Edit tour

Windows Analysis Report
SecuriteInfo.com.Trojan.Siggen29.57841.15930.23271.exe

Overview

General Information

Sample name:	SecuriteInfo.com.Trojan.Siggen29.57841.15930.23271.exe
Analysis ID:	1541397
MD5:	a904ae8b26c7d421140be930266ed425
SHA1:	c2e246b9197c18d6d40d9477a8e9a2d74a83b0e2
SHA256:	9d3380ee1ccaae63ca9f39e86630ffe877d0e3ecb711d87dc02350922595dc84
Tags:	exe
Infos:

Detection

RedLine

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected RedLine Stealer

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Injects a PE file into a foreign processes

Installs new ROOT certificates

Machine Learning detection for sample

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops certificate files (DER)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE file contains sections with non-standard names

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

SecuriteInfo.com.Trojan.Siggen29.57841.15930.23271.exe (PID: 1136 cmdline: "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.57841.15930.23271.exe" MD5: A904AE8B26C7D421140BE930266ED425)

MSBuild.exe (PID: 5996 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

MSBuild.exe (PID: 6108 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

WerFault.exe (PID: 3220 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 1136 -s 268 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
RedLine Stealer	RedLine Stealer is a malware available on underground forums for sale apparently as a standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://apophis133.medium.com/redline-technical-analysis-report-5034e16ad152 https://asec.ahnlab.com/en/30445/ https://asec.ahnlab.com/en/35981/ https://asec.ahnlab.com/ko/25837/	https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Malware Configuration

Threatname: RedLine

{"C2 url": "89.105.223.196:29155", "Bot Id": "RDX", "Authorization Header": "21d3b2e8d7fdeff423c7a5819c5e64ed"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_RedLine_1	Yara detected RedLine Stealer	Joe Security
dump.pcap	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.2192787560.00000000001AC000.00000004.00000001.01000000.00000003.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000003.00000002.2335270089.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: SecuriteInfo.com.Trojan.Siggen29.57841.15930.23271.exe PID: 1136	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: MSBuild.exe PID: 6108	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: MSBuild.exe PID: 6108	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Click to see the 1 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
3.2.MSBuild.exe.400000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.SecuriteInfo.com.Trojan.Siggen29.57841.15930.23271.exe.180000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Suricata Signatures

ET MALWARE Redline Stealer TCP CnC - Id1Response

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-24T19:30:03.592849+0200	2043234	1	A Network Trojan was detected	89.105.223.196	29155	192.168.2.6	49714	TCP

ET MALWARE Redline Stealer TCP CnC Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-24T19:30:03.345929+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49714	89.105.223.196	29155	TCP
2024-10-24T19:30:08.881188+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49714	89.105.223.196	29155	TCP
2024-10-24T19:30:10.028260+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49714	89.105.223.196	29155	TCP
2024-10-24T19:30:10.288046+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49714	89.105.223.196	29155	TCP
2024-10-24T19:30:10.540147+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49714	89.105.223.196	29155	TCP
2024-10-24T19:30:11.703384+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49714	89.105.223.196	29155	TCP
2024-10-24T19:30:11.957568+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49714	89.105.223.196	29155	TCP
2024-10-24T19:30:12.206040+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49714	89.105.223.196	29155	TCP
2024-10-24T19:30:13.071208+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49714	89.105.223.196	29155	TCP
2024-10-24T19:30:13.448335+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49714	89.105.223.196	29155	TCP
2024-10-24T19:30:13.722053+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49714	89.105.223.196	29155	TCP
2024-10-24T19:30:14.101787+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49714	89.105.223.196	29155	TCP
2024-10-24T19:30:14.108991+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49714	89.105.223.196	29155	TCP
2024-10-24T19:30:14.988305+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49714	89.105.223.196	29155	TCP
2024-10-24T19:30:15.239871+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49714	89.105.223.196	29155	TCP
2024-10-24T19:30:16.023215+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49714	89.105.223.196	29155	TCP
2024-10-24T19:30:16.274229+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49714	89.105.223.196	29155	TCP
2024-10-24T19:30:16.552097+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49714	89.105.223.196	29155	TCP
2024-10-24T19:30:16.842038+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49714	89.105.223.196	29155	TCP
2024-10-24T19:30:17.254260+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49714	89.105.223.196	29155	TCP
2024-10-24T19:30:17.571261+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49714	89.105.223.196	29155	TCP
2024-10-24T19:30:17.822877+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49714	89.105.223.196	29155	TCP
2024-10-24T19:30:18.072047+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49714	89.105.223.196	29155	TCP
2024-10-24T19:30:18.365169+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49714	89.105.223.196	29155	TCP

ET MALWARE Redline Stealer/MetaStealer Family Activity (Response)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-24T19:30:10.035107+0200	2046056	1	A Network Trojan was detected	89.105.223.196	29155	192.168.2.6	49714	TCP

ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-24T19:30:03.345929+0200	2046045	1	A Network Trojan was detected	192.168.2.6	49714	89.105.223.196	29155	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 00000003.00000002.2336947884.00000000029E1000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: RedLine {"C2 url": "89.105.223.196:29155", "Bot Id": "RDX", "Authorization Header": "21d3b2e8d7fdeff423c7a5819c5e64ed"}

Multi AV Scanner detection for submitted file

Source: SecuriteInfo.com.Trojan.Siggen29.57841.15930.23271.exe

ReversingLabs: Detection: 73%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: SecuriteInfo.com.Trojan.Siggen29.57841.15930.23271.exe

Joe Sandbox ML: detected

Source: SecuriteInfo.com.Trojan.Siggen29.57841.15930.23271.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.6:49717 version: TLS 1.2

Source: SecuriteInfo.com.Trojan.Siggen29.57841.15930.23271.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.57841.15930.23271.exe

Code function: 0_2_00199FD9 FindFirstFileExW,

0_2_00199FD9

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp 065B9A03h	3_2_065B9740
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp 065BCF4Fh	3_2_065BC7E2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp 065BEEA1h	3_2_065BEE89
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then inc dword ptr [ebp-20h]	3_2_065B2E88
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then inc dword ptr [ebp-20h]	3_2_065B3158
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp 065EC808h	3_2_065EC310
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	3_2_065E9439
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp 065E9E7Ch	3_2_065E9BA8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp 065E8A0Dh	3_2_065E89EC

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2043231 - Severity 1 - ET MALWARE Redline Stealer TCP CnC Activity : 192.168.2.6:49714 -> 89.105.223.196:29155
Source: Network traffic	Suricata IDS: 2046045 - Severity 1 - ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization) : 192.168.2.6:49714 -> 89.105.223.196:29155
Source: Network traffic	Suricata IDS: 2043234 - Severity 1 - ET MALWARE Redline Stealer TCP CnC - Id1Response : 89.105.223.196:29155 -> 192.168.2.6:49714
Source: Network traffic	Suricata IDS: 2046056 - Severity 1 - ET MALWARE Redline Stealer/MetaStealer Family Activity (Response) : 89.105.223.196:29155 -> 192.168.2.6:49714

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 89.105.223.196:29155

Source: global traffic

TCP traffic: 192.168.2.6:49714 -> 89.105.223.196:29155

Source: Joe Sandbox View

IP Address: 89.105.223.196 89.105.223.196

Source: Joe Sandbox View

ASN Name: NOVOSERVE-GMBH-ASFrankfurtGermanyNL NOVOSERVE-GMBH-ASFrankfurtGermanyNL

Source: Joe Sandbox View

JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 89.105.223.196
Source: unknown	TCP traffic detected without corresponding DNS query: 89.105.223.196
Source: unknown	TCP traffic detected without corresponding DNS query: 89.105.223.196
Source: unknown	TCP traffic detected without corresponding DNS query: 89.105.223.196
Source: unknown	TCP traffic detected without corresponding DNS query: 89.105.223.196
Source: unknown	TCP traffic detected without corresponding DNS query: 89.105.223.196
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 89.105.223.196
Source: unknown	TCP traffic detected without corresponding DNS query: 89.105.223.196
Source: unknown	TCP traffic detected without corresponding DNS query: 89.105.223.196
Source: unknown	TCP traffic detected without corresponding DNS query: 89.105.223.196
Source: unknown	TCP traffic detected without corresponding DNS query: 89.105.223.196
Source: unknown	TCP traffic detected without corresponding DNS query: 89.105.223.196
Source: unknown	TCP traffic detected without corresponding DNS query: 89.105.223.196
Source: unknown	TCP traffic detected without corresponding DNS query: 89.105.223.196
Source: unknown	TCP traffic detected without corresponding DNS query: 89.105.223.196
Source: unknown	TCP traffic detected without corresponding DNS query: 89.105.223.196
Source: unknown	TCP traffic detected without corresponding DNS query: 89.105.223.196
Source: unknown	TCP traffic detected without corresponding DNS query: 89.105.223.196
Source: unknown	TCP traffic detected without corresponding DNS query: 89.105.223.196
Source: unknown	TCP traffic detected without corresponding DNS query: 89.105.223.196
Source: unknown	TCP traffic detected without corresponding DNS query: 89.105.223.196
Source: unknown	TCP traffic detected without corresponding DNS query: 89.105.223.196
Source: unknown	TCP traffic detected without corresponding DNS query: 89.105.223.196
Source: unknown	TCP traffic detected without corresponding DNS query: 89.105.223.196
Source: unknown	TCP traffic detected without corresponding DNS query: 89.105.223.196
Source: unknown	TCP traffic detected without corresponding DNS query: 89.105.223.196
Source: unknown	TCP traffic detected without corresponding DNS query: 89.105.223.196
Source: unknown	TCP traffic detected without corresponding DNS query: 89.105.223.196
Source: unknown	TCP traffic detected without corresponding DNS query: 89.105.223.196
Source: unknown	TCP traffic detected without corresponding DNS query: 89.105.223.196
Source: unknown	TCP traffic detected without corresponding DNS query: 89.105.223.196
Source: unknown	TCP traffic detected without corresponding DNS query: 89.105.223.196
Source: unknown	TCP traffic detected without corresponding DNS query: 89.105.223.196
Source: unknown	TCP traffic detected without corresponding DNS query: 89.105.223.196
Source: unknown	TCP traffic detected without corresponding DNS query: 89.105.223.196
Source: unknown	TCP traffic detected without corresponding DNS query: 89.105.223.196
Source: unknown	TCP traffic detected without corresponding DNS query: 89.105.223.196
Source: unknown	TCP traffic detected without corresponding DNS query: 89.105.223.196
Source: unknown	TCP traffic detected without corresponding DNS query: 89.105.223.196
Source: unknown	TCP traffic detected without corresponding DNS query: 89.105.223.196
Source: unknown	TCP traffic detected without corresponding DNS query: 89.105.223.196
Source: unknown	TCP traffic detected without corresponding DNS query: 89.105.223.196

Source: MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary
Source: MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary
Source: MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text
Source: MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
Source: MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentif
Source: MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ
Source: MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510
Source: MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1
Source: MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license
Source: MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID
Source: MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID
Source: MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1
Source: MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0
Source: MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey
Source: MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1
Source: MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1
Source: MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd
Source: MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap
Source: MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/tlsnego#TLS_Wrap
Source: MSBuild.exe, 00000003.00000002.2336947884.00000000029E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: MSBuild.exe, 00000003.00000002.2336947884.00000000029E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2002/12/policy
Source: MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/sc
Source: MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk
Source: MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/sct
Source: MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1
Source: MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Issue
Source: MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce
Source: MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/Issue
Source: MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT
Source: MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue
Source: MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT
Source: MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey
Source: MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust
Source: MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey
Source: MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey
Source: MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/06/addressingex
Source: MSBuild.exe, 00000003.00000002.2336947884.00000000029E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: MSBuild.exe, 00000003.00000002.2336947884.00000000029E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/faultp9
Source: MSBuild.exe, 00000003.00000002.2336947884.00000000029E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat
Source: MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted
Source: MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Commit
Source: MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Committed
Source: MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion
Source: MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC
Source: MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare
Source: MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepared
Source: MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly
Source: MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay
Source: MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback
Source: MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC
Source: MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/fault
Source: MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor
Source: MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContext
Source: MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse
Source: MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register
Source: MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/RegisterResponse
Source: MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/fault
Source: MSBuild.exe, 00000003.00000002.2336947884.00000000029E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm
Source: MSBuild.exe, 00000003.00000002.2336947884.00000000029E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested
Source: MSBuild.exe, 00000003.00000002.2336947884.00000000029E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence
Source: MSBuild.exe, 00000003.00000002.2336947884.00000000029E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse
Source: MSBuild.exe, 00000003.00000002.2336947884.00000000029E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/LastMessage
Source: MSBuild.exe, 00000003.00000002.2336947884.00000000029E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement
Source: MSBuild.exe, 00000003.00000002.2336947884.00000000029E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence
Source: MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc
Source: MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk
Source: MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1
Source: MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/sct
Source: MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret
Source: MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1
Source: MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Cancel
Source: MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issue
Source: MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce
Source: MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey
Source: MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue
Source: MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT
Source: MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel
Source: MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Renew
Source: MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
Source: MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT
Source: MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel
Source: MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew
Source: MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Renew
Source: MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/SymmetricKey
Source: MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/spnego
Source: MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego
Source: MSBuild.exe, 00000003.00000002.2336947884.00000000029E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns
Source: MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: MSBuild.exe, 00000003.00000002.2336947884.00000000029E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty
Source: MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2006/02/addressingidentity
Source: MSBuild.exe, 00000003.00000002.2336947884.00000000029E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/
Source: MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/D
Source: MSBuild.exe, 00000003.00000002.2336947884.00000000029E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1
Source: MSBuild.exe, 00000003.00000002.2336947884.00000000029E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10
Source: MSBuild.exe, 00000003.00000002.2336947884.00000000029E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10Response
Source: MSBuild.exe, 00000003.00000002.2336947884.0000000003056000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10ResponseD
Source: MSBuild.exe, 00000003.00000002.2336947884.00000000029E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11
Source: MSBuild.exe, 00000003.00000002.2336947884.00000000029E1000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11Response
Source: MSBuild.exe, 00000003.00000002.2336947884.0000000003004000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11ResponseD
Source: MSBuild.exe, 00000003.00000002.2336947884.00000000029E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12
Source: MSBuild.exe, 00000003.00000002.2336947884.00000000029E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12Response
Source: MSBuild.exe, 00000003.00000002.2336947884.0000000003004000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12ResponseD
Source: MSBuild.exe, 00000003.00000002.2336947884.00000000029E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13
Source: MSBuild.exe, 00000003.00000002.2336947884.00000000029E1000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13Response
Source: MSBuild.exe, 00000003.00000002.2336947884.0000000003056000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13ResponseD
Source: MSBuild.exe, 00000003.00000002.2336947884.00000000029E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14
Source: MSBuild.exe, 00000003.00000002.2336947884.00000000029E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14Response
Source: MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14ResponseD
Source: MSBuild.exe, 00000003.00000002.2336947884.00000000029E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15
Source: MSBuild.exe, 00000003.00000002.2336947884.00000000029E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15Response
Source: MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15ResponseD
Source: MSBuild.exe, 00000003.00000002.2336947884.00000000029E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16
Source: MSBuild.exe, 00000003.00000002.2336947884.00000000029E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16Response
Source: MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16ResponseD
Source: MSBuild.exe, 00000003.00000002.2336947884.00000000029E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17
Source: MSBuild.exe, 00000003.00000002.2336947884.00000000029E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17Response
Source: MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17ResponseD
Source: MSBuild.exe, 00000003.00000002.2336947884.00000000029E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18
Source: MSBuild.exe, 00000003.00000002.2336947884.00000000029E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18Response
Source: MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18ResponseD
Source: MSBuild.exe, 00000003.00000002.2336947884.00000000029E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19
Source: MSBuild.exe, 00000003.00000002.2336947884.00000000029E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19Response
Source: MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19ResponseD
Source: MSBuild.exe, 00000003.00000002.2336947884.00000000029E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1Response
Source: MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1ResponseD
Source: MSBuild.exe, 00000003.00000002.2336947884.00000000029E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2
Source: MSBuild.exe, 00000003.00000002.2336947884.00000000029E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20
Source: MSBuild.exe, 00000003.00000002.2336947884.00000000029E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20Response
Source: MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20ResponseD
Source: MSBuild.exe, 00000003.00000002.2336947884.00000000029E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21
Source: MSBuild.exe, 00000003.00000002.2336947884.00000000029E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21Response
Source: MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21ResponseD
Source: MSBuild.exe, 00000003.00000002.2336947884.00000000029E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22
Source: MSBuild.exe, 00000003.00000002.2336947884.00000000029E1000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22Response
Source: MSBuild.exe, 00000003.00000002.2336947884.00000000030FF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22ResponseD
Source: MSBuild.exe, 00000003.00000002.2336947884.00000000029E1000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2336947884.00000000030F7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23
Source: MSBuild.exe, 00000003.00000002.2336947884.0000000003056000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2336947884.00000000029E1000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23Response
Source: MSBuild.exe, 00000003.00000002.2336947884.00000000030FF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23ResponseD
Source: MSBuild.exe, 00000003.00000002.2336947884.00000000029E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24
Source: MSBuild.exe, 00000003.00000002.2336947884.00000000029E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24Response
Source: MSBuild.exe, 00000003.00000002.2336947884.00000000029E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2Response
Source: MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2ResponseD
Source: MSBuild.exe, 00000003.00000002.2336947884.00000000029E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3
Source: MSBuild.exe, 00000003.00000002.2336947884.00000000029E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3Response
Source: MSBuild.exe, 00000003.00000002.2336947884.00000000029E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4
Source: MSBuild.exe, 00000003.00000002.2336947884.00000000029E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4Response
Source: MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4ResponseD
Source: MSBuild.exe, 00000003.00000002.2336947884.00000000029E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5
Source: MSBuild.exe, 00000003.00000002.2336947884.00000000029E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5Response
Source: MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5ResponseD
Source: MSBuild.exe, 00000003.00000002.2336947884.00000000029E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6
Source: MSBuild.exe, 00000003.00000002.2336947884.00000000029E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6Response
Source: MSBuild.exe, 00000003.00000002.2336947884.0000000003072000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6ResponseD
Source: MSBuild.exe, 00000003.00000002.2336947884.00000000029E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7
Source: MSBuild.exe, 00000003.00000002.2336947884.00000000029E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7Response
Source: MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7ResponseD
Source: MSBuild.exe, 00000003.00000002.2336947884.00000000029E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8
Source: MSBuild.exe, 00000003.00000002.2336947884.00000000029E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8Response
Source: MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8ResponseD
Source: MSBuild.exe, 00000003.00000002.2336947884.00000000029E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9
Source: MSBuild.exe, 00000003.00000002.2336947884.00000000029E1000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2336947884.00000000030FF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9Response
Source: MSBuild.exe, 00000003.00000002.2336947884.00000000030FF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9ResponseD
Source: Amcache.hve.6.dr	String found in binary or memory: http://upx.sf.net
Source: MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: SecuriteInfo.com.Trojan.Siggen29.57841.15930.23271.exe, SecuriteInfo.com.Trojan.Siggen29.57841.15930.23271.exe, 00000000.00000002.2192787560.00000000001AC000.00000004.00000001.01000000.00000003.sdmp, MSBuild.exe, 00000003.00000002.2335270089.0000000000402000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ip.sb/ip
Source: MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49947 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49969 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49940
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49939
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49938
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49937
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49936
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49935
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49934
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49933
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49932
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49931
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49930
Source: unknown	Network traffic detected: HTTP traffic on port 49925 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49971 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49936 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49960 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49929
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49928
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49927
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49926
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49925
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49924
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49923
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49922
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49921
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49920
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443

Source: unknown

HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.6:49717 version: TLS 1.2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\Users\user\AppData\Local\Temp\TmpC5E2.tmp			Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\Users\user\AppData\Local\Temp\TmpC5D1.tmp			Jump to dropped file

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.57841.15930.23271.exe	Code function: 0_2_0018C8FE	0_2_0018C8FE
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.57841.15930.23271.exe	Code function: 0_2_0018F900	0_2_0018F900
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.57841.15930.23271.exe	Code function: 0_2_001941F3	0_2_001941F3
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.57841.15930.23271.exe	Code function: 0_2_00183A65	0_2_00183A65
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.57841.15930.23271.exe	Code function: 0_2_0019C2CF	0_2_0019C2CF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.57841.15930.23271.exe	Code function: 0_2_0019DC53	0_2_0019DC53
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.57841.15930.23271.exe	Code function: 0_2_0018CC46	0_2_0018CC46
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.57841.15930.23271.exe	Code function: 0_2_001954E9	0_2_001954E9
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.57841.15930.23271.exe	Code function: 0_2_001B253D	0_2_001B253D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.57841.15930.23271.exe	Code function: 0_2_001B1DB8	0_2_001B1DB8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.57841.15930.23271.exe	Code function: 0_2_001866DC	0_2_001866DC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_00F4DC74	3_2_00F4DC74
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_04FB6948	3_2_04FB6948
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_04FB7C20	3_2_04FB7C20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_04FB0040	3_2_04FB0040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_04FB001C	3_2_04FB001C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_04FB7C12	3_2_04FB7C12
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_04FB5A43	3_2_04FB5A43
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_062CA6B8	3_2_062CA6B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_062C67D8	3_2_062C67D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_062C3F50	3_2_062C3F50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_062CA688	3_2_062CA688
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_062C6FE8	3_2_062C6FE8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_062C6FF8	3_2_062C6FF8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_0657EF40	3_2_0657EF40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_0657C588	3_2_0657C588
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_06570A0C	3_2_06570A0C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_065B8E58	3_2_065B8E58
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_065B7640	3_2_065B7640
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_065BDE38	3_2_065BDE38
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_065BBE20	3_2_065BBE20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_065B9740	3_2_065B9740
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_065BD7F8	3_2_065BD7F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_065BC7E2	3_2_065BC7E2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_065BF457	3_2_065BF457
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_065B6D70	3_2_065B6D70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_065BE5A0	3_2_065BE5A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_065B13C0	3_2_065B13C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_065B88E8	3_2_065B88E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_065B8E48	3_2_065B8E48
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_065BD7E9	3_2_065BD7E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_065B6A28	3_2_065B6A28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_065BA2C0	3_2_065BA2C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_065B13B0	3_2_065B13B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_065EE2A0	3_2_065EE2A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_065EC310	3_2_065EC310
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_065EA100	3_2_065EA100
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_065EEFE8	3_2_065EEFE8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_065E8AA0	3_2_065E8AA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_065EAB80	3_2_065EAB80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_065E9439	3_2_065E9439
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_065E7D40	3_2_065E7D40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_065E6208	3_2_065E6208
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_065E61F7	3_2_065E61F7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_065E8A91	3_2_065E8A91

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.57841.15930.23271.exe

Code function: String function: 00186FB0 appears 50 times

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.57841.15930.23271.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 1136 -s 268

Source: SecuriteInfo.com.Trojan.Siggen29.57841.15930.23271.exe	Binary or memory string: OriginalFilename vs SecuriteInfo.com.Trojan.Siggen29.57841.15930.23271.exe
Source: SecuriteInfo.com.Trojan.Siggen29.57841.15930.23271.exe, 00000000.00000002.2192787560.00000000001EF000.00000004.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameCopilot.exe8 vs SecuriteInfo.com.Trojan.Siggen29.57841.15930.23271.exe

Source: SecuriteInfo.com.Trojan.Siggen29.57841.15930.23271.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: SecuriteInfo.com.Trojan.Siggen29.57841.15930.23271.exe

Static PE information: Section: .data ZLIB complexity 0.9898304977786753

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@6/10@0/1

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1003\76b53b3ec448f7ccdda2063b15d2bfc3_9e146be9-c76a-4720-bcdb-53011b87bd06

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Mutant created: NULL
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess1136

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

File created: C:\Users\user\AppData\Local\Temp\TmpC5D1.tmp

Jump to behavior

Source: SecuriteInfo.com.Trojan.Siggen29.57841.15930.23271.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

File read: C:\Program Files (x86)\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.57841.15930.23271.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: SecuriteInfo.com.Trojan.Siggen29.57841.15930.23271.exe

ReversingLabs: Detection: 73%

Source: unknown	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.57841.15930.23271.exe "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.57841.15930.23271.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.57841.15930.23271.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.57841.15930.23271.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.57841.15930.23271.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 1136 -s 268
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.57841.15930.23271.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.57841.15930.23271.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.57841.15930.23271.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: msvcp140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: esdsip.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ntasn1.dll	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\InProcServer32

Jump to behavior

Source: Google Chrome.lnk.3.dr

LNK file: ..\..\..\Program Files\Google\Chrome\Application\chrome.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: SecuriteInfo.com.Trojan.Siggen29.57841.15930.23271.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: SecuriteInfo.com.Trojan.Siggen29.57841.15930.23271.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: SecuriteInfo.com.Trojan.Siggen29.57841.15930.23271.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: SecuriteInfo.com.Trojan.Siggen29.57841.15930.23271.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: SecuriteInfo.com.Trojan.Siggen29.57841.15930.23271.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: SecuriteInfo.com.Trojan.Siggen29.57841.15930.23271.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: SecuriteInfo.com.Trojan.Siggen29.57841.15930.23271.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: SecuriteInfo.com.Trojan.Siggen29.57841.15930.23271.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: SecuriteInfo.com.Trojan.Siggen29.57841.15930.23271.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: SecuriteInfo.com.Trojan.Siggen29.57841.15930.23271.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: SecuriteInfo.com.Trojan.Siggen29.57841.15930.23271.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: SecuriteInfo.com.Trojan.Siggen29.57841.15930.23271.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: SecuriteInfo.com.Trojan.Siggen29.57841.15930.23271.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: SecuriteInfo.com.Trojan.Siggen29.57841.15930.23271.exe	Static PE information: section name: .bsp
Source: SecuriteInfo.com.Trojan.Siggen29.57841.15930.23271.exe	Static PE information: section name: .bsp

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.57841.15930.23271.exe	Code function: 0_2_00186122 push ecx; ret	0_2_00186135
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.57841.15930.23271.exe	Code function: 0_2_001B1A4E push es; retn 0000h	0_2_001B1ABE
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.57841.15930.23271.exe	Code function: 0_2_001B1AD0 push es; retn 0000h	0_2_001B1ABE
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.57841.15930.23271.exe	Code function: 0_2_001B1AD0 push es; ret	0_2_001B1ACD
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.57841.15930.23271.exe	Code function: 0_2_001B1AC1 push es; retn 0000h	0_2_001B1ABE
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.57841.15930.23271.exe	Code function: 0_2_001B1AC1 push es; ret	0_2_001B1ACD
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.57841.15930.23271.exe	Code function: 0_2_001B1B3D push es; retf 0000h	0_2_001B1B2A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.57841.15930.23271.exe	Code function: 0_2_001B1B3D push es; retf	0_2_001B1B3A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.57841.15930.23271.exe	Code function: 0_2_00183DE5 push eax; ret	0_2_00183E45
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_062CEFB2 push eax; ret	3_2_062CEFC1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_06575CEF push eax; ret	3_2_06575D03
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_0657A4AD push es; iretd	3_2_0657A4CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_0657E3F0 push es; ret	3_2_0657E400
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_06572952 push es; ret	3_2_06572960
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_06574998 push es; ret	3_2_065749F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_065BB4D0 push es; ret	3_2_065BB5B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_065BB580 push es; ret	3_2_065BB5B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_065E0782 pushfd ; iretd	3_2_065E0789

Persistence and Installation Behavior

Installs new ROOT certificates

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064 Blob

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: F40000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: 29E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: 49E0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Window / User API: threadDelayed 1639			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Window / User API: threadDelayed 3101			Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.57841.15930.23271.exe

API coverage: 3.9 %

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 3820	Thread sleep time: -14757395258967632s >= -30000s			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7056	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.57841.15930.23271.exe

