94

Function 0055A020 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 142COMMON

Download Yara Rule

APIs

Part of subcall function 0040AB10: ___std_exception_copy.LIBVCRUNTIME ref: 0040AB58
Part of subcall function 0040AB10: ___std_exception_destroy.LIBVCRUNTIME ref: 0040AB68
Part of subcall function 0040AB10: ___std_exception_copy.LIBVCRUNTIME ref: 0040AB72
Part of subcall function 0040AB10: ___std_exception_destroy.LIBVCRUNTIME ref: 0040AB85

ExpandEnvironmentStringsW.KERNEL32(?,?,00000104), ref: 0055A133
GetLastError.KERNEL32 ref: 0055A13D

Strings

st, xrefs: 0055A04A, 0055A119
Unable to retrieve a path of the known folder ({})!, xrefs: 0055A179

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: ___std_exception_copy___std_exception_destroy$EnvironmentErrorExpandLastStrings
String ID: Unable to retrieve a path of the known folder ({})!$st
API String ID: 90833314-2104566928
Opcode ID: 109c61817797d09628a7d0ce3ad10bf9192ac1cbeccff0ab34ef877d1af2ba9e
Instruction ID: 5a2000d10899d35bca69ec8952784422b09ffe44a238d0bd9615afaec2647301
Opcode Fuzzy Hash: 109c61817797d09628a7d0ce3ad10bf9192ac1cbeccff0ab34ef877d1af2ba9e
Instruction Fuzzy Hash: 3F41D371A10204AFDB04DF58DC95BAEBBB9FB48710F00461EF8119B291E771AE04CBE2

Function 0053A1F0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 142synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 0040ACA0: CloseHandle.KERNEL32(?,E57473E3,?,?,?,?,00475410,?,E57473E3,?), ref: 0040AD00
Part of subcall function 0040ACA0: LeaveCriticalSection.KERNEL32(?,E57473E3,?), ref: 0040AD3A

WaitForSingleObject.KERNEL32(?,000000FF,?,E57473E3,?,00000000), ref: 0053A313
CloseHandle.KERNEL32(?), ref: 0053A32A

Part of subcall function 005583D0: EnterCriticalSection.KERNEL32(00000000), ref: 0055844E
Part of subcall function 005583D0: LeaveCriticalSection.KERNEL32(00000000,?,?,00000000), ref: 00558482

Part of subcall function 00557BF0: SetEvent.KERNEL32(?,E57473E3,?,00000000,0040ED03,0075904C,E57473E3,?,00000000,?,?,00000000,0060B9F0,000000FF,?,invalid string position), ref: 00557C4A
Part of subcall function 00557BF0: CloseHandle.KERNEL32(?,?,?,00000000,0060B9F0,000000FF,?,invalid string position,00419371), ref: 00557C64
Part of subcall function 00557BF0: LeaveCriticalSection.KERNEL32(0060B9F0,?,?,00000000,0060B9F0), ref: 00557C86

Strings

st, xrefs: 0053A218
lifetime_object must be allocated on static memory (static or global variable or member of such a variable)., xrefs: 0053A35C, 0053A38A

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: CriticalSection$CloseHandleLeave$EnterEventObjectSingleWait
String ID: lifetime_object must be allocated on static memory (static or global variable or member of such a variable).$st
API String ID: 3951272266-2580301956
Opcode ID: 45c24841d2946cffcd49afb75e1890d3937cd5c06abe59f7db2a85cca9833f55
Instruction ID: b7ac5035f15a4453d75684d09565097929fa446bd4f7b0b6bb597d9ee211868a
Opcode Fuzzy Hash: 45c24841d2946cffcd49afb75e1890d3937cd5c06abe59f7db2a85cca9833f55
Instruction Fuzzy Hash: 38518D70D04649DFCB00DFA4C949BDEFBB4FF14310F10866AE815A7291EB746A08CBA5

Function 00538540 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 134synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 0040ACA0: CloseHandle.KERNEL32(?,E57473E3,?,?,?,?,00475410,?,E57473E3,?), ref: 0040AD00
Part of subcall function 0040ACA0: LeaveCriticalSection.KERNEL32(?,E57473E3,?), ref: 0040AD3A

WaitForSingleObject.KERNEL32(00000001,000000FF,?,E57473E3,00000000,00000000), ref: 0053867A
CloseHandle.KERNEL32(00000001), ref: 00538691

Part of subcall function 005583D0: EnterCriticalSection.KERNEL32(00000000), ref: 0055844E
Part of subcall function 005583D0: LeaveCriticalSection.KERNEL32(00000000,?,?,00000000), ref: 00558482

Part of subcall function 00557BF0: SetEvent.KERNEL32(?,E57473E3,?,00000000,0040ED03,0075904C,E57473E3,?,00000000,?,?,00000000,0060B9F0,000000FF,?,invalid string position), ref: 00557C4A
Part of subcall function 00557BF0: CloseHandle.KERNEL32(?,?,?,00000000,0060B9F0,000000FF,?,invalid string position,00419371), ref: 00557C64
Part of subcall function 00557BF0: LeaveCriticalSection.KERNEL32(0060B9F0,?,?,00000000,0060B9F0), ref: 00557C86

Strings

st, xrefs: 00538568
lifetime_object must be allocated on static memory (static or global variable or member of such a variable)., xrefs: 005386C5, 005386F3

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: CriticalSection$CloseHandleLeave$EnterEventObjectSingleWait
String ID: lifetime_object must be allocated on static memory (static or global variable or member of such a variable).$st
API String ID: 3951272266-2580301956
Opcode ID: 7625d57362a737e09f3ee6bd2098c4af478057ca256f3f6a4d0112cda61f7f16
Instruction ID: 2293031841be183a6a1db995c499bda4919941afd88590197f9c26bf5812e011
Opcode Fuzzy Hash: 7625d57362a737e09f3ee6bd2098c4af478057ca256f3f6a4d0112cda61f7f16
Instruction Fuzzy Hash: E05181B0D043589FCB00DFA4C859BDEBFB4FB54714F604269E811AB291DBB95A08CBA5

Function 00561C30 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 134registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(?,?,?,?,?,?,E57473E3,00000000,?), ref: 00561CEE

Strings

st, xrefs: 00561C5B, 005620E4
,ph, xrefs: 00561D60
st, xrefs: 00561C3D

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: Open
String ID: ,ph$st$st
API String ID: 71445658-4071429895
Opcode ID: b6c22eb29d012393069a9704bb46edd90f62d3b6f6f82ea97aeffb5b30c24321
Instruction ID: bb9c114db3c46b72a0518f043c69b4f5a0d683c6a1b0530a820648e52f36e443
Opcode Fuzzy Hash: b6c22eb29d012393069a9704bb46edd90f62d3b6f6f82ea97aeffb5b30c24321
Instruction Fuzzy Hash: 4D517AB0D05659AFDB14DFA8C889BAEFBB4FF08304F148299D818A7241D7756A44CF94

Function 00473860 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 122COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00473905

Strings

pAo, xrefs: 004739B0
st, xrefs: 00473877
JSON Conversion Module already unloaded., xrefs: 0047395F

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: ___std_exception_destroy
String ID: JSON Conversion Module already unloaded.$pAo$st
API String ID: 4194217158-2481960517
Opcode ID: 2005072e4681726beb60970eda63c8fc180ad2161db2bf8ab63640c591eb3609
Instruction ID: 0d360ab1303d49ff5458dd519c5241fc4b9e29d96559f3d9c7ed72f7666f784e
Opcode Fuzzy Hash: 2005072e4681726beb60970eda63c8fc180ad2161db2bf8ab63640c591eb3609
Instruction Fuzzy Hash: 88419371E002599BCF00EFA5D889BDEBBB9EF44314F10452EE505A7381DFB85A04CB95

Function 0055E280 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 105registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00561C30: RegOpenKeyExW.ADVAPI32(?,?,?,?,?,?,E57473E3,00000000,?), ref: 00561CEE

Part of subcall function 005601B0: RegQueryValueExW.ADVAPI32(00000000,?,00000000,?,?), ref: 00560209

RegCloseKey.ADVAPI32(?,?,E57473E3), ref: 0055E2EA
SetLastError.KERNEL32(00000000), ref: 0055E2F5

Part of subcall function 005C90B0: RaiseException.KERNEL32(E06D7363,00000001,00000003,0042867C,?,?,?,?,0042867C,st,006E8FF4,E57473E3), ref: 005C9110

___std_exception_copy.LIBVCRUNTIME ref: 0055E36F

Strings

st, xrefs: 0055E294

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: CloseErrorExceptionLastOpenQueryRaiseValue___std_exception_copy
String ID: st
API String ID: 617419043-1638371401
Opcode ID: 81033fa45d5340482a6b847ddb76c4ee1a6968bff7756fd430ae7a012fa92364
Instruction ID: 5f4ec0a0179f8fa634cf388ed125db6039606f945fe7fff46cb27539a6ca9170
Opcode Fuzzy Hash: 81033fa45d5340482a6b847ddb76c4ee1a6968bff7756fd430ae7a012fa92364
Instruction Fuzzy Hash: F9316575A00609AFCB04DFA4DC45FAEBBB9FF44710F10452AF915D7640EB74AA14CBA4

Function 00571AC0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 104registryCOMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNEL32(?,?,00000104), ref: 00571B29
RegCloseKey.ADVAPI32(?), ref: 00571BAA