Code function: 0_2_00199FD9 FindFirstFileExW,

0_2_00199FD9

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: MSBuild.exe, 00000003.00000002.2336947884.0000000002C60000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: Amcache.hve.6.dr	Binary or memory string: VMware
Source: MSBuild.exe, 00000003.00000002.2336947884.0000000002C60000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: MSBuild.exe, 00000003.00000002.2336947884.0000000002C60000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: MSBuild.exe, 00000003.00000002.2340731502.0000000003DB7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696487552f
Source: MSBuild.exe, 00000003.00000002.2336947884.0000000002C60000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: MSBuild.exe, 00000003.00000002.2336947884.0000000002C60000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: MSBuild.exe, 00000003.00000002.2336947884.0000000002D3A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,1
Source: Amcache.hve.6.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: MSBuild.exe, 00000003.00000002.2336947884.0000000002C60000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: MSBuild.exe, 00000003.00000002.2340731502.0000000003DB7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: MSBuild.exe, 00000003.00000002.2336947884.0000000002C60000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: MSBuild.exe, 00000003.00000002.2340731502.0000000003DB7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: MSBuild.exe, 00000003.00000002.2340731502.0000000003DB7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: MSBuild.exe, 00000003.00000002.2340731502.0000000003DB7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696487552
Source: MSBuild.exe, 00000003.00000002.2340731502.0000000003DB7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: MSBuild.exe, 00000003.00000002.2336947884.0000000002C60000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: MSBuild.exe, 00000003.00000002.2336947884.0000000002C60000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: MSBuild.exe, 00000003.00000002.2336947884.0000000002C60000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696487552
Source: Amcache.hve.6.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: MSBuild.exe, 00000003.00000002.2336947884.0000000002C60000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: MSBuild.exe, 00000003.00000002.2336947884.0000000002C60000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: MSBuild.exe, 00000003.00000002.2340731502.0000000003DB7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696487552
Source: MSBuild.exe, 00000003.00000002.2336947884.0000000002C60000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: MSBuild.exe, 00000003.00000002.2336947884.0000000002C60000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: MSBuild.exe, 00000003.00000002.2340731502.0000000003DB7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: MSBuild.exe, 00000003.00000002.2340731502.0000000003DB7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: MSBuild.exe, 00000003.00000002.2336947884.0000000002C60000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696487552
Source: MSBuild.exe, 00000003.00000002.2340731502.0000000003DB7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: Amcache.hve.6.dr	Binary or memory string: vmci.sys
Source: MSBuild.exe, 00000003.00000002.2340731502.0000000003DB7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: MSBuild.exe, 00000003.00000002.2336947884.0000000002C60000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: MSBuild.exe, 00000003.00000002.2336947884.0000000002C60000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: MSBuild.exe, 00000003.00000002.2340731502.0000000003DB7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: MSBuild.exe, 00000003.00000002.2336947884.0000000002C60000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: MSBuild.exe, 00000003.00000002.2340731502.0000000003DB7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: MSBuild.exe, 00000003.00000002.2336947884.0000000002C60000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696487552f
Source: Amcache.hve.6.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.6.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.6.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.6.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.6.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.6.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.6.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual RAM
Source: MSBuild.exe, 00000003.00000002.2336947884.0000000002C60000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: Amcache.hve.6.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: MSBuild.exe, 00000003.00000002.2336947884.0000000002C60000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: MSBuild.exe, 00000003.00000002.2336947884.0000000002C60000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: Amcache.hve.6.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563
Source: MSBuild.exe, 00000003.00000002.2340731502.0000000003DB7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: MSBuild.exe, 00000003.00000002.2340731502.0000000003DB7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: MSBuild.exe, 00000003.00000002.2340731502.0000000003DB7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.6.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.6.dr	Binary or memory string: VMware, Inc.
Source: MSBuild.exe, 00000003.00000002.2340731502.0000000003DB7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: MSBuild.exe, 00000003.00000002.2336947884.0000000002C60000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: MSBuild.exe, 00000003.00000002.2336947884.0000000002C60000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552
Source: Amcache.hve.6.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.6.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: MSBuild.exe, 00000003.00000002.2336947884.0000000002C60000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: Amcache.hve.6.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.6.dr	Binary or memory string: VMware-42 27 80 4d 99 30 0e 9c-c1 9b 2a 23 ea 1f c4 20
Source: Amcache.hve.6.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: MSBuild.exe, 00000003.00000002.2340731502.0000000003DB7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: MSBuild.exe, 00000003.00000002.2336947884.0000000002C60000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: MSBuild.exe, 00000003.00000002.2347911582.0000000005C90000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll]
Source: Amcache.hve.6.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.6.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: MSBuild.exe, 00000003.00000002.2340731502.0000000003DB7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: MSBuild.exe, 00000003.00000002.2340731502.0000000003DB7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: Amcache.hve.6.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.6.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: MSBuild.exe, 00000003.00000002.2336947884.0000000002C60000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: MSBuild.exe, 00000003.00000002.2336947884.0000000002C9B000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2336947884.0000000002D75000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2336947884.0000000002BC1000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2336947884.0000000002F28000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2336947884.0000000002E4F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: a+gZHWRMVWxqhmGkwPDYyjKMCw0Og3WVeEka+xsvn29TtmTfWbTJ0IYJkyXVZTogEvk0Ug/cTvdVBjxCPm0bNBY/sA3VxFhkhdzQsFcLBz6uGXB1DV0nbobJw9jhNYa0gG/En+48ZFhmCFIXmuZoqiopbM5c3YRODtzXlizVX/mAitADqNeW5oaJtWpjpinGWLCK8urG3jKNN0mmupGvcU5HlXybvdFUXWgqEhdpkMfvjkkaEbCSfMYSxkL4HWyoXAB1G5hDlqeMuUnwoUAFmVChtHrzZUujZ1qMtmQuVsgyJgRjoLosLTOWYnCQQNUD+mHRChOMZhQemhTYAQZgYPXrgAlY7arGVNjsQrU1hANJXXgrvFAvKP9iwWKe4wjrnFHs+Z6nrkdzDfsQ7pfwBivJDdeBjyC8ZBrYMHeatMrX4SJ1l2vEDg/GZZwN3qvaQEOk1nsYI0nQhADMY/hZsIxYmq3ilFF3yHgGzY6tEzFmBea/UBzFhAmYb1oqHrA2HYnHoIDc0qDg5jN/iSm+UGwHYbQqqkRJVpdhCsWfEsDQs2YatlmgMvGsygRH9PIZM241n1Wg2QJriGdD15v8AEBGUz5wmlUAhSdeuRka5XGneIZTmGpDHsAMQJpeyqP8xYFGCRUAjTnqs8pnAw7ZfJaRM+v+EFLwrtaPnqkMBbgxavDBYWANPixOUg4B+VzjJUjJYCBsUJclzNAchyM4pexDM02OhsoxyzrVD0C6Arsg91oEjxRVPKLcNQkNKVbxTCUW6soC2egIZoCPA7t4NFXTGOgK4Ztqmq9iAIBoyJ0taxTdWMw6zUbRFVnX0UrMS8+qbjpa49lGwqehC3MjgPLqrkBUFpyDPwpFUfupRlk6QW9NIcWAwPgjCgxdK6okaC1DF0K1ohFZDl5jASmKR3itQzUXpUraHaACX6vQ/9XAsTV4DSBo7dk3QZrlT5uo4dswPOpnsJUzg7nmNYtWoEgESZWcUTH2xOwuFIKgJgfVnHTK+JLmAb/RowJPMKhAsCv3xIKp3A3J0bIrT6Kneikg7dvk+GJmkHFttaJEguSLSv129ueZxPU8u/jjbOh58SbK79gHC6fbyHtiXugGa2piEQXxG+bmG0Cus4t/nq2zXfIR5aooh8B19rBJQYmQ20FEfz4uFqfTRmf/+lM6Ex746uEtS7v0ouFUMm83c8HpZ5PQzRdxuv47EQAZ9PEP/ZL6ecyVbL+8hOSJm6+yF+1A6ySN83i+WdwHy5TP6AGa54yNOQDMt0K/OHXfg+kqThLIfk6QFsLDCjZdpZTGOzjUsCOwZe5C6Gi8Q8TVSedBLpSfsvQj8BDp18kmZ3ex54YP0+Gs0yuOc0oHyahpuklKSN9DNVuBZhWH/uMHS1PAuQ5a2Lju9F/SWeKm7prBc0jVP84iPJxdnHVJ/HDDDbXL54Z89qdU0Vcin6gqmwXrJjGgP4IA8IR19qewIwTnUCQdrTZp1GW0u9j1R6sUgPUrm2c5cvXl9oot3E2Yi+lA6TVxs+wzTv0RyoJlnAb/LVyrQ+JXXkt08JQiqZojt7zmAq6A6TMAI3d99XjZOb1H2Ej05cPkbrRi3jsQ/1cA/+FiEaSdYURoSjyCbui7SR58sFKCEAn3HKH4uwm3eDW6eeqSVnn3vRu5S+ZPUrZgKYs8lgl1/fYieGCfbdnVWn1in27qZ19Yfhv4WKpf3SAPgywfR4sYK3wdc8VGoHmK3TWFL5jmOUHB49Ogy2jYoedRvh3h9D96fGhUBv0WbVKW3Fxq4ViXVL2x9NKNgA+vC8A5zUncE8H2TafulfEOSRqFccYu86ht5uc0nLgpiCrzoulmnAYZLfk4zbvX51WQrYMsc8ORmzRWmqqLFXZVINxxVKaxrpheUhYRfRx54cZnzZZxdMOYT0VhpWbZdIcVFHnb3QBFJEgxwyQpCTte0yQjzn7uCUZsuA+iYIJO4a+Hmq+9ONtmOcMMYl7TbktlwpTMf366yxqm+uPbWY4CHOTnXrwGvPjnt7OfVwg2HHr8jHcJ5uzn/JOx/BvEfztbLR
Source: Amcache.hve.6.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: MSBuild.exe, 00000003.00000002.2340731502.0000000003DB7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: MSBuild.exe, 00000003.00000002.2340731502.0000000003DB7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: MSBuild.exe, 00000003.00000002.2336947884.0000000002C60000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: MSBuild.exe, 00000003.00000002.2340731502.0000000003DB7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: MSBuild.exe, 00000003.00000002.2336947884.0000000002C60000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: MSBuild.exe, 00000003.00000002.2340731502.0000000003DB7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: MSBuild.exe, 00000003.00000002.2340731502.0000000003DB7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: Amcache.hve.6.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: MSBuild.exe, 00000003.00000002.2340731502.0000000003DB7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: MSBuild.exe, 00000003.00000002.2336947884.0000000002C60000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: MSBuild.exe, 00000003.00000002.2340731502.0000000003DB7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: MSBuild.exe, 00000003.00000002.2340731502.0000000003DB7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: MSBuild.exe, 00000003.00000002.2340731502.0000000003DB7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: MSBuild.exe, 00000003.00000002.2340731502.0000000003DB7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: MSBuild.exe, 00000003.00000002.2336947884.0000000002C60000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: MSBuild.exe, 00000003.00000002.2340731502.0000000003DB7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.57841.15930.23271.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.57841.15930.23271.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.57841.15930.23271.exe

Code function: 0_2_00183DE5 LdrInitializeThunk,LdrInitializeThunk,

0_2_00183DE5

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.57841.15930.23271.exe

Code function: 0_2_0018AAD3 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_0018AAD3

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.57841.15930.23271.exe	Code function: 0_2_00183EE0 mov edi, dword ptr fs:[00000030h]	0_2_00183EE0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.57841.15930.23271.exe	Code function: 0_2_00190DA3 mov ecx, dword ptr fs:[00000030h]	0_2_00190DA3
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.57841.15930.23271.exe	Code function: 0_2_0019ADE5 mov eax, dword ptr fs:[00000030h]	0_2_0019ADE5

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.57841.15930.23271.exe

Code function: 0_2_0019D3E4 GetProcessHeap,

0_2_0019D3E4

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.57841.15930.23271.exe	Code function: 0_2_00186A55 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00186A55
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.57841.15930.23271.exe	Code function: 0_2_0018AAD3 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0018AAD3
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.57841.15930.23271.exe	Code function: 0_2_00186D5B IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00186D5B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.57841.15930.23271.exe	Code function: 0_2_00186EE8 SetUnhandledExceptionFilter,	0_2_00186EE8

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.57841.15930.23271.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.57841.15930.23271.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.57841.15930.23271.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.57841.15930.23271.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 402000	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.57841.15930.23271.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 432000	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.57841.15930.23271.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 450000	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.57841.15930.23271.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 8D6008	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.57841.15930.23271.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"			Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.57841.15930.23271.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"			Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.57841.15930.23271.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	0_2_0019C81E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.57841.15930.23271.exe	Code function: GetLocaleInfoW,	0_2_0019D0B3
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.57841.15930.23271.exe	Code function: EnumSystemLocalesW,	0_2_001948DD
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.57841.15930.23271.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_0019D182
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.57841.15930.23271.exe	Code function: EnumSystemLocalesW,	0_2_0019CAC0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.57841.15930.23271.exe	Code function: EnumSystemLocalesW,	0_2_0019CB0B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.57841.15930.23271.exe	Code function: EnumSystemLocalesW,	0_2_0019CBA6
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.57841.15930.23271.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_0019CC31
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.57841.15930.23271.exe	Code function: GetLocaleInfoW,	0_2_00194DA6
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.57841.15930.23271.exe	Code function: GetLocaleInfoW,	0_2_0019CE84
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.57841.15930.23271.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_0019CFAD

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.57841.15930.23271.exe

Code function: 0_2_00186C55 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00186C55

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Amcache.hve.6.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: MSBuild.exe, 00000003.00000002.2355439035.0000000009056000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: MsMpEng.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct

Stealing of Sensitive Information

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 3.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Trojan.Siggen29.57841.15930.23271.exe.180000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2192787560.00000000001AC000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2335270089.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Trojan.Siggen29.57841.15930.23271.exe PID: 1136, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 6108, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\atomic\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\Cache\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\db\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\	Jump to behavior

Source: Yara match	File source: 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 6108, type: MEMORYSTR

Remote Access Functionality

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 3.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Trojan.Siggen29.57841.15930.23271.exe.180000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2192787560.00000000001AC000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2335270089.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Trojan.Siggen29.57841.15930.23271.exe PID: 1136, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 6108, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	221 Windows Management Instrumentation	1 DLL Side-Loading	311 Process Injection	1 Masquerading	1 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	12 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	261 Security Software Discovery	Remote Desktop Protocol	2 Data from Local System	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	251 Virtualization/Sandbox Evasion	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	11 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	311 Process Injection	NTDS	251 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	3 Obfuscated Files or Information	Cached Domain Credentials	2 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Install Root Certificate	DCSync	124 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Software Packing	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 DLL Side-Loading	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
SecuriteInfo.com.Trojan.Siggen29.57841.15930.23271.exe	74%	ReversingLabs	Win32.Trojan.LummaC
SecuriteInfo.com.Trojan.Siggen29.57841.15930.23271.exe	100%	Joe Sandbox ML

URLs

Source	Detection	Scanner	Label
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/sc/sct	0%	URL Reputation	safe
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1	0%	URL Reputation	safe
http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/fault	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey	0%	URL Reputation	safe
https://api.ip.sb/ip	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/sc	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/08/addressing	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/trust	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/Renew	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2006/02/addressingidentity	0%	URL Reputation	safe
http://schemas.xmlsoap.org/soap/envelope/	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false		unknown
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text	MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/sc/sct	MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/chrome_newtab	MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk	MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id14ResponseD	MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id23ResponseD	MSBuild.exe, 00000003.00000002.2336947884.00000000030FF000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary	MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id12Response	MSBuild.exe, 00000003.00000002.2336947884.00000000029E1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/	MSBuild.exe, 00000003.00000002.2336947884.00000000029E1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id2Response	MSBuild.exe, 00000003.00000002.2336947884.00000000029E1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1	MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id21Response	MSBuild.exe, 00000003.00000002.2336947884.00000000029E1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap	MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id9	MSBuild.exe, 00000003.00000002.2336947884.00000000029E1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID	MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id8	MSBuild.exe, 00000003.00000002.2336947884.00000000029E1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id6ResponseD	MSBuild.exe, 00000003.00000002.2336947884.0000000003072000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id5	MSBuild.exe, 00000003.00000002.2336947884.00000000029E1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare	MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id4	MSBuild.exe, 00000003.00000002.2336947884.00000000029E1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id7	MSBuild.exe, 00000003.00000002.2336947884.00000000029E1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id6	MSBuild.exe, 00000003.00000002.2336947884.00000000029E1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret	MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id19Response	MSBuild.exe, 00000003.00000002.2336947884.00000000029E1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license	MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted	MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	MSBuild.exe, 00000003.00000002.2336947884.00000000029E1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id13ResponseD	MSBuild.exe, 00000003.00000002.2336947884.0000000003056000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/fault	MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat	MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey	MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id15Response	MSBuild.exe, 00000003.00000002.2336947884.00000000029E1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id5ResponseD	MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew	MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing/faultp9	MSBuild.exe, 00000003.00000002.2336947884.00000000029E1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register	MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id6Response	MSBuild.exe, 00000003.00000002.2336947884.00000000029E1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey	MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.ip.sb/ip	SecuriteInfo.com.Trojan.Siggen29.57841.15930.23271.exe, SecuriteInfo.com.Trojan.Siggen29.57841.15930.23271.exe, 00000000.00000002.2192787560.00000000001AC000.00000004.00000001.01000000.00000003.sdmp, MSBuild.exe, 00000003.00000002.2335270089.0000000000402000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/sc	MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id1ResponseD	MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC	MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel	MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id9Response	MSBuild.exe, 00000003.00000002.2336947884.00000000029E1000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2336947884.00000000030FF000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id20	MSBuild.exe, 00000003.00000002.2336947884.00000000029E1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id21	MSBuild.exe, 00000003.00000002.2336947884.00000000029E1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id22	MSBuild.exe, 00000003.00000002.2336947884.00000000029E1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1	MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id23	MSBuild.exe, 00000003.00000002.2336947884.00000000029E1000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2336947884.00000000030F7000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1	MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id24	MSBuild.exe, 00000003.00000002.2336947884.00000000029E1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue	MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id24Response	MSBuild.exe, 00000003.00000002.2336947884.00000000029E1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.ecosia.org/newtab/	MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id1Response	MSBuild.exe, 00000003.00000002.2336947884.00000000029E1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested	MSBuild.exe, 00000003.00000002.2336947884.00000000029E1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly	MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay	MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego	MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary	MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC	MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey	MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id21ResponseD	MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing	MSBuild.exe, 00000003.00000002.2336947884.00000000029E1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion	MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/trust	MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id10	MSBuild.exe, 00000003.00000002.2336947884.00000000029E1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id11	MSBuild.exe, 00000003.00000002.2336947884.00000000029E1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id10ResponseD	MSBuild.exe, 00000003.00000002.2336947884.0000000003056000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id12	MSBuild.exe, 00000003.00000002.2336947884.00000000029E1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id16Response	MSBuild.exe, 00000003.00000002.2336947884.00000000029E1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse	MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel	MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id13	MSBuild.exe, 00000003.00000002.2336947884.00000000029E1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id14	MSBuild.exe, 00000003.00000002.2336947884.00000000029E1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id15	MSBuild.exe, 00000003.00000002.2336947884.00000000029E1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id16	MSBuild.exe, 00000003.00000002.2336947884.00000000029E1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce	MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id17	MSBuild.exe, 00000003.00000002.2336947884.00000000029E1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id18	MSBuild.exe, 00000003.00000002.2336947884.00000000029E1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id5Response	MSBuild.exe, 00000003.00000002.2336947884.00000000029E1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id19	MSBuild.exe, 00000003.00000002.2336947884.00000000029E1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns	MSBuild.exe, 00000003.00000002.2336947884.00000000029E1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id15ResponseD	MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id10Response	MSBuild.exe, 00000003.00000002.2336947884.00000000029E1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Renew	MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id11ResponseD	MSBuild.exe, 00000003.00000002.2336947884.0000000003004000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id8Response	MSBuild.exe, 00000003.00000002.2336947884.00000000029E1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey	MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0	MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID	MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT	MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2006/02/addressingidentity	MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id17ResponseD	MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/soap/envelope/	MSBuild.exe, 00000003.00000002.2336947884.00000000029E1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id8ResponseD	MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey	MSBuild.exe, 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
89.105.223.196	unknown	Netherlands		21159	NOVOSERVE-GMBH-ASFrankfurtGermanyNL	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1541397
Start date and time:	2024-10-24 19:29:05 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 33s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	11
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SecuriteInfo.com.Trojan.Siggen29.57841.15930.23271.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@6/10@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 98% Number of executed functions: 219 Number of non-executed functions: 67
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 40.113.103.199, 40.126.32.68, 40.126.32.133, 40.126.32.140, 20.190.160.17, 40.126.32.72, 40.126.32.76, 40.126.32.74, 20.190.160.20, 192.229.221.95, 20.42.65.92, 2.19.126.137, 2.19.126.163, 20.109.210.53, 40.69.42.241, 4.175.87.197, 20.3.187.198
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, otelrules.afd.azureedge.net, a767.dspw65.akamai.net, wns.notify.trafficmanager.net, ocsp.digicert.com, login.live.com, ocsp.edge.digicert.com, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, wu-b-net.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net, client.wns.windows.com, prdv4a.aadg.msidentity.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, www.tm.v4.a.prd.aadg.akadns.net, ctldl.windowsupdate.com, login.msa.msidentity.com, download.windowsupdate.com.edgesuite.net, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, onedsblobprdeus17.eastus.cloudapp.azure.com, blobcollector.events.data.trafficmanager.net, azureedge-t-prod.trafficmanager.net, umwatson.events.data.microsoft.com, www.tm.lg.prod.aadmsa.trafficmanager.net
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: SecuriteInfo.com.Trojan.Siggen29.57841.15930.23271.exe

Simulations

Behavior and APIs

Time	Type	Description
13:30:03	API Interceptor	1x Sleep call for process: WerFault.exe modified
13:30:15	API Interceptor	23x Sleep call for process: MSBuild.exe modified

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_SecuriteInfo.com_d3361eebbf430e036b4a51b6ef5b69d794b9ba_78258953_0519d225-d812-4cba-ad6d-22db454bf1fb\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.7019321165562383
Encrypted:	false
SSDEEP:	96:+5F9k95ttzKsJMhGOoI7Rn6tQXIDcQvc6QcEVcw3cE/KP6+HbHg/5hZAX/d5FMTs:mXq9K++0BU/wjhzuiFNZ24IO8u
MD5:	DB2C1624FB23A855BACD0FB69651FD35
SHA1:	F519D565CCE6DC86E25E405720C0EFD7A62E849E
SHA-256:	952E006A82C9ECDC60755F00098A160E8E6E1A35F516B94D89F0B895FB24472D
SHA-512:	078BD7F91BD85B3F0729E39C8106923489E736F0248F58353CD5E9BBA9565F4ECCF602A295EE3A459F79233A28FB87678FF7A1076C75FD291515D2D83141D400
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.4.2.6.4.6.0.0.2.9.6.7.6.7.7.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.4.2.6.4.6.0.0.7.3.4.2.7.3.9.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.0.5.1.9.d.2.2.5.-.d.8.1.2.-.4.c.b.a.-.a.d.6.d.-.2.2.d.b.4.5.4.b.f.1.f.b.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.8.2.4.6.8.8.0.5.-.a.b.3.4.-.4.3.d.3.-.9.b.1.f.-.f.9.e.7.b.f.e.e.2.0.d.1.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.S.e.c.u.r.i.t.e.I.n.f.o...c.o.m...T.r.o.j.a.n...S.i.g.g.e.n.2.9...5.7.8.4.1...1.5.9.3.0...2.3.2.7.1...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.4.7.0.-.0.0.0.1.-.0.0.1.5.-.5.0.7.a.-.d.f.5.8.3.a.2.6.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.3.1.4.a.5.0.1.8.9.5.6.d.e.2.b.f.2.a.6.a.0.a.a.a.4.7.6.2.b.f.c.b.0.0.0.0.f.f.f.f.!.0.0.0.0.c.2.e.2.4.6.b.9.1.9.7.c.1.8.d.6.d.4.0.d.9.4.7.7.a.8.e.9.a.2.d.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC620.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Thu Oct 24 17:30:00 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	34342
Entropy (8bit):	1.6318814399247972
Encrypted:	false
SSDEEP:	96:5Q8dk6vHo6MHHWRi77d5PiemQT0yOeGrKVkjS68LWx4Wqx9avYfCo44PX8v/8WIV:BXq4OlXoPgcQu5I
MD5:	E7BED4442CFE634FE925D16B4035F52A
SHA1:	418F54811590CC3B50A379FEE6C79F95D3EA5032
SHA-256:	E2DBBAADB91A9B2528101F4B45CF1A54328C10C27AD36A8CC6D921A0B8B4FC7C
SHA-512:	1CC54529868625A0093A775ACAC3053034122E1B31589728A84321970B74D961D27764884ADD2DCE00DA8257A4FA77F897AF8BA43C1162B774F827E1B6378871
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... ..........g........................d...........................T.......8...........T...............&{......................................................................................................eJ..............GenuineIntel............T.......p......g.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC67E.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8562
Entropy (8bit):	3.6987454603701906
Encrypted:	false
SSDEEP:	192:R6l7wVeJzS6z6Y2DpSU96I0pgmfFnvprT89bkBsf+qjMm:R6lXJm6z6Y0SU967pgmfl2k6f1d
MD5:	94AD0D363542ED3AAD4E4EE3810DAC71
SHA1:	7FF036A739BEFD06C2330414A894CB172B3C32E5
SHA-256:	9C8ABCD839950A0C759D61B917A47E500896F87F946E4774DFEC21D751BFEA96
SHA-512:	A8B05EEDD6A1F089F03B6DF6CD2D511362FE0E0F126F520C6534984AEA87FB73EDA2330AC24A565B3245C5D45835747C1EF622C3EFA5D53A3F227291B1F27B82
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.1.1.3.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC6BE.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4920
Entropy (8bit):	4.560721772036011
Encrypted:	false
SSDEEP:	48:cvIwWl8zsxJg77aI961WpW8VYrYm8M4J6eq7Fg+q8v1qgFsTLTAd:uIjfDI7QE7VvJ6eRK1XFsTLTAd
MD5:	F1EA38F6D7331A35B38AC87F788F6A5E
SHA1:	B9A4F911193F441D1BDA5783F013660D1C1B608D
SHA-256:	2E666627A8F00509F222F12B6DF60C46C22EED31E53BCA7D74B62B98DA8B3CFD
SHA-512:	32AEEC5ABC20CB64F7692420B5ADCB9326C783561DB9AD8A071E954C48C1B6E17C55DA48DF7A171B8EA1A744A4C76102075D20C99856B6C4FF46F427FF949635
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="557792" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Users\Public\Desktop\Google Chrome.lnk

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:41 2023, mtime=Thu Oct 5 05:47:19 2023, atime=Wed Sep 27 08:36:54 2023, length=3242272, window=hide
Category:	dropped
Size (bytes):	2104
Entropy (8bit):	3.4653709432324757
Encrypted:	false
SSDEEP:	48:8S4d5TvG90lRYrnvPdAKRkdAGdAKRFdAKR6P:8SSby7
MD5:	B1B07C8B0570C97A7945C23BC2CAAB38
SHA1:	B73B99564DF4F682B941ADF0D390BF07F666DA09
SHA-256:	7F8F05BB4D21DBBCCB71F88F8525BC56269864B50D150FA61EBC58CC3006103F
SHA-512:	F03FE3480AD6BDFDED4EE65D4152173DA0BDB85A09C7FEAE440771923DD55A50EC41C68BF89E11EB92886C8D34B806ADEF8A50BAE3A7F173CAD6EE613D1BD70B
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ......,.....AV.W....X.&&... y1.....................#....P.O. .:i.....+00.../C:\.....................1.....EW.3..PROGRA~1..t......O.IEW.5....B...............J.......j.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VEW@2....L.....................p+j.G.o.o.g.l.e.....T.1.....EW.2..Chrome..>......CW.VEW.2....M.....................7...C.h.r.o.m.e.....`.1.....EW.2..APPLIC~1..H......CW.VEW.2..........................7...A.p.p.l.i.c.a.t.i.o.n.....`.2. y1.;W.L .chrome.exe..F......CW.VEW.5.........................l...c.h.r.o.m.e...e.x.e.......d...............-.......c............F.......C:\Program Files\Google\Chrome\Application\chrome.exe....A.c.c.e.s.s. .t.h.e. .I.n.t.e.r.n.e.t.;.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.!.-.-.p.r.o.x.y.-.s.e.r.v.e.r

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\MSBuild.exe.log

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3274
Entropy (8bit):	5.3318368586986695
Encrypted:	false
SSDEEP:	96:Pq5qHwCYqh3oPtI6eqzxP0aymRLKTqdqlq7qqjqcEZ5D:Pq5qHwCYqh3qtI6eqzxP0at9KTqdqlqY
MD5:	0B2E58EF6402AD69025B36C36D16B67F
SHA1:	5ECC642327EF5E6A54B7918A4BD7B46A512BF926
SHA-256:	4B0FB8EECEAD6C835CED9E06F47D9021C2BCDB196F2D60A96FEE09391752C2D7
SHA-512:	1464106CEC5E264F8CEA7B7FF03C887DA5192A976FBC9369FC60A480A7B9DB0ED1956EFCE6FFAD2E40A790BD51FD27BB037256964BC7B4B2DA6D4D5C6B267FA1
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Temp\TmpC5D1.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	data
Category:	dropped
Size (bytes):	2662
Entropy (8bit):	7.8230547059446645
Encrypted:	false
SSDEEP:	48:qJdHasMPAUha1DgSVVi59ca13MfyKjWwUmq9W2UgniDhiRhkjp9g:bhhEgSVVi59defyfW2sDgAj3g
MD5:	1420D30F964EAC2C85B2CCFE968EEBCE
SHA1:	BDF9A6876578A3E38079C4F8CF5D6C79687AD750
SHA-256:	F3327793E3FD1F3F9A93F58D033ED89CE832443E2695BECA9F2B04ADBA049ED9
SHA-512:	6FCB6CE148E1E246D6805502D4914595957061946751656567A5013D96033DD1769A22A87C45821E7542CDE533450E41182CEE898CD2CCF911C91BC4822371A8
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	0..b...0.."...H..............0...0......H..............0...0......H............0...0....H.......0...p.,\|.(.............mW.....$\|Bb.[ .w..#.G.a.K-..i.....+Yo..^m~{........@...iC....[....L.q.J....s?K..G..n.}......;.Q..6..WW..uP.k.F..</..%...X.P...V..R......@.Va...Zm....(M3......"..2-..{9......k.3....Y..c]..O.Bq.H.>..p.RS...\|B.d..kr.=G.g.v..f.d.C.?...0Ch[2:.V....A..7..PD..G....p..*.L{1.&'e..uU)@.i....:.P.;.j.j.......Y.:.a..6.j.L.J.....^[..8,."...2E.......[qU..6.].......nr..i..^l......-..m..u@P;..Ra."......n.p.Z..).:p).F($..\|.R.!9V.....[.gV...i..!.....=.y{.T6.9.m..+.....(2..\..V.1..].V...q.%.4.a...n.B..Q..g.~N..s....=iZ...3..).......E..A.I...hH..Q%0.]...u..........h0T.P.X.A............'.....O....Py.=..3..n..c.F.$z..t..jM.E..W...i1..'...Y,r.,.+...o.}.7..kb.t'DQTV..{...#....sT..G...:..3.L.....c..b%z..e.\.EY...M;x.Z....t..nv...@Ka.....\|s>.2Qr..f,O..XJ`d....78H8.....`..);.vMcUJ.......m.G5.ib]5.h.v<.?S.{1O.Y...kb.....a&.R......E.l..."J..G.

C:\Users\user\AppData\Local\Temp\TmpC5E2.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	data
Category:	dropped
Size (bytes):	2662
Entropy (8bit):	7.8230547059446645
Encrypted:	false
SSDEEP:	48:qJdHasMPAUha1DgSVVi59ca13MfyKjWwUmq9W2UgniDhiRhkjp9g:bhhEgSVVi59defyfW2sDgAj3g
MD5:	1420D30F964EAC2C85B2CCFE968EEBCE
SHA1:	BDF9A6876578A3E38079C4F8CF5D6C79687AD750
SHA-256:	F3327793E3FD1F3F9A93F58D033ED89CE832443E2695BECA9F2B04ADBA049ED9
SHA-512:	6FCB6CE148E1E246D6805502D4914595957061946751656567A5013D96033DD1769A22A87C45821E7542CDE533450E41182CEE898CD2CCF911C91BC4822371A8
Malicious:	false
Preview:	0..b...0.."...H..............0...0......H..............0...0......H............0...0....H.......0...p.,\|.(.............mW.....$\|Bb.[ .w..#.G.a.K-..i.....+Yo..^m~{........@...iC....[....L.q.J....s?K..G..n.}......;.Q..6..WW..uP.k.F..</..%...X.P...V..R......@.Va...Zm....(M3......"..2-..{9......k.3....Y..c]..O.Bq.H.>..p.RS...\|B.d..kr.=G.g.v..f.d.C.?...0Ch[2:.V....A..7..PD..G....p..*.L{1.&'e..uU)@.i....:.P.;.j.j.......Y.:.a..6.j.L.J.....^[..8,."...2E.......[qU..6.].......nr..i..^l......-..m..u@P;..Ra."......n.p.Z..).:p).F($..\|.R.!9V.....[.gV...i..!.....=.y{.T6.9.m..+.....(2..\..V.1..].V...q.%.4.a...n.B..Q..g.~N..s....=iZ...3..).......E..A.I...hH..Q%0.]...u..........h0T.P.X.A............'.....O....Py.=..3..n..c.F.$z..t..jM.E..W...i1..'...Y,r.,.+...o.}.7..kb.t'DQTV..{...#....sT..G...:..3.L.....c..b%z..e.\.EY...M;x.Z....t..nv...@Ka.....\|s>.2Qr..f,O..XJ`d....78H8.....`..);.vMcUJ.......m.G5.ib]5.h.v<.?S.{1O.Y...kb.....a&.R......E.l..."J..G.

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1003\76b53b3ec448f7ccdda2063b15d2bfc3_9e146be9-c76a-4720-bcdb-53011b87bd06

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	data
Category:	dropped
Size (bytes):	2251
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	0158FE9CEAD91D1B027B795984737614
SHA1:	B41A11F909A7BDF1115088790A5680AC4E23031B
SHA-256:	513257326E783A862909A2A0F0941D6FF899C403E104FBD1DBC10443C41D9F9A
SHA-512:	C48A55CC7A92CEFCEFE5FB2382CCD8EF651FC8E0885E88A256CD2F5D83B824B7D910F755180B29ECCB54D9361D6AF82F9CC741BD7E6752122949B657DA973676
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.468839054620657
Encrypted:	false
SSDEEP:	6144:GzZfpi6ceLPx9skLmb0fgZWSP3aJG8nAgeiJRMMhA2zX4WABluuNsjDH5S:IZHtgZWOKnMM6bFpij4
MD5:	B3122E9C9C1BFFFFC5BEC9DEAE4C26A5
SHA1:	8C2FFFAF8C3F8EB4C42A8EF996EF20462BC14A79
SHA-256:	6736F04D0EA0C6C521D25E8BE44944874F506C4A40453F8DEC20CFD5A0B7057A
SHA-512:	3091C7D2A7CB5A4F17F465D769C5B6059C65C7AC9FFD4148E3A50604681923018EB0B2505720CAA37B7F8798FE7DAD2DC22901C688E49251C7AA47B87CDE8F55
Malicious:	false
Preview:	regfH...H....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm.NKZ:&................................................................................................................................................................................................................................................................................................................................................]n........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

AddAtomW, WideCharToMultiByte, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionEx, DeleteCriticalSection, EncodePointer, DecodePointer, MultiByteToWideChar, LCMapStringEx, GetStringTypeW, GetCPInfo, IsProcessorFeaturePresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, GetStartupInfoW, GetModuleHandleW, CreateFileW, RaiseException, RtlUnwind, GetLastError, SetLastError, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, GetProcAddress, LoadLibraryExW, GetStdHandle, WriteFile, GetModuleFileNameW, ExitProcess, GetModuleHandleExW, HeapAlloc, HeapFree, LCMapStringW, GetLocaleInfoW, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, GetFileType, CloseHandle, FlushFileBuffers, GetConsoleOutputCP, GetConsoleMode, ReadFile, GetFileSizeEx, SetFilePointerEx, ReadConsoleW, HeapReAlloc, FindClose, FindFirstFileExW, FindNextFileW, IsValidCodePage, GetACP, GetOEMCP, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetStdHandle, GetProcessHeap, HeapSize, WriteConsoleW