Strings

st, xrefs: 00571AC9
HKEY_LOCAL_MACHINE, xrefs: 00571B61

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: CloseLongNamePath
String ID: HKEY_LOCAL_MACHINE$st
API String ID: 3037798420-1029450009
Opcode ID: aed0b09ec5361515b1e904ebbf164789942a1e4a3c23fec856202b1b267c5068
Instruction ID: 53514045c3bca3fbdedd9affba45677b84f6efc8309d70e79541b0f39bac64a2
Opcode Fuzzy Hash: aed0b09ec5361515b1e904ebbf164789942a1e4a3c23fec856202b1b267c5068
Instruction Fuzzy Hash: D7417671E016289BDB24DF68EC8879DB7B9BF14314F1042EAD80DA7251EB709EC48F94

Function 005605C0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 99registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,E57473E3,?,00000001), ref: 00560658

Strings

st, xrefs: 005605D7
8sh, xrefs: 005607E3

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: QueryValue
String ID: 8sh$st
API String ID: 3660427363-395864684
Opcode ID: ae753b646951015b8369503d205cd017efeb02ebdcef074b90d8380096fcbd11
Instruction ID: b07f572d7ec8c1f5705cad8e839bbe7653a1a2989254833615797eef89dedf9f
Opcode Fuzzy Hash: ae753b646951015b8369503d205cd017efeb02ebdcef074b90d8380096fcbd11
Instruction Fuzzy Hash: 444104B1D002199FDB24CF59C854BEEBBF5FB58314F108199E819B7290DB74AA84CF90

Function 00440A30 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 94threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00440A73
EnterCriticalSection.KERNEL32(?,E57473E3), ref: 00440A85
LeaveCriticalSection.KERNEL32(?,?,?), ref: 00440B10

Strings

st, xrefs: 00440A44

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: CriticalSection$CurrentEnterLeaveThread
String ID: st
API String ID: 2351996187-1638371401
Opcode ID: d70b176cdb57b62f2079486cd6e87604516c7b4e5333aadff5751ed5da964407
Instruction ID: 8b191f6c709d2222621a6ae2f371f4796e009d194a3edf5d6bba5de00f08d756
Opcode Fuzzy Hash: d70b176cdb57b62f2079486cd6e87604516c7b4e5333aadff5751ed5da964407
Instruction Fuzzy Hash: 4B31E471E0024A9FDB00DF94C885FAEB7B6FF58314F10815AE512A7381D738AE45CBA8

Function 005743D0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 85COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,?,?,?), ref: 00574479
GetLastError.KERNEL32 ref: 00574486

Strings

st, xrefs: 005743D6
FILE:, xrefs: 005743F8

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: AttributesErrorFileLast
String ID: FILE:$st
API String ID: 1799206407-1692901217
Opcode ID: 8d26f41dd148cdc8350d50ee6d773ee4874d324f40a91af2a1fef90a61c4548f
Instruction ID: d54daeb9b60c0f01848ae181903e37345c4cd97ca8a32f2d35952762104c6213
Opcode Fuzzy Hash: 8d26f41dd148cdc8350d50ee6d773ee4874d324f40a91af2a1fef90a61c4548f
Instruction Fuzzy Hash: 3A219371A003189BDF109F75EC497AEBBF9FF58321F10452AE816E7390EBB15A049B91

Function 0055F9D0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 81registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00561C30: RegOpenKeyExW.ADVAPI32(?,?,?,?,?,?,E57473E3,00000000,?), ref: 00561CEE

RegDeleteValueW.ADVAPI32(?,?,?,00000002), ref: 0055FA59

Part of subcall function 0055DFF0: ___std_exception_copy.LIBVCRUNTIME ref: 0055E12F

RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0055FA88
SetLastError.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0055FA93

Strings

st, xrefs: 0055F9F9

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: CloseDeleteErrorLastOpenValue___std_exception_copy
String ID: st
API String ID: 4245273304-1638371401
Opcode ID: 5c72bf886968448b3878fc62f0997b566d5f787435838c01748c57bf02ba98fd
Instruction ID: 1a0bb91e12ba4ce4b9abd28c59fb82e654eae30bc842f606710ba7a23f0bf837
Opcode Fuzzy Hash: 5c72bf886968448b3878fc62f0997b566d5f787435838c01748c57bf02ba98fd
Instruction Fuzzy Hash: 3D31E870D04348AFDB04DF68D94ABAEBBF4FB08700F14466EE801A7241EB34AD048BA0

Function 00427A70 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 76COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00427A9B
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00427AEA

Part of subcall function 005C4712: _Yarn.LIBCPMT ref: 005C4731
Part of subcall function 005C4712: _Yarn.LIBCPMT ref: 005C4755

Strings

st, xrefs: 00427A83
bad locale name, xrefs: 00427B06

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: Yarnstd::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name$st
API String ID: 1908188788-2289111497
Opcode ID: 911a0d364f9f30b1bf50fceb6a4309d9f871681f8b0cddb4ee86ec5e6506eec1
Instruction ID: 2823b8f1df06a6065e384c6aa0c9804478fe69ac4dfce7c322d90fffb51cf3d2
Opcode Fuzzy Hash: 911a0d364f9f30b1bf50fceb6a4309d9f871681f8b0cddb4ee86ec5e6506eec1
Instruction Fuzzy Hash: 0111AFB1904B409FD320CF68D805B47BFE8EF19710F008A5EE889C7B81E7B5A904CBA5

Function 00447310 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 72timeCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00447328
GetSystemTimes.KERNEL32(?,?,?,?,?), ref: 0044733F
GetProcessTimes.KERNEL32(00000001,?,?,?,?,?,?), ref: 00447364

Strings

st, xrefs: 00447319

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: Times$CountProcessSystemTick
String ID: st
API String ID: 1969624557-1638371401
Opcode ID: af791ce0d03a7daaa87b290e9720e99ad2ecf157e8cc984323421e6d759c51ff
Instruction ID: 18df83849b856489298a54e6683a213495e636af42faad8c13d8725a6c1385d9
Opcode Fuzzy Hash: af791ce0d03a7daaa87b290e9720e99ad2ecf157e8cc984323421e6d759c51ff
Instruction Fuzzy Hash: FA31C471908B459FD320CF29C58099BB7F9BB88314F005A2EE99AD2750EB70E985CB52

Function 0056FF30 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,40000000,00000000,?,?,?,00000000), ref: 0056FF84
GetLastError.KERNEL32(?,?,?,00000000), ref: 0056FF91

Strings

st, xrefs: 0056FF39
\\.\%s, xrefs: 0056FF4F

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: CreateErrorFileLast
String ID: \\.\%s$st
API String ID: 1214770103-1350944200
Opcode ID: f27895120091b5ca663b10db3111ce15788cc643c850ed1370bde818a3dc07fa
Instruction ID: d3c79a83431a9a2663f4b909869825b05c1d94bc2f647d84496459effd64cfbc
Opcode Fuzzy Hash: f27895120091b5ca663b10db3111ce15788cc643c850ed1370bde818a3dc07fa
Instruction Fuzzy Hash: 87118271A00219AADB14ABB4AC06BBDB7E9EB49310F5045AEFC0AD7280DE315E048795

Function 005C901F Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 44COMMON

Download Yara Rule

APIs

std::__non_rtti_object::__construct_from_string_literal.LIBVCRUNTIME ref: 005C9062
std::__non_rtti_object::__construct_from_string_literal.LIBVCRUNTIME ref: 005C9096

Strings

Bad read pointer - no RTTI data!, xrefs: 005C9059
Attempted a typeid of nullptr pointer!, xrefs: 005C908D

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: std::__non_rtti_object::__construct_from_string_literal
String ID: Attempted a typeid of nullptr pointer!$Bad read pointer - no RTTI data!
API String ID: 3887850325-4195314292
Opcode ID: 62e8d92b2f56aa8da5efe55618bfe9950317aa6a5226c9c44f1deb7da2dd7fcf
Instruction ID: dcde9e46a961b45c5d7adbe1886ae0b7a77712aa0b182d0a695076ee05aa9c4f
Opcode Fuzzy Hash: 62e8d92b2f56aa8da5efe55618bfe9950317aa6a5226c9c44f1deb7da2dd7fcf
Instruction Fuzzy Hash: 08F08C326043499EDB14DBD9D94EFD977E8BB84720F20445EE110A72C1EFB2EA049A54

Function 005740D0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

GetFileSize.KERNEL32(E57473E3,?,00000000), ref: 005740F8
GetLastError.KERNEL32 ref: 00574105
SetLastError.KERNEL32(000000A0,00000000,?,?,0057381F), ref: 00574128

Strings

st, xrefs: 005740D6

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: ErrorLast$FileSize
String ID: st
API String ID: 3064237074-1638371401
Opcode ID: 2b92afef2608368ab9bef785294a2e86c330fdad501ecc67648decd56ec2e98b
Instruction ID: 45ec3d5a7d7bf35b073420d3a17f477d4fca723b9c5b78f9fae2a1a5aea2f184
Opcode Fuzzy Hash: 2b92afef2608368ab9bef785294a2e86c330fdad501ecc67648decd56ec2e98b
Instruction Fuzzy Hash: A701D630B012189BCB00EBB8AC49AADBBB5AF15331F50935DEC26D72D0DB305E458A80

Function 005D2D59 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(005C887F,00000000,00000800,?,005D2D0A,?,?,00000000,?,?,?,005D2E34,00000002,FlsGetValue,006595D8,FlsGetValue), ref: 005D2D66
GetLastError.KERNEL32(?,005D2D0A,?,?,00000000,?,?,?,005D2E34,00000002,FlsGetValue,006595D8,FlsGetValue,?,?,005CB3FB), ref: 005D2D70
LoadLibraryExW.KERNEL32(005C887F,00000000,00000000,005CB3D1,005C887F,00604DCC), ref: 005D2D98