Exports

Name	Ordinal	Address
_ReturnDataValidator@8	1	0x403ecf

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-24T19:30:03.345929+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49714	89.105.223.196	29155	TCP
2024-10-24T19:30:03.345929+0200	2046045	ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization)	1	192.168.2.6	49714	89.105.223.196	29155	TCP
2024-10-24T19:30:03.592849+0200	2043234	ET MALWARE Redline Stealer TCP CnC - Id1Response	1	89.105.223.196	29155	192.168.2.6	49714	TCP
2024-10-24T19:30:08.881188+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49714	89.105.223.196	29155	TCP
2024-10-24T19:30:10.028260+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49714	89.105.223.196	29155	TCP
2024-10-24T19:30:10.035107+0200	2046056	ET MALWARE Redline Stealer/MetaStealer Family Activity (Response)	1	89.105.223.196	29155	192.168.2.6	49714	TCP
2024-10-24T19:30:10.288046+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49714	89.105.223.196	29155	TCP
2024-10-24T19:30:10.540147+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49714	89.105.223.196	29155	TCP
2024-10-24T19:30:11.703384+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49714	89.105.223.196	29155	TCP
2024-10-24T19:30:11.957568+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49714	89.105.223.196	29155	TCP
2024-10-24T19:30:12.206040+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49714	89.105.223.196	29155	TCP
2024-10-24T19:30:13.071208+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49714	89.105.223.196	29155	TCP
2024-10-24T19:30:13.448335+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49714	89.105.223.196	29155	TCP
2024-10-24T19:30:13.722053+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49714	89.105.223.196	29155	TCP
2024-10-24T19:30:14.101787+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49714	89.105.223.196	29155	TCP
2024-10-24T19:30:14.108991+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49714	89.105.223.196	29155	TCP
2024-10-24T19:30:14.988305+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49714	89.105.223.196	29155	TCP
2024-10-24T19:30:15.239871+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49714	89.105.223.196	29155	TCP
2024-10-24T19:30:16.023215+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49714	89.105.223.196	29155	TCP
2024-10-24T19:30:16.274229+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49714	89.105.223.196	29155	TCP
2024-10-24T19:30:16.552097+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49714	89.105.223.196	29155	TCP
2024-10-24T19:30:16.842038+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49714	89.105.223.196	29155	TCP
2024-10-24T19:30:17.254260+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49714	89.105.223.196	29155	TCP
2024-10-24T19:30:17.571261+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49714	89.105.223.196	29155	TCP
2024-10-24T19:30:17.822877+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49714	89.105.223.196	29155	TCP
2024-10-24T19:30:18.072047+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49714	89.105.223.196	29155	TCP
2024-10-24T19:30:18.365169+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49714	89.105.223.196	29155	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 24, 2024 19:29:56.798033953 CEST	49673	443	192.168.2.6	173.222.162.64
Oct 24, 2024 19:29:56.798037052 CEST	49674	443	192.168.2.6	173.222.162.64
Oct 24, 2024 19:29:57.110553980 CEST	49672	443	192.168.2.6	173.222.162.64
Oct 24, 2024 19:30:02.223176003 CEST	49714	29155	192.168.2.6	89.105.223.196
Oct 24, 2024 19:30:02.228678942 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:02.228800058 CEST	49714	29155	192.168.2.6	89.105.223.196
Oct 24, 2024 19:30:02.236527920 CEST	49714	29155	192.168.2.6	89.105.223.196
Oct 24, 2024 19:30:02.241942883 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:03.069281101 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:03.110713005 CEST	49714	29155	192.168.2.6	89.105.223.196
Oct 24, 2024 19:30:03.345928907 CEST	49714	29155	192.168.2.6	89.105.223.196
Oct 24, 2024 19:30:03.351366997 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:03.592849016 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:03.641844034 CEST	49714	29155	192.168.2.6	89.105.223.196
Oct 24, 2024 19:30:04.082530022 CEST	49717	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:04.082581043 CEST	443	49717	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:04.082655907 CEST	49717	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:04.083523035 CEST	49717	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:04.083539009 CEST	443	49717	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:05.065368891 CEST	443	49717	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:05.065464973 CEST	49717	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:05.067394972 CEST	49717	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:05.067409039 CEST	443	49717	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:05.067847013 CEST	443	49717	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:05.077341080 CEST	49717	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:05.119338036 CEST	443	49717	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:05.296443939 CEST	443	49717	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:05.296478987 CEST	443	49717	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:05.296499014 CEST	443	49717	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:05.296617985 CEST	49717	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:05.296690941 CEST	443	49717	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:05.296767950 CEST	49717	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:05.325934887 CEST	443	49717	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:05.325984001 CEST	443	49717	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:05.326117992 CEST	49717	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:05.326136112 CEST	443	49717	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:05.326174021 CEST	49717	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:05.327980995 CEST	49717	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:05.413585901 CEST	443	49717	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:05.413610935 CEST	443	49717	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:05.413757086 CEST	49717	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:05.413794994 CEST	443	49717	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:05.413856983 CEST	49717	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:05.445628881 CEST	443	49717	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:05.445672989 CEST	443	49717	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:05.445729971 CEST	49717	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:05.445739985 CEST	443	49717	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:05.445797920 CEST	49717	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:05.447699070 CEST	443	49717	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:05.447760105 CEST	443	49717	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:05.447793961 CEST	49717	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:05.447803974 CEST	443	49717	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:05.447820902 CEST	49717	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:05.447854042 CEST	49717	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:05.530117035 CEST	443	49717	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:05.530164003 CEST	443	49717	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:05.530226946 CEST	49717	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:05.530261993 CEST	443	49717	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:05.530311108 CEST	49717	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:05.530337095 CEST	49717	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:05.530653000 CEST	443	49717	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:05.530695915 CEST	443	49717	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:05.530744076 CEST	49717	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:05.530764103 CEST	443	49717	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:05.530797958 CEST	49717	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:05.531039953 CEST	49717	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:05.558600903 CEST	443	49717	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:05.558641911 CEST	443	49717	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:05.558698893 CEST	49717	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:05.558710098 CEST	443	49717	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:05.558764935 CEST	49717	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:05.559310913 CEST	443	49717	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:05.559371948 CEST	443	49717	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:05.559401989 CEST	49717	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:05.559411049 CEST	443	49717	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:05.559459925 CEST	49717	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:05.559487104 CEST	49717	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:05.560193062 CEST	443	49717	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:05.560234070 CEST	443	49717	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:05.560271025 CEST	49717	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:05.560280085 CEST	443	49717	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:05.560322046 CEST	49717	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:05.560343027 CEST	49717	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:05.561053038 CEST	443	49717	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:05.561091900 CEST	443	49717	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:05.561155081 CEST	49717	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:05.561162949 CEST	443	49717	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:05.561203957 CEST	49717	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:05.561228991 CEST	49717	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:05.564824104 CEST	443	49717	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:05.564865112 CEST	443	49717	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:05.564903975 CEST	49717	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:05.564912081 CEST	443	49717	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:05.564954042 CEST	49717	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:05.564984083 CEST	49717	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:05.565531969 CEST	443	49717	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:05.565572977 CEST	443	49717	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:05.565624952 CEST	49717	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:05.565633059 CEST	443	49717	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:05.565669060 CEST	49717	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:05.565695047 CEST	49717	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:05.647222996 CEST	443	49717	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:05.647327900 CEST	49717	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:05.647337914 CEST	443	49717	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:05.647392035 CEST	49717	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:05.647435904 CEST	443	49717	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:05.647489071 CEST	49717	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:05.647532940 CEST	49717	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:05.647553921 CEST	443	49717	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:05.647567034 CEST	49717	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:05.647574902 CEST	443	49717	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:05.729315996 CEST	49719	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:05.729382992 CEST	443	49719	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:05.729582071 CEST	49719	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:05.731209993 CEST	49720	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:05.731257915 CEST	443	49720	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:05.731328964 CEST	49720	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:05.731487989 CEST	49721	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:05.731523991 CEST	443	49721	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:05.731585979 CEST	49721	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:05.732125044 CEST	49719	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:05.732161999 CEST	443	49719	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:05.732805967 CEST	49720	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:05.732820988 CEST	443	49720	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:05.732981920 CEST	49722	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:05.732990026 CEST	443	49722	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:05.733055115 CEST	49722	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:05.733197927 CEST	49722	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:05.733211040 CEST	443	49722	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:05.733396053 CEST	49723	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:05.733407021 CEST	443	49723	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:05.733478069 CEST	49723	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:05.733630896 CEST	49721	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:05.733640909 CEST	443	49721	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:05.733661890 CEST	49723	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:05.733669996 CEST	443	49723	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:06.407445908 CEST	49673	443	192.168.2.6	173.222.162.64
Oct 24, 2024 19:30:06.407464027 CEST	49674	443	192.168.2.6	173.222.162.64
Oct 24, 2024 19:30:06.461705923 CEST	443	49723	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:06.474337101 CEST	443	49721	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:06.476913929 CEST	443	49722	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:06.477653980 CEST	443	49720	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:06.477777004 CEST	443	49719	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:06.516798973 CEST	49723	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:06.516829014 CEST	49721	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:06.532414913 CEST	49722	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:06.532428980 CEST	49720	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:06.532541037 CEST	49719	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:06.537389040 CEST	49719	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:06.537417889 CEST	443	49719	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:06.541917086 CEST	49719	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:06.541930914 CEST	443	49719	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:06.542397022 CEST	49720	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:06.542403936 CEST	443	49720	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:06.542989016 CEST	49720	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:06.542994022 CEST	443	49720	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:06.543239117 CEST	49723	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:06.543251991 CEST	443	49723	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:06.543592930 CEST	49723	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:06.543597937 CEST	443	49723	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:06.544087887 CEST	49721	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:06.544094086 CEST	443	49721	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:06.544519901 CEST	49721	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:06.544524908 CEST	443	49721	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:06.545237064 CEST	49722	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:06.545242071 CEST	443	49722	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:06.545798063 CEST	49722	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:06.545803070 CEST	443	49722	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:06.668991089 CEST	443	49723	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:06.669023037 CEST	443	49723	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:06.669087887 CEST	443	49723	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:06.669102907 CEST	49723	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:06.669135094 CEST	49723	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:06.669981003 CEST	443	49719	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:06.670042992 CEST	443	49719	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:06.670114040 CEST	49719	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:06.670151949 CEST	443	49719	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:06.670203924 CEST	49719	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:06.670455933 CEST	49723	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:06.670483112 CEST	443	49723	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:06.670497894 CEST	49723	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:06.670506001 CEST	443	49723	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:06.670528889 CEST	443	49719	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:06.670708895 CEST	443	49720	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:06.670959949 CEST	443	49719	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:06.671005011 CEST	49719	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:06.671055079 CEST	443	49720	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:06.671099901 CEST	49720	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:06.672616005 CEST	49720	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:06.672633886 CEST	443	49720	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:06.672643900 CEST	49720	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:06.672650099 CEST	443	49720	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:06.673573017 CEST	443	49721	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:06.673598051 CEST	443	49721	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:06.673649073 CEST	49721	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:06.673659086 CEST	443	49721	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:06.674700022 CEST	443	49721	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:06.674755096 CEST	49721	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:06.679553986 CEST	443	49722	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:06.679634094 CEST	443	49722	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:06.679727077 CEST	49722	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:06.719912052 CEST	49672	443	192.168.2.6	173.222.162.64
Oct 24, 2024 19:30:06.783970118 CEST	49721	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:06.783987045 CEST	443	49721	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:06.784006119 CEST	49721	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:06.784013033 CEST	443	49721	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:06.839029074 CEST	49722	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:06.839029074 CEST	49722	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:06.839055061 CEST	443	49722	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:06.839062929 CEST	443	49722	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:06.840750933 CEST	49719	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:06.840773106 CEST	443	49719	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:06.840787888 CEST	49719	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:06.840795040 CEST	443	49719	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:06.847326040 CEST	49724	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:06.847361088 CEST	443	49724	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:06.847417116 CEST	49724	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:06.855429888 CEST	49724	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:06.855448961 CEST	443	49724	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:06.873070002 CEST	49725	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:06.873136997 CEST	443	49725	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:06.873217106 CEST	49725	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:06.873542070 CEST	49725	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:06.873579025 CEST	443	49725	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:06.874424934 CEST	49726	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:06.874443054 CEST	443	49726	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:06.874502897 CEST	49726	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:06.874612093 CEST	49726	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:06.874623060 CEST	443	49726	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:06.875579119 CEST	49727	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:06.875612020 CEST	443	49727	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:06.875679970 CEST	49727	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:06.876322985 CEST	49728	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:06.876342058 CEST	443	49728	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:06.876445055 CEST	49728	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:06.876522064 CEST	49727	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:06.876545906 CEST	443	49727	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:06.876622915 CEST	49728	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:06.876645088 CEST	443	49728	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:07.620310068 CEST	443	49725	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:07.620585918 CEST	443	49726	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:07.621174097 CEST	49726	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:07.621191978 CEST	443	49726	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:07.621350050 CEST	443	49728	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:07.621428013 CEST	443	49727	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:07.621809959 CEST	49726	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:07.621814966 CEST	443	49726	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:07.622087002 CEST	49725	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:07.622104883 CEST	443	49725	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:07.622235060 CEST	49727	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:07.622247934 CEST	443	49727	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:07.622605085 CEST	49725	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:07.622608900 CEST	443	49725	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:07.622693062 CEST	49727	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:07.622697115 CEST	443	49727	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:07.622963905 CEST	49728	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:07.622977018 CEST	443	49728	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:07.623449087 CEST	49728	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:07.623454094 CEST	443	49728	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:07.636742115 CEST	443	49724	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:07.637273073 CEST	49724	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:07.637284994 CEST	443	49724	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:07.637856007 CEST	49724	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:07.637861013 CEST	443	49724	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:08.739468098 CEST	443	49725	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:08.739474058 CEST	443	49728	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:08.739502907 CEST	443	49727	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:08.739526987 CEST	443	49725	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:08.739526987 CEST	443	49728	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:08.739563942 CEST	443	49727	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:08.739711046 CEST	443	49726	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:08.739753008 CEST	49728	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:08.739753008 CEST	49725	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:08.739753008 CEST	49727	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:08.739856005 CEST	443	49726	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:08.739913940 CEST	49726	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:08.739943027 CEST	49725	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:08.739943027 CEST	49725	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:08.739976883 CEST	443	49725	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:08.740004063 CEST	443	49725	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:08.740070105 CEST	443	49724	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:08.740080118 CEST	49728	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:08.740092039 CEST	443	49728	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:08.740118980 CEST	49728	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:08.740124941 CEST	443	49724	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:08.740133047 CEST	443	49728	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:08.740165949 CEST	49724	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:08.740833998 CEST	49726	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:08.740845919 CEST	443	49726	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:08.740859032 CEST	49726	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:08.740864992 CEST	443	49726	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:08.741339922 CEST	443	49708	173.222.162.64	192.168.2.6
Oct 24, 2024 19:30:08.741348982 CEST	49724	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:08.741354942 CEST	443	49724	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:08.741398096 CEST	49724	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:08.741405010 CEST	443	49724	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:08.741512060 CEST	49708	443	192.168.2.6	173.222.162.64
Oct 24, 2024 19:30:08.741566896 CEST	443	49708	173.222.162.64	192.168.2.6
Oct 24, 2024 19:30:08.741633892 CEST	49708	443	192.168.2.6	173.222.162.64
Oct 24, 2024 19:30:08.742396116 CEST	49727	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:08.742419958 CEST	443	49727	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:08.742499113 CEST	49727	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:08.742511034 CEST	443	49727	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:08.744805098 CEST	49729	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:08.744837046 CEST	443	49729	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:08.744913101 CEST	49729	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:08.744976997 CEST	49730	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:08.745022058 CEST	443	49730	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:08.745081902 CEST	49730	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:08.745620012 CEST	49731	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:08.745631933 CEST	443	49731	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:08.745688915 CEST	49731	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:08.745872974 CEST	49729	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:08.745892048 CEST	443	49729	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:08.745982885 CEST	49730	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:08.746016979 CEST	443	49730	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:08.746058941 CEST	49731	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:08.746078014 CEST	443	49731	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:08.746129036 CEST	49732	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:08.746161938 CEST	443	49732	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:08.746215105 CEST	49732	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:08.746335983 CEST	49732	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:08.746345997 CEST	443	49732	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:08.746900082 CEST	49733	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:08.746927023 CEST	443	49733	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:08.746995926 CEST	49733	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:08.747109890 CEST	49733	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:08.747124910 CEST	443	49733	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:08.881187916 CEST	49714	29155	192.168.2.6	89.105.223.196
Oct 24, 2024 19:30:08.886642933 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:09.134912968 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:09.134934902 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:09.134951115 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:09.134982109 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:09.134996891 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:09.135013103 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:09.135036945 CEST	49714	29155	192.168.2.6	89.105.223.196
Oct 24, 2024 19:30:09.135082006 CEST	49714	29155	192.168.2.6	89.105.223.196
Oct 24, 2024 19:30:09.484442949 CEST	443	49733	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:09.486546993 CEST	443	49732	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:09.492305994 CEST	443	49730	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:09.492525101 CEST	443	49729	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:09.497625113 CEST	49729	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:09.497636080 CEST	443	49729	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:09.498125076 CEST	49729	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:09.498133898 CEST	443	49729	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:09.498425007 CEST	49733	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:09.498444080 CEST	443	49733	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:09.498768091 CEST	49733	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:09.498774052 CEST	443	49733	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:09.499072075 CEST	49732	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:09.499097109 CEST	443	49732	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:09.499425888 CEST	49732	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:09.499432087 CEST	443	49732	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:09.499855042 CEST	49730	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:09.499875069 CEST	443	49730	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:09.500386000 CEST	49730	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:09.500391006 CEST	443	49730	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:09.503635883 CEST	443	49731	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:09.520061016 CEST	49731	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:09.520078897 CEST	443	49731	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:09.520498037 CEST	49731	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:09.520503998 CEST	443	49731	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:09.623019934 CEST	443	49733	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:09.623073101 CEST	443	49733	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:09.623122931 CEST	49733	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:09.624367952 CEST	443	49729	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:09.624419928 CEST	443	49729	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:09.624459028 CEST	49729	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:09.625930071 CEST	443	49732	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:09.626008034 CEST	443	49732	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:09.626048088 CEST	49732	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:09.627403975 CEST	443	49730	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:09.627470970 CEST	443	49730	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:09.627516031 CEST	49730	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:09.651638985 CEST	443	49731	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:09.651717901 CEST	443	49731	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:09.651913881 CEST	49731	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:09.720649004 CEST	49733	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:09.720668077 CEST	443	49733	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:09.720678091 CEST	49733	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:09.720684052 CEST	443	49733	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:09.789830923 CEST	49730	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:09.789905071 CEST	443	49730	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:09.822475910 CEST	49731	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:09.822495937 CEST	443	49731	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:09.822516918 CEST	49731	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:09.822523117 CEST	443	49731	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:09.825532913 CEST	49729	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:09.825540066 CEST	443	49729	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:09.825551987 CEST	49729	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:09.825556993 CEST	443	49729	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:09.827048063 CEST	49732	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:09.827048063 CEST	49732	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:09.827078104 CEST	443	49732	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:09.827091932 CEST	443	49732	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:09.949198008 CEST	49734	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:09.949251890 CEST	443	49734	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:09.949363947 CEST	49734	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:09.963515997 CEST	49734	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:09.963560104 CEST	443	49734	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:09.967433929 CEST	49735	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:09.967474937 CEST	443	49735	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:09.967530012 CEST	49735	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:09.967885017 CEST	49735	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:09.967896938 CEST	443	49735	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:09.971982002 CEST	49736	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:09.972026110 CEST	443	49736	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:09.972105980 CEST	49736	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:09.972598076 CEST	49736	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:09.972615957 CEST	443	49736	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:09.973598957 CEST	49737	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:09.973642111 CEST	443	49737	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:09.973700047 CEST	49737	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:09.973841906 CEST	49737	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:09.973859072 CEST	443	49737	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:09.974648952 CEST	49738	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:09.974673033 CEST	443	49738	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:09.974721909 CEST	49738	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:09.974894047 CEST	49738	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:09.974905968 CEST	443	49738	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:10.028259993 CEST	49714	29155	192.168.2.6	89.105.223.196
Oct 24, 2024 19:30:10.035106897 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:10.276962042 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:10.288045883 CEST	49714	29155	192.168.2.6	89.105.223.196
Oct 24, 2024 19:30:10.293471098 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:10.535404921 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:10.540147066 CEST	49714	29155	192.168.2.6	89.105.223.196
Oct 24, 2024 19:30:10.546346903 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:11.701481104 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:11.701822042 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:11.701956034 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:11.702054024 CEST	49714	29155	192.168.2.6	89.105.223.196
Oct 24, 2024 19:30:11.702054977 CEST	49714	29155	192.168.2.6	89.105.223.196
Oct 24, 2024 19:30:11.702296019 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:11.702351093 CEST	49714	29155	192.168.2.6	89.105.223.196
Oct 24, 2024 19:30:11.703383923 CEST	49714	29155	192.168.2.6	89.105.223.196
Oct 24, 2024 19:30:11.707403898 CEST	443	49736	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:11.708343029 CEST	49736	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:11.708409071 CEST	443	49736	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:11.709027052 CEST	49736	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:11.709042072 CEST	443	49736	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:11.709250927 CEST	443	49734	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:11.709625959 CEST	49734	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:11.709635973 CEST	443	49734	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:11.709875107 CEST	443	49738	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:11.710155964 CEST	49734	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:11.710160971 CEST	443	49734	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:11.710436106 CEST	49738	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:11.710469007 CEST	443	49738	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:11.710932970 CEST	49738	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:11.710943937 CEST	443	49738	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:11.711879015 CEST	443	49737	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:11.712213039 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:11.712250948 CEST	49737	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:11.712266922 CEST	443	49737	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:11.712812901 CEST	49737	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:11.712819099 CEST	443	49737	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:11.838526964 CEST	443	49738	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:11.838609934 CEST	443	49738	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:11.838682890 CEST	49738	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:11.838846922 CEST	443	49734	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:11.838947058 CEST	49738	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:11.838969946 CEST	443	49738	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:11.838982105 CEST	49738	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:11.838992119 CEST	443	49738	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:11.839013100 CEST	443	49734	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:11.839076042 CEST	49734	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:11.839099884 CEST	49734	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:11.839113951 CEST	443	49734	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:11.839126110 CEST	49734	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:11.839131117 CEST	443	49734	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:11.840153933 CEST	443	49736	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:11.840384007 CEST	443	49736	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:11.840434074 CEST	49736	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:11.840559959 CEST	49736	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:11.840568066 CEST	443	49736	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:11.840579987 CEST	49736	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:11.840584040 CEST	443	49736	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:11.842447996 CEST	49740	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:11.842498064 CEST	443	49740	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:11.842534065 CEST	49741	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:11.842556953 CEST	443	49741	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:11.842571020 CEST	49740	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:11.842602968 CEST	49741	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:11.842750072 CEST	49740	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:11.842762947 CEST	443	49740	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:11.842829943 CEST	49741	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:11.842844963 CEST	443	49741	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:11.843642950 CEST	49742	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:11.843658924 CEST	443	49742	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:11.843729973 CEST	49742	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:11.843835115 CEST	49742	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:11.843848944 CEST	443	49742	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:11.846160889 CEST	443	49737	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:11.846679926 CEST	443	49737	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:11.846771955 CEST	49737	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:11.846771955 CEST	49737	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:11.846796989 CEST	49737	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:11.846812010 CEST	443	49737	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:11.848946095 CEST	49743	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:11.848975897 CEST	443	49743	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:11.849039078 CEST	49743	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:11.849143028 CEST	49743	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:11.849154949 CEST	443	49743	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:11.855191946 CEST	443	49735	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:11.855539083 CEST	49735	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:11.855573893 CEST	443	49735	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:11.856007099 CEST	49735	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:11.856014967 CEST	443	49735	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:11.954058886 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:11.957567930 CEST	49714	29155	192.168.2.6	89.105.223.196
Oct 24, 2024 19:30:11.963069916 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:11.983602047 CEST	443	49735	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:11.983752966 CEST	443	49735	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:11.983872890 CEST	49735	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:11.983987093 CEST	49735	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:11.984014988 CEST	443	49735	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:11.984029055 CEST	49735	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:11.984036922 CEST	443	49735	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:11.987282991 CEST	49744	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:11.987329960 CEST	443	49744	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:11.987431049 CEST	49744	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:11.987560034 CEST	49744	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:11.987580061 CEST	443	49744	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:12.204751968 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:12.206039906 CEST	49714	29155	192.168.2.6	89.105.223.196
Oct 24, 2024 19:30:12.211409092 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:12.452248096 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:12.501176119 CEST	49714	29155	192.168.2.6	89.105.223.196
Oct 24, 2024 19:30:12.567204952 CEST	443	49741	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:12.570892096 CEST	443	49740	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:12.579277039 CEST	443	49742	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:12.601224899 CEST	443	49743	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:12.610651970 CEST	49740	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:12.610663891 CEST	49741	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:12.633945942 CEST	49742	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:12.641818047 CEST	49743	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:12.738976955 CEST	443	49744	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:12.781519890 CEST	49744	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:12.791615009 CEST	49744	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:12.791629076 CEST	443	49744	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:12.792823076 CEST	49744	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:12.792829037 CEST	443	49744	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:12.793365002 CEST	49743	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:12.793384075 CEST	443	49743	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:12.794315100 CEST	49743	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:12.794325113 CEST	443	49743	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:12.794832945 CEST	49741	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:12.794845104 CEST	443	49741	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:12.795537949 CEST	49741	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:12.795543909 CEST	443	49741	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:12.796551943 CEST	49740	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:12.796576023 CEST	443	49740	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:12.797429085 CEST	49740	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:12.797435045 CEST	443	49740	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:12.798356056 CEST	49742	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:12.798367023 CEST	443	49742	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:12.799002886 CEST	49742	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:12.799006939 CEST	443	49742	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:12.920887947 CEST	443	49741	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:12.920942068 CEST	443	49744	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:12.921077013 CEST	443	49744	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:12.921096087 CEST	443	49741	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:12.921122074 CEST	49744	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:12.921147108 CEST	49741	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:12.921768904 CEST	49741	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:12.921787977 CEST	443	49741	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:12.924025059 CEST	443	49740	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:12.924088001 CEST	443	49743	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:12.924093962 CEST	49744	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:12.924118042 CEST	443	49744	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:12.924132109 CEST	49744	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:12.924140930 CEST	443	49744	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:12.924217939 CEST	443	49740	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:12.924264908 CEST	49740	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:12.924268961 CEST	443	49743	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:12.924315929 CEST	49743	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:12.924436092 CEST	49743	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:12.924453020 CEST	443	49743	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:12.924468994 CEST	49743	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:12.924477100 CEST	443	49743	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:12.927042007 CEST	49740	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:12.927061081 CEST	443	49740	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:12.927072048 CEST	49740	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:12.927077055 CEST	443	49740	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:12.928699970 CEST	443	49742	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:12.928774118 CEST	443	49742	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:12.928812027 CEST	49742	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:12.932524920 CEST	49745	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:12.932562113 CEST	443	49745	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:12.932616949 CEST	49745	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:12.933269978 CEST	49746	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:12.933300018 CEST	443	49746	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:12.933341980 CEST	49746	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:12.933538914 CEST	49742	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:12.933552980 CEST	443	49742	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:12.933562994 CEST	49742	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:12.933567047 CEST	443	49742	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:12.935736895 CEST	49747	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:12.935753107 CEST	443	49747	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:12.935806036 CEST	49747	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:12.935978889 CEST	49747	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:12.935990095 CEST	443	49747	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:12.938705921 CEST	49748	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:12.938745975 CEST	443	49748	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:12.938797951 CEST	49748	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:12.938864946 CEST	49745	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:12.938878059 CEST	443	49745	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:12.938940048 CEST	49748	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:12.938956022 CEST	443	49748	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:12.939207077 CEST	49746	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:12.939225912 CEST	443	49746	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:12.941271067 CEST	49749	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:12.941294909 CEST	443	49749	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:12.941342115 CEST	49749	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:12.941760063 CEST	49749	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:12.941770077 CEST	443	49749	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:13.071208000 CEST	49714	29155	192.168.2.6	89.105.223.196
Oct 24, 2024 19:30:13.080307961 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:13.327323914 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:13.376171112 CEST	49714	29155	192.168.2.6	89.105.223.196
Oct 24, 2024 19:30:13.448334932 CEST	49714	29155	192.168.2.6	89.105.223.196
Oct 24, 2024 19:30:13.453730106 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:13.673594952 CEST	443	49747	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:13.674375057 CEST	49747	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:13.674416065 CEST	443	49747	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:13.674911022 CEST	49747	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:13.674916983 CEST	443	49747	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:13.686604977 CEST	443	49745	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:13.687222004 CEST	49745	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:13.687242985 CEST	443	49745	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:13.687835932 CEST	49745	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:13.687844038 CEST	443	49745	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:13.694482088 CEST	443	49749	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:13.696027994 CEST	443	49748	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:13.696444988 CEST	443	49746	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:13.700536966 CEST	49749	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:13.700612068 CEST	443	49749	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:13.701200008 CEST	49748	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:13.701241016 CEST	443	49748	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:13.701267958 CEST	49749	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:13.701287985 CEST	443	49749	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:13.701497078 CEST	49746	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:13.701525927 CEST	443	49746	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:13.701625109 CEST	49748	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:13.701633930 CEST	443	49748	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:13.701848030 CEST	49746	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:13.701853037 CEST	443	49746	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:13.716561079 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:13.722053051 CEST	49714	29155	192.168.2.6	89.105.223.196
Oct 24, 2024 19:30:13.727556944 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:13.812024117 CEST	443	49747	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:13.812356949 CEST	443	49747	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:13.812422991 CEST	49747	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:13.812458992 CEST	49747	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:13.812477112 CEST	443	49747	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:13.812493086 CEST	49747	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:13.812500954 CEST	443	49747	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:13.817154884 CEST	49750	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:13.817195892 CEST	443	49750	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:13.817261934 CEST	49750	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:13.817490101 CEST	49750	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:13.817502022 CEST	443	49750	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:13.823653936 CEST	443	49745	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:13.824042082 CEST	443	49745	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:13.824112892 CEST	49745	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:13.824160099 CEST	49745	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:13.824177027 CEST	443	49745	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:13.824192047 CEST	49745	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:13.824197054 CEST	443	49745	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:13.827416897 CEST	49751	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:13.827505112 CEST	443	49751	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:13.827588081 CEST	49751	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:13.827735901 CEST	49751	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:13.827766895 CEST	443	49751	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:13.829960108 CEST	443	49748	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:13.830132008 CEST	443	49749	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:13.830185890 CEST	443	49749	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:13.830236912 CEST	49749	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:13.830312014 CEST	49749	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:13.830312014 CEST	49749	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:13.830338955 CEST	443	49749	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:13.830360889 CEST	443	49749	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:13.830377102 CEST	443	49748	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:13.830426931 CEST	49748	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:13.830449104 CEST	49748	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:13.830460072 CEST	443	49748	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:13.830471039 CEST	49748	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:13.830476999 CEST	443	49748	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:13.831775904 CEST	443	49746	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:13.831852913 CEST	443	49746	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:13.831898928 CEST	49746	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:13.832591057 CEST	49746	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:13.832607985 CEST	443	49746	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:13.832618952 CEST	49746	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:13.832623959 CEST	443	49746	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:13.832994938 CEST	49752	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:13.833020926 CEST	443	49752	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:13.833070040 CEST	49752	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:13.833405018 CEST	49752	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:13.833415985 CEST	443	49752	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:13.834841967 CEST	49753	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:13.834867954 CEST	443	49753	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:13.834929943 CEST	49753	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:13.835064888 CEST	49753	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:13.835082054 CEST	443	49753	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:13.835114002 CEST	49754	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:13.835134029 CEST	443	49754	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:13.835177898 CEST	49754	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:13.835309029 CEST	49754	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:13.835325003 CEST	443	49754	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:13.973449945 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.014210939 CEST	49714	29155	192.168.2.6	89.105.223.196
Oct 24, 2024 19:30:14.101787090 CEST	49714	29155	192.168.2.6	89.105.223.196
Oct 24, 2024 19:30:14.108855963 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.108918905 CEST	49714	29155	192.168.2.6	89.105.223.196
Oct 24, 2024 19:30:14.108947039 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.108958960 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.108969927 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.108980894 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.108990908 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.108990908 CEST	49714	29155	192.168.2.6	89.105.223.196
Oct 24, 2024 19:30:14.109009981 CEST	49714	29155	192.168.2.6	89.105.223.196
Oct 24, 2024 19:30:14.109077930 CEST	49714	29155	192.168.2.6	89.105.223.196
Oct 24, 2024 19:30:14.109128952 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.109139919 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.109149933 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.109159946 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.109169006 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.109179020 CEST	49714	29155	192.168.2.6	89.105.223.196
Oct 24, 2024 19:30:14.109200954 CEST	49714	29155	192.168.2.6	89.105.223.196
Oct 24, 2024 19:30:14.109258890 CEST	49714	29155	192.168.2.6	89.105.223.196
Oct 24, 2024 19:30:14.109271049 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.109330893 CEST	49714	29155	192.168.2.6	89.105.223.196
Oct 24, 2024 19:30:14.114347935 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.114424944 CEST	49714	29155	192.168.2.6	89.105.223.196
Oct 24, 2024 19:30:14.114448071 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.114459038 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.114475965 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.114487886 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.114500999 CEST	49714	29155	192.168.2.6	89.105.223.196
Oct 24, 2024 19:30:14.114542961 CEST	49714	29155	192.168.2.6	89.105.223.196
Oct 24, 2024 19:30:14.114563942 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.114574909 CEST	49714	29155	192.168.2.6	89.105.223.196
Oct 24, 2024 19:30:14.114636898 CEST	49714	29155	192.168.2.6	89.105.223.196
Oct 24, 2024 19:30:14.114721060 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.114783049 CEST	49714	29155	192.168.2.6	89.105.223.196
Oct 24, 2024 19:30:14.114809036 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.114820957 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.114865065 CEST	49714	29155	192.168.2.6	89.105.223.196
Oct 24, 2024 19:30:14.114908934 CEST	49714	29155	192.168.2.6	89.105.223.196
Oct 24, 2024 19:30:14.115159988 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.115276098 CEST	49714	29155	192.168.2.6	89.105.223.196
Oct 24, 2024 19:30:14.121073961 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.121140957 CEST	49714	29155	192.168.2.6	89.105.223.196
Oct 24, 2024 19:30:14.121797085 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.121840000 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.121850967 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.121939898 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.121951103 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.121959925 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.121962070 CEST	49714	29155	192.168.2.6	89.105.223.196
Oct 24, 2024 19:30:14.121969938 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.122061968 CEST	49714	29155	192.168.2.6	89.105.223.196
Oct 24, 2024 19:30:14.122853041 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.122868061 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.122889042 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.122899055 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.122903109 CEST	49714	29155	192.168.2.6	89.105.223.196
Oct 24, 2024 19:30:14.122917891 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.122930050 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.122939110 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.122948885 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.122948885 CEST	49714	29155	192.168.2.6	89.105.223.196
Oct 24, 2024 19:30:14.122961998 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.122972012 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.122981071 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.122992992 CEST	49714	29155	192.168.2.6	89.105.223.196
Oct 24, 2024 19:30:14.122993946 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.123004913 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.123016119 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.123022079 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.123032093 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.123042107 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.123049021 CEST	49714	29155	192.168.2.6	89.105.223.196
Oct 24, 2024 19:30:14.123051882 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.123063087 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.123074055 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.123114109 CEST	49714	29155	192.168.2.6	89.105.223.196
Oct 24, 2024 19:30:14.123127937 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.123166084 CEST	49714	29155	192.168.2.6	89.105.223.196
Oct 24, 2024 19:30:14.123210907 CEST	49714	29155	192.168.2.6	89.105.223.196
Oct 24, 2024 19:30:14.126734972 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.126828909 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.126837969 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.126847982 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.127425909 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.127477884 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.127526999 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.127537012 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.127655029 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.127693892 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.127747059 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.127779961 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.127798080 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.127902031 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.127913952 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.127952099 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.127962112 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.127971888 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.128206015 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.128216028 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.128226042 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.128236055 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.128245115 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.128254890 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.128264904 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.128274918 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.128284931 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.128309011 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.128318071 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.128329039 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.128343105 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.128353119 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.128362894 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.128374100 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.128391027 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.128400087 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.128403902 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.128442049 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.128446102 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.128449917 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.128513098 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.128571987 CEST	49714	29155	192.168.2.6	89.105.223.196
Oct 24, 2024 19:30:14.128592014 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.128637075 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.128715038 CEST	49714	29155	192.168.2.6	89.105.223.196
Oct 24, 2024 19:30:14.128726959 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.128880024 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.128890038 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.128914118 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.129031897 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.129439116 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.129448891 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.129457951 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.129467964 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.129482985 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.129491091 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.129498005 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.129504919 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.129507065 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.129514933 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.129520893 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.129523039 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.129528046 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.129530907 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.129535913 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.129543066 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.129544020 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.129544973 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.129550934 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.129553080 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.129554033 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.129554987 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.129560947 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.129573107 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.129580975 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.129586935 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.129622936 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.129708052 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.129724026 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.129769087 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.130352020 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.130644083 CEST	49714	29155	192.168.2.6	89.105.223.196
Oct 24, 2024 19:30:14.130796909 CEST	49714	29155	192.168.2.6	89.105.223.196
Oct 24, 2024 19:30:14.134396076 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.134409904 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.134422064 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.134433985 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.134772062 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.134783030 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.134844065 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.134852886 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.134880066 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.134938955 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.135042906 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.135137081 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.135147095 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.135356903 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.135396957 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.135406017 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.135415077 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.135426044 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.135577917 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.135587931 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.135718107 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.135726929 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.135734081 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.136279106 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.136296034 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.136298895 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.136306047 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.136312008 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.136313915 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.136316061 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.136321068 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.136327982 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.136328936 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.136329889 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.136337042 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.136342049 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.136343956 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.136344910 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.136346102 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.136352062 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.136358023 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.136363983 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.136370897 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.136372089 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.136373997 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.136379957 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.136385918 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.136388063 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.136389017 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.136389971 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.136394978 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.136400938 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.136401892 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.136564970 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.136574984 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.136584044 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.136620045 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.136626005 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.136635065 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.136785030 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.136799097 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.136807919 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.136816978 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.136873960 CEST	49714	29155	192.168.2.6	89.105.223.196
Oct 24, 2024 19:30:14.136949062 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.137001991 CEST	49714	29155	192.168.2.6	89.105.223.196
Oct 24, 2024 19:30:14.137002945 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.137012959 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.137022972 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.137058020 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.137068033 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.137125015 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.137171030 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.137181044 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.137229919 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.137332916 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.137357950 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.137425900 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.137434959 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.137444973 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.137454033 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.137464046 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.137474060 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.137568951 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.137578011 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.137588978 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.137598991 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.137607098 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.137650013 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.137660980 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.137682915 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.137691975 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.137701035 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.137710094 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.137725115 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.137866974 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.137876987 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.137885094 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.137942076 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.137953043 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.137962103 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.137970924 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.138020992 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.138031006 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.138040066 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.138115883 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.138204098 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.138231039 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.138299942 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.142854929 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.142868042 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.142879009 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.142889023 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.142900944 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.143047094 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.143160105 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.143225908 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.143234968 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.143290997 CEST	49714	29155	192.168.2.6	89.105.223.196
Oct 24, 2024 19:30:14.143327951 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.143347025 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.143388987 CEST	49714	29155	192.168.2.6	89.105.223.196
Oct 24, 2024 19:30:14.186678886 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.187022924 CEST	49714	29155	192.168.2.6	89.105.223.196
Oct 24, 2024 19:30:14.187169075 CEST	49714	29155	192.168.2.6	89.105.223.196
Oct 24, 2024 19:30:14.187169075 CEST	49714	29155	192.168.2.6	89.105.223.196
Oct 24, 2024 19:30:14.187227011 CEST	49714	29155	192.168.2.6	89.105.223.196
Oct 24, 2024 19:30:14.234685898 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.235152960 CEST	49714	29155	192.168.2.6	89.105.223.196
Oct 24, 2024 19:30:14.235367060 CEST	49714	29155	192.168.2.6	89.105.223.196
Oct 24, 2024 19:30:14.235367060 CEST	49714	29155	192.168.2.6	89.105.223.196
Oct 24, 2024 19:30:14.235459089 CEST	49714	29155	192.168.2.6	89.105.223.196
Oct 24, 2024 19:30:14.271260023 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.549231052 CEST	443	49750	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:14.549891949 CEST	49750	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:14.549923897 CEST	443	49750	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:14.550388098 CEST	49750	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:14.550394058 CEST	443	49750	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:14.558768988 CEST	443	49751	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:14.559043884 CEST	49751	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:14.559086084 CEST	443	49753	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:14.559103012 CEST	443	49751	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:14.559371948 CEST	49753	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:14.559379101 CEST	49751	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:14.559400082 CEST	443	49751	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:14.559408903 CEST	443	49753	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:14.559897900 CEST	49753	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:14.559911966 CEST	443	49753	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:14.581481934 CEST	443	49754	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:14.581877947 CEST	49754	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:14.581902981 CEST	443	49754	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:14.582264900 CEST	49754	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:14.582271099 CEST	443	49754	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:14.678440094 CEST	443	49750	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:14.678606987 CEST	443	49750	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:14.678664923 CEST	49750	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:14.678822994 CEST	49750	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:14.678844929 CEST	49750	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:14.678848982 CEST	443	49750	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:14.678864956 CEST	443	49750	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:14.681605101 CEST	49755	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:14.681642056 CEST	443	49755	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:14.681724072 CEST	49755	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:14.681859016 CEST	49755	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:14.681875944 CEST	443	49755	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:14.686652899 CEST	443	49753	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:14.686891079 CEST	443	49753	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:14.686948061 CEST	49753	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:14.687020063 CEST	49753	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:14.687037945 CEST	443	49753	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:14.687050104 CEST	49753	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:14.687056065 CEST	443	49753	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:14.689135075 CEST	49756	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:14.689172983 CEST	443	49756	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:14.689258099 CEST	49756	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:14.689373970 CEST	49756	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:14.689383984 CEST	443	49756	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:14.689727068 CEST	443	49751	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:14.689872980 CEST	443	49751	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:14.690197945 CEST	49751	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:14.690198898 CEST	49751	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:14.690198898 CEST	49751	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:14.691992044 CEST	49757	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:14.692025900 CEST	443	49757	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:14.692090034 CEST	49757	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:14.692198992 CEST	49757	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:14.692212105 CEST	443	49757	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:14.714500904 CEST	443	49754	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:14.714654922 CEST	443	49754	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:14.714711905 CEST	49754	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:14.714905977 CEST	49754	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:14.714920998 CEST	443	49754	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:14.714935064 CEST	49754	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:14.714940071 CEST	443	49754	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:14.717452049 CEST	49758	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:14.717492104 CEST	443	49758	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:14.717590094 CEST	49758	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:14.717721939 CEST	49758	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:14.717736959 CEST	443	49758	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:14.923048019 CEST	49751	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:14.923080921 CEST	443	49751	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:14.978173018 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.988305092 CEST	49714	29155	192.168.2.6	89.105.223.196
Oct 24, 2024 19:30:14.993905067 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.994036913 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.994048119 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.994082928 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.994111061 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:14.994121075 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:15.235594034 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:15.239871025 CEST	49714	29155	192.168.2.6	89.105.223.196
Oct 24, 2024 19:30:15.245345116 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:15.430155039 CEST	443	49756	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:15.430788994 CEST	49756	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:15.430823088 CEST	443	49756	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:15.431328058 CEST	49756	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:15.431334019 CEST	443	49756	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:15.433145046 CEST	443	49755	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:15.433624983 CEST	49755	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:15.433660984 CEST	443	49755	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:15.434012890 CEST	49755	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:15.434020042 CEST	443	49755	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:15.447120905 CEST	443	49757	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:15.447591066 CEST	49757	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:15.447604895 CEST	443	49757	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:15.448060989 CEST	49757	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:15.448065996 CEST	443	49757	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:15.449820042 CEST	443	49758	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:15.450149059 CEST	49758	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:15.450170040 CEST	443	49758	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:15.450568914 CEST	49758	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:15.450577974 CEST	443	49758	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:15.487957954 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:15.532445908 CEST	49714	29155	192.168.2.6	89.105.223.196
Oct 24, 2024 19:30:15.540127039 CEST	443	49752	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:15.540674925 CEST	49752	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:15.540709972 CEST	443	49752	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:15.541409969 CEST	49752	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:15.541418076 CEST	443	49752	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:15.562391043 CEST	443	49756	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:15.562551975 CEST	443	49756	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:15.562627077 CEST	49756	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:15.562856913 CEST	49756	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:15.562880993 CEST	443	49756	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:15.562896013 CEST	49756	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:15.562903881 CEST	443	49756	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:15.566184044 CEST	49760	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:15.566222906 CEST	443	49760	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:15.566221952 CEST	443	49755	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:15.566322088 CEST	49760	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:15.566327095 CEST	443	49755	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:15.566385984 CEST	49755	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:15.566505909 CEST	49755	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:15.566518068 CEST	49760	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:15.566524029 CEST	443	49755	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:15.566534042 CEST	443	49760	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:15.566559076 CEST	49755	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:15.566565990 CEST	443	49755	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:15.568579912 CEST	49761	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:15.568631887 CEST	443	49761	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:15.568703890 CEST	49761	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:15.568804026 CEST	49761	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:15.568820953 CEST	443	49761	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:15.583272934 CEST	443	49758	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:15.583422899 CEST	443	49758	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:15.583498001 CEST	49758	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:15.583587885 CEST	49758	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:15.583601952 CEST	443	49758	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:15.583614111 CEST	49758	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:15.583620071 CEST	443	49758	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:15.585879087 CEST	49762	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:15.585915089 CEST	443	49762	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:15.585990906 CEST	49762	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:15.586131096 CEST	49762	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:15.586146116 CEST	443	49762	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:15.588104963 CEST	443	49757	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:15.588191986 CEST	443	49757	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:15.588267088 CEST	49757	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:15.588329077 CEST	49757	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:15.588329077 CEST	49757	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:15.588339090 CEST	443	49757	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:15.588351011 CEST	443	49757	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:15.590329885 CEST	49763	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:15.590377092 CEST	443	49763	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:15.590446949 CEST	49763	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:15.590585947 CEST	49763	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:15.590607882 CEST	443	49763	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:15.689542055 CEST	443	49752	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:15.689641953 CEST	443	49752	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:15.689743042 CEST	49752	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:15.690505028 CEST	49752	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:15.690505028 CEST	49752	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:15.690535069 CEST	443	49752	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:15.690550089 CEST	443	49752	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:15.693456888 CEST	49764	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:15.693504095 CEST	443	49764	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:15.693578959 CEST	49764	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:15.693775892 CEST	49764	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:15.693790913 CEST	443	49764	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:16.023215055 CEST	49714	29155	192.168.2.6	89.105.223.196
Oct 24, 2024 19:30:16.028980017 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:16.270422935 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:16.274229050 CEST	49714	29155	192.168.2.6	89.105.223.196
Oct 24, 2024 19:30:16.280396938 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:16.308284998 CEST	443	49760	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:16.308971882 CEST	49760	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:16.308990955 CEST	443	49760	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:16.309499979 CEST	49760	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:16.309506893 CEST	443	49760	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:16.311063051 CEST	443	49761	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:16.311465025 CEST	49761	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:16.311496973 CEST	443	49761	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:16.311857939 CEST	49761	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:16.311863899 CEST	443	49761	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:16.349212885 CEST	443	49763	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:16.349576950 CEST	49763	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:16.349589109 CEST	443	49763	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:16.350338936 CEST	49763	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:16.350344896 CEST	443	49763	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:16.354973078 CEST	443	49762	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:16.355295897 CEST	49762	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:16.355310917 CEST	443	49762	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:16.355871916 CEST	49762	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:16.355890036 CEST	443	49762	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:16.439356089 CEST	443	49760	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:16.439429045 CEST	443	49760	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:16.439604044 CEST	49760	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:16.440017939 CEST	49760	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:16.440017939 CEST	49760	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:16.440041065 CEST	443	49760	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:16.440052986 CEST	443	49760	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:16.444297075 CEST	443	49764	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:16.445801973 CEST	443	49761	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:16.445988894 CEST	443	49761	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:16.447972059 CEST	49761	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:16.458425045 CEST	49761	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:16.458447933 CEST	443	49761	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:16.458462954 CEST	49761	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:16.458470106 CEST	443	49761	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:16.458872080 CEST	49765	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:16.458908081 CEST	443	49765	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:16.459041119 CEST	49765	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:16.459497929 CEST	49764	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:16.459521055 CEST	443	49764	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:16.460110903 CEST	49764	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:16.460114956 CEST	443	49764	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:16.461236954 CEST	49765	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:16.461247921 CEST	443	49765	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:16.462860107 CEST	49766	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:16.462883949 CEST	443	49766	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:16.463090897 CEST	49766	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:16.463288069 CEST	49766	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:16.463296890 CEST	443	49766	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:16.481949091 CEST	443	49763	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:16.482512951 CEST	443	49763	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:16.482566118 CEST	49763	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:16.482597113 CEST	49763	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:16.482603073 CEST	443	49763	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:16.482619047 CEST	49763	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:16.482624054 CEST	443	49763	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:16.485651970 CEST	49767	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:16.485666990 CEST	443	49767	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:16.485783100 CEST	49767	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:16.485980034 CEST	443	49762	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:16.485982895 CEST	49767	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:16.485992908 CEST	443	49767	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:16.486042023 CEST	443	49762	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:16.486196995 CEST	49762	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:16.486196995 CEST	49762	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:16.486742973 CEST	49762	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:16.486753941 CEST	443	49762	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:16.488945007 CEST	49768	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:16.488966942 CEST	443	49768	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:16.489156961 CEST	49768	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:16.489156961 CEST	49768	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:16.489176035 CEST	443	49768	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:16.521810055 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:16.552097082 CEST	49714	29155	192.168.2.6	89.105.223.196
Oct 24, 2024 19:30:16.557612896 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:16.589437962 CEST	443	49764	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:16.589833975 CEST	443	49764	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:16.589916945 CEST	49764	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:16.589963913 CEST	49764	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:16.589984894 CEST	443	49764	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:16.590002060 CEST	49764	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:16.590007067 CEST	443	49764	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:16.593694925 CEST	49769	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:16.593735933 CEST	443	49769	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:16.593813896 CEST	49769	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:16.594013929 CEST	49769	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:16.594033003 CEST	443	49769	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:16.838640928 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:16.842037916 CEST	49714	29155	192.168.2.6	89.105.223.196
Oct 24, 2024 19:30:16.847831964 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:17.094887018 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:17.141819954 CEST	49714	29155	192.168.2.6	89.105.223.196
Oct 24, 2024 19:30:17.199877024 CEST	443	49766	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:17.204988956 CEST	443	49765	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:17.209271908 CEST	49766	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:17.209301949 CEST	443	49766	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:17.210325003 CEST	49766	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:17.210346937 CEST	443	49766	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:17.223263025 CEST	443	49767	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:17.223721027 CEST	49767	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:17.223772049 CEST	443	49767	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:17.224277973 CEST	49767	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:17.224289894 CEST	443	49767	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:17.225003958 CEST	49765	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:17.225018024 CEST	443	49765	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:17.225485086 CEST	49765	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:17.225495100 CEST	443	49765	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:17.254260063 CEST	49714	29155	192.168.2.6	89.105.223.196
Oct 24, 2024 19:30:17.259974003 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:17.336175919 CEST	443	49769	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:17.336716890 CEST	49769	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:17.336733103 CEST	443	49769	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:17.337290049 CEST	49769	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:17.337295055 CEST	443	49769	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:17.337495089 CEST	443	49766	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:17.337738991 CEST	443	49766	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:17.337799072 CEST	49766	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:17.337841034 CEST	49766	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:17.337862968 CEST	443	49766	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:17.337879896 CEST	49766	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:17.337886095 CEST	443	49766	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:17.340924978 CEST	49770	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:17.340961933 CEST	443	49770	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:17.341223001 CEST	49770	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:17.341411114 CEST	49770	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:17.341422081 CEST	443	49770	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:17.356126070 CEST	443	49767	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:17.356205940 CEST	443	49767	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:17.356312037 CEST	49767	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:17.356424093 CEST	49767	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:17.356472015 CEST	443	49767	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:17.356503963 CEST	49767	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:17.356520891 CEST	443	49767	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:17.357213020 CEST	443	49765	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:17.357743025 CEST	443	49765	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:17.357821941 CEST	49765	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:17.357850075 CEST	49765	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:17.357866049 CEST	443	49765	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:17.357888937 CEST	49765	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:17.357898951 CEST	443	49765	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:17.360078096 CEST	49771	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:17.360111952 CEST	443	49771	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:17.360160112 CEST	49772	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:17.360172033 CEST	49771	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:17.360198975 CEST	443	49772	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:17.360289097 CEST	49772	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:17.360320091 CEST	49771	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:17.360333920 CEST	443	49771	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:17.360459089 CEST	49772	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:17.360474110 CEST	443	49772	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:17.457717896 CEST	443	49768	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:17.459290981 CEST	49768	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:17.459311008 CEST	443	49768	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:17.461045027 CEST	49768	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:17.461051941 CEST	443	49768	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:17.468267918 CEST	443	49769	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:17.468369961 CEST	443	49769	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:17.468429089 CEST	49769	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:17.468739986 CEST	49769	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:17.468764067 CEST	443	49769	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:17.468777895 CEST	49769	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:17.468785048 CEST	443	49769	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:17.473455906 CEST	49773	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:17.473512888 CEST	443	49773	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:17.473656893 CEST	49773	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:17.474556923 CEST	49773	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:17.474570990 CEST	443	49773	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:17.502765894 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:17.548053026 CEST	49714	29155	192.168.2.6	89.105.223.196
Oct 24, 2024 19:30:17.571260929 CEST	49714	29155	192.168.2.6	89.105.223.196
Oct 24, 2024 19:30:17.576927900 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:17.576970100 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:17.577006102 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:17.577153921 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:17.577164888 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:17.577187061 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:17.577195883 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:17.577203989 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:17.577212095 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:17.577222109 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:17.577431917 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:17.577444077 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:17.577454090 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:17.577462912 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:17.589962006 CEST	443	49768	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:17.590362072 CEST	443	49768	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:17.590464115 CEST	49768	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:17.590464115 CEST	49768	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:17.590523005 CEST	49768	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:17.590543985 CEST	443	49768	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:17.593236923 CEST	49775	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:17.593274117 CEST	443	49775	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:17.593398094 CEST	49775	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:17.593554020 CEST	49775	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:17.593568087 CEST	443	49775	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:17.822014093 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:17.822876930 CEST	49714	29155	192.168.2.6	89.105.223.196
Oct 24, 2024 19:30:17.828479052 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:18.071105003 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:18.072046995 CEST	49714	29155	192.168.2.6	89.105.223.196
Oct 24, 2024 19:30:18.077567101 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:18.081039906 CEST	443	49770	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:18.081809044 CEST	49770	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:18.081823111 CEST	443	49770	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:18.082351923 CEST	49770	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:18.082364082 CEST	443	49770	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:18.099185944 CEST	443	49772	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:18.099869013 CEST	49772	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:18.099889994 CEST	443	49772	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:18.100445986 CEST	49772	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:18.100454092 CEST	443	49772	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:18.102199078 CEST	443	49771	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:18.102637053 CEST	49771	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:18.102653027 CEST	443	49771	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:18.103091002 CEST	49771	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:18.103096962 CEST	443	49771	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:18.211827993 CEST	443	49770	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:18.211939096 CEST	443	49770	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:18.211988926 CEST	49770	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:18.228519917 CEST	443	49773	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:18.229062080 CEST	49770	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:18.229101896 CEST	443	49770	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:18.229271889 CEST	443	49772	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:18.229523897 CEST	443	49772	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:18.229578972 CEST	49772	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:18.229603052 CEST	49770	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:18.229612112 CEST	443	49770	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:18.230473995 CEST	49772	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:18.230496883 CEST	443	49772	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:18.230514050 CEST	49772	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:18.230520010 CEST	443	49772	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:18.231220007 CEST	443	49771	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:18.231457949 CEST	443	49771	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:18.231512070 CEST	49771	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:18.231563091 CEST	49771	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:18.231585979 CEST	443	49771	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:18.231601954 CEST	49771	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:18.231611013 CEST	443	49771	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:18.232904911 CEST	49773	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:18.232927084 CEST	443	49773	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:18.233390093 CEST	49773	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:18.233396053 CEST	443	49773	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:18.235810041 CEST	49776	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:18.235837936 CEST	443	49776	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:18.235944986 CEST	49776	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:18.236099958 CEST	49776	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:18.236113071 CEST	443	49776	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:18.237863064 CEST	49778	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:18.237874031 CEST	443	49778	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:18.238147020 CEST	49777	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:18.238174915 CEST	443	49777	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:18.238183975 CEST	49778	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:18.238375902 CEST	49778	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:18.238387108 CEST	443	49778	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:18.238425970 CEST	49777	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:18.238526106 CEST	49777	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:18.238532066 CEST	443	49777	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:18.321646929 CEST	29155	49714	89.105.223.196	192.168.2.6
Oct 24, 2024 19:30:18.352294922 CEST	443	49775	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:18.353668928 CEST	49775	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:18.353691101 CEST	443	49775	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:18.354295969 CEST	49775	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:18.354302883 CEST	443	49775	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:18.365169048 CEST	49714	29155	192.168.2.6	89.105.223.196
Oct 24, 2024 19:30:18.366918087 CEST	443	49773	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:18.367022991 CEST	443	49773	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:18.367095947 CEST	49773	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:18.367386103 CEST	49773	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:18.367405891 CEST	443	49773	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:18.367422104 CEST	49773	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:18.367429018 CEST	443	49773	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:18.372760057 CEST	49779	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:18.372807026 CEST	443	49779	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:18.372936964 CEST	49779	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:18.373420000 CEST	49779	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:18.373431921 CEST	443	49779	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:18.487693071 CEST	443	49775	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:18.487986088 CEST	443	49775	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:18.488075018 CEST	49775	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:18.502233028 CEST	49775	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:18.502259016 CEST	443	49775	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:18.502276897 CEST	49775	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:18.502285004 CEST	443	49775	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:18.507473946 CEST	49780	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:18.507503986 CEST	443	49780	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:18.507569075 CEST	49780	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:18.508229971 CEST	49780	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:18.508248091 CEST	443	49780	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:18.982095957 CEST	443	49778	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:18.982764959 CEST	49778	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:18.982793093 CEST	443	49778	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:18.983344078 CEST	49778	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:18.983359098 CEST	443	49778	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:18.988665104 CEST	443	49776	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:18.989231110 CEST	49776	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:18.989269972 CEST	443	49776	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:18.989593029 CEST	443	49777	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:18.989876986 CEST	49776	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:18.989890099 CEST	443	49776	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:18.990427017 CEST	49777	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:18.990447044 CEST	443	49777	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:18.990783930 CEST	49777	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:18.990788937 CEST	443	49777	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:19.106039047 CEST	443	49779	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:19.106951952 CEST	49779	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:19.106976032 CEST	443	49779	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:19.107610941 CEST	49779	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:19.107619047 CEST	443	49779	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:19.112315893 CEST	443	49778	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:19.112795115 CEST	443	49778	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:19.112848043 CEST	49778	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:19.112905025 CEST	49778	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:19.112922907 CEST	443	49778	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:19.112940073 CEST	49778	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:19.112946033 CEST	443	49778	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:19.116349936 CEST	49781	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:19.116404057 CEST	443	49781	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:19.116478920 CEST	49781	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:19.116660118 CEST	49781	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:19.116674900 CEST	443	49781	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:19.133975029 CEST	443	49776	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:19.134090900 CEST	443	49776	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:19.134247065 CEST	49776	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:19.134289026 CEST	49776	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:19.134289026 CEST	49776	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:19.134310961 CEST	443	49776	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:19.134325027 CEST	443	49776	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:19.140588045 CEST	49782	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:19.140625000 CEST	443	49782	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:19.140701056 CEST	49782	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:19.140876055 CEST	49782	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:19.140889883 CEST	443	49782	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:19.240139008 CEST	443	49780	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:19.240722895 CEST	49780	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:19.240761042 CEST	443	49780	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:19.241235018 CEST	49780	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:19.241249084 CEST	443	49780	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:19.291322947 CEST	443	49777	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:19.291461945 CEST	443	49777	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:19.292110920 CEST	49777	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:19.292110920 CEST	49777	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:19.292407036 CEST	49777	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:19.292423010 CEST	443	49777	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:19.296437979 CEST	49783	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:19.296473026 CEST	443	49783	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:19.296724081 CEST	49783	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:19.296724081 CEST	49783	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:19.296751022 CEST	443	49783	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:19.373270988 CEST	443	49780	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:19.373362064 CEST	443	49780	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:19.373459101 CEST	49780	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:19.373656988 CEST	49780	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:19.373673916 CEST	443	49780	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:19.373704910 CEST	49780	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:19.373712063 CEST	443	49780	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:19.376801968 CEST	49784	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:19.376844883 CEST	443	49784	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:19.377295971 CEST	49784	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:19.377444983 CEST	49784	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:19.377482891 CEST	443	49784	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:19.401607990 CEST	443	49779	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:19.401761055 CEST	443	49779	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:19.402050972 CEST	49779	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:19.402050972 CEST	49779	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:19.402050972 CEST	49779	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:19.404761076 CEST	49785	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:19.404812098 CEST	443	49785	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:19.405026913 CEST	49785	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:19.405236959 CEST	49785	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:19.405255079 CEST	443	49785	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:19.704518080 CEST	49779	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:19.704535961 CEST	443	49779	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:19.847990990 CEST	443	49781	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:19.849261999 CEST	49781	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:19.849288940 CEST	443	49781	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:19.850526094 CEST	49781	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:19.850532055 CEST	443	49781	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:19.878757954 CEST	443	49782	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:19.880109072 CEST	49782	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:19.880110025 CEST	49782	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:19.880136967 CEST	443	49782	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:19.880157948 CEST	443	49782	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:19.981887102 CEST	443	49781	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:19.981971025 CEST	443	49781	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:19.982881069 CEST	49781	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:19.983083010 CEST	49781	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:19.983083010 CEST	49781	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:19.983099937 CEST	443	49781	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:19.983108997 CEST	443	49781	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:19.986484051 CEST	49786	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:19.986537933 CEST	443	49786	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:19.987523079 CEST	49786	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:19.987706900 CEST	49786	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:19.987726927 CEST	443	49786	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:20.012733936 CEST	443	49782	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:20.012790918 CEST	443	49782	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:20.014967918 CEST	49782	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:20.014967918 CEST	49782	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:20.015011072 CEST	49782	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:20.015028000 CEST	443	49782	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:20.018893957 CEST	49787	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:20.018922091 CEST	443	49787	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:20.019033909 CEST	49787	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:20.019470930 CEST	49787	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:20.019480944 CEST	443	49787	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:20.044578075 CEST	443	49783	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:20.044986010 CEST	49783	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:20.045002937 CEST	443	49783	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:20.046891928 CEST	49783	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:20.046895981 CEST	443	49783	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:20.131755114 CEST	443	49784	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:20.132364035 CEST	49784	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:20.132426977 CEST	443	49784	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:20.132891893 CEST	49784	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:20.132905960 CEST	443	49784	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:20.141596079 CEST	443	49785	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:20.142374992 CEST	49785	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:20.142391920 CEST	443	49785	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:20.142592907 CEST	49785	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:20.142599106 CEST	443	49785	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:20.176557064 CEST	443	49783	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:20.176637888 CEST	443	49783	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:20.176780939 CEST	49783	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:20.176908016 CEST	49783	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:20.176922083 CEST	443	49783	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:20.176951885 CEST	49783	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:20.176958084 CEST	443	49783	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:20.179883003 CEST	49788	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:20.179976940 CEST	443	49788	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:20.180136919 CEST	49788	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:20.180938959 CEST	49788	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:20.180977106 CEST	443	49788	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:20.267668962 CEST	443	49784	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:20.267741919 CEST	443	49784	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:20.267853975 CEST	49784	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:20.268121004 CEST	49784	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:20.268146992 CEST	443	49784	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:20.268162966 CEST	49784	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:20.268171072 CEST	443	49784	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:20.274116039 CEST	443	49785	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:20.274597883 CEST	443	49785	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:20.276233912 CEST	49785	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:20.276628971 CEST	49789	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:20.276669025 CEST	443	49789	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:20.276806116 CEST	49789	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:20.277122021 CEST	49785	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:20.277138948 CEST	443	49785	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:20.277152061 CEST	49785	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:20.277157068 CEST	443	49785	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:20.277277946 CEST	49789	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:20.277296066 CEST	443	49789	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:20.280344963 CEST	49790	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:20.280427933 CEST	443	49790	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:20.280777931 CEST	49790	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:20.280981064 CEST	49790	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:20.281012058 CEST	443	49790	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:20.752023935 CEST	443	49786	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:20.752742052 CEST	49786	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:20.752803087 CEST	443	49786	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:20.753253937 CEST	49786	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:20.753268003 CEST	443	49786	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:20.763915062 CEST	443	49787	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:20.764413118 CEST	49787	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:20.764431953 CEST	443	49787	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:20.764827013 CEST	49787	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:20.764832973 CEST	443	49787	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:20.892365932 CEST	443	49786	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:20.892961025 CEST	443	49786	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:20.893066883 CEST	49786	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:20.893382072 CEST	49786	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:20.893383026 CEST	49786	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:20.893430948 CEST	443	49786	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:20.893460035 CEST	443	49786	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:20.895278931 CEST	443	49787	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:20.895493984 CEST	443	49787	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:20.895550966 CEST	49787	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:20.895940065 CEST	49787	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:20.895963907 CEST	443	49787	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:20.895977974 CEST	49787	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:20.895983934 CEST	443	49787	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:20.900087118 CEST	49791	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:20.900130033 CEST	443	49791	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:20.900245905 CEST	49791	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:20.906197071 CEST	49791	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:20.906219959 CEST	443	49791	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:20.910060883 CEST	49792	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:20.910114050 CEST	443	49792	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:20.910232067 CEST	49792	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:20.910497904 CEST	49792	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:20.910531044 CEST	443	49792	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:20.921120882 CEST	443	49788	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:20.926716089 CEST	49788	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:20.926795959 CEST	443	49788	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:20.927833080 CEST	49788	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:20.927849054 CEST	443	49788	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:21.006509066 CEST	443	49790	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:21.007261038 CEST	49790	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:21.007302999 CEST	443	49790	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:21.008069992 CEST	49790	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:21.008080959 CEST	443	49790	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:21.029896021 CEST	443	49789	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:21.030522108 CEST	49789	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:21.030558109 CEST	443	49789	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:21.031085968 CEST	49789	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:21.031091928 CEST	443	49789	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:21.055648088 CEST	443	49788	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:21.055711031 CEST	443	49788	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:21.055905104 CEST	49788	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:21.056057930 CEST	49788	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:21.056098938 CEST	443	49788	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:21.056126118 CEST	49788	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:21.056142092 CEST	443	49788	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:21.059003115 CEST	49793	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:21.059034109 CEST	443	49793	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:21.059201956 CEST	49793	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:21.059407949 CEST	49793	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:21.059417963 CEST	443	49793	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:21.134736061 CEST	443	49790	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:21.134984970 CEST	443	49790	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:21.135080099 CEST	49790	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:21.135210991 CEST	49790	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:21.135232925 CEST	443	49790	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:21.135257006 CEST	49790	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:21.135267973 CEST	443	49790	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:21.138500929 CEST	49794	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:21.138592005 CEST	443	49794	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:21.138681889 CEST	49794	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:21.138919115 CEST	49794	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:21.138959885 CEST	443	49794	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:21.166723967 CEST	443	49789	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:21.167272091 CEST	443	49789	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:21.167515039 CEST	49789	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:21.167515039 CEST	49789	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:21.167515039 CEST	49789	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:21.170624018 CEST	49795	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:21.170672894 CEST	443	49795	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:21.170902967 CEST	49795	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:21.171056032 CEST	49795	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:21.171070099 CEST	443	49795	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:21.469901085 CEST	49789	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:21.469923973 CEST	443	49789	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:21.640412092 CEST	443	49791	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:21.644655943 CEST	49791	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:21.644680977 CEST	443	49791	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:21.646594048 CEST	49791	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:21.646614075 CEST	443	49791	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:21.659250021 CEST	443	49792	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:21.665093899 CEST	49792	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:21.665157080 CEST	443	49792	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:21.665812016 CEST	49792	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:21.665826082 CEST	443	49792	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:21.773662090 CEST	443	49791	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:21.773988962 CEST	443	49791	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:21.774049997 CEST	49791	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:21.774137974 CEST	49791	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:21.774152994 CEST	443	49791	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:21.774166107 CEST	49791	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:21.774172068 CEST	443	49791	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:21.777424097 CEST	49796	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:21.777466059 CEST	443	49796	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:21.777767897 CEST	49796	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:21.777956009 CEST	49796	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:21.777962923 CEST	443	49796	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:21.795053005 CEST	443	49792	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:21.795216084 CEST	443	49792	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:21.795293093 CEST	49792	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:21.795399904 CEST	49792	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:21.795399904 CEST	49792	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:21.795449018 CEST	443	49792	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:21.795484066 CEST	443	49792	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:21.798758030 CEST	49797	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:21.798775911 CEST	443	49797	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:21.798867941 CEST	49797	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:21.799259901 CEST	49797	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:21.799274921 CEST	443	49797	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:21.808139086 CEST	443	49793	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:21.809123993 CEST	49793	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:21.809138060 CEST	443	49793	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:21.809298992 CEST	49793	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:21.809303999 CEST	443	49793	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:21.875087976 CEST	443	49794	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:21.875670910 CEST	49794	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:21.875699043 CEST	443	49794	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:21.876481056 CEST	49794	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:21.876494884 CEST	443	49794	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:21.905942917 CEST	443	49795	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:21.906636000 CEST	49795	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:21.906656981 CEST	443	49795	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:21.907124996 CEST	49795	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:21.907131910 CEST	443	49795	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:21.943346024 CEST	443	49793	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:21.943481922 CEST	443	49793	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:21.943846941 CEST	49793	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:21.943846941 CEST	49793	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:21.944286108 CEST	49793	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:21.944298983 CEST	443	49793	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:21.947545052 CEST	49798	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:21.947627068 CEST	443	49798	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:21.947859049 CEST	49798	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:21.948067904 CEST	49798	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:21.948105097 CEST	443	49798	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:22.005695105 CEST	443	49794	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:22.005763054 CEST	443	49794	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:22.005870104 CEST	49794	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:22.006160975 CEST	49794	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:22.006208897 CEST	443	49794	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:22.006241083 CEST	49794	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:22.006257057 CEST	443	49794	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:22.009952068 CEST	49799	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:22.009965897 CEST	443	49799	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:22.010068893 CEST	49799	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:22.010301113 CEST	49799	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:22.010312080 CEST	443	49799	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:22.037412882 CEST	443	49795	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:22.037503958 CEST	443	49795	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:22.037617922 CEST	49795	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:22.037767887 CEST	49795	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:22.037767887 CEST	49795	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:22.037791967 CEST	443	49795	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:22.037802935 CEST	443	49795	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:22.041059017 CEST	49800	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:22.041091919 CEST	443	49800	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:22.041187048 CEST	49800	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:22.041418076 CEST	49800	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:22.041435957 CEST	443	49800	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:22.709567070 CEST	443	49797	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:22.709635973 CEST	443	49796	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:22.710268021 CEST	49796	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:22.710297108 CEST	443	49796	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:22.710484982 CEST	49797	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:22.710516930 CEST	443	49797	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:22.710869074 CEST	49796	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:22.710879087 CEST	443	49796	