Strings

api-ms-, xrefs: 005D2D7D

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 03884f7ce01a1dc531d0c4e347698dd4bd5bf8c29c570c7c2a0db88613258bc2
Instruction ID: 2a8cde7dd109ec9663ed5bf35e7e583a3696fece9e30777f7a7874cee4504bc5
Opcode Fuzzy Hash: 03884f7ce01a1dc531d0c4e347698dd4bd5bf8c29c570c7c2a0db88613258bc2
Instruction Fuzzy Hash: 4EE01230280214BBEB212F55DC06F583E56AB20B52F544022F90DE82E0DB61E95196D4

Function 005C6DF0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 23COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(00755B64,?,?,0040B088,007567F8), ref: 005C6DFA
ReleaseSRWLockExclusive.KERNEL32(00755B64,?,0040B088,007567F8), ref: 005C6E2D
WakeAllConditionVariable.KERNEL32(00755B60,?,0040B088,007567F8), ref: 005C6E38

Strings

d[u, xrefs: 005C6DF4

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: ExclusiveLock$AcquireConditionReleaseVariableWake
String ID: d[u
API String ID: 1466638765-3384785858
Opcode ID: fc7d27f0018ab9997844619d93c0bfc601f9d29ba40b3685b9f04659d95f1d53
Instruction ID: 7de33d74405baa2b816ab0c5a7210a1587a68d8b0fb4513469ca6aa7099f9abd
Opcode Fuzzy Hash: fc7d27f0018ab9997844619d93c0bfc601f9d29ba40b3685b9f04659d95f1d53
Instruction Fuzzy Hash: 15F06D74940AE4DFC704DF58E898D947BAAFB09311B04902AFD0A8B320CFB96901CFA4

Function 005691F0 Relevance: 6.2, APIs: 1, Strings: 3, Instructions: 235COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(0000000C,?,?,E57473E3,?,?,?,?,?,?,?,?,?,?,?,00628D24), ref: 0056929C

Strings

st, xrefs: 00569206
Qg, xrefs: 0056921F
st, xrefs: 00569478, 0056948C

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: CriticalInitializeSection
String ID: Qg$st$st
API String ID: 32694325-3561113721
Opcode ID: 1436d745cbbbab2957558b90264d0f7499fc08c442b81f9ec028fca7d43212c9
Instruction ID: a4e2761c0a4fa1638eb4f8485c5c7f0ea9aaed2489e302ed79c978e057374afe
Opcode Fuzzy Hash: 1436d745cbbbab2957558b90264d0f7499fc08c442b81f9ec028fca7d43212c9
Instruction Fuzzy Hash: E1A147B0A016068FCB14CF58C944BAABFF5FF49325F14865ED41AAB3A0DB75A941CF90

Function 005375B0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 227COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00000001,E57473E3,00000000,0000000C,?,?,module_task_container,00000015,00000000), ref: 005377CF
LeaveCriticalSection.KERNEL32(00000001,?,?,?,?,module_task_container), ref: 0053782D

Strings

st, xrefs: 005375D8, 005377A4
module_task_container, xrefs: 00537620

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: module_task_container$st
API String ID: 3168844106-1167296240
Opcode ID: 1f1ba161f4438ea4b78ad94e06f9c2694f3ced6a20e5893e2e2318723f943eba
Instruction ID: 4b9e445db17772189ffb77989cfaf693d0715627cf95d9b34e1fbb3d5ad09635
Opcode Fuzzy Hash: 1f1ba161f4438ea4b78ad94e06f9c2694f3ced6a20e5893e2e2318723f943eba
Instruction Fuzzy Hash: C491ACB0E006099FCB11CF64C949BAEBBF5FF89310F14825EE415AB391DB75AA41CB91

Function 005CF567 Relevance: 6.2, APIs: 4, Instructions: 169COMMON

Download Yara Rule

APIs

DName::operator+.LIBCMT ref: 005CF69C

Part of subcall function 005CC7E0: __aulldvrm.LIBCMT ref: 005CC811

DName::operator+.LIBCMT ref: 005CF5FD
DName::operator=.LIBVCRUNTIME ref: 005CF6E1
DName::DName.LIBVCRUNTIME ref: 005CF713

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: Name::operator+$NameName::Name::operator=__aulldvrm
String ID:
API String ID: 2973644308-0
Opcode ID: f3ef3359da1f789f3ea4605a19ed3ed0ec39ebd0d7c622025d05eeb3787fe5da
Instruction ID: 3ae106bf753ba54b31cfd5484b6302c899eaf5d5c76bb2ea6271d82777ac29d0
Opcode Fuzzy Hash: f3ef3359da1f789f3ea4605a19ed3ed0ec39ebd0d7c622025d05eeb3787fe5da
Instruction Fuzzy Hash: 2B617CB490021ADFDB04CF98D895FADBFB6FB44300F1580AEE4056B3A1D7B49A81CB90

Function 0053A7A0 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 140COMMON

Download Yara Rule

APIs

Part of subcall function 00539B90: ___std_exception_destroy.LIBVCRUNTIME ref: 00539C35

InitializeCriticalSection.KERNEL32(E57473E3,00000002,?,00000000,?,?,00000000,00624303,000000FF), ref: 0053A8FA
InitializeCriticalSection.KERNEL32(?,?,?,00000000,00624303,000000FF), ref: 0053A91B

Strings

Dh, xrefs: 0053A8B2
st, xrefs: 0053A7CA

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: CriticalInitializeSection$___std_exception_destroy
String ID: Dh$st
API String ID: 749221889-484290545
Opcode ID: c05c458d0d51452a2fee52617b1843355184614d589cad9886547cc18977cef0
Instruction ID: 5f31f138bda185818aa4a20750f54beacd7e2e674c15f674aa0ebfe6155b1d72
Opcode Fuzzy Hash: c05c458d0d51452a2fee52617b1843355184614d589cad9886547cc18977cef0
Instruction Fuzzy Hash: 98517AB1A00A169FD704CF28C948B9AFBF5FF48324F148219D86997391DB74A915CFD1

Function 005C8D0D Relevance: 6.1, APIs: 4, Instructions: 140COMMON

Download Yara Rule

APIs

TypeidsEqual.LIBVCRUNTIME ref: 005C8D5E
TypeidsEqual.LIBVCRUNTIME ref: 005C8D83
PMDtoOffset.LIBCMT ref: 005C8D99
PMDtoOffset.LIBCMT ref: 005C8E1A

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: EqualOffsetTypeids
String ID:
API String ID: 1707706676-0
Opcode ID: 2ca317564d3a52bdce74212441e3e6b18e266408b0b4746ca7a4d4689c7ceabc
Instruction ID: 5296376b13b91e5af693781621b17b15e0795bdcb0be7429d52bbefb25712cb8
Opcode Fuzzy Hash: 2ca317564d3a52bdce74212441e3e6b18e266408b0b4746ca7a4d4689c7ceabc
Instruction Fuzzy Hash: D941683590420A9FCF10CFA8C480BBEBFF9BF55750F14449ED891A7291DB72AE058B90

Function 00436930 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 133COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?), ref: 004369A0
LeaveCriticalSection.KERNEL32(000000FF,?,00000002,?,?,?,?,?,?,?), ref: 00436A95

Strings

st, xrefs: 00436947
st, xrefs: 00436ABA

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: st$st
API String ID: 3168844106-562346131
Opcode ID: a383f8b9acf84ddea7eb40c42815a42b43cf12079910eea30f89414c46aa1733
Instruction ID: 5a5c603fb89d23690aaefc87f4e33d88525f738eb26aca37b6658de0a94fc140
Opcode Fuzzy Hash: a383f8b9acf84ddea7eb40c42815a42b43cf12079910eea30f89414c46aa1733
Instruction Fuzzy Hash: CE515D75A0021ADFCB00CF54C884BAEBBB5FF49324F15816AE819A7350DB35AE45CF94

Function 004A0930 Relevance: 6.1, APIs: 4, Instructions: 117COMMON

Download Yara Rule

APIs

Part of subcall function 005C6245: QueryPerformanceFrequency.KERNEL32(00000000,?,?,?,004A0947,?,00000000,00000001,?,E57473E3,?,?), ref: 005C6263

Part of subcall function 005C622E: QueryPerformanceCounter.KERNEL32(00000000,?,?,?,004A0954,?,00000000,00000001,?,E57473E3,?,?), ref: 005C6237

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004A09A0
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004A09D4
__alldvrm.LIBCMT ref: 004A09F3
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004A0A1B

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@$PerformanceQuery$CounterFrequency__alldvrm
String ID:
API String ID: 2057067329-0
Opcode ID: d55cf05a06276c9eba9e1f8cce0e56d376588da9da580187b92cb09a23384ea2
Instruction ID: 0d708f7131c46043bf48e91c657e0d89ba646bc61a06bad211fb5ae48af94609
Opcode Fuzzy Hash: d55cf05a06276c9eba9e1f8cce0e56d376588da9da580187b92cb09a23384ea2
Instruction Fuzzy Hash: A031C4B17043006FD718DE6D9C46F3BAADEEBC8790F01862DF509D7391E6249D0487A9

Function 00459070 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 97COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00000004,E57473E3,0000001C,00000000,?,?,?,?,?,?,?,00000000,00610BC5,000000FF,?,00463D4C), ref: 004590BC
LeaveCriticalSection.KERNEL32(?), ref: 004590F7

Strings

st, xrefs: 00459084
asw::serialization::ConcreteData<struct asw::settings::GetPropertyOrDefaultInt32Output>::Value: Invalid data., xrefs: 0045911C

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: asw::serialization::ConcreteData<struct asw::settings::GetPropertyOrDefaultInt32Output>::Value: Invalid data.$st
API String ID: 3168844106-49919985
Opcode ID: 7520e912f8cbdc90e83a7df4d2d672676e5850a7fdae5e930d072132b610438a
Instruction ID: a5036e1bef84670e5e5f79dcfa8bf927cd665264a265c7444ab2b5456f717525
Opcode Fuzzy Hash: 7520e912f8cbdc90e83a7df4d2d672676e5850a7fdae5e930d072132b610438a
Instruction Fuzzy Hash: 47317E71A00219AFDB04DF64C885FEAB7F9FF48714F10422AE80597640DB75AA45CB90