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:22.711250067 CEST	49797	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:22.711256027 CEST	443	49797	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:22.834860086 CEST	443	49800	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:22.835460901 CEST	443	49798	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:22.836201906 CEST	49800	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:22.836221933 CEST	443	49800	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:22.837021112 CEST	49800	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:22.837028027 CEST	443	49800	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:22.837507963 CEST	49798	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:22.837572098 CEST	443	49798	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:22.838207960 CEST	49798	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:22.838236094 CEST	443	49798	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:22.843430042 CEST	443	49797	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:22.843455076 CEST	443	49797	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:22.843518972 CEST	49797	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:22.843544960 CEST	443	49797	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:22.843600035 CEST	443	49797	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:22.843667030 CEST	49797	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:22.844012022 CEST	49797	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:22.844029903 CEST	443	49797	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:22.844058037 CEST	49797	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:22.844064951 CEST	443	49797	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:22.844892025 CEST	443	49796	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:22.845664024 CEST	443	49796	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:22.845727921 CEST	49796	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:22.845810890 CEST	49796	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:22.845850945 CEST	443	49796	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:22.845880985 CEST	49796	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:22.845896006 CEST	443	49796	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:22.853718042 CEST	49801	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:22.853755951 CEST	443	49801	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:22.853828907 CEST	49801	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:22.853986025 CEST	49801	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:22.853992939 CEST	443	49801	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:22.854244947 CEST	49802	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:22.854289055 CEST	443	49802	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:22.854360104 CEST	49802	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:22.854585886 CEST	49802	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:22.854610920 CEST	443	49802	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:23.962635040 CEST	443	49800	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:23.962707043 CEST	443	49800	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:23.962733984 CEST	443	49798	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:23.962820053 CEST	49800	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:23.962836027 CEST	443	49800	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:23.962846041 CEST	443	49798	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:23.962853909 CEST	443	49800	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:23.962927103 CEST	49798	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:23.962930918 CEST	49800	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:23.963083982 CEST	49800	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:23.963099957 CEST	443	49800	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:23.963119984 CEST	49800	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:23.963125944 CEST	443	49800	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:23.963418007 CEST	49798	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:23.963465929 CEST	443	49798	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:23.963502884 CEST	49798	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:23.963520050 CEST	443	49798	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:23.967129946 CEST	49803	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:23.967134953 CEST	49804	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:23.967170954 CEST	443	49804	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:23.967215061 CEST	443	49803	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:23.967528105 CEST	49803	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:23.967566013 CEST	49804	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:23.967740059 CEST	49804	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:23.967746019 CEST	49803	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:23.967756033 CEST	443	49804	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:23.967766047 CEST	443	49803	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:23.969532013 CEST	443	49799	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:23.972450972 CEST	49799	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:23.972475052 CEST	443	49799	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:23.973185062 CEST	49799	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:23.973190069 CEST	443	49799	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:24.386199951 CEST	443	49802	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:24.386930943 CEST	49802	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:24.386945963 CEST	443	49802	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:24.387501001 CEST	49802	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:24.387505054 CEST	443	49802	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:24.388622046 CEST	443	49799	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:24.388719082 CEST	443	49799	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:24.388866901 CEST	49799	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:24.389044046 CEST	49799	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:24.389044046 CEST	49799	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:24.389065981 CEST	443	49799	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:24.389075994 CEST	443	49799	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:24.389635086 CEST	443	49801	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:24.390152931 CEST	49801	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:24.390171051 CEST	443	49801	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:24.390708923 CEST	49801	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:24.390716076 CEST	443	49801	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:24.392838955 CEST	49805	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:24.392874002 CEST	443	49805	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:24.392939091 CEST	49805	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:24.393059015 CEST	49805	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:24.393070936 CEST	443	49805	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:24.520487070 CEST	443	49802	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:24.520510912 CEST	443	49802	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:24.520584106 CEST	443	49802	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:24.520634890 CEST	49802	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:24.520634890 CEST	49802	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:24.520895958 CEST	49802	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:24.520924091 CEST	443	49802	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:24.520956039 CEST	49802	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:24.520962000 CEST	443	49802	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:24.524873972 CEST	49806	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:24.524926901 CEST	443	49806	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:24.525006056 CEST	49806	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:24.525203943 CEST	49806	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:24.525221109 CEST	443	49806	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:24.527702093 CEST	443	49801	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:24.527715921 CEST	443	49801	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:24.527782917 CEST	49801	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:24.527791977 CEST	443	49801	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:24.528019905 CEST	49801	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:24.528084040 CEST	49801	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:24.528084040 CEST	49801	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:24.528110027 CEST	443	49801	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:24.528122902 CEST	443	49801	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:24.530792952 CEST	49807	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:24.530813932 CEST	443	49807	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:24.530884027 CEST	49807	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:24.531078100 CEST	49807	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:24.531089067 CEST	443	49807	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:24.995491982 CEST	443	49803	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:24.996388912 CEST	49803	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:24.996407986 CEST	443	49803	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:24.997061014 CEST	49803	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:24.997068882 CEST	443	49803	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:25.010869026 CEST	443	49804	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:25.012525082 CEST	49804	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:25.012537956 CEST	443	49804	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:25.013134003 CEST	49804	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:25.013143063 CEST	443	49804	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:25.115482092 CEST	443	49805	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:25.116219044 CEST	49805	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:25.116236925 CEST	443	49805	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:25.116869926 CEST	49805	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:25.116874933 CEST	443	49805	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:25.129417896 CEST	443	49803	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:25.129547119 CEST	443	49803	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:25.129755974 CEST	49803	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:25.129867077 CEST	49803	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:25.129887104 CEST	443	49803	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:25.130055904 CEST	49803	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:25.130063057 CEST	443	49803	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:25.133356094 CEST	49808	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:25.133383036 CEST	443	49808	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:25.133476019 CEST	49808	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:25.133631945 CEST	49808	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:25.133644104 CEST	443	49808	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:25.142700911 CEST	443	49804	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:25.142762899 CEST	443	49804	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:25.142932892 CEST	49804	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:25.142956972 CEST	49804	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:25.142973900 CEST	443	49804	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:25.143073082 CEST	49804	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:25.143079996 CEST	443	49804	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:25.145473003 CEST	49809	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:25.145503998 CEST	443	49809	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:25.145576000 CEST	49809	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:25.145703077 CEST	49809	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:25.145718098 CEST	443	49809	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:25.247065067 CEST	443	49805	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:25.247131109 CEST	443	49805	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:25.247301102 CEST	49805	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:25.247673988 CEST	49805	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:25.247685909 CEST	443	49805	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:25.247699976 CEST	49805	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:25.247705936 CEST	443	49805	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:25.251619101 CEST	49810	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:25.251648903 CEST	443	49810	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:25.252058029 CEST	49810	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:25.252280951 CEST	49810	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:25.252296925 CEST	443	49810	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:25.265449047 CEST	443	49807	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:25.265981913 CEST	49807	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:25.265994072 CEST	443	49807	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:25.266515017 CEST	49807	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:25.266519070 CEST	443	49807	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:25.273674011 CEST	443	49806	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:25.275310040 CEST	49806	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:25.275335073 CEST	443	49806	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:25.275629044 CEST	49806	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:25.275635958 CEST	443	49806	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:25.406429052 CEST	443	49807	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:25.406472921 CEST	443	49806	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:25.406507015 CEST	443	49807	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:25.406575918 CEST	49807	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:25.406696081 CEST	443	49806	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:25.406759024 CEST	49806	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:25.406869888 CEST	49806	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:25.406869888 CEST	49806	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:25.406888962 CEST	443	49806	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:25.406892061 CEST	49807	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:25.406899929 CEST	443	49806	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:25.406917095 CEST	443	49807	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:25.406934977 CEST	49807	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:25.406939983 CEST	443	49807	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:25.410667896 CEST	49811	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:25.410706043 CEST	443	49811	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:25.410810947 CEST	49811	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:25.410871029 CEST	49812	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:25.410896063 CEST	443	49812	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:25.410969019 CEST	49811	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:25.410984039 CEST	443	49811	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:25.411003113 CEST	49812	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:25.411211967 CEST	49812	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:25.411231995 CEST	443	49812	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:25.875746012 CEST	443	49809	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:25.876632929 CEST	443	49808	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:25.876914024 CEST	49809	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:25.876926899 CEST	443	49809	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:25.877470016 CEST	49808	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:25.877482891 CEST	443	49808	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:25.877994061 CEST	49809	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:25.877995968 CEST	49808	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:25.877999067 CEST	443	49809	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:25.878002882 CEST	443	49808	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:26.005603075 CEST	443	49809	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:26.005661964 CEST	443	49810	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:26.005669117 CEST	443	49809	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:26.005791903 CEST	49809	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:26.005956888 CEST	443	49808	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:26.006025076 CEST	443	49808	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:26.006124020 CEST	49809	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:26.006141901 CEST	443	49809	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:26.006205082 CEST	49808	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:26.006237030 CEST	49810	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:26.006258965 CEST	443	49810	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:26.006762028 CEST	49810	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:26.006767988 CEST	443	49810	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:26.006937027 CEST	49808	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:26.006961107 CEST	443	49808	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:26.006975889 CEST	49808	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:26.006983042 CEST	443	49808	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:26.009769917 CEST	49813	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:26.009800911 CEST	443	49813	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:26.009857893 CEST	49814	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:26.009885073 CEST	443	49814	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:26.009910107 CEST	49813	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:26.009938955 CEST	49814	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:26.010030985 CEST	49813	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:26.010046005 CEST	443	49813	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:26.010148048 CEST	49814	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:26.010155916 CEST	443	49814	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:26.140762091 CEST	443	49810	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:26.141158104 CEST	443	49810	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:26.141290903 CEST	49810	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:26.141599894 CEST	49810	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:26.141623020 CEST	443	49810	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:26.141638994 CEST	49810	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:26.141654015 CEST	443	49810	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:26.142172098 CEST	443	49811	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:26.144334078 CEST	49811	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:26.144352913 CEST	443	49811	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:26.144820929 CEST	49811	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:26.144825935 CEST	443	49811	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:26.145613909 CEST	49815	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:26.145652056 CEST	443	49815	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:26.145730972 CEST	49815	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:26.145951033 CEST	49815	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:26.145967960 CEST	443	49815	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:26.274214029 CEST	443	49811	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:26.274332047 CEST	443	49811	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:26.275917053 CEST	49811	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:26.276283979 CEST	49811	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:26.276309013 CEST	443	49811	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:26.276321888 CEST	49811	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:26.276326895 CEST	443	49811	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:26.280159950 CEST	49816	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:26.280195951 CEST	443	49816	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:26.280342102 CEST	49816	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:26.280677080 CEST	49816	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:26.280705929 CEST	443	49816	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:26.348361969 CEST	443	49812	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:26.349200964 CEST	49812	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:26.349217892 CEST	443	49812	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:26.349720955 CEST	49812	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:26.349726915 CEST	443	49812	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:26.477231979 CEST	443	49812	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:26.477303028 CEST	443	49812	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:26.477361917 CEST	49812	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:26.477744102 CEST	49812	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:26.477760077 CEST	443	49812	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:26.477771997 CEST	49812	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:26.477777004 CEST	443	49812	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:26.481712103 CEST	49817	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:26.481764078 CEST	443	49817	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:26.481861115 CEST	49817	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:26.482120037 CEST	49817	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:26.482136011 CEST	443	49817	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:26.750507116 CEST	443	49813	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:26.755295038 CEST	49813	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:26.755321980 CEST	443	49813	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:26.756373882 CEST	49813	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:26.756385088 CEST	443	49813	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:26.790000916 CEST	443	49814	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:26.790713072 CEST	49814	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:26.790739059 CEST	443	49814	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:26.791204929 CEST	49814	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:26.791210890 CEST	443	49814	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:26.879741907 CEST	443	49815	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:26.880501032 CEST	49815	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:26.880522966 CEST	443	49815	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:26.881032944 CEST	49815	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:26.881053925 CEST	443	49815	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:26.884068966 CEST	443	49813	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:26.884108067 CEST	443	49813	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:26.884155035 CEST	49813	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:26.884166956 CEST	443	49813	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:26.884183884 CEST	443	49813	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:26.884352922 CEST	49813	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:26.884382963 CEST	49813	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:26.884398937 CEST	443	49813	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:26.884413004 CEST	49813	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:26.884418964 CEST	443	49813	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:26.888334990 CEST	49818	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:26.888372898 CEST	443	49818	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:26.888489962 CEST	49818	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:26.888648033 CEST	49818	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:26.888660908 CEST	443	49818	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:26.922746897 CEST	443	49814	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:26.922817945 CEST	443	49814	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:26.922869921 CEST	49814	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:26.923099041 CEST	49814	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:26.923113108 CEST	443	49814	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:26.923131943 CEST	49814	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:26.923136950 CEST	443	49814	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:26.926347017 CEST	49819	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:26.926386118 CEST	443	49819	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:26.926479101 CEST	49819	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:26.926625013 CEST	49819	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:26.926640987 CEST	443	49819	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:27.010938883 CEST	443	49815	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:27.011050940 CEST	443	49815	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:27.011096001 CEST	443	49815	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:27.011131048 CEST	49815	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:27.011192083 CEST	49815	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:27.011590004 CEST	49815	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:27.011590004 CEST	49815	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:27.011606932 CEST	443	49815	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:27.011617899 CEST	443	49815	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:27.011637926 CEST	443	49816	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:27.012135029 CEST	49816	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:27.012147903 CEST	443	49816	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:27.012805939 CEST	49816	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:27.012810946 CEST	443	49816	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:27.015110970 CEST	49820	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:27.015144110 CEST	443	49820	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:27.015228987 CEST	49820	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:27.015500069 CEST	49820	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:27.015515089 CEST	443	49820	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:27.146657944 CEST	443	49816	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:27.146749020 CEST	443	49816	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:27.146831036 CEST	49816	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:27.147135973 CEST	49816	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:27.147135973 CEST	49816	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:27.147164106 CEST	443	49816	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:27.147172928 CEST	443	49816	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:27.150677919 CEST	49821	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:27.150731087 CEST	443	49821	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:27.150805950 CEST	49821	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:27.150966883 CEST	49821	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:27.150986910 CEST	443	49821	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:27.246117115 CEST	443	49817	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:27.246773958 CEST	49817	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:27.246804953 CEST	443	49817	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:27.247469902 CEST	49817	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:27.247484922 CEST	443	49817	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:27.441215992 CEST	443	49817	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:27.441284895 CEST	443	49817	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:27.441342115 CEST	49817	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:27.441615105 CEST	49817	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:27.441637993 CEST	443	49817	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:27.441648960 CEST	49817	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:27.441653967 CEST	443	49817	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:27.444920063 CEST	49823	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:27.444972992 CEST	443	49823	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:27.445067883 CEST	49823	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:27.445230007 CEST	49823	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:27.445249081 CEST	443	49823	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:27.626993895 CEST	443	49818	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:27.627682924 CEST	49818	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:27.627696037 CEST	443	49818	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:27.628288031 CEST	49818	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:27.628292084 CEST	443	49818	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:27.758670092 CEST	443	49818	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:27.759157896 CEST	443	49818	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:27.759264946 CEST	49818	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:27.759264946 CEST	49818	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:27.759296894 CEST	49818	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:27.759330034 CEST	443	49818	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:27.762377024 CEST	49824	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:27.762415886 CEST	443	49824	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:27.762484074 CEST	49824	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:27.762653112 CEST	49824	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:27.762665033 CEST	443	49824	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:27.768825054 CEST	443	49820	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:27.769326925 CEST	49820	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:27.769359112 CEST	443	49820	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:27.769824028 CEST	49820	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:27.769830942 CEST	443	49820	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:27.899934053 CEST	443	49821	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:27.900917053 CEST	49821	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:27.900979042 CEST	443	49821	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:27.901642084 CEST	443	49820	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:27.901654005 CEST	49821	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:27.901669025 CEST	443	49821	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:27.901942968 CEST	443	49820	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:27.901998043 CEST	49820	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:27.902034044 CEST	49820	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:27.902049065 CEST	443	49820	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:27.902065992 CEST	49820	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:27.902074099 CEST	443	49820	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:27.905370951 CEST	49825	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:27.905405998 CEST	443	49825	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:27.905472994 CEST	49825	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:27.905628920 CEST	49825	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:27.905644894 CEST	443	49825	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:28.028728962 CEST	443	49819	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:28.029367924 CEST	49819	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:28.029396057 CEST	443	49819	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:28.029915094 CEST	49819	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:28.029922962 CEST	443	49819	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:28.034415007 CEST	443	49821	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:28.034684896 CEST	443	49821	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:28.034755945 CEST	49821	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:28.034837008 CEST	49821	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:28.034883976 CEST	443	49821	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:28.034915924 CEST	49821	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:28.034933090 CEST	443	49821	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:28.038305044 CEST	49826	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:28.038336992 CEST	443	49826	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:28.038389921 CEST	49826	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:28.038618088 CEST	49826	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:28.038630009 CEST	443	49826	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:28.160703897 CEST	443	49819	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:28.161041975 CEST	443	49819	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:28.161097050 CEST	443	49819	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:28.161108017 CEST	49819	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:28.161143064 CEST	49819	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:28.161204100 CEST	49819	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:28.161226034 CEST	443	49819	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:28.161237955 CEST	49819	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:28.161243916 CEST	443	49819	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:28.164510965 CEST	49827	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:28.164562941 CEST	443	49827	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:28.164643049 CEST	49827	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:28.164797068 CEST	49827	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:28.164809942 CEST	443	49827	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:28.178666115 CEST	443	49823	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:28.179203987 CEST	49823	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:28.179239988 CEST	443	49823	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:28.179725885 CEST	49823	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:28.179739952 CEST	443	49823	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:28.330149889 CEST	443	49823	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:28.330219030 CEST	443	49823	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:28.330594063 CEST	49823	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:28.330594063 CEST	49823	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:28.330594063 CEST	49823	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:28.333722115 CEST	49828	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:28.333770037 CEST	443	49828	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:28.333841085 CEST	49828	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:28.334007025 CEST	49828	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:28.334019899 CEST	443	49828	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:28.510041952 CEST	443	49824	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:28.510576010 CEST	49824	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:28.510591984 CEST	443	49824	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:28.511084080 CEST	49824	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:28.511087894 CEST	443	49824	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:28.641788006 CEST	49823	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:28.641808987 CEST	443	49823	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:28.643939018 CEST	443	49825	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:28.646202087 CEST	443	49824	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:28.646544933 CEST	443	49824	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:28.646590948 CEST	443	49824	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:28.646639109 CEST	49824	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:28.646671057 CEST	49825	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:28.646682978 CEST	443	49825	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:28.647165060 CEST	49825	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:28.647170067 CEST	443	49825	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:28.647412062 CEST	49824	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:28.647430897 CEST	443	49824	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:28.647442102 CEST	49824	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:28.647448063 CEST	443	49824	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:28.650000095 CEST	49829	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:28.650046110 CEST	443	49829	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:28.650119066 CEST	49829	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:28.650264978 CEST	49829	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:28.650279999 CEST	443	49829	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:28.774755955 CEST	443	49826	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:28.776468992 CEST	49826	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:28.776489973 CEST	443	49826	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:28.776999950 CEST	49826	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:28.777004004 CEST	443	49826	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:28.781171083 CEST	443	49825	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:28.781371117 CEST	443	49825	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:28.781470060 CEST	49825	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:28.781745911 CEST	49825	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:28.781764984 CEST	443	49825	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:28.781775951 CEST	49825	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:28.781781912 CEST	443	49825	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:28.784889936 CEST	49830	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:28.784934998 CEST	443	49830	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:28.785015106 CEST	49830	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:28.785145998 CEST	49830	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:28.785165071 CEST	443	49830	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:28.900228024 CEST	443	49827	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:28.901103020 CEST	49827	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:28.901117086 CEST	443	49827	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:28.901614904 CEST	49827	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:28.901619911 CEST	443	49827	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:28.904927015 CEST	443	49826	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:28.904987097 CEST	443	49826	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:28.905031919 CEST	49826	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:28.905042887 CEST	443	49826	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:28.905056953 CEST	443	49826	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:28.905097961 CEST	49826	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:28.905289888 CEST	49826	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:28.905301094 CEST	443	49826	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:28.905323029 CEST	49826	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:28.905329943 CEST	443	49826	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:28.908713102 CEST	49831	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:28.908745050 CEST	443	49831	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:28.908819914 CEST	49831	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:28.908993006 CEST	49831	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:28.909008026 CEST	443	49831	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:29.030592918 CEST	443	49827	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:29.031003952 CEST	443	49827	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:29.031088114 CEST	49827	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:29.031131983 CEST	49827	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:29.031131983 CEST	49827	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:29.031153917 CEST	443	49827	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:29.031168938 CEST	443	49827	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:29.034271002 CEST	49832	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:29.034313917 CEST	443	49832	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:29.034421921 CEST	49832	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:29.034543991 CEST	49832	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:29.034552097 CEST	443	49832	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:29.079173088 CEST	443	49828	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:29.079914093 CEST	49828	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:29.079941034 CEST	443	49828	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:29.080418110 CEST	49828	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:29.080425024 CEST	443	49828	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:29.213196993 CEST	443	49828	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:29.213416100 CEST	443	49828	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:29.213596106 CEST	49828	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:29.213660955 CEST	49828	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:29.213679075 CEST	443	49828	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:29.213712931 CEST	49828	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:29.213718891 CEST	443	49828	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:29.217065096 CEST	49833	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:29.217117071 CEST	443	49833	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:29.217190027 CEST	49833	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:29.217350960 CEST	49833	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:29.217366934 CEST	443	49833	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:29.369966030 CEST	443	49829	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:29.370682955 CEST	49829	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:29.370709896 CEST	443	49829	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:29.371206999 CEST	49829	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:29.371212006 CEST	443	49829	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:29.499850035 CEST	443	49829	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:29.499926090 CEST	443	49829	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:29.499991894 CEST	49829	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:29.504678965 CEST	49829	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:29.504698038 CEST	443	49829	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:29.504740000 CEST	49829	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:29.504745007 CEST	443	49829	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:29.508650064 CEST	49834	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:29.508690119 CEST	443	49834	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:29.508806944 CEST	49834	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:29.509042025 CEST	49834	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:29.509057045 CEST	443	49834	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:30.566741943 CEST	443	49830	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:30.567579985 CEST	49830	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:30.567603111 CEST	443	49830	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:30.568099022 CEST	49830	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:30.568114996 CEST	443	49830	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:30.694571018 CEST	443	49831	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:30.695241928 CEST	49831	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:30.695271015 CEST	443	49831	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:30.695734978 CEST	49831	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:30.695739985 CEST	443	49831	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:30.699481964 CEST	443	49832	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:30.699771881 CEST	49832	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:30.699793100 CEST	443	49832	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:30.700081110 CEST	49832	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:30.700086117 CEST	443	49832	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:30.700166941 CEST	443	49830	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:30.700206041 CEST	443	49830	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:30.700263023 CEST	49830	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:30.700264931 CEST	443	49830	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:30.700313091 CEST	49830	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:30.700511932 CEST	49830	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:30.700530052 CEST	443	49830	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:30.700541019 CEST	49830	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:30.700546026 CEST	443	49830	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:30.701510906 CEST	443	49833	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:30.701926947 CEST	49833	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:30.701953888 CEST	443	49833	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:30.702332973 CEST	49833	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:30.702338934 CEST	443	49833	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:30.703469992 CEST	49835	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:30.703515053 CEST	443	49835	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:30.703596115 CEST	49835	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:30.703723907 CEST	49835	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:30.703730106 CEST	443	49835	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:30.831916094 CEST	443	49833	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:30.832000017 CEST	443	49833	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:30.832118988 CEST	49833	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:30.832514048 CEST	49833	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:30.832536936 CEST	443	49833	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:30.832547903 CEST	49833	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:30.832554102 CEST	443	49833	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:30.836261988 CEST	49836	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:30.836313009 CEST	443	49836	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:30.836426973 CEST	49836	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:30.836642981 CEST	49836	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:30.836658001 CEST	443	49836	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:30.846013069 CEST	443	49831	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:30.846170902 CEST	443	49831	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:30.846229076 CEST	49831	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:30.846272945 CEST	49831	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:30.846287012 CEST	443	49831	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:30.846297026 CEST	49831	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:30.846302032 CEST	443	49831	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:30.849436998 CEST	49837	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:30.849525928 CEST	443	49837	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:30.849644899 CEST	49837	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:30.849934101 CEST	49837	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:30.849970102 CEST	443	49837	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:30.850162983 CEST	443	49832	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:30.850404024 CEST	443	49832	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:30.850490093 CEST	49832	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:30.850563049 CEST	49832	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:30.850578070 CEST	443	49832	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:30.850591898 CEST	49832	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:30.850595951 CEST	443	49832	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:30.853172064 CEST	49838	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:30.853184938 CEST	443	49838	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:30.853261948 CEST	49838	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:30.853411913 CEST	49838	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:30.853425026 CEST	443	49838	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:31.295011044 CEST	443	49834	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:31.295764923 CEST	49834	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:31.295775890 CEST	443	49834	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:31.296253920 CEST	49834	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:31.296258926 CEST	443	49834	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:31.427658081 CEST	443	49834	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:31.427956104 CEST	443	49834	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:31.428019047 CEST	443	49834	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:31.428054094 CEST	49834	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:31.428096056 CEST	49834	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:31.428361893 CEST	49834	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:31.428378105 CEST	443	49834	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:31.428389072 CEST	49834	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:31.428395033 CEST	443	49834	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:31.432225943 CEST	49839	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:31.432293892 CEST	443	49839	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:31.432393074 CEST	49839	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:31.432627916 CEST	49839	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:31.432641983 CEST	443	49839	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:31.452316046 CEST	443	49835	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:31.453186035 CEST	49835	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:31.453222036 CEST	443	49835	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:31.453674078 CEST	49835	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:31.453680038 CEST	443	49835	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:31.557985067 CEST	443	49836	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:31.559272051 CEST	49836	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:31.559300900 CEST	443	49836	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:31.559931993 CEST	49836	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:31.559936047 CEST	443	49836	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:31.585078955 CEST	443	49835	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:31.585419893 CEST	443	49835	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:31.585515022 CEST	49835	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:31.585602045 CEST	49835	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:31.585602045 CEST	49835	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:31.585649967 CEST	443	49835	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:31.585678101 CEST	443	49835	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:31.586529970 CEST	443	49837	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:31.587035894 CEST	49837	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:31.587060928 CEST	443	49837	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:31.587501049 CEST	49837	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:31.587506056 CEST	443	49837	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:31.588928938 CEST	49840	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:31.588978052 CEST	443	49840	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:31.589169025 CEST	49840	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:31.589302063 CEST	49840	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:31.589328051 CEST	443	49840	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:31.624161959 CEST	443	49838	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:31.624846935 CEST	49838	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:31.624861956 CEST	443	49838	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:31.625360966 CEST	49838	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:31.625365019 CEST	443	49838	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:31.689616919 CEST	443	49836	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:31.689677000 CEST	443	49836	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:31.689759016 CEST	49836	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:31.690057039 CEST	49836	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:31.690078020 CEST	443	49836	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:31.690087080 CEST	49836	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:31.690093994 CEST	443	49836	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:31.693213940 CEST	49841	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:31.693258047 CEST	443	49841	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:31.693357944 CEST	49841	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:31.693496943 CEST	49841	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:31.693516970 CEST	443	49841	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:31.721703053 CEST	443	49837	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:31.721782923 CEST	443	49837	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:31.721865892 CEST	49837	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:31.722059011 CEST	49837	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:31.722107887 CEST	443	49837	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:31.722140074 CEST	49837	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:31.722156048 CEST	443	49837	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:31.725579977 CEST	49842	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:31.725609064 CEST	443	49842	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:31.725677013 CEST	49842	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:31.725951910 CEST	49842	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:31.725972891 CEST	443	49842	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:31.824328899 CEST	443	49838	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:31.824569941 CEST	443	49838	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:31.824637890 CEST	49838	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:31.824642897 CEST	443	49838	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:31.824695110 CEST	49838	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:31.824863911 CEST	49838	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:31.824877977 CEST	443	49838	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:31.824892044 CEST	49838	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:31.824896097 CEST	443	49838	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:31.828284979 CEST	49843	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:31.828315973 CEST	443	49843	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:31.828397036 CEST	49843	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:31.828583956 CEST	49843	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:31.828593969 CEST	443	49843	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:32.177809000 CEST	443	49839	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:32.178525925 CEST	49839	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:32.178595066 CEST	443	49839	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:32.179243088 CEST	49839	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:32.179258108 CEST	443	49839	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:32.312968969 CEST	443	49839	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:32.313054085 CEST	443	49839	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:32.313110113 CEST	49839	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:32.313401937 CEST	49839	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:32.313433886 CEST	443	49839	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:32.313453913 CEST	49839	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:32.313462973 CEST	443	49839	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:32.318032026 CEST	49844	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:32.318077087 CEST	443	49844	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:32.318150043 CEST	49844	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:32.318428993 CEST	49844	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:32.318448067 CEST	443	49844	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:32.351984024 CEST	443	49840	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:32.353142023 CEST	49840	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:32.353219986 CEST	443	49840	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:32.354108095 CEST	49840	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:32.354123116 CEST	443	49840	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:32.449536085 CEST	443	49841	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:32.450308084 CEST	49841	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:32.450334072 CEST	443	49841	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:32.450805902 CEST	49841	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:32.450810909 CEST	443	49841	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:32.470005035 CEST	443	49842	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:32.470767975 CEST	49842	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:32.470802069 CEST	443	49842	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:32.471431017 CEST	49842	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:32.471441984 CEST	443	49842	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:32.491210938 CEST	443	49840	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:32.491413116 CEST	443	49840	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:32.491585016 CEST	49840	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:32.491662979 CEST	49840	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:32.491702080 CEST	443	49840	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:32.491729021 CEST	49840	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:32.491743088 CEST	443	49840	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:32.494895935 CEST	49845	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:32.494949102 CEST	443	49845	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:32.495038033 CEST	49845	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:32.495277882 CEST	49845	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:32.495296001 CEST	443	49845	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:32.566252947 CEST	443	49843	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:32.566998959 CEST	49843	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:32.567008972 CEST	443	49843	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:32.567289114 CEST	49843	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:32.567292929 CEST	443	49843	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:32.583506107 CEST	443	49841	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:32.583674908 CEST	443	49841	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:32.583802938 CEST	49841	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:32.584155083 CEST	49841	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:32.584155083 CEST	49841	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:32.584171057 CEST	443	49841	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:32.584177971 CEST	443	49841	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:32.589365005 CEST	49846	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:32.589436054 CEST	443	49846	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:32.589549065 CEST	49846	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:32.589682102 CEST	49846	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:32.589698076 CEST	443	49846	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:32.616684914 CEST	443	49842	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:32.616724968 CEST	443	49842	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:32.616781950 CEST	443	49842	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:32.616817951 CEST	49842	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:32.616894960 CEST	49842	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:32.617198944 CEST	49842	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:32.617238998 CEST	443	49842	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:32.617266893 CEST	49842	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:32.617280006 CEST	443	49842	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:32.620672941 CEST	49847	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:32.620723009 CEST	443	49847	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:32.620804071 CEST	49847	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:32.621030092 CEST	49847	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:32.621047020 CEST	443	49847	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:32.700207949 CEST	443	49843	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:32.700301886 CEST	443	49843	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:32.700465918 CEST	49843	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:32.700733900 CEST	49843	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:32.700733900 CEST	49843	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:32.700756073 CEST	443	49843	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:32.700764894 CEST	443	49843	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:32.704188108 CEST	49848	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:32.704227924 CEST	443	49848	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:32.704353094 CEST	49848	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:32.704945087 CEST	49848	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:32.704962015 CEST	443	49848	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:33.257016897 CEST	443	49845	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:33.259426117 CEST	49845	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:33.259463072 CEST	443	49845	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:33.259923935 CEST	49845	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:33.259929895 CEST	443	49845	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:33.345550060 CEST	443	49847	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:33.347103119 CEST	49847	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:33.347122908 CEST	443	49847	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:33.347615957 CEST	49847	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:33.347620010 CEST	443	49847	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:33.348068953 CEST	443	49846	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:33.351130009 CEST	49846	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:33.351162910 CEST	443	49846	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:33.351538897 CEST	49846	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:33.351545095 CEST	443	49846	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:33.388525009 CEST	443	49845	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:33.388693094 CEST	443	49845	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:33.388822079 CEST	49845	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:33.389107943 CEST	49845	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:33.389122963 CEST	443	49845	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:33.389132977 CEST	49845	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:33.389137030 CEST	443	49845	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:33.392436028 CEST	49849	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:33.392457962 CEST	443	49849	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:33.392518997 CEST	49849	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:33.392712116 CEST	49849	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:33.392724991 CEST	443	49849	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:33.475888014 CEST	443	49847	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:33.476094007 CEST	443	49847	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:33.476283073 CEST	49847	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:33.476346016 CEST	49847	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:33.476366997 CEST	443	49847	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:33.476380110 CEST	49847	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:33.476386070 CEST	443	49847	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:33.479844093 CEST	443	49846	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:33.479939938 CEST	443	49846	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:33.480066061 CEST	443	49846	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:33.480142117 CEST	49846	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:33.480246067 CEST	49850	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:33.480283022 CEST	443	49850	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:33.480410099 CEST	49846	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:33.480410099 CEST	49846	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:33.480432987 CEST	49850	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:33.480453968 CEST	443	49846	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:33.480499029 CEST	443	49846	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:33.481645107 CEST	49850	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:33.481657982 CEST	443	49850	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:33.482748985 CEST	49851	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:33.482790947 CEST	443	49851	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:33.482867956 CEST	49851	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:33.482976913 CEST	49851	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:33.482989073 CEST	443	49851	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:33.498230934 CEST	443	49848	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:33.498666048 CEST	49848	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:33.498704910 CEST	443	49848	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:33.499156952 CEST	49848	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:33.499165058 CEST	443	49848	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:33.630786896 CEST	443	49848	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:33.630877972 CEST	443	49848	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:33.630944967 CEST	443	49848	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:33.631015062 CEST	49848	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:33.631223917 CEST	49848	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:33.631223917 CEST	49848	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:33.631270885 CEST	443	49848	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:33.631302118 CEST	443	49848	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:33.634855032 CEST	49852	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:33.634893894 CEST	443	49852	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:33.634964943 CEST	49852	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:33.635286093 CEST	49852	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:33.635303974 CEST	443	49852	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:34.145101070 CEST	443	49849	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:34.187484026 CEST	49849	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:34.187503099 CEST	443	49849	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:34.193871021 CEST	49849	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:34.193885088 CEST	443	49849	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:34.216741085 