Function 0045A300 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 97COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00000004,E57473E3,0000001C,00000000,?,?,?,?,?,?,?,00000000,00610BC5,000000FF,?,0045BA82), ref: 0045A34C
LeaveCriticalSection.KERNEL32(?), ref: 0045A387

Strings

st, xrefs: 0045A314
asw::serialization::ConcreteData<class std::tuple<class std::basic_string<wchar_t,struct std::char_traits<wchar_t>,class std::allocator<wchar_t> >,class std::variant<struct std::monostate,bool,int,__int64,unsigned int,unsigned __int64,class std::basic_string<c, xrefs: 0045A3AC

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: asw::serialization::ConcreteData<class std::tuple<class std::basic_string<wchar_t,struct std::char_traits<wchar_t>,class std::allocator<wchar_t> >,class std::variant<struct std::monostate,bool,int,__int64,unsigned int,unsigned __int64,class std::basic_string<c$st
API String ID: 3168844106-145408319
Opcode ID: 48500b186b9e513058c035a831a15f0cc321099a9f94ebc6b9d3584f96384598
Instruction ID: b740eaa0e92f721fc10fcd188fbfa44dfa49c88901362d2dedba1ab1a6801b1c
Opcode Fuzzy Hash: 48500b186b9e513058c035a831a15f0cc321099a9f94ebc6b9d3584f96384598
Instruction Fuzzy Hash: FB317E71A00219AFCB04DFA4C885FEEB7F9FF48714F10422AE80597640DB75AA55CB91

Function 004583D0 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 97COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00000004,E57473E3,0000001C,00000000,?,?,?,?,?,?,?,00000000,00610BC5,000000FF,?,00463B0C), ref: 0045841C
LeaveCriticalSection.KERNEL32(?), ref: 00458457

Strings

st, xrefs: 004583E4
asw::serialization::ConcreteData<struct asw::settings::GetPropertyOrDefaultStringVectorOutput>::Value: Invalid data., xrefs: 0045847C

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: asw::serialization::ConcreteData<struct asw::settings::GetPropertyOrDefaultStringVectorOutput>::Value: Invalid data.$st
API String ID: 3168844106-2092833648
Opcode ID: 24c30b2db4223e0898fe3d6163024d2d4129aca66e0ac1e780a68e36a4b63371
Instruction ID: 933fc9c502f0e7ceaeea78414016539cd19b9b035fd2645fa16a17a565a2bee0
Opcode Fuzzy Hash: 24c30b2db4223e0898fe3d6163024d2d4129aca66e0ac1e780a68e36a4b63371
Instruction Fuzzy Hash: 00319C71A00219AFCB04DFA8C885FEEB7F9FF49714F00412EE805A7640EB75AA45CB90

Function 0045A6C0 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 97COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00000004,E57473E3,0000001C,00000000,?,?,?,?,?,?,?,00000000,00610BC5,000000FF,?,0045B802), ref: 0045A70C
LeaveCriticalSection.KERNEL32(?), ref: 0045A747

Strings

st, xrefs: 0045A6D4
asw::serialization::ConcreteData<class std::tuple<> >::Value: Invalid data., xrefs: 0045A76C

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: asw::serialization::ConcreteData<class std::tuple<> >::Value: Invalid data.$st
API String ID: 3168844106-572865207
Opcode ID: 5526064845a563871dca745cd31c0d5bbffa573643f3c900f4ff654681158ca2
Instruction ID: f9f3d0ec3d62e57963f319b5d798766095919822a92a7d0ee7533359dec6c8d4
Opcode Fuzzy Hash: 5526064845a563871dca745cd31c0d5bbffa573643f3c900f4ff654681158ca2
Instruction Fuzzy Hash: 34319E35A00219AFCB04DF64C885FEAB7F9FF48714F00422AE80597640EB75AA45CB91

Function 00458760 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 97COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00000004,E57473E3,0000001C,00000000,?,?,?,?,?,?,?,00000000,00610BC5,000000FF,?,00463BCC), ref: 004587AC
LeaveCriticalSection.KERNEL32(?), ref: 004587E7

Strings

st, xrefs: 00458774
asw::serialization::ConcreteData<struct asw::settings::GetPropertyOrDefaultStringOutput>::Value: Invalid data., xrefs: 0045880C

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: asw::serialization::ConcreteData<struct asw::settings::GetPropertyOrDefaultStringOutput>::Value: Invalid data.$st
API String ID: 3168844106-1380898976
Opcode ID: e76f8ec67216c941301e8f3217d87268b5743fca727923df7331a6e2d357840a
Instruction ID: d48cd8b051987e0ca8e70b7bc607a6f4153543b1d09aa45bd834f6781f009e1c
Opcode Fuzzy Hash: e76f8ec67216c941301e8f3217d87268b5743fca727923df7331a6e2d357840a
Instruction Fuzzy Hash: 00317C71A00219AFCB04DFA8D885FEAB7F9FF48714F50412EE805A7740EB75AA45CB90

Function 004599B0 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 97COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00000004,E57473E3,?,?,?,?,?,?,?,?,?,00000000,00610BC5,000000FF,?,004810D1), ref: 004599FC
LeaveCriticalSection.KERNEL32(?), ref: 00459A37

Strings

st, xrefs: 004599C4
asw::serialization::ConcreteData<struct asw::settings::GetPropertyOrDefaultInput>::Value: Invalid data., xrefs: 00459A5C

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: asw::serialization::ConcreteData<struct asw::settings::GetPropertyOrDefaultInput>::Value: Invalid data.$st
API String ID: 3168844106-1351795781
Opcode ID: 287c5968ab2154091b22354837dba43ef64416714b003435493fd0e363798fa2
Instruction ID: 5dc28e537cf1e05d2c3609dce81085a4113942a8da34a321719c726f16a292d1
Opcode Fuzzy Hash: 287c5968ab2154091b22354837dba43ef64416714b003435493fd0e363798fa2
Instruction Fuzzy Hash: F0317E71A00259EFDB04DF64C885FEAB7F9FF48714F50412AE80597640DB75AA45CBA0

Function 00480A30 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 93COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00000004,E57473E3,0000001C,00000000,?,?,?,?,?,?,?,00000000,00610BC5,000000FF,?,00480A1C), ref: 00480A7C
LeaveCriticalSection.KERNEL32(?), ref: 00480AB7

Strings

st, xrefs: 00480A44
asw::serialization::ConcreteData<struct asw::settings::EnumeratePropertiesOutput>::Value: Invalid data., xrefs: 00480ADC

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: asw::serialization::ConcreteData<struct asw::settings::EnumeratePropertiesOutput>::Value: Invalid data.$st
API String ID: 3168844106-3152064285
Opcode ID: 3fdaa531f4b29f395b5c636e8cfca235e4a028025ab41cca73986a4a50ba36e8
Instruction ID: 11596e348821abf82dbf2bc4a39398c42844029c93c77850661cd5cddeec05bd
Opcode Fuzzy Hash: 3fdaa531f4b29f395b5c636e8cfca235e4a028025ab41cca73986a4a50ba36e8
Instruction Fuzzy Hash: 5531CF71A00259EFCB04DF68C884FAABBF9FF48314F10416EE805A7350DB75AA45CB94

Function 00446C10 Relevance: 6.1, APIs: 4, Instructions: 52threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00446C20

Part of subcall function 005C5A36: WaitForSingleObjectEx.KERNEL32(000010DD,000000FF,00000000,?,?,?,00440D46,?,00000000,00000000,?,?,006E90A4,006E90A4,000010DD,Already running), ref: 005C5A42
Part of subcall function 005C5A36: GetExitCodeThread.KERNEL32(000010DD,?,?,?,?,00440D46,?,00000000,00000000,?,?,006E90A4,006E90A4,000010DD,Already running), ref: 005C5A5B
Part of subcall function 005C5A36: CloseHandle.KERNEL32(000010DD,?,?,?,00440D46,?,00000000,00000000,?,?,006E90A4,006E90A4,000010DD,Already running), ref: 005C5A6D

std::_Throw_Cpp_error.LIBCPMT ref: 00446C49
std::_Throw_Cpp_error.LIBCPMT ref: 00446C50
std::_Throw_Cpp_error.LIBCPMT ref: 00446C57

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$Thread$CloseCodeCurrentExitHandleObjectSingleWait
String ID:
API String ID: 2210105531-0
Opcode ID: 5a17aa50974f33a84b3a707fea5c15ab4a2ffefb30816feaae663bef6fc89c25
Instruction ID: d9a0d7f09d98122dd996fc059ba2774944295cc02f45a55f56034edbe5a53311
Opcode Fuzzy Hash: 5a17aa50974f33a84b3a707fea5c15ab4a2ffefb30816feaae663bef6fc89c25
Instruction Fuzzy Hash: 0301F931401715DFD7346BE48D0FB1A7A94BB40721F00866EA594576C1EFB1B840C692

Function 005D354F Relevance: 6.0, APIs: 4, Instructions: 42COMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(00000000,?,?,00000000,005D36AE,00000000,?,005E4B12,005D36AE,005D36AE,?,00000000,?,?,?,00000001), ref: 005D3565
GetLastError.KERNEL32(?,005E4B12,005D36AE,005D36AE,?,00000000,?,?,?,00000001,00000000,00000000,?,005D36AE,?,?), ref: 005D356F
__dosmaperr.LIBCMT ref: 005D3576
GetFullPathNameW.KERNEL32(00000000,?,?,00000000,?,?,005E4B12,005D36AE,005D36AE,?,00000000,?,?,?,00000001,00000000), ref: 005D35A0

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: FullNamePath$ErrorLast__dosmaperr
String ID:
API String ID: 1391015842-0
Opcode ID: d9dab2f16658d848859ee1f3af991f34053149c9206cfcaf6726ee285d8e34f1
Instruction ID: b352257627fc5db932109255beb9e712c39b32694e384800a48cbb4df60d6d54
Opcode Fuzzy Hash: d9dab2f16658d848859ee1f3af991f34053149c9206cfcaf6726ee285d8e34f1
Instruction Fuzzy Hash: D1F03176600211AFDB309F69EC08E57BFAAFF84760710882BF556C2220DB71EA109791

Function 005D35B5 Relevance: 6.0, APIs: 4, Instructions: 42COMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(00000000,?,?,00000000,005D36AE,00000000,?,005E4B8A,005D36AE,?,00000000,?,?,?,00000001,00000000), ref: 005D35CB
GetLastError.KERNEL32(?,005E4B8A,005D36AE,?,00000000,?,?,?,00000001,00000000,00000000,?,005D36AE,?,?,?), ref: 005D35D5
__dosmaperr.LIBCMT ref: 005D35DC
GetFullPathNameW.KERNEL32(00000000,?,?,00000000,?,?,005E4B8A,005D36AE,?,00000000,?,?,?,00000001,00000000,00000000), ref: 005D3606

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: FullNamePath$ErrorLast__dosmaperr
String ID:
API String ID: 1391015842-0
Opcode ID: fcdf75906f2fded096ca95200de7eb5ce9ed4d86920df5ffa809a0e4e7b4e2d3
Instruction ID: a13d8b39a06232b26e52e81d6019f09deb7a51a722b863fbe6097d689c75b197
Opcode Fuzzy Hash: fcdf75906f2fded096ca95200de7eb5ce9ed4d86920df5ffa809a0e4e7b4e2d3
Instruction Fuzzy Hash: 66F0CD76200611AFDB305F6AD808A56BFA9FF84760710881BF65AC6720DB71EA50DB91

Function 0043ADB0 Relevance: 5.7, APIs: 2, Strings: 1, Instructions: 405COMMON

Download Yara Rule

APIs

_strcspn.LIBCMT ref: 0043AE4B
_strcspn.LIBCMT ref: 0043AE6D

Strings

st, xrefs: 0043ADC4

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: _strcspn
String ID: st
API String ID: 3709121408-1638371401
Opcode ID: c836804adfb83e13244c19994d2ada40e1d36e667bbb436eab1c1c0ca807849c
Instruction ID: 3027ac8ae6faaaec4226dd6c29c8aee49f2980c9e51d4de788c9d023be386a21
Opcode Fuzzy Hash: c836804adfb83e13244c19994d2ada40e1d36e667bbb436eab1c1c0ca807849c
Instruction Fuzzy Hash: 0EF18C75E002089FCF15CFA8C885AAEBBB6FF48310F14805AE955AB351D738AE05CF95

Function 00579BB0 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 241COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,00000000,?,00000000), ref: 00579BF2
GetLastError.KERNEL32 ref: 00579C0A

Strings

st, xrefs: 00579BB6

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: ErrorGlobalLastMemoryStatus
String ID: st
API String ID: 3848946878-1638371401
Opcode ID: 4621bbab9569b2e2167735b68c2ebf060242653438af5d5bf7e17f0f15c74b46
Instruction ID: 37170762a237e3796a89ca75f3b6d84fc85da1eca29fe55bd93c8eee6af41f49
Opcode Fuzzy Hash: 4621bbab9569b2e2167735b68c2ebf060242653438af5d5bf7e17f0f15c74b46
Instruction Fuzzy Hash: 83919B71E002188FCF25DF98D885BADBBB5FF94310F198069E809AF255D734AD45DBA0

Function 00574150 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 234COMMON

Download Yara Rule

Strings

st, xrefs: 00574159

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID:
String ID: st
API String ID: 0-1638371401
Opcode ID: ebc2cb14f2660a90878374e4250d5541a1b60ea37d8bf90fe18c9e65d42c8beb
Instruction ID: 09bd62233a7dba79d7887c9c37f18614d1e2d7bcadab84bc74caf7d84acd4c01
Opcode Fuzzy Hash: ebc2cb14f2660a90878374e4250d5541a1b60ea37d8bf90fe18c9e65d42c8beb
Instruction Fuzzy Hash: 3F91ECB5A006199FCB14CF69E491AADFBF5FB4C321F10826AE819D7740DB30A951CF90

Function 004846D0 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 204COMMON

Download Yara Rule

APIs

std::_Throw_Cpp_error.LIBCPMT ref: 0048473A
std::_Throw_Cpp_error.LIBCPMT ref: 00484745

Strings

st, xrefs: 004846E5

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: Cpp_errorThrow_std::_
String ID: st
API String ID: 2134207285-1638371401
Opcode ID: 5ba08608d9fd06fabc9c7bb489d51131d325c50f28381ae1ac1779f8f35ab36c
Instruction ID: e383e06e6c9876b4b9bd64af30f111a43381ee3e8e6527eb58ae8e9bf2fb595d
Opcode Fuzzy Hash: 5ba08608d9fd06fabc9c7bb489d51131d325c50f28381ae1ac1779f8f35ab36c
Instruction Fuzzy Hash: 3071F1755083C29FC711EF29C4806AFFBE4AF96314F144A9EE8D54B342D324E849CBA6

Function 00565430 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 180registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(?,?,00000001,?,E57473E3,00000007), ref: 00565663
SetLastError.KERNEL32(00000000,?,E57473E3,00000007), ref: 0056566E

Strings

st, xrefs: 00565444, 005655B7

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: CloseErrorLast
String ID: st
API String ID: 3262646002-1638371401
Opcode ID: 0413c937d69cb6e12bb320f8964cdb6c1813a5547e463003f41e72a0d154877f
Instruction ID: 9e59c12e2ac51a0734382be923bcab277ca7ebb1a255b623a8b3148f71313cbf
Opcode Fuzzy Hash: 0413c937d69cb6e12bb320f8964cdb6c1813a5547e463003f41e72a0d154877f
Instruction Fuzzy Hash: 15612E71D0164D9FCB04DFA8D995BEEBBF5FB48310F10426AE815A7340EB35AA44CBA0

Function 005E8F3B Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 177COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 005E8A67: GetOEMCP.KERNEL32(00000000,?,?,00000000,?), ref: 005E8A92

IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,?,?,?,?,005E8D7E,?,00000000,?,00000000,?), ref: 005E8F9C
GetCPInfo.KERNEL32(00000000,?,?,?,?,?,?,?,?,005E8D7E,?,00000000,?,00000000,?), ref: 005E8FDE

Strings

st, xrefs: 005E8F43

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: CodeInfoPageValid
String ID: st
API String ID: 546120528-1638371401
Opcode ID: aa513a184c3fad54be9f735e99eb9f4eb2a5bec558f284655346b1a52213238d
Instruction ID: 09b3befeb9b6e8f9ca04308ddcab1f905587945a1f8f14f1d0614ef9860b4f7c
Opcode Fuzzy Hash: aa513a184c3fad54be9f735e99eb9f4eb2a5bec558f284655346b1a52213238d
Instruction Fuzzy Hash: 27512470A003859EDB28DF66C848ABBBFF5FF81310F18446ED0D68B251DBB59A46CB41

Function 0056FDA0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 134registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000,00000000), ref: 0056FE14
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,00000000,?), ref: 0056FE63

Strings

st, xrefs: 0056FDA9

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: QueryValue
String ID: st
API String ID: 3660427363-1638371401
Opcode ID: 87f18deaa01af8129b774dfb657b55ffb680f337317ed9a413377bbb3500a0a2
Instruction ID: 3f23e5f03d24bd5a8106021106a71e2b53fa4e3a7ed207379bdfa7331c90cf28
Opcode Fuzzy Hash: 87f18deaa01af8129b774dfb657b55ffb680f337317ed9a413377bbb3500a0a2
Instruction Fuzzy Hash: FD41C471F0022C5BCB24DFA8EC89BBEBBB9FF54314F0005B9E80A97251DA715E418B90

Function 00474C10 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 133COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00400000,?,00000105,E57473E3,?), ref: 00474C80

Strings

st, xrefs: 00474847, 004749DB, 00474C3B
Module: , xrefs: 00474D06

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: FileModuleName
String ID: Module: $st
API String ID: 514040917-3985298484
Opcode ID: ff6fc13f78cc37d5cdf86b77e34e4ae55ff5095c4700e2c69c95b1ee9605db55
Instruction ID: 068193822bb02bf03a7815db889cac9d48f85f6b784d9900fddc4fdac6bbb0e7
Opcode Fuzzy Hash: ff6fc13f78cc37d5cdf86b77e34e4ae55ff5095c4700e2c69c95b1ee9605db55
Instruction Fuzzy Hash: 1341C1709013189FD720DF24DD89BEAB7B4FF54304F10829AE449A7281EB74AB84CF95

Function 00485970 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

std::_Throw_Cpp_error.LIBCPMT ref: 00485AA1
std::_Throw_Cpp_error.LIBCPMT ref: 00485AAC

Strings

st, xrefs: 00485998

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: Cpp_errorThrow_std::_
String ID: st
API String ID: 2134207285-1638371401
Opcode ID: 040f8ca0ef711a3cb6dc2cbed898a98689edd20bb058ce5ac401173ab1323985
Instruction ID: 92f57274cfc836026c717928eff468f4d9242ad51e21a7a77cd14becc22b8d2e
Opcode Fuzzy Hash: 040f8ca0ef711a3cb6dc2cbed898a98689edd20bb058ce5ac401173ab1323985
Instruction Fuzzy Hash: F041BE71D006089FCB04EFA4D881B9EB7B4FF58314F10862EE815AB281EB34A945CBA5