CEST	443	49850	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:34.217436075 CEST	49850	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:34.217454910 CEST	443	49850	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:34.218278885 CEST	49850	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:34.218283892 CEST	443	49850	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:34.236454964 CEST	443	49851	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:34.241972923 CEST	49851	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:34.241991997 CEST	443	49851	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:34.242539883 CEST	49851	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:34.242548943 CEST	443	49851	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:34.337707996 CEST	443	49849	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:34.337886095 CEST	443	49849	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:34.337965012 CEST	49849	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:34.339926004 CEST	49849	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:34.339941025 CEST	443	49849	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:34.339965105 CEST	49849	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:34.339971066 CEST	443	49849	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:34.345947981 CEST	49853	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:34.345990896 CEST	443	49853	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:34.346054077 CEST	49853	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:34.346338987 CEST	49853	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:34.346354008 CEST	443	49853	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:34.347923994 CEST	443	49850	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:34.347980976 CEST	443	49850	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:34.348026991 CEST	49850	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:34.348030090 CEST	443	49850	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:34.348087072 CEST	49850	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:34.348264933 CEST	49850	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:34.348278999 CEST	443	49850	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:34.348289013 CEST	49850	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:34.348294020 CEST	443	49850	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:34.351537943 CEST	49854	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:34.351576090 CEST	443	49854	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:34.351636887 CEST	49854	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:34.351874113 CEST	49854	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:34.351888895 CEST	443	49854	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:34.369786024 CEST	443	49851	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:34.369968891 CEST	443	49851	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:34.370026112 CEST	49851	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:34.370208025 CEST	49851	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:34.370208025 CEST	49851	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:34.370224953 CEST	443	49851	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:34.370233059 CEST	443	49851	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:34.372011900 CEST	443	49852	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:34.372530937 CEST	49852	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:34.372543097 CEST	443	49852	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:34.373090982 CEST	49852	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:34.373095989 CEST	443	49852	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:34.374131918 CEST	49855	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:34.374216080 CEST	443	49855	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:34.374351025 CEST	49855	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:34.374514103 CEST	49855	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:34.374548912 CEST	443	49855	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:34.504568100 CEST	443	49852	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:34.504745007 CEST	443	49852	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:34.504836082 CEST	49852	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:34.505054951 CEST	49852	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:34.505076885 CEST	443	49852	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:34.505088091 CEST	49852	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:34.505094051 CEST	443	49852	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:34.508652925 CEST	49856	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:34.508699894 CEST	443	49856	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:34.508791924 CEST	49856	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:34.508980989 CEST	49856	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:34.508991957 CEST	443	49856	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:34.516515970 CEST	443	49844	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:34.517050982 CEST	49844	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:34.517083883 CEST	443	49844	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:34.517575979 CEST	49844	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:34.517584085 CEST	443	49844	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:34.702905893 CEST	443	49844	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:34.703095913 CEST	443	49844	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:34.703165054 CEST	443	49844	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:34.703190088 CEST	49844	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:34.703228951 CEST	49844	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:34.703531981 CEST	49844	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:34.703557968 CEST	443	49844	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:34.703572035 CEST	49844	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:34.703577995 CEST	443	49844	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:34.707319021 CEST	49857	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:34.707362890 CEST	443	49857	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:34.707457066 CEST	49857	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:34.707688093 CEST	49857	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:34.707703114 CEST	443	49857	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:35.107095957 CEST	443	49853	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:35.107922077 CEST	49853	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:35.107949972 CEST	443	49853	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:35.108423948 CEST	443	49854	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:35.108551979 CEST	49853	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:35.108565092 CEST	443	49853	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:35.108730078 CEST	49854	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:35.108751059 CEST	443	49854	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:35.109231949 CEST	49854	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:35.109236956 CEST	443	49854	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:35.129107952 CEST	443	49855	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:35.129728079 CEST	49855	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:35.129769087 CEST	443	49855	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:35.130269051 CEST	49855	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:35.130275011 CEST	443	49855	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:35.237781048 CEST	443	49856	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:35.238414049 CEST	49856	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:35.238439083 CEST	443	49856	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:35.238944054 CEST	49856	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:35.238950014 CEST	443	49856	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:35.240497112 CEST	443	49854	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:35.240525961 CEST	443	49854	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:35.240572929 CEST	443	49854	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:35.240601063 CEST	49854	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:35.240649939 CEST	49854	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:35.240884066 CEST	49854	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:35.240902901 CEST	443	49854	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:35.240915060 CEST	49854	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:35.240921021 CEST	443	49854	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:35.244093895 CEST	49858	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:35.244127989 CEST	443	49858	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:35.244221926 CEST	49858	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:35.244360924 CEST	49858	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:35.244371891 CEST	443	49858	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:35.261035919 CEST	443	49855	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:35.261105061 CEST	443	49855	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:35.261220932 CEST	49855	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:35.261543036 CEST	49855	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:35.261543036 CEST	49855	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:35.261557102 CEST	443	49855	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:35.261567116 CEST	443	49855	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:35.264739990 CEST	49859	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:35.264775038 CEST	443	49859	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:35.264882088 CEST	49859	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:35.265012980 CEST	49859	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:35.265024900 CEST	443	49859	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:35.365266085 CEST	443	49856	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:35.365448952 CEST	443	49856	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:35.365495920 CEST	49856	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:35.365502119 CEST	443	49856	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:35.365551949 CEST	49856	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:35.365724087 CEST	49856	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:35.365742922 CEST	443	49856	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:35.365753889 CEST	49856	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:35.365760088 CEST	443	49856	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:35.369512081 CEST	49860	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:35.369549036 CEST	443	49860	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:35.369618893 CEST	49860	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:35.369813919 CEST	49860	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:35.369826078 CEST	443	49860	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:35.429110050 CEST	443	49857	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:35.429997921 CEST	49857	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:35.430030107 CEST	443	49857	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:35.430706024 CEST	49857	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:35.430711985 CEST	443	49857	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:35.435334921 CEST	443	49853	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:35.435554981 CEST	443	49853	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:35.435656071 CEST	49853	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:35.435714960 CEST	49853	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:35.435714960 CEST	49853	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:35.435733080 CEST	443	49853	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:35.435745001 CEST	443	49853	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:35.439078093 CEST	49861	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:35.439121008 CEST	443	49861	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:35.439218998 CEST	49861	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:35.439394951 CEST	49861	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:35.439403057 CEST	443	49861	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:35.562681913 CEST	443	49857	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:35.562768936 CEST	443	49857	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:35.562979937 CEST	49857	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:35.563195944 CEST	49857	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:35.563218117 CEST	443	49857	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:35.563229084 CEST	49857	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:35.563235998 CEST	443	49857	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:35.567075014 CEST	49862	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:35.567116022 CEST	443	49862	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:35.567209959 CEST	49862	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:35.567368984 CEST	49862	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:35.567380905 CEST	443	49862	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:36.001717091 CEST	443	49858	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:36.002768993 CEST	49858	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:36.002788067 CEST	443	49858	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:36.004133940 CEST	49858	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:36.004141092 CEST	443	49858	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:36.011986971 CEST	443	49859	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:36.012516975 CEST	49859	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:36.012538910 CEST	443	49859	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:36.013338089 CEST	49859	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:36.013353109 CEST	443	49859	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:36.127613068 CEST	443	49860	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:36.128328085 CEST	49860	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:36.128345013 CEST	443	49860	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:36.128839970 CEST	49860	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:36.128844023 CEST	443	49860	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:36.131928921 CEST	443	49858	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:36.131994963 CEST	443	49858	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:36.132052898 CEST	49858	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:36.132287025 CEST	49858	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:36.132313013 CEST	443	49858	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:36.132342100 CEST	49858	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:36.132356882 CEST	443	49858	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:36.135765076 CEST	49863	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:36.135804892 CEST	443	49863	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:36.135938883 CEST	49863	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:36.136118889 CEST	49863	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:36.136137009 CEST	443	49863	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:36.147625923 CEST	443	49859	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:36.147800922 CEST	443	49859	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:36.147881985 CEST	49859	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:36.147977114 CEST	49859	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:36.147977114 CEST	49859	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:36.147996902 CEST	443	49859	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:36.148005962 CEST	443	49859	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:36.151035070 CEST	49864	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:36.151084900 CEST	443	49864	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:36.151185989 CEST	49864	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:36.151381016 CEST	49864	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:36.151400089 CEST	443	49864	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:36.184111118 CEST	443	49861	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:36.184835911 CEST	49861	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:36.184860945 CEST	443	49861	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:36.185246944 CEST	49861	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:36.185254097 CEST	443	49861	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:36.267442942 CEST	443	49860	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:36.267482042 CEST	443	49860	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:36.267534018 CEST	443	49860	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:36.267574072 CEST	49860	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:36.267745972 CEST	49860	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:36.267965078 CEST	49860	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:36.267983913 CEST	443	49860	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:36.267997980 CEST	49860	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:36.268002987 CEST	443	49860	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:36.271919966 CEST	49865	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:36.271966934 CEST	443	49865	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:36.272059917 CEST	49865	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:36.272321939 CEST	49865	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:36.272334099 CEST	443	49865	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:36.296483994 CEST	443	49862	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:36.297152042 CEST	49862	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:36.297182083 CEST	443	49862	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:36.297641039 CEST	49862	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:36.297647953 CEST	443	49862	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:36.315454006 CEST	443	49861	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:36.315759897 CEST	443	49861	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:36.315893888 CEST	49861	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:36.315893888 CEST	49861	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:36.315926075 CEST	49861	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:36.315948009 CEST	443	49861	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:36.319114923 CEST	49866	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:36.319152117 CEST	443	49866	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:36.319248915 CEST	49866	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:36.319447041 CEST	49866	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:36.319458961 CEST	443	49866	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:36.430351973 CEST	443	49862	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:36.430376053 CEST	443	49862	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:36.430425882 CEST	443	49862	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:36.430434942 CEST	49862	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:36.430485010 CEST	49862	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:36.430829048 CEST	49862	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:36.430849075 CEST	443	49862	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:36.430860996 CEST	49862	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:36.430866957 CEST	443	49862	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:36.435767889 CEST	49867	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:36.435825109 CEST	443	49867	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:36.435900927 CEST	49867	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:36.436158895 CEST	49867	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:36.436177015 CEST	443	49867	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:36.872893095 CEST	443	49863	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:36.879951954 CEST	49863	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:36.879976034 CEST	443	49863	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:36.884768963 CEST	49863	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:36.884782076 CEST	443	49863	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:36.889107943 CEST	443	49864	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:36.897692919 CEST	49864	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:36.897718906 CEST	443	49864	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:36.898317099 CEST	49864	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:36.898320913 CEST	443	49864	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:37.011523962 CEST	443	49863	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:37.012309074 CEST	443	49863	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:37.012388945 CEST	49863	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:37.012789011 CEST	443	49865	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:37.019911051 CEST	49863	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:37.019911051 CEST	49863	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:37.019941092 CEST	443	49863	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:37.019953012 CEST	443	49863	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:37.054023981 CEST	443	49864	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:37.054095984 CEST	443	49864	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:37.054162025 CEST	49864	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:37.063697100 CEST	49865	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:37.065787077 CEST	443	49866	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:37.086905956 CEST	49866	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:37.086946964 CEST	443	49866	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:37.087855101 CEST	49866	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:37.087862015 CEST	443	49866	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:37.088046074 CEST	49865	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:37.088073015 CEST	443	49865	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:37.088819981 CEST	49865	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:37.088825941 CEST	443	49865	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:37.089051008 CEST	49864	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:37.089072943 CEST	443	49864	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:37.089087009 CEST	49864	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:37.089095116 CEST	443	49864	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:37.155817986 CEST	443	49867	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:37.182782888 CEST	49868	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:37.182832956 CEST	443	49868	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:37.182936907 CEST	49868	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:37.183903933 CEST	49867	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:37.183934927 CEST	443	49867	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:37.184958935 CEST	49867	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:37.184966087 CEST	443	49867	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:37.186347961 CEST	49868	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:37.186363935 CEST	443	49868	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:37.192168951 CEST	49869	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:37.192267895 CEST	443	49869	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:37.192378044 CEST	49869	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:37.204814911 CEST	49869	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:37.204870939 CEST	443	49869	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:37.231667042 CEST	443	49865	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:37.231987000 CEST	443	49865	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:37.232054949 CEST	49865	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:37.232897997 CEST	49865	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:37.232923031 CEST	443	49865	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:37.232934952 CEST	49865	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:37.232940912 CEST	443	49865	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:37.239119053 CEST	443	49866	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:37.240869999 CEST	443	49866	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:37.240942001 CEST	49866	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:37.311575890 CEST	443	49867	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:37.311654091 CEST	443	49867	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:37.311729908 CEST	49867	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:37.337482929 CEST	49866	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:37.337513924 CEST	443	49866	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:37.337528944 CEST	49866	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:37.337536097 CEST	443	49866	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:37.358706951 CEST	49867	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:37.358743906 CEST	443	49867	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:37.358768940 CEST	49867	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:37.358777046 CEST	443	49867	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:37.402096987 CEST	49870	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:37.402143002 CEST	443	49870	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:37.402288914 CEST	49870	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:37.412276983 CEST	49870	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:37.412293911 CEST	443	49870	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:37.413961887 CEST	49871	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:37.414012909 CEST	443	49871	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:37.414074898 CEST	49871	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:37.414197922 CEST	49871	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:37.414215088 CEST	443	49871	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:37.414858103 CEST	49872	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:37.414894104 CEST	443	49872	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:37.414944887 CEST	49872	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:37.415273905 CEST	49872	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:37.415291071 CEST	443	49872	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:37.918373108 CEST	443	49868	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:37.919112921 CEST	49868	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:37.919123888 CEST	443	49868	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:37.919598103 CEST	49868	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:37.919601917 CEST	443	49868	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:37.928884983 CEST	443	49869	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:37.929425001 CEST	49869	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:37.929490089 CEST	443	49869	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:37.929909945 CEST	49869	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:37.929924965 CEST	443	49869	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:38.052145004 CEST	443	49868	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:38.052227974 CEST	443	49868	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:38.052361965 CEST	49868	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:38.052643061 CEST	49868	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:38.052643061 CEST	49868	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:38.052664995 CEST	443	49868	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:38.052679062 CEST	443	49868	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:38.056047916 CEST	49873	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:38.056085110 CEST	443	49873	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:38.056149006 CEST	49873	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:38.056314945 CEST	49873	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:38.056329966 CEST	443	49873	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:38.059684992 CEST	443	49869	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:38.059742928 CEST	443	49869	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:38.059807062 CEST	49869	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:38.059973001 CEST	49869	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:38.059973001 CEST	49869	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:38.060017109 CEST	443	49869	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:38.060045958 CEST	443	49869	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:38.062325954 CEST	49874	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:38.062352896 CEST	443	49874	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:38.062423944 CEST	49874	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:38.062551022 CEST	49874	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:38.062563896 CEST	443	49874	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:38.144839048 CEST	443	49871	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:38.145632029 CEST	49871	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:38.145692110 CEST	443	49871	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:38.146162033 CEST	49871	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:38.146172047 CEST	443	49871	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:38.152065039 CEST	443	49870	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:38.153656006 CEST	49870	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:38.153656006 CEST	49870	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:38.153678894 CEST	443	49870	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:38.153693914 CEST	443	49870	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:38.163526058 CEST	443	49872	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:38.164001942 CEST	49872	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:38.164036989 CEST	443	49872	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:38.164387941 CEST	49872	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:38.164396048 CEST	443	49872	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:38.279082060 CEST	443	49871	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:38.279153109 CEST	443	49871	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:38.279208899 CEST	49871	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:38.279516935 CEST	49871	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:38.279532909 CEST	443	49871	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:38.279546976 CEST	49871	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:38.279552937 CEST	443	49871	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:38.283188105 CEST	49875	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:38.283227921 CEST	443	49875	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:38.283296108 CEST	49875	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:38.283500910 CEST	49875	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:38.283515930 CEST	443	49875	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:38.284977913 CEST	443	49870	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:38.284997940 CEST	443	49870	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:38.285065889 CEST	443	49870	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:38.285077095 CEST	49870	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:38.285187006 CEST	49870	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:38.285330057 CEST	49870	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:38.285330057 CEST	49870	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:38.285345078 CEST	443	49870	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:38.285355091 CEST	443	49870	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:38.287563086 CEST	49876	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:38.287584066 CEST	443	49876	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:38.287653923 CEST	49876	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:38.287827015 CEST	49876	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:38.287838936 CEST	443	49876	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:38.299410105 CEST	443	49872	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:38.299474001 CEST	443	49872	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:38.299520016 CEST	49872	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:38.299679995 CEST	49872	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:38.299701929 CEST	443	49872	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:38.299720049 CEST	49872	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:38.299736977 CEST	443	49872	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:38.302011967 CEST	49877	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:38.302043915 CEST	443	49877	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:38.302179098 CEST	49877	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:38.302321911 CEST	49877	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:38.302329063 CEST	443	49877	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:38.801495075 CEST	443	49873	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:38.802778006 CEST	49873	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:38.802819967 CEST	443	49873	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:38.811234951 CEST	49873	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:38.811244965 CEST	443	49873	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:38.859946012 CEST	443	49874	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:38.860651970 CEST	49874	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:38.860685110 CEST	443	49874	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:38.861278057 CEST	49874	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:38.861284971 CEST	443	49874	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:38.940030098 CEST	443	49873	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:38.940582991 CEST	443	49873	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:38.940639019 CEST	49873	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:38.940707922 CEST	49873	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:38.940726995 CEST	443	49873	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:38.940747976 CEST	49873	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:38.940752983 CEST	443	49873	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:38.944279909 CEST	49878	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:38.944324017 CEST	443	49878	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:38.944384098 CEST	49878	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:38.944529057 CEST	49878	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:38.944535017 CEST	443	49878	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:39.018449068 CEST	443	49875	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:39.019013882 CEST	49875	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:39.019038916 CEST	443	49875	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:39.019565105 CEST	49875	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:39.019570112 CEST	443	49875	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:39.022337914 CEST	443	49876	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:39.022818089 CEST	49876	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:39.022838116 CEST	443	49876	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:39.023245096 CEST	49876	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:39.023251057 CEST	443	49876	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:39.027745008 CEST	443	49874	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:39.027767897 CEST	443	49874	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:39.027827024 CEST	49874	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:39.027856112 CEST	443	49874	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:39.028017044 CEST	49874	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:39.028024912 CEST	443	49874	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:39.028043032 CEST	49874	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:39.028176069 CEST	443	49874	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:39.028203964 CEST	443	49874	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:39.028240919 CEST	49874	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:39.030201912 CEST	443	49877	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:39.030688047 CEST	49877	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:39.030706882 CEST	443	49877	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:39.031100035 CEST	49877	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:39.031105042 CEST	443	49877	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:39.032758951 CEST	49879	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:39.032788038 CEST	443	49879	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:39.033027887 CEST	49879	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:39.033027887 CEST	49879	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:39.033061028 CEST	443	49879	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:39.150928974 CEST	443	49875	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:39.154397011 CEST	443	49876	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:39.154429913 CEST	443	49876	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:39.154484987 CEST	443	49876	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:39.154649019 CEST	49876	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:39.154649019 CEST	49876	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:39.155780077 CEST	49876	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:39.155800104 CEST	443	49876	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:39.155870914 CEST	49876	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:39.155877113 CEST	443	49876	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:39.157668114 CEST	443	49875	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:39.157736063 CEST	443	49875	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:39.157737970 CEST	49875	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:39.157789946 CEST	49875	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:39.158457041 CEST	49875	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:39.158480883 CEST	443	49875	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:39.158493042 CEST	49875	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:39.158499002 CEST	443	49875	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:39.163867950 CEST	49880	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:39.163913965 CEST	443	49880	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:39.164001942 CEST	49880	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:39.183567047 CEST	49881	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:39.183615923 CEST	443	49881	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:39.183620930 CEST	49880	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:39.183656931 CEST	443	49880	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:39.183757067 CEST	49881	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:39.183859110 CEST	49881	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:39.183873892 CEST	443	49881	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:39.249612093 CEST	443	49877	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:39.249720097 CEST	443	49877	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:39.249792099 CEST	49877	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:39.250138998 CEST	49877	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:39.250138998 CEST	49877	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:39.250160933 CEST	443	49877	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:39.250169992 CEST	443	49877	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:39.254429102 CEST	49882	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:39.254471064 CEST	443	49882	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:39.254534006 CEST	49882	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:39.254746914 CEST	49882	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:39.254760981 CEST	443	49882	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:39.676652908 CEST	443	49878	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:39.677475929 CEST	49878	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:39.677509069 CEST	443	49878	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:39.678016901 CEST	49878	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:39.678028107 CEST	443	49878	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:40.140935898 CEST	443	49878	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:40.140969038 CEST	443	49878	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:40.141016960 CEST	443	49878	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:40.141208887 CEST	49878	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:40.141571045 CEST	49878	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:40.141571045 CEST	49878	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:40.141623974 CEST	443	49878	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:40.141654015 CEST	443	49878	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:40.142891884 CEST	443	49879	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:40.144905090 CEST	49879	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:40.144937992 CEST	443	49879	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:40.145195007 CEST	49879	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:40.145200968 CEST	443	49879	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:40.145908117 CEST	49883	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:40.145956993 CEST	443	49883	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:40.146030903 CEST	49883	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:40.146183968 CEST	49883	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:40.146199942 CEST	443	49883	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:40.279083014 CEST	443	49880	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:40.279892921 CEST	443	49879	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:40.280018091 CEST	49880	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:40.280050039 CEST	443	49880	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:40.280086994 CEST	443	49879	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:40.280574083 CEST	49880	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:40.280580997 CEST	443	49880	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:40.280632019 CEST	443	49881	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:40.280642986 CEST	49879	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:40.280702114 CEST	49879	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:40.280723095 CEST	443	49879	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:40.280764103 CEST	49879	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:40.280771017 CEST	443	49879	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:40.281017065 CEST	49881	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:40.281049013 CEST	443	49881	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:40.281455994 CEST	49881	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:40.281464100 CEST	443	49881	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:40.283767939 CEST	443	49882	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:40.284210920 CEST	49882	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:40.284229040 CEST	443	49882	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:40.284668922 CEST	49882	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:40.284674883 CEST	443	49882	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:40.285244942 CEST	49884	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:40.285286903 CEST	443	49884	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:40.285361052 CEST	49884	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:40.285607100 CEST	49884	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:40.285624027 CEST	443	49884	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:40.417480946 CEST	443	49882	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:40.417515993 CEST	443	49882	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:40.417577982 CEST	443	49882	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:40.417634964 CEST	49882	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:40.417690992 CEST	49882	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:40.418020964 CEST	49882	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:40.418020964 CEST	49882	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:40.418044090 CEST	443	49882	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:40.418049097 CEST	443	49882	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:40.421567917 CEST	443	49880	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:40.421602011 CEST	443	49880	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:40.421659946 CEST	443	49880	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:40.421700954 CEST	49880	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:40.421710968 CEST	49885	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:40.421752930 CEST	49880	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:40.421765089 CEST	443	49885	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:40.421838045 CEST	49885	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:40.421917915 CEST	49880	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:40.421930075 CEST	443	49880	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:40.421946049 CEST	49880	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:40.421951056 CEST	443	49880	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:40.422087908 CEST	49885	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:40.422101974 CEST	443	49885	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:40.425367117 CEST	49886	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:40.425403118 CEST	443	49886	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:40.425509930 CEST	49886	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:40.425739050 CEST	49886	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:40.425753117 CEST	443	49886	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:40.754987955 CEST	443	49881	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:40.755019903 CEST	443	49881	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:40.755086899 CEST	443	49881	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:40.755177975 CEST	49881	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:40.755225897 CEST	49881	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:40.755625010 CEST	49881	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:40.755646944 CEST	443	49881	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:40.755660057 CEST	49881	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:40.755673885 CEST	443	49881	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:40.759618044 CEST	49887	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:40.759665966 CEST	443	49887	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:40.759790897 CEST	49887	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:40.760067940 CEST	49887	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:40.760086060 CEST	443	49887	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:40.934281111 CEST	443	49883	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:40.935122967 CEST	49883	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:40.935146093 CEST	443	49883	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:40.935627937 CEST	49883	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:40.935632944 CEST	443	49883	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:41.024152994 CEST	443	49884	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:41.024758101 CEST	49884	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:41.024776936 CEST	443	49884	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:41.025255919 CEST	49884	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:41.025262117 CEST	443	49884	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:41.066983938 CEST	443	49883	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:41.067915916 CEST	443	49883	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:41.067982912 CEST	49883	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:41.068041086 CEST	49883	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:41.068063974 CEST	443	49883	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:41.068075895 CEST	49883	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:41.068080902 CEST	443	49883	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:41.071554899 CEST	49888	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:41.071580887 CEST	443	49888	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:41.071640968 CEST	49888	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:41.071870089 CEST	49888	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:41.071885109 CEST	443	49888	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:41.148761034 CEST	443	49885	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:41.149463892 CEST	49885	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:41.149490118 CEST	443	49885	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:41.149971962 CEST	49885	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:41.149976969 CEST	443	49885	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:41.155869007 CEST	443	49884	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:41.155956030 CEST	443	49884	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:41.156101942 CEST	49884	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:41.156141043 CEST	49884	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:41.156160116 CEST	443	49884	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:41.156197071 CEST	49884	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:41.156203985 CEST	443	49884	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:41.159349918 CEST	49889	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:41.159394026 CEST	443	49889	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:41.159461975 CEST	49889	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:41.159643888 CEST	49889	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:41.159658909 CEST	443	49889	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:41.182198048 CEST	443	49886	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:41.182770014 CEST	49886	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:41.182782888 CEST	443	49886	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:41.183274984 CEST	49886	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:41.183279991 CEST	443	49886	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:41.278434992 CEST	443	49885	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:41.278517008 CEST	443	49885	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:41.278595924 CEST	49885	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:41.278834105 CEST	49885	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:41.278850079 CEST	443	49885	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:41.278858900 CEST	49885	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:41.278865099 CEST	443	49885	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:41.282300949 CEST	49890	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:41.282416105 CEST	443	49890	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:41.282500982 CEST	49890	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:41.282771111 CEST	49890	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:41.282809973 CEST	443	49890	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:41.314426899 CEST	443	49886	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:41.315653086 CEST	443	49886	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:41.315721035 CEST	443	49886	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:41.315730095 CEST	49886	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:41.315767050 CEST	49886	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:41.315839052 CEST	49886	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:41.315851927 CEST	443	49886	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:41.315864086 CEST	49886	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:41.315870047 CEST	443	49886	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:41.318789959 CEST	49891	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:41.318810940 CEST	443	49891	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:41.319037914 CEST	49891	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:41.319185972 CEST	49891	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:41.319200993 CEST	443	49891	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:41.586097002 CEST	443	49887	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:41.586899042 CEST	49887	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:41.586926937 CEST	443	49887	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:41.587447882 CEST	49887	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:41.587454081 CEST	443	49887	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:41.809252977 CEST	443	49888	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:41.810209990 CEST	49888	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:41.810230017 CEST	443	49888	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:41.810746908 CEST	49888	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:41.810754061 CEST	443	49888	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:41.887326002 CEST	443	49889	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:41.887501955 CEST	443	49887	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:41.887784958 CEST	443	49887	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:41.887876987 CEST	49887	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:41.887928009 CEST	49887	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:41.887940884 CEST	443	49887	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:41.887953997 CEST	49887	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:41.887954950 CEST	49889	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:41.887959003 CEST	443	49887	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:41.887989044 CEST	443	49889	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:41.888452053 CEST	49889	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:41.888458967 CEST	443	49889	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:41.891257048 CEST	49892	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:41.891294956 CEST	443	49892	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:41.891386032 CEST	49892	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:41.891549110 CEST	49892	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:41.891566038 CEST	443	49892	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:41.941508055 CEST	443	49888	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:41.941543102 CEST	443	49888	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:41.941586971 CEST	443	49888	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:41.941656113 CEST	49888	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:41.941720963 CEST	49888	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:41.942024946 CEST	49888	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:41.942066908 CEST	443	49888	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:41.942097902 CEST	49888	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:41.942114115 CEST	443	49888	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:41.945703030 CEST	49893	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:41.945738077 CEST	443	49893	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:41.945825100 CEST	49893	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:41.946037054 CEST	49893	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:41.946049929 CEST	443	49893	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:42.018444061 CEST	443	49889	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:42.018532038 CEST	443	49889	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:42.018587112 CEST	49889	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:42.018870115 CEST	49889	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:42.018883944 CEST	443	49889	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:42.018893003 CEST	49889	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:42.018898010 CEST	443	49889	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:42.021542072 CEST	443	49890	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:42.022110939 CEST	49890	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:42.022135973 CEST	443	49890	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:42.022679090 CEST	49890	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:42.022687912 CEST	443	49890	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:42.023322105 CEST	49894	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:42.023356915 CEST	443	49894	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:42.023431063 CEST	49894	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:42.023622990 CEST	49894	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:42.023637056 CEST	443	49894	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:42.057461977 CEST	443	49891	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:42.058104038 CEST	49891	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:42.058113098 CEST	443	49891	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:42.058804035 CEST	49891	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:42.058809042 CEST	443	49891	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:42.158078909 CEST	443	49890	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:42.158113003 CEST	443	49890	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:42.158171892 CEST	443	49890	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:42.158220053 CEST	49890	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:42.158266068 CEST	49890	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:42.158586025 CEST	49890	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:42.158611059 CEST	443	49890	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:42.158622980 CEST	49890	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:42.158627987 CEST	443	49890	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:42.162161112 CEST	49895	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:42.162203074 CEST	443	49895	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:42.162409067 CEST	49895	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:42.162506104 CEST	49895	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:42.162512064 CEST	443	49895	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:42.187306881 CEST	443	49891	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:42.187493086 CEST	443	49891	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:42.187546015 CEST	49891	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:42.187681913 CEST	49891	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:42.187704086 CEST	443	49891	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:42.187716007 CEST	49891	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:42.187721968 CEST	443	49891	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:42.191450119 CEST	49896	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:42.191494942 CEST	443	49896	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:42.191567898 CEST	49896	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:42.191729069 CEST	49896	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:42.191751957 CEST	443	49896	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:43.789904118 CEST	443	49892	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:43.790630102 CEST	49892	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:43.790654898 CEST	443	49892	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:43.791100979 CEST	49892	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:43.791110039 CEST	443	49892	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:43.909379005 CEST	443	49894	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:43.910022974 CEST	49894	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:43.910051107 CEST	443	49894	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:43.910470009 CEST	49894	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:43.910478115 CEST	443	49894	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:43.917371035 CEST	443	49893	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:43.918071032 CEST	49893	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:43.918092966 CEST	443	49893	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:43.918561935 CEST	49893	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:43.918567896 CEST	443	49893	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:43.925379038 CEST	443	49895	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:43.926455975 CEST	49895	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:43.926476002 CEST	443	49895	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:43.926995039 CEST	49895	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:43.927000999 CEST	443	49895	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:43.929549932 CEST	443	49896	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:43.929905891 CEST	49896	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:43.929935932 CEST	443	49896	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:43.930260897 CEST	49896	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:43.930268049 CEST	443	49896	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:43.930512905 CEST	443	49892	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:43.930583000 CEST	443	49892	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:43.930649996 CEST	49892	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:43.930998087 CEST	49892	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:43.930999041 CEST	49892	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:43.931026936 CEST	443	49892	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:43.931041002 CEST	443	49892	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:43.934559107 CEST	49897	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:43.934600115 CEST	443	49897	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:43.934673071 CEST	49897	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:43.934840918 CEST	49897	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:43.934850931 CEST	443	49897	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:44.039911032 CEST	443	49894	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:44.039993048 CEST	443	49894	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:44.040074110 CEST	49894	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:44.040474892 CEST	49894	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:44.040474892 CEST	49894	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:44.040504932 CEST	443	49894	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:44.040522099 CEST	443	49894	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:44.044028044 CEST	49898	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:44.044068098 CEST	443	49898	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:44.044163942 CEST	49898	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:44.044393063 CEST	49898	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:44.044411898 CEST	443	49898	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:44.047795057 CEST	443	49893	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:44.047863960 CEST	443	49893	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:44.047934055 CEST	49893	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:44.048254013 CEST	49893	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:44.048254013 CEST	49893	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:44.048280001 CEST	443	49893	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:44.048290014 CEST	443	49893	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:44.051352024 CEST	49899	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:44.051395893 CEST	443	49899	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:44.051489115 CEST	49899	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:44.051687002 CEST	49899	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:44.051702976 CEST	443	49899	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:44.057522058 CEST	443	49895	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:44.057600021 CEST	443	49895	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:44.057727098 CEST	49895	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:44.057871103 CEST	49895	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:44.057871103 CEST	49895	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:44.057882071 CEST	443	49895	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:44.057889938 CEST	443	49895	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:44.060920954 CEST	49900	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:44.060952902 CEST	443	49900	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:44.061052084 CEST	49900	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:44.061209917 CEST	49900	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:44.061223030 CEST	443	49900	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:44.095768929 CEST	443	49896	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:44.096065044 CEST	443	49896	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:44.096148014 CEST	443	49896	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:44.096163034 CEST	49896	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:44.096206903 CEST	49896	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:44.096276999 CEST	49896	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:44.096295118 CEST	443	49896	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:44.096309900 CEST	49896	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:44.096318007 CEST	443	49896	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:44.099674940 CEST	49901	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:44.099716902 CEST	443	49901	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:44.099785089 CEST	49901	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:44.099948883 CEST	49901	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:44.099956036 CEST	443	49901	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:44.815387964 CEST	443	49898	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:44.815972090 CEST	49898	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:44.816014051 CEST	443	49898	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:44.816548109 CEST	49898	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:44.816560984 CEST	443	49898	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:44.817297935 CEST	443	49900	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:44.817612886 CEST	443	49899	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:44.817662954 CEST	49900	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:44.817677975 CEST	443	49900	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:44.817888975 CEST	49899	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:44.817909956 CEST	443	49899	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:44.818146944 CEST	49900	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:44.818154097 CEST	443	49900	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:44.818303108 CEST	49899	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:44.818319082 CEST	443	49899	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:44.818584919 CEST	443	49897	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:44.818869114 CEST	49897	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:44.818882942 CEST	443	49897	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:44.819298029 CEST	49897	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:44.819303036 CEST	443	49897	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:44.832307100 CEST	443	49901	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:44.832806110 CEST	49901	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:44.832824945 CEST	443	49901	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:44.833260059 CEST	49901	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:44.833271980 CEST	443	49901	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:44.947804928 CEST	443	49900	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:44.947839975 CEST	443	49900	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:44.947895050 CEST	443	49900	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:44.947921038 CEST	49900	