Function 0042AC80 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 119COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 0042AD1D

Strings

st, xrefs: 0042AC97
invalid hex_char_value<wchar_t>, xrefs: 0042ADC3

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: __aullrem
String ID: invalid hex_char_value<wchar_t>$st
API String ID: 3758378126-4188998929
Opcode ID: 2f61e14c0e2916ca0fbf5cfa1c7c780c0a0899b0c858433b20713d0cfac1e850
Instruction ID: 7bdae9eba53e5c2c257e7c862f1a45018a9b121a1473ff1b2dfa6bfc03df523b
Opcode Fuzzy Hash: 2f61e14c0e2916ca0fbf5cfa1c7c780c0a0899b0c858433b20713d0cfac1e850
Instruction Fuzzy Hash: 05412231A102198FCB14DF59D884BEBF7B6FF88701F90809EE815AB681E7786944CB95

Function 00485820 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

std::_Throw_Cpp_error.LIBCPMT ref: 00485951
std::_Throw_Cpp_error.LIBCPMT ref: 0048595C

Strings

st, xrefs: 00485848

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: Cpp_errorThrow_std::_
String ID: st
API String ID: 2134207285-1638371401
Opcode ID: 10f16ecf4b4703c73f7a2fa52ab48bc7458281d0e7a7786f17605a655d39e201
Instruction ID: c6a50dc580fd6d2724ca71d2d5cef1aadb40b72d1457648c68a531f277dce5ba
Opcode Fuzzy Hash: 10f16ecf4b4703c73f7a2fa52ab48bc7458281d0e7a7786f17605a655d39e201
Instruction Fuzzy Hash: 6541BE71D006089BCB00EFA8D881BDEF7B4FF58310F10862EE815A7281EB74A944CBA5

Function 00495C80 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 109COMMON

Download Yara Rule

APIs

RtlDllShutdownInProgress.NTDLL ref: 00495CDA
RtlDllShutdownInProgress.NTDLL ref: 00495D11

Strings

st, xrefs: 00495C94

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: ProgressShutdown
String ID: st
API String ID: 396724402-1638371401
Opcode ID: f21543229650e59c321b6a19e60ddb1e52382900c82ff9192d26583e5e4152c2
Instruction ID: 9edbd813029b347be1ce4338b3df10ef41d461fecad7cf050c18b4ee02337ff3
Opcode Fuzzy Hash: f21543229650e59c321b6a19e60ddb1e52382900c82ff9192d26583e5e4152c2
Instruction Fuzzy Hash: 684149B1D006189FDB01DFA4D888A9EBBB5FB58314F10826AE806B7351E7356E45CFA4

Function 005EA81A Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 102COMMONLIBRARYCODE

Download Yara Rule

APIs

GetStringTypeW.KERNEL32(?,00000000,00000000,00000001,?,?,?,?,?,?,?,?,?,?,?,E8458D00), ref: 005EA8EA
__freea.LIBCMT ref: 005EA8F9

Part of subcall function 005E4C31: RtlAllocateHeap.NTDLL(00000000,?,?,?,005C6D8D,?,?,0056925A,00000008,E57473E3), ref: 005E4C63

Strings

st, xrefs: 005EA822

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: AllocateHeapStringType__freea
String ID: st
API String ID: 4073780324-1638371401
Opcode ID: 5733eb536c2d9a5719b488e14a0d0a20b36c226dbcc323e602a68042e1657f74
Instruction ID: da05534852ba2b89e1f0522a8caae28ea853082aec697857ffd7fd429cc24aee
Opcode Fuzzy Hash: 5733eb536c2d9a5719b488e14a0d0a20b36c226dbcc323e602a68042e1657f74
Instruction Fuzzy Hash: E431C271A0029AABDB299F76CC49EAF7FA5FF44710F044028F85497251EB34DD51CB91

Function 00478590 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 101COMMON

Download Yara Rule

APIs

Part of subcall function 00556FC0: GetModuleHandleExW.KERNEL32(00000006,00478CA0,?,E57473E3,?,00000000), ref: 00557021

___std_exception_copy.LIBVCRUNTIME ref: 004785F9
___std_exception_copy.LIBVCRUNTIME ref: 0047867E

Strings

st, xrefs: 00478599

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: ___std_exception_copy$HandleModule
String ID: st
API String ID: 113806698-1638371401
Opcode ID: 4f5aabb34608bb6681fa60803c1efaef6e3529362c199f7dc40ecc5f5e1d3206
Instruction ID: 0c0a9fa420f00d11c0731f70defe7631e53050eec1fbf0dc5523ec477c1741b3
Opcode Fuzzy Hash: 4f5aabb34608bb6681fa60803c1efaef6e3529362c199f7dc40ecc5f5e1d3206
Instruction Fuzzy Hash: A531D471914205AFC708DF68DC8599BBBE9FF99314F04862EF94997301E770E9408BA6

Function 0049C530 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 79COMMON

Download Yara Rule

APIs

__Xtime_get_ticks.LIBCPMT ref: 0049C584
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0049C5E2

Strings

st, xrefs: 0049C539

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: Unothrow_t@std@@@Xtime_get_ticks__ehfuncinfo$??2@
String ID: st
API String ID: 3390117325-1638371401
Opcode ID: fabbd70b80df9de57eb8e6c78de9a96a7abb526dce3aced74a512f67012d826e
Instruction ID: 8b8bb78b45554e1dff0e6cf6195676547cb6517c37723306d2f3853c31be9bdb
Opcode Fuzzy Hash: fabbd70b80df9de57eb8e6c78de9a96a7abb526dce3aced74a512f67012d826e
Instruction Fuzzy Hash: FC219172A043119FCB10DF28C881A2BBBE9ABC8364F05492EF99597351D734ED058B96

Function 005C8F2C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 75COMMON

Download Yara Rule

APIs

PMDtoOffset.LIBCMT ref: 005C8FBE

Strings

Bad dynamic_cast!, xrefs: 005C9000

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: Offset
String ID: Bad dynamic_cast!
API String ID: 1587990502-2956939130
Opcode ID: 79738e95bffb1bfbb296a7f56b5502a35c309df3dba0b1f3cff43848f4f6e233
Instruction ID: dbc87b9461aaa4c8b74ad0a1a7a7dede8db1a5f86a4596bdecef1df0d308a825
Opcode Fuzzy Hash: 79738e95bffb1bfbb296a7f56b5502a35c309df3dba0b1f3cff43848f4f6e233
Instruction Fuzzy Hash: C7219272A042069FCB14DFA4C94AFBE7BB5FB85720B24465DE915A7180DF31E900D691

Function 005C43C5 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 73COMMON

Download Yara Rule

APIs

RaiseException.KERNEL32(?,?,?,?,?,00000000), ref: 005C4472

Part of subcall function 005C90B0: RaiseException.KERNEL32(E06D7363,00000001,00000003,0042867C,?,?,?,?,0042867C,st,006E8FF4,E57473E3), ref: 005C9110

Part of subcall function 005D969D: IsProcessorFeaturePresent.KERNEL32(00000017,005D3072,?,005D2FE1,?,00000000,005D31F0,?,?,?,?,?,00000000,00000000,00000000,00000000), ref: 005D96B9

Strings

st, xrefs: 005C43CB
csm, xrefs: 005C4401

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: ExceptionRaise$FeaturePresentProcessor
String ID: csm$st
API String ID: 1492173874-228821529
Opcode ID: cd3a8e8888efe03423a71814241e5f2041635b6565681c59c791dc496e160926
Instruction ID: bce0b09ec26b8c2713ba3bb2063b4db21c22311dc6eebc73ab72bc20816d5b91
Opcode Fuzzy Hash: cd3a8e8888efe03423a71814241e5f2041635b6565681c59c791dc496e160926
Instruction Fuzzy Hash: E2210536D00218AFCF28DBD5D899FAEBBB9BF84711F64041DE905AB650D630AD45CB81

Function 00485610 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

std::_Throw_Cpp_error.LIBCPMT ref: 004856A1
std::_Throw_Cpp_error.LIBCPMT ref: 004856AC

Part of subcall function 005C5CBC: ReleaseSRWLockExclusive.KERNEL32(004A74AD,?,004A74B5,?,00000000,?,?), ref: 005C5CD0

Strings

st, xrefs: 00485624

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$ExclusiveLockRelease
String ID: st
API String ID: 3666349979-1638371401
Opcode ID: ea01e961f44ccca39b806dcd2fc14c02dd0d8de85bc202e0eef63853fb096382
Instruction ID: 31ae006d9984d54a8eca890d280bdc792e5e7bbae5846579e34b2624ed1da882
Opcode Fuzzy Hash: ea01e961f44ccca39b806dcd2fc14c02dd0d8de85bc202e0eef63853fb096382
Instruction Fuzzy Hash: 1011E371D00A499FC701EBA4C806BAFBBB4FF15310F10462EF81696280FB756A54CB91

Function 00427B40 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 00427B66
std::_Lockit::~_Lockit.LIBCPMT ref: 00427BFA

Strings

st, xrefs: 00427B52

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: std::_$Locinfo::_Locinfo_dtorLockitLockit::~_
String ID: st
API String ID: 3286764726-1638371401
Opcode ID: 9bc45a0ec563875859c281c6f3a0034a2acc56b0ae9144d30d7ea1a45661d68b
Instruction ID: d6fbe22eeb9eefb4a0800d46148ac9e335b926d4325bd9828556eca868e604cc
Opcode Fuzzy Hash: 9bc45a0ec563875859c281c6f3a0034a2acc56b0ae9144d30d7ea1a45661d68b
Instruction Fuzzy Hash: 55114FF1A04B515BEB30DF65E805F177FE8AB00704F044A2EE81A87781EB7AF5048B96

Function 004856C0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

std::_Throw_Cpp_error.LIBCPMT ref: 00485758
std::_Throw_Cpp_error.LIBCPMT ref: 00485763

Part of subcall function 005C5CBC: ReleaseSRWLockExclusive.KERNEL32(004A74AD,?,004A74B5,?,00000000,?,?), ref: 005C5CD0

Strings

st, xrefs: 004856D4

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$ExclusiveLockRelease
String ID: st
API String ID: 3666349979-1638371401
Opcode ID: 3dc0d78019151e6422131d6f2e593b98e9fafcf03219fa84102b4afc318a1424
Instruction ID: 85aa8adc0b7c7fc01f57db79e736b1df24de062ffd7ada468c846267e3f43010
Opcode Fuzzy Hash: 3dc0d78019151e6422131d6f2e593b98e9fafcf03219fa84102b4afc318a1424
Instruction Fuzzy Hash: A811B271E006499FC710DBA9C846BAFBBF8EF55310F10462EF416A7380EB746945CB95

Function 00485770 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

std::_Throw_Cpp_error.LIBCPMT ref: 00485808
std::_Throw_Cpp_error.LIBCPMT ref: 00485813

Part of subcall function 005C5CBC: ReleaseSRWLockExclusive.KERNEL32(004A74AD,?,004A74B5,?,00000000,?,?), ref: 005C5CD0

Strings

st, xrefs: 00485784

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$ExclusiveLockRelease
String ID: st
API String ID: 3666349979-1638371401
Opcode ID: d22ab20c70413ae204eca42973012f0ba587ff8ccb7e785630898ccb4dd37aab
Instruction ID: 607cdd98610cf0563e4563bf7c51c9208d3cca9f331eb05dfba148f199be5c8d
Opcode Fuzzy Hash: d22ab20c70413ae204eca42973012f0ba587ff8ccb7e785630898ccb4dd37aab
Instruction Fuzzy Hash: 7611B271E006499FC710EBA9C846BAFBBF8EF55320F10462EF416A7380EA746945CB95

Function 00557F60 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(00000000,E57473E3,00000000,0060B9F0,00000000,00000000,0062751D,000000FF), ref: 00557F8E
DeleteCriticalSection.KERNEL32(00000000), ref: 00558009

Strings

@lu, xrefs: 00557FAD

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: CriticalSection$DeleteInitialize
String ID: @lu
API String ID: 2496364965-1727854026
Opcode ID: 82b4af0259e22eab69232526a50a3eff225dda1c9142f15cab15a7799c70ae1b
Instruction ID: 0e9cc20b8a4d2a2bac47823f9e63cbfbca09a6a4eb0e49692286126aba9d7aa4
Opcode Fuzzy Hash: 82b4af0259e22eab69232526a50a3eff225dda1c9142f15cab15a7799c70ae1b
Instruction Fuzzy Hash: 1711E6706007109BE320DF55DC09B5BBBE8FF44315F40051DE44A97681DB76BA04CBD9

Function 005EE61C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 61COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32(00000105,?,?,?,005D36AE), ref: 005EE655
GetCurrentDirectoryW.KERNEL32(00000001,00000000,?,?,?,?,005D36AE), ref: 005EE688

Strings

st, xrefs: 005EE627

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: CurrentDirectory
String ID: st
API String ID: 1611563598-1638371401
Opcode ID: f1e15e10348b8019cce31af44c993c28ee8aeb7c12c3602cf1722eda71d9f2bb
Instruction ID: 40507249b43e250a8be0a8e391bb0bc436b86eaedef0eb0ac716ce3d1a93b02e
Opcode Fuzzy Hash: f1e15e10348b8019cce31af44c993c28ee8aeb7c12c3602cf1722eda71d9f2bb
Instruction Fuzzy Hash: DF012B72A102656AE314AB66BC8FEAF7BADFFD4310F50045AF445D7181EF708F408591

Function 00440EE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 61COMMON

Download Yara Rule

APIs

DeviceIoControl.KERNEL32(?,00070060,00000000,00000000,00000000,00000000,?,00000000), ref: 00440F12
CloseHandle.KERNEL32(?), ref: 00440F1E

Strings

st, xrefs: 00440EE6

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: CloseControlDeviceHandle
String ID: st
API String ID: 2349616827-1638371401
Opcode ID: 0f1f6050541a21ea9a8bf2636693de475fe1d13583de05507c230c1593665442
Instruction ID: 4bd635b2135b37861a3b46178ecc68969062b5ab71f65a25a89d5f8f61a2d618
Opcode Fuzzy Hash: 0f1f6050541a21ea9a8bf2636693de475fe1d13583de05507c230c1593665442
Instruction Fuzzy Hash: 0511BB30300605ABC7189B68CC85B69F7A6FF48321F10022AE22A973D0EB74BD618BC4

Function 005C6D3B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 005C730E
___raise_securityfailure.LIBCMT ref: 005C73F6

Strings

st, xrefs: 005C73D7

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: FeaturePresentProcessor___raise_securityfailure
String ID: st
API String ID: 3761405300-1638371401
Opcode ID: 6adc825acd71e378b9643c66db7859f8caaf4bd3f5c2dbd0324af733ec934f87
Instruction ID: d460723bfe276a468f5492b69a5d6d42e01e8a160f0e98f224eca569445a4553
Opcode Fuzzy Hash: 6adc825acd71e378b9643c66db7859f8caaf4bd3f5c2dbd0324af733ec934f87
Instruction Fuzzy Hash: DA2109B4514B069FD700CF18F9A6B953BB5FB08316F50945EE5098B3A0EBF86981CF18

Function 004405F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 57COMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,E57473E3,00000044,-0000000C,0044077E), ref: 00440654
InitializeCriticalSection.KERNEL32(00000014), ref: 00440661

Strings

st, xrefs: 00440606

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: CreateCriticalEventInitializeSection
String ID: st
API String ID: 2948115387-1638371401
Opcode ID: f067e95ed941c9298b7ee3f97d6948e5b2a32494bad6cbd69e28550b56639474
Instruction ID: 423bcb772f88d2a47ad21f20792a520a6b9fcdc0060c26e98af3e9579702e865
Opcode Fuzzy Hash: f067e95ed941c9298b7ee3f97d6948e5b2a32494bad6cbd69e28550b56639474
Instruction Fuzzy Hash: 562147B1A00746AFD710CF69C805B86FBF8FF04714F10822AE5089BB80E7B9A654CBD1

Function 0040A500 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(00758618,00000FA0), ref: 0040A5AF

Strings

st, xrefs: 0040A514
st, xrefs: 0040A51C

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpin
String ID: st$st
API String ID: 2593887523-562346131
Opcode ID: 72fdce52ce07cd0a7a33fad32d488057dbaef41ec3c3d2bf578f57434c7d0c2d
Instruction ID: f7a6d092b6120d3fcba67cb5e5811b434352ad976ec63b63de5ed4018a4d3d05
Opcode Fuzzy Hash: 72fdce52ce07cd0a7a33fad32d488057dbaef41ec3c3d2bf578f57434c7d0c2d
Instruction Fuzzy Hash: 842127B0904384DFD781CF64EC09B857FF0EB05315F058169D408AB2A2EBB94608CB96

Function 0042B8D0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

HeapFree.KERNEL32(?,00000000,?,E57473E3,000000D4,00000000,00000000,0060BD60,000000FF,?,000000D4,00000000), ref: 0042B927
asw_process_storage_deallocate_connector.ANTISPAM_CONNECT_EU(?,000000D4,00000000), ref: 0042B937

Strings

st, xrefs: 0042B8EC

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: FreeHeapasw_process_storage_deallocate_connector
String ID: st
API String ID: 1088447885-1638371401
Opcode ID: 611ce5351d9a7af012d85a26939c3102834a9ee26f1c5f264d9e1129cf9f3ef6
Instruction ID: a9dc7a1486215cc7729865ae2f158a8ff5177765344b01ac0883638b1d97c39f
Opcode Fuzzy Hash: 611ce5351d9a7af012d85a26939c3102834a9ee26f1c5f264d9e1129cf9f3ef6
Instruction Fuzzy Hash: 950192B5A44618EFC710CF58DC85F6ABBB9FB09724F10415AE905973A0DB356D008BD5

Function 00431F60 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 47COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00431FD4

Strings

st, xrefs: 00431F77
avcfg://settings/CrashGuard/FullDumpFraction, xrefs: 00431FAE

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: ___std_exception_destroy
String ID: avcfg://settings/CrashGuard/FullDumpFraction$st
API String ID: 4194217158-715866953
Opcode ID: 61241715b42a74a935eba6af066c18017178a5ccd1dcded0b168102dc30ce517
Instruction ID: ed02010eaf8f95c2bf45ec40bc7692ad14822087de88902d00b3db81ac9fb4ac
Opcode Fuzzy Hash: 61241715b42a74a935eba6af066c18017178a5ccd1dcded0b168102dc30ce517
Instruction Fuzzy Hash: 5F01B9B1D046499FCB04DF95C8856AFFBB9FB45714F10026AE415A7340D7745A05CFE1

Function 005790A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45timeCOMMON

Download Yara Rule

APIs

SetFileTime.KERNEL32(?,00000000,?,00000000), ref: 005790DB
GetLastError.KERNEL32 ref: 005790E5

Strings

st, xrefs: 005790A6

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: ErrorFileLastTime
String ID: st
API String ID: 2212998366-1638371401
Opcode ID: b79784256537a4307142e6a3ea3c47bf4b7d0b4f49892a2e0887ad832b29c718
Instruction ID: 8f0197817887fbe069fb69e9dbc718609fe543a6ad308c5269bc7a7f33f142d2
Opcode Fuzzy Hash: b79784256537a4307142e6a3ea3c47bf4b7d0b4f49892a2e0887ad832b29c718
Instruction Fuzzy Hash: D2018470B002099FDB10DFA8D859B6D7BB5EB14320F50839DE82ED72C1EA315E11D751

Function 005C5A85 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 005C6282: __Xtime_get_ticks.LIBCPMT ref: 005C6288
Part of subcall function 005C6282: __aullrem.LIBCMT ref: 005C62B0

__Xtime_diff_to_millis2.LIBCPMT ref: 005C5AA8
Sleep.KERNEL32(00000000,?,00000064,00000000,?,?,?), ref: 005C5AB0

Strings

st, xrefs: 005C5A8B

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: SleepXtime_diff_to_millis2Xtime_get_ticks__aullrem
String ID: st
API String ID: 3404424058-1638371401
Opcode ID: c1455e22c4fc1e8cc61e8da4c9fa08dbe19855981bd79168bc037d98e5e3d3f0
Instruction ID: e870933d3f469713880fbbf9f59109f912c72d9a56fd20cf2274dfbc4e04c9c1
Opcode Fuzzy Hash: c1455e22c4fc1e8cc61e8da4c9fa08dbe19855981bd79168bc037d98e5e3d3f0
Instruction Fuzzy Hash: 70012C3190160A9FCF14EBE5D985DAEB7B8FF44315720052EE002A7141EA70BB84CBA5

Function 00428B70 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

HeapFree.KERNEL32(00000000,00000000,?,E57473E3,?,?,?,0060C620,000000FF), ref: 00428BB5
asw_process_storage_deallocate_connector.ANTISPAM_CONNECT_EU(?,?,?,0060C620,000000FF), ref: 00428BC5

Strings

st, xrefs: 00428B83

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: FreeHeapasw_process_storage_deallocate_connector
String ID: st
API String ID: 1088447885-1638371401
Opcode ID: 6605e7e58bec7508e2436cb0eaadc71aa8c025374d0eb64759855bd5db3152bf
Instruction ID: 324383ab8d80dfc83c34efbf1ad6e908e0b102d70ecca89ea7184d6f274f69fc
Opcode Fuzzy Hash: 6605e7e58bec7508e2436cb0eaadc71aa8c025374d0eb64759855bd5db3152bf
Instruction Fuzzy Hash: 1101D1B1604614EFC320CF05EC51B6BBBF9EB84724F00852EE81687790DB79B9008B94

Function 00428BF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

HeapFree.KERNEL32(?,00000000,?,E57473E3,?,?,?,0060C620,000000FF), ref: 00428C35
asw_process_storage_deallocate_connector.ANTISPAM_CONNECT_EU(?,?,?,0060C620,000000FF), ref: 00428C45

Strings

st, xrefs: 00428C03

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: FreeHeapasw_process_storage_deallocate_connector
String ID: st
API String ID: 1088447885-1638371401
Opcode ID: 24d4d5b663f4b775dcff509e54b8205f3dad3cbdaff905b5ddf0f4b00ad22fd4
Instruction ID: b3c5d08bef90edb65dc7d6c16f50161b0660b1284efd41ecb855fe9940163536
Opcode Fuzzy Hash: 24d4d5b663f4b775dcff509e54b8205f3dad3cbdaff905b5ddf0f4b00ad22fd4
Instruction Fuzzy Hash: E801D171605704DFC324CF16EC11B6BB7F9FB44720F00862EE81697780DB79A9008B94

Function 00442080 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 31threadCOMMON

Download Yara Rule

APIs

GetGUIThreadInfo.USER32(?,00000030), ref: 004420BB

Strings

st, xrefs: 00442089
0, xrefs: 004420A8

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: InfoThread
String ID: 0$st
API String ID: 4189086476-1356953281
Opcode ID: 810704628184d95a0df54c15f7d2dc0e5e8505adc2523dfe3e4611de2e8a64a8
Instruction ID: 2718563720e2af93077ebcdfb3a43b99488984db3a3dca47f67a778c451c0d2f
Opcode Fuzzy Hash: 810704628184d95a0df54c15f7d2dc0e5e8505adc2523dfe3e4611de2e8a64a8
Instruction Fuzzy Hash: 5DF05471625304AFD310DF64DC4AE5677E8EB44620F408629B89987291E730E914C696

Function 004404D0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 31COMMON

Download Yara Rule

APIs

DeviceIoControl.KERNEL32(?,00070060,00000000,00000000,00000000,00000000,?,00000000), ref: 004404FF
CloseHandle.KERNEL32(?), ref: 00440508

Strings

st, xrefs: 004404D6

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: CloseControlDeviceHandle
String ID: st
API String ID: 2349616827-1638371401
Opcode ID: d336a22c0594bbe12c724569db9295da2c36d929d01ee1ad7b1dbb12c7066bfe
Instruction ID: 6d31ad9a27329d9b321d7c009a19293d536ee108d0bce95f45af1f940acb1809
Opcode Fuzzy Hash: d336a22c0594bbe12c724569db9295da2c36d929d01ee1ad7b1dbb12c7066bfe
Instruction Fuzzy Hash: 06F08230750708BBD7249F68DC4AF9AB7A5EB04720F50075DF516A62D0DBB07A158B98

Function 00428430 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 29COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00428462

Strings

89\, xrefs: 00428440
st, xrefs: 00428436

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: ___std_exception_copy
String ID: 89\$st
API String ID: 2659868963-1114048837
Opcode ID: c96f2ed42ce9064e0f9afa0bd49aba8f2f130c48c938aae14b870b9ed9146e26
Instruction ID: c8b160267a9fdc563c947ea8fc1896b06da9bd088c0f8ebf27957634cf1e899b
Opcode Fuzzy Hash: c96f2ed42ce9064e0f9afa0bd49aba8f2f130c48c938aae14b870b9ed9146e26
Instruction Fuzzy Hash: 70F0A771D1020DAFC714DFA8D8419DEBFF5AF95304F5082AEE44167200EB715B558BD4

Function 005C6E41 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(00755B64,?,?,?,0040B061,007567F8,E57473E3,E57473E3,0060B741,000000FF,?,0040FB81,?,?), ref: 005C6E4C
ReleaseSRWLockExclusive.KERNEL32(00755B64,?,0040B061,007567F8,E57473E3,E57473E3,0060B741,000000FF,?,0040FB81,?,?), ref: 005C6E86

Strings

d[u, xrefs: 005C6E46

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: ExclusiveLock$AcquireRelease
String ID: d[u
API String ID: 17069307-3384785858
Opcode ID: e7d6e74140b4bb4df0c2a418ae4cbd642bfb098357254761f4206ec0559f9af8
Instruction ID: 330ff75c61922a895291f7680d1308302707e260cb2c01b3d2edb6aa7e04d1da
Opcode Fuzzy Hash: e7d6e74140b4bb4df0c2a418ae4cbd642bfb098357254761f4206ec0559f9af8
Instruction Fuzzy Hash: FAF08239500541DFC7205F98D844F66BBB9FB45731F10422FE965472A0CB755A42CA51

Function 005E369A Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 005E36A1

Strings

st, xrefs: 005E36C4, 005E36C7
r0], xrefs: 005E36C0, 005E36C3

Memory Dump Source

Source File: 00000001.00000002.3439018252.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3439001644.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439201123.0000000000633000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439261389.00000000006EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439279357.00000000006EE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439333692.0000000000755000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3439370150.000000000075A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_antispam_connect_eu.jbxd

Similarity

API ID: H_prolog3
String ID: r0]$st
API String ID: 431132790-213648239
Opcode ID: 272a389db10bdc84c0ed4adc4e054cf7b3a5bb564bd06b1175e5c953c9dc0c25
Instruction ID: f22473873a8d9290babdf963e1bc7708c7ac566607bda18c6e1f2169ffafd2dc
Opcode Fuzzy Hash: 272a389db10bdc84c0ed4adc4e054cf7b3a5bb564bd06b1175e5c953c9dc0c25
Instruction Fuzzy Hash: 56E07576C0020E9EDB01DFE4C446FEEBBBCBB48300F50456AA255EA141EA7497458BA1

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report antispam_connect_eu.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Exports

Possible Origin

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

Statistics

CPU Usage

Memory Usage

Windows Analysis Report
antispam_connect_eu.exe

Function 00409150 Relevance: 74.8, Strings: 59, Instructions: 1059
COMMON

Function 00568410 Relevance: 43.9, APIs: 21, Strings: 4, Instructions: 190
memorysleepregistryCOMMON

Function 0042B9A0 Relevance: 24.7, APIs: 7, Strings: 7, Instructions: 196
libraryloaderCOMMON

Function 00429000 Relevance: 21.6, APIs: 8, Strings: 4, Instructions: 556
COMMON

Function 00422120 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 296
nativememoryCOMMON

Function 005ADF30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42
timeCOMMON

Function 063C0D6F Relevance: 7.6, APIs: 5, Instructions: 141
networkCOMMON

Function 063C03DF Relevance: 6.2, APIs: 4, Instructions: 212
memoryCOMMON

Function 00428580 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 131
COMMONLIBRARYCODE

Function 0040A430 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47
timeCOMMON

Function 063C04B8 Relevance: 4.8, APIs: 3, Instructions: 313
COMMON

Function 00408A10 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 78
COMMON

Function 005E5061 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 57
COMMONLIBRARYCODE

Function 063C0A4D Relevance: 3.1, APIs: 2, Instructions: 73
networkCOMMON

Function 063C0D38 Relevance: 3.0, APIs: 2, Instructions: 25
COMMON