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:44.947962999 CEST	49900	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:44.948246002 CEST	49900	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:44.948271990 CEST	443	49900	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:44.948282003 CEST	49900	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:44.948288918 CEST	443	49900	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:44.951524973 CEST	443	49897	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:44.951654911 CEST	49902	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:44.951675892 CEST	443	49902	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:44.951710939 CEST	443	49897	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:44.951755047 CEST	443	49899	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:44.951756954 CEST	49902	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:44.951797962 CEST	49897	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:44.951878071 CEST	49897	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:44.951878071 CEST	49897	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:44.951894045 CEST	443	49897	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:44.951904058 CEST	443	49897	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:44.951910019 CEST	443	49899	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:44.951925993 CEST	49902	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:44.951940060 CEST	443	49902	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:44.951984882 CEST	49899	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:44.952095032 CEST	49899	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:44.952095032 CEST	49899	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:44.952100039 CEST	443	49899	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:44.952106953 CEST	443	49899	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:44.954806089 CEST	49904	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:44.954828978 CEST	443	49904	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:44.954849958 CEST	49903	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:44.954879999 CEST	443	49903	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:44.954900980 CEST	49904	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:44.954926968 CEST	49903	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:44.955329895 CEST	49904	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:44.955341101 CEST	443	49904	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:44.955398083 CEST	49903	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:44.955410957 CEST	443	49903	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:44.963758945 CEST	443	49901	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:44.965742111 CEST	443	49901	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:44.965801954 CEST	49901	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:44.965837955 CEST	49901	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:44.965857983 CEST	443	49901	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:44.965871096 CEST	49901	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:44.965877056 CEST	443	49901	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:44.968209982 CEST	49905	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:44.968246937 CEST	443	49905	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:44.968319893 CEST	49905	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:44.968446016 CEST	49905	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:44.968461990 CEST	443	49905	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:45.113322973 CEST	443	49898	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:45.113393068 CEST	443	49898	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:45.113454103 CEST	49898	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:45.113464117 CEST	443	49898	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:45.113519907 CEST	443	49898	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:45.113837957 CEST	49898	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:45.113837957 CEST	49898	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:45.113854885 CEST	49898	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:45.113862038 CEST	443	49898	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:45.117552996 CEST	49906	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:45.117575884 CEST	443	49906	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:45.117686033 CEST	49906	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:45.117852926 CEST	49906	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:45.117858887 CEST	443	49906	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:46.598345995 CEST	443	49902	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:46.599056005 CEST	49902	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:46.599075079 CEST	443	49902	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:46.599627972 CEST	49902	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:46.599637985 CEST	443	49902	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:46.600332975 CEST	443	49905	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:46.600617886 CEST	49905	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:46.600644112 CEST	443	49905	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:46.600970030 CEST	49905	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:46.600975990 CEST	443	49905	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:46.627988100 CEST	443	49903	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:46.628046036 CEST	443	49906	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:46.628431082 CEST	49903	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:46.628449917 CEST	443	49903	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:46.628473997 CEST	49906	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:46.628489971 CEST	443	49906	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:46.628865004 CEST	49906	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:46.628870010 CEST	443	49906	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:46.629021883 CEST	49903	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:46.629026890 CEST	443	49903	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:46.737786055 CEST	443	49902	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:46.737821102 CEST	443	49902	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:46.737879038 CEST	443	49902	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:46.737929106 CEST	49902	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:46.737961054 CEST	49902	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:46.738251925 CEST	49902	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:46.738272905 CEST	443	49902	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:46.738284111 CEST	49902	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:46.738290071 CEST	443	49902	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:46.741746902 CEST	49907	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:46.741796017 CEST	443	49907	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:46.741893053 CEST	49907	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:46.742100954 CEST	49907	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:46.742119074 CEST	443	49907	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:46.760302067 CEST	443	49903	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:46.760329962 CEST	443	49903	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:46.760394096 CEST	443	49903	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:46.760436058 CEST	49903	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:46.760472059 CEST	49903	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:46.760833979 CEST	49903	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:46.760834932 CEST	49903	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:46.760850906 CEST	443	49903	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:46.760858059 CEST	443	49903	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:46.763921976 CEST	49908	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:46.763947964 CEST	443	49908	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:46.764033079 CEST	49908	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:46.764233112 CEST	49908	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:46.764245033 CEST	443	49908	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:46.768856049 CEST	443	49906	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:46.768927097 CEST	443	49906	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:46.768979073 CEST	49906	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:46.769000053 CEST	443	49906	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:46.769051075 CEST	443	49906	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:46.769095898 CEST	49906	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:46.769227982 CEST	49906	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:46.769247055 CEST	443	49906	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:46.769257069 CEST	49906	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:46.769264936 CEST	443	49906	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:46.772140026 CEST	49909	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:46.772156000 CEST	443	49909	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:46.772221088 CEST	49909	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:46.772413969 CEST	49909	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:46.772428036 CEST	443	49909	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:46.855652094 CEST	443	49905	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:46.855685949 CEST	443	49905	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:46.855791092 CEST	443	49905	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:46.855868101 CEST	49905	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:46.855931997 CEST	49905	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:46.856259108 CEST	49905	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:46.856280088 CEST	443	49905	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:46.856295109 CEST	49905	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:46.856303930 CEST	443	49905	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:46.859785080 CEST	49910	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:46.859822035 CEST	443	49910	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:46.859911919 CEST	49910	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:46.860099077 CEST	49910	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:46.860107899 CEST	443	49910	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:47.478955984 CEST	443	49907	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:47.479626894 CEST	49907	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:47.479651928 CEST	443	49907	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:47.480159998 CEST	49907	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:47.480165958 CEST	443	49907	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:47.501338959 CEST	443	49908	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:47.501869917 CEST	49908	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:47.501893044 CEST	443	49908	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:47.502367020 CEST	49908	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:47.502382040 CEST	443	49908	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:47.517441034 CEST	443	49909	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:47.518069029 CEST	49909	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:47.518078089 CEST	443	49909	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:47.518434048 CEST	49909	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:47.518436909 CEST	443	49909	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:47.563657999 CEST	443	49904	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:47.564690113 CEST	49904	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:47.564711094 CEST	443	49904	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:47.565179110 CEST	49904	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:47.565184116 CEST	443	49904	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:47.600250006 CEST	443	49910	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:47.600956917 CEST	49910	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:47.601001978 CEST	443	49910	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:47.601459026 CEST	49910	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:47.601468086 CEST	443	49910	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:47.622993946 CEST	443	49907	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:47.623070002 CEST	443	49907	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:47.623143911 CEST	49907	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:47.623478889 CEST	49907	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:47.623501062 CEST	443	49907	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:47.623513937 CEST	49907	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:47.623519897 CEST	443	49907	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:47.627054930 CEST	49912	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:47.627095938 CEST	443	49912	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:47.627171040 CEST	49912	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:47.627343893 CEST	49912	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:47.627360106 CEST	443	49912	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:47.638300896 CEST	443	49908	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:47.638329983 CEST	443	49908	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:47.638377905 CEST	443	49908	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:47.638405085 CEST	49908	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:47.638442993 CEST	49908	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:47.638756990 CEST	49908	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:47.638780117 CEST	443	49908	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:47.638794899 CEST	49908	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:47.638803005 CEST	443	49908	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:47.641977072 CEST	49913	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:47.642014027 CEST	443	49913	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:47.642107010 CEST	49913	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:47.642273903 CEST	49913	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:47.642290115 CEST	443	49913	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:47.650587082 CEST	443	49909	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:47.651032925 CEST	443	49909	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:47.651114941 CEST	49909	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:47.651153088 CEST	49909	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:47.651153088 CEST	49909	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:47.651169062 CEST	443	49909	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:47.651177883 CEST	443	49909	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:47.653881073 CEST	49914	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:47.653904915 CEST	443	49914	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:47.653986931 CEST	49914	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:47.654155016 CEST	49914	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:47.654167891 CEST	443	49914	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:47.743439913 CEST	443	49904	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:47.743619919 CEST	443	49904	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:47.743725061 CEST	49904	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:47.743958950 CEST	49904	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:47.743958950 CEST	49904	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:47.743974924 CEST	443	49904	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:47.743983984 CEST	443	49904	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:47.744600058 CEST	443	49910	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:47.745836973 CEST	443	49910	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:47.745899916 CEST	443	49910	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:47.745928049 CEST	49910	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:47.745970011 CEST	49910	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:47.746660948 CEST	49910	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:47.746692896 CEST	443	49910	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:47.746707916 CEST	49910	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:47.746716976 CEST	443	49910	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:47.748451948 CEST	49915	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:47.748492002 CEST	443	49915	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:47.748570919 CEST	49915	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:47.749732018 CEST	49916	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:47.749757051 CEST	443	49916	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:47.749830008 CEST	49916	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:47.749908924 CEST	49915	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:47.749932051 CEST	443	49915	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:47.750014067 CEST	49916	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:47.750026941 CEST	443	49916	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:48.368828058 CEST	443	49912	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:48.369842052 CEST	49912	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:48.369878054 CEST	443	49912	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:48.370440006 CEST	49912	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:48.370448112 CEST	443	49912	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:48.388714075 CEST	443	49913	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:48.389460087 CEST	49913	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:48.389537096 CEST	443	49913	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:48.389981985 CEST	49913	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:48.389997959 CEST	443	49913	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:48.401983976 CEST	443	49914	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:48.402584076 CEST	49914	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:48.402612925 CEST	443	49914	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:48.403098106 CEST	49914	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:48.403104067 CEST	443	49914	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:48.487557888 CEST	443	49915	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:48.488270044 CEST	49915	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:48.488305092 CEST	443	49915	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:48.488815069 CEST	49915	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:48.488826036 CEST	443	49915	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:48.500500917 CEST	443	49912	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:48.500581026 CEST	443	49912	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:48.500719070 CEST	49912	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:48.501014948 CEST	49912	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:48.501014948 CEST	49912	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:48.501034975 CEST	443	49912	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:48.501049042 CEST	443	49912	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:48.504745960 CEST	49917	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:48.504784107 CEST	443	49917	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:48.504883051 CEST	49917	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:48.505093098 CEST	49917	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:48.505119085 CEST	443	49917	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:48.506496906 CEST	443	49916	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:48.506992102 CEST	49916	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:48.507000923 CEST	443	49916	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:48.507467985 CEST	49916	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:48.507472992 CEST	443	49916	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:48.522531986 CEST	443	49913	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:48.522612095 CEST	443	49913	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:48.522713900 CEST	49913	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:48.522742987 CEST	443	49913	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:48.522777081 CEST	443	49913	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:48.522835016 CEST	49913	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:48.523113966 CEST	49913	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:48.523149967 CEST	443	49913	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:48.523175955 CEST	49913	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:48.523190975 CEST	443	49913	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:48.526469946 CEST	49918	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:48.526519060 CEST	443	49918	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:48.526681900 CEST	49918	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:48.526835918 CEST	49918	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:48.526848078 CEST	443	49918	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:48.534956932 CEST	443	49914	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:48.535032034 CEST	443	49914	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:48.535085917 CEST	49914	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:48.535275936 CEST	49914	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:48.535290956 CEST	443	49914	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:48.535303116 CEST	49914	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:48.535307884 CEST	443	49914	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:48.538083076 CEST	49919	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:48.538105965 CEST	443	49919	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:48.538175106 CEST	49919	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:48.538331032 CEST	49919	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:48.538346052 CEST	443	49919	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:48.637151957 CEST	443	49915	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:48.637180090 CEST	443	49915	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:48.637231112 CEST	443	49915	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:48.637280941 CEST	49915	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:48.637315989 CEST	49915	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:48.637628078 CEST	49915	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:48.637650967 CEST	443	49915	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:48.637674093 CEST	49915	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:48.637685061 CEST	443	49915	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:48.640938997 CEST	49920	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:48.640976906 CEST	443	49920	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:48.641078949 CEST	49920	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:48.641256094 CEST	49920	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:48.641271114 CEST	443	49920	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:48.641685009 CEST	443	49916	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:48.641750097 CEST	443	49916	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:48.641817093 CEST	49916	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:48.642087936 CEST	49916	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:48.642087936 CEST	49916	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:48.642102957 CEST	443	49916	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:48.642112017 CEST	443	49916	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:48.644706011 CEST	49921	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:48.644740105 CEST	443	49921	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:48.644824982 CEST	49921	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:48.645013094 CEST	49921	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:48.645029068 CEST	443	49921	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:49.253757954 CEST	443	49917	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:49.254324913 CEST	49917	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:49.254349947 CEST	443	49917	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:49.254859924 CEST	49917	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:49.254867077 CEST	443	49917	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:49.274286985 CEST	443	49918	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:49.274893045 CEST	49918	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:49.274905920 CEST	443	49918	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:49.275425911 CEST	49918	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:49.275429964 CEST	443	49918	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:49.293644905 CEST	443	49919	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:49.294142962 CEST	49919	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:49.294174910 CEST	443	49919	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:49.294625044 CEST	49919	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:49.294631958 CEST	443	49919	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:49.362495899 CEST	443	49920	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:49.363028049 CEST	49920	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:49.363063097 CEST	443	49920	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:49.363517046 CEST	49920	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:49.363527060 CEST	443	49920	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:49.380626917 CEST	443	49921	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:49.383485079 CEST	49921	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:49.383511066 CEST	443	49921	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:49.383970976 CEST	49921	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:49.383977890 CEST	443	49921	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:49.398241997 CEST	443	49917	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:49.398319960 CEST	443	49917	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:49.398433924 CEST	49917	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:49.398747921 CEST	49917	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:49.398747921 CEST	49917	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:49.398788929 CEST	443	49917	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:49.398816109 CEST	443	49917	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:49.401783943 CEST	49922	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:49.401822090 CEST	443	49922	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:49.401887894 CEST	49922	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:49.402045965 CEST	49922	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:49.402055025 CEST	443	49922	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:49.419676065 CEST	443	49918	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:49.420312881 CEST	443	49918	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:49.420398951 CEST	49918	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:49.420416117 CEST	443	49918	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:49.420435905 CEST	443	49918	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:49.420489073 CEST	49918	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:49.420717001 CEST	49918	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:49.420731068 CEST	443	49918	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:49.420742989 CEST	49918	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:49.420747042 CEST	443	49918	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:49.424293995 CEST	49923	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:49.424321890 CEST	443	49923	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:49.424391031 CEST	49923	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:49.424588919 CEST	49923	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:49.424602985 CEST	443	49923	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:49.428013086 CEST	443	49919	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:49.428179026 CEST	443	49919	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:49.428255081 CEST	49919	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:49.428416014 CEST	49919	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:49.428425074 CEST	443	49919	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:49.428437948 CEST	49919	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:49.428445101 CEST	443	49919	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:49.430846930 CEST	49924	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:49.430882931 CEST	443	49924	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:49.430969000 CEST	49924	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:49.431126118 CEST	49924	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:49.431153059 CEST	443	49924	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:49.492342949 CEST	443	49920	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:49.492407084 CEST	443	49920	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:49.492657900 CEST	49920	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:49.492842913 CEST	49920	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:49.492866039 CEST	443	49920	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:49.492883921 CEST	49920	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:49.492891073 CEST	443	49920	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:49.499335051 CEST	49925	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:49.499371052 CEST	443	49925	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:49.499623060 CEST	49925	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:49.499623060 CEST	49925	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:49.499655008 CEST	443	49925	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:49.515081882 CEST	443	49921	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:49.515110016 CEST	443	49921	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:49.515165091 CEST	443	49921	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:49.515182972 CEST	49921	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:49.515933037 CEST	49921	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:49.515933037 CEST	49921	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:49.515933037 CEST	49921	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:49.518624067 CEST	49926	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:49.518663883 CEST	443	49926	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:49.518724918 CEST	49926	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:49.518861055 CEST	49926	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:49.518872023 CEST	443	49926	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:49.829340935 CEST	49921	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:49.829374075 CEST	443	49921	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:50.155180931 CEST	443	49922	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:50.158483982 CEST	49922	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:50.158495903 CEST	443	49922	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:50.159013033 CEST	49922	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:50.159018040 CEST	443	49922	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:50.162098885 CEST	443	49923	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:50.164397001 CEST	49923	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:50.164432049 CEST	443	49923	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:50.164894104 CEST	49923	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:50.164900064 CEST	443	49923	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:50.172797918 CEST	443	49924	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:50.176568985 CEST	49924	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:50.176594973 CEST	443	49924	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:50.177057981 CEST	49924	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:50.177064896 CEST	443	49924	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:50.241998911 CEST	443	49925	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:50.243920088 CEST	49925	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:50.243932962 CEST	443	49925	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:50.244488955 CEST	49925	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:50.244494915 CEST	443	49925	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:50.261913061 CEST	443	49926	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:50.264435053 CEST	49926	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:50.264447927 CEST	443	49926	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:50.264935017 CEST	49926	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:50.264940023 CEST	443	49926	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:50.288837910 CEST	443	49922	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:50.289024115 CEST	443	49922	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:50.289082050 CEST	49922	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:50.289175987 CEST	49922	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:50.289189100 CEST	443	49922	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:50.289203882 CEST	49922	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:50.289210081 CEST	443	49922	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:50.292587996 CEST	49927	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:50.292613983 CEST	443	49927	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:50.292715073 CEST	49927	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:50.292869091 CEST	49927	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:50.292882919 CEST	443	49927	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:50.303529978 CEST	443	49924	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:50.303621054 CEST	443	49924	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:50.303673983 CEST	49924	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:50.303813934 CEST	49924	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:50.303827047 CEST	443	49924	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:50.303841114 CEST	49924	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:50.303845882 CEST	443	49924	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:50.306703091 CEST	49928	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:50.306729078 CEST	443	49928	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:50.306796074 CEST	49928	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:50.306910992 CEST	49928	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:50.306925058 CEST	443	49928	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:50.352358103 CEST	443	49923	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:50.352436066 CEST	443	49923	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:50.352490902 CEST	49923	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:50.352504015 CEST	443	49923	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:50.352564096 CEST	443	49923	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:50.352612972 CEST	49923	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:50.352752924 CEST	49923	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:50.352766991 CEST	443	49923	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:50.352777004 CEST	49923	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:50.352781057 CEST	443	49923	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:50.355705976 CEST	49929	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:50.355732918 CEST	443	49929	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:50.355808020 CEST	49929	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:50.355967045 CEST	49929	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:50.355973959 CEST	443	49929	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:50.379136086 CEST	443	49925	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:50.379184008 CEST	443	49925	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:50.379265070 CEST	49925	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:50.379436970 CEST	49925	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:50.379455090 CEST	443	49925	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:50.379477978 CEST	49925	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:50.379482985 CEST	443	49925	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:50.382272959 CEST	49930	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:50.382286072 CEST	443	49930	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:50.382348061 CEST	49930	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:50.382520914 CEST	49930	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:50.382530928 CEST	443	49930	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:50.408974886 CEST	443	49926	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:50.409681082 CEST	443	49926	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:50.409729958 CEST	443	49926	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:50.409733057 CEST	49926	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:50.409776926 CEST	49926	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:50.409822941 CEST	49926	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:50.409837961 CEST	443	49926	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:50.409848928 CEST	49926	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:50.409853935 CEST	443	49926	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:50.412619114 CEST	49931	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:50.412655115 CEST	443	49931	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:50.412750006 CEST	49931	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:50.412908077 CEST	49931	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:50.412938118 CEST	443	49931	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:51.228553057 CEST	443	49927	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:51.229221106 CEST	49927	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:51.229233027 CEST	443	49927	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:51.229734898 CEST	49927	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:51.229742050 CEST	443	49927	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:51.229784012 CEST	443	49928	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:51.230158091 CEST	49928	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:51.230176926 CEST	443	49928	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:51.230506897 CEST	49928	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:51.230513096 CEST	443	49928	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:51.352425098 CEST	443	49931	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:51.353403091 CEST	49931	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:51.353423119 CEST	443	49931	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:51.353959084 CEST	49931	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:51.353970051 CEST	443	49931	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:51.357685089 CEST	443	49929	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:51.358012915 CEST	49929	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:51.358030081 CEST	443	49929	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:51.358057022 CEST	443	49930	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:51.358309984 CEST	49930	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:51.358325005 CEST	443	49930	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:51.358381987 CEST	49929	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:51.358392954 CEST	443	49929	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:51.358819008 CEST	49930	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:51.358824015 CEST	443	49930	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:51.362951994 CEST	443	49928	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:51.362962961 CEST	443	49927	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:51.363130093 CEST	443	49928	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:51.363226891 CEST	49928	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:51.363276958 CEST	49928	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:51.363293886 CEST	443	49928	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:51.363303900 CEST	49928	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:51.363308907 CEST	443	49928	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:51.363338947 CEST	443	49927	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:51.363388062 CEST	49927	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:51.363420963 CEST	49927	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:51.363420963 CEST	49927	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:51.363450050 CEST	443	49927	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:51.363465071 CEST	443	49927	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:51.366663933 CEST	49932	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:51.366682053 CEST	49933	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:51.366700888 CEST	443	49932	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:51.366730928 CEST	443	49933	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:51.366811037 CEST	49933	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:51.366872072 CEST	49932	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:51.366987944 CEST	49933	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:51.366997957 CEST	443	49933	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:51.367335081 CEST	49932	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:51.367347002 CEST	443	49932	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:51.490257025 CEST	443	49929	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:51.490330935 CEST	443	49929	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:51.490447044 CEST	443	49929	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:51.490478039 CEST	49929	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:51.490516901 CEST	49929	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:51.490691900 CEST	49929	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:51.490717888 CEST	443	49929	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:51.490735054 CEST	49929	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:51.490742922 CEST	443	49929	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:51.494110107 CEST	49934	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:51.494143009 CEST	443	49934	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:51.494352102 CEST	49934	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:51.494352102 CEST	49934	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:51.494380951 CEST	443	49934	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:51.494719028 CEST	443	49930	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:51.494913101 CEST	443	49930	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:51.494967937 CEST	49930	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:51.495008945 CEST	49930	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:51.495008945 CEST	49930	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:51.495038986 CEST	443	49930	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:51.495054007 CEST	443	49930	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:51.497410059 CEST	49935	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:51.497502089 CEST	443	49935	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:51.497695923 CEST	49935	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:51.497852087 CEST	49935	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:51.497888088 CEST	443	49935	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:51.729149103 CEST	443	49931	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:51.729197979 CEST	443	49931	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:51.729266882 CEST	443	49931	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:51.729326963 CEST	49931	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:51.729424000 CEST	49931	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:51.729736090 CEST	49931	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:51.729756117 CEST	443	49931	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:51.729773998 CEST	49931	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:51.729779959 CEST	443	49931	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:51.733423948 CEST	49936	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:51.733453035 CEST	443	49936	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:51.733534098 CEST	49936	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:51.733728886 CEST	49936	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:51.733741999 CEST	443	49936	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:52.115221977 CEST	443	49932	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:52.115832090 CEST	49932	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:52.115845919 CEST	443	49932	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:52.116322994 CEST	49932	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:52.116328955 CEST	443	49932	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:52.124166012 CEST	443	49933	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:52.124568939 CEST	49933	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:52.124608040 CEST	443	49933	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:52.124798059 CEST	49933	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:52.124808073 CEST	443	49933	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:52.227241993 CEST	443	49934	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:52.230348110 CEST	49934	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:52.230360031 CEST	443	49934	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:52.230988026 CEST	49934	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:52.230993986 CEST	443	49934	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:52.233797073 CEST	443	49935	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:52.234232903 CEST	49935	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:52.234299898 CEST	443	49935	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:52.234569073 CEST	49935	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:52.234586000 CEST	443	49935	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:52.250775099 CEST	443	49932	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:52.250930071 CEST	443	49932	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:52.250994921 CEST	49932	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:52.251192093 CEST	49932	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:52.251211882 CEST	443	49932	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:52.251221895 CEST	49932	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:52.251226902 CEST	443	49932	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:52.254529953 CEST	49937	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:52.254580021 CEST	443	49937	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:52.254698038 CEST	49937	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:52.254920959 CEST	49937	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:52.254935980 CEST	443	49937	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:52.322307110 CEST	443	49933	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:52.322792053 CEST	443	49933	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:52.322879076 CEST	49933	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:52.322938919 CEST	49933	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:52.322963953 CEST	443	49933	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:52.322979927 CEST	49933	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:52.322987080 CEST	443	49933	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:52.326169014 CEST	49938	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:52.326263905 CEST	443	49938	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:52.326356888 CEST	49938	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:52.326515913 CEST	49938	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:52.326555967 CEST	443	49938	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:52.357183933 CEST	443	49934	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:52.357255936 CEST	443	49934	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:52.357311964 CEST	49934	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:52.357566118 CEST	49934	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:52.357582092 CEST	443	49934	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:52.357593060 CEST	49934	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:52.357598066 CEST	443	49934	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:52.361031055 CEST	49939	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:52.361071110 CEST	443	49939	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:52.361152887 CEST	49939	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:52.361324072 CEST	49939	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:52.361340046 CEST	443	49939	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:52.366369963 CEST	443	49935	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:52.366409063 CEST	443	49935	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:52.366457939 CEST	443	49935	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:52.366460085 CEST	49935	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:52.366502047 CEST	49935	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:52.366703033 CEST	49935	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:52.366714001 CEST	443	49935	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:52.366729021 CEST	49935	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:52.366733074 CEST	443	49935	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:52.369369030 CEST	49940	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:52.369399071 CEST	443	49940	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:52.369488001 CEST	49940	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:52.369651079 CEST	49940	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:52.369668007 CEST	443	49940	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:52.482856035 CEST	443	49936	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:52.483696938 CEST	49936	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:52.483741045 CEST	443	49936	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:52.484178066 CEST	49936	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:52.484189987 CEST	443	49936	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:52.624306917 CEST	443	49936	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:52.624385118 CEST	443	49936	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:52.624428988 CEST	49936	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:52.624691963 CEST	49936	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:52.624720097 CEST	443	49936	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:52.624735117 CEST	49936	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:52.624742985 CEST	443	49936	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:52.628205061 CEST	49941	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:52.628241062 CEST	443	49941	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:52.628300905 CEST	49941	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:52.628467083 CEST	49941	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:52.628478050 CEST	443	49941	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:52.995461941 CEST	443	49937	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:52.996134996 CEST	49937	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:52.996166945 CEST	443	49937	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:52.996769905 CEST	49937	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:52.996779919 CEST	443	49937	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:53.058208942 CEST	443	49938	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:53.058836937 CEST	49938	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:53.058866024 CEST	443	49938	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:53.059319019 CEST	49938	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:53.059324980 CEST	443	49938	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:53.111110926 CEST	443	49939	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:53.111612082 CEST	49939	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:53.111661911 CEST	443	49939	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:53.112210989 CEST	49939	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:53.112219095 CEST	443	49939	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:53.125206947 CEST	443	49940	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:53.125617981 CEST	49940	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:53.125684023 CEST	443	49940	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:53.126085043 CEST	49940	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:53.126099110 CEST	443	49940	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:53.134393930 CEST	443	49937	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:53.134463072 CEST	443	49937	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:53.134573936 CEST	49937	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:53.134588003 CEST	443	49937	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:53.134635925 CEST	443	49937	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:53.134660006 CEST	49937	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:53.134689093 CEST	443	49937	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:53.134706974 CEST	49937	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:53.134706974 CEST	49937	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:53.134716988 CEST	443	49937	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:53.134727955 CEST	443	49937	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:53.137778044 CEST	49943	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:53.137818098 CEST	443	49943	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:53.137954950 CEST	49943	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:53.138101101 CEST	49943	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:53.138118982 CEST	443	49943	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:53.189119101 CEST	443	49938	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:53.189431906 CEST	443	49938	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:53.189492941 CEST	49938	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:53.189543962 CEST	49938	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:53.189543962 CEST	49938	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:53.189567089 CEST	443	49938	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:53.189579964 CEST	443	49938	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:53.194000006 CEST	49944	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:53.194039106 CEST	443	49944	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:53.194093943 CEST	49944	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:53.194314957 CEST	49944	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:53.194333076 CEST	443	49944	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:53.243174076 CEST	443	49939	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:53.243206978 CEST	443	49939	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:53.243261099 CEST	443	49939	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:53.243288040 CEST	49939	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:53.243341923 CEST	49939	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:53.248457909 CEST	49939	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:53.248487949 CEST	443	49939	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:53.248503923 CEST	49939	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:53.248511076 CEST	443	49939	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:53.251908064 CEST	49945	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:53.251945972 CEST	443	49945	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:53.252001047 CEST	49945	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:53.252155066 CEST	49945	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:53.252168894 CEST	443	49945	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:53.261594057 CEST	443	49940	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:53.262105942 CEST	443	49940	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:53.262186050 CEST	49940	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:53.262268066 CEST	49940	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:53.262268066 CEST	49940	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:53.262314081 CEST	443	49940	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:53.262342930 CEST	443	49940	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:53.264429092 CEST	49946	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:53.264456034 CEST	443	49946	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:53.264527082 CEST	49946	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:53.264657021 CEST	49946	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:53.264672995 CEST	443	49946	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:53.373199940 CEST	443	49941	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:53.376694918 CEST	49941	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:53.376708031 CEST	443	49941	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:53.377859116 CEST	49941	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:53.377863884 CEST	443	49941	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:53.504622936 CEST	443	49941	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:53.505453110 CEST	443	49941	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:53.505564928 CEST	49941	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:53.505590916 CEST	49941	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:53.505608082 CEST	443	49941	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:53.505618095 CEST	49941	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:53.505624056 CEST	443	49941	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:53.508754015 CEST	49947	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:53.508784056 CEST	443	49947	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:53.509958982 CEST	49947	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:53.510145903 CEST	49947	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:53.510153055 CEST	443	49947	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:53.886615038 CEST	443	49943	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:53.887197018 CEST	49943	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:53.887209892 CEST	443	49943	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:53.887691975 CEST	49943	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:53.887696981 CEST	443	49943	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:53.931302071 CEST	443	49944	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:53.936841011 CEST	49944	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:53.936872959 CEST	443	49944	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:53.937419891 CEST	49944	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:53.937426090 CEST	443	49944	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:53.989804983 CEST	443	49945	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:53.990304947 CEST	49945	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:53.990331888 CEST	443	49945	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:53.990943909 CEST	49945	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:53.990952015 CEST	443	49945	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:54.000694036 CEST	443	49946	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:54.001334906 CEST	49946	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:54.001343966 CEST	443	49946	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:54.001825094 CEST	49946	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:54.001830101 CEST	443	49946	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:54.018681049 CEST	443	49943	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:54.018742085 CEST	443	49943	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:54.018831968 CEST	49943	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:54.019318104 CEST	49943	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:54.019318104 CEST	49943	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:54.019335032 CEST	443	49943	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:54.019345999 CEST	443	49943	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:54.022341013 CEST	49948	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:54.022377014 CEST	443	49948	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:54.022471905 CEST	49948	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:54.022672892 CEST	49948	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:54.022687912 CEST	443	49948	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:54.069204092 CEST	443	49944	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:54.069241047 CEST	443	49944	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:54.069298029 CEST	49944	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:54.069304943 CEST	443	49944	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:54.069353104 CEST	49944	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:54.069636106 CEST	49944	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:54.069649935 CEST	443	49944	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:54.069683075 CEST	49944	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:54.069688082 CEST	443	49944	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:54.073307037 CEST	49949	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:54.073345900 CEST	443	49949	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:54.073421955 CEST	49949	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:54.073590994 CEST	49949	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:54.073604107 CEST	443	49949	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:54.119643927 CEST	443	49945	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:54.119721889 CEST	443	49945	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:54.119780064 CEST	49945	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:54.120074034 CEST	49945	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:54.120091915 CEST	443	49945	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:54.120100975 CEST	49945	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:54.120106936 CEST	443	49945	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:54.123508930 CEST	49950	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:54.123538017 CEST	443	49950	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:54.123653889 CEST	49950	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:54.123905897 CEST	49950	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:54.123919964 CEST	443	49950	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:54.134049892 CEST	443	49946	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:54.134123087 CEST	443	49946	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:54.134180069 CEST	49946	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:54.134282112 CEST	49946	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:54.134294987 CEST	443	49946	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:54.134305954 CEST	49946	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:54.134310961 CEST	443	49946	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:54.137020111 CEST	49951	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:54.137042999 CEST	443	49951	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:54.137111902 CEST	49951	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:54.137254000 CEST	49951	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:54.137265921 CEST	443	49951	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:54.257769108 CEST	443	49947	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:54.258558035 CEST	49947	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:54.258570910 CEST	443	49947	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:54.259109974 CEST	49947	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:54.259119034 CEST	443	49947	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:54.667042017 CEST	443	49947	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:54.667113066 CEST	443	49947	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:54.667403936 CEST	49947	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:54.667440891 CEST	49947	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:54.667454004 CEST	443	49947	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:54.667467117 CEST	49947	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:54.667471886 CEST	443	49947	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:54.670660973 CEST	49952	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:54.670701027 CEST	443	49952	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:54.670780897 CEST	49952	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:54.670938969 CEST	49952	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:54.670953989 CEST	443	49952	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:54.769222021 CEST	443	49948	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:54.769938946 CEST	49948	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:54.769961119 CEST	443	49948	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:54.770493031 CEST	49948	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:54.770499945 CEST	443	49948	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:54.824413061 CEST	443	49949	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:54.824903965 CEST	49949	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:54.824922085 CEST	443	49949	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:54.825342894 CEST	49949	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:54.825349092 CEST	443	49949	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:54.876216888 CEST	443	49950	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:54.879157066 CEST	49950	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:54.879170895 CEST	443	49950	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:54.879591942 CEST	49950	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:54.879597902 CEST	443	49950	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:54.881759882 CEST	443	49951	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:54.882095098 CEST	49951	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:54.882112980 CEST	443	49951	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:54.882503986 CEST	49951	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:54.882508993 CEST	443	49951	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:54.899975061 CEST	443	49948	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:54.900233030 CEST	443	49948	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:54.900279999 CEST	49948	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:54.900474072 CEST	49948	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:54.900490999 CEST	443	49948	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:54.900501966 CEST	49948	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:54.900507927 CEST	443	49948	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:54.903253078 CEST	49953	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:54.903291941 CEST	443	49953	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:54.903402090 CEST	49953	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:54.903558016 CEST	49953	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:54.903570890 CEST	443	49953	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:54.974828959 CEST	443	49949	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:54.974917889 CEST	443	49949	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:54.975025892 CEST	49949	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:54.986201048 CEST	49949	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:54.986224890 CEST	443	49949	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:54.986237049 CEST	49949	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:54.986243010 CEST	443	49949	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:54.990889072 CEST	49954	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:54.990931034 CEST	443	49954	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:54.991230965 CEST	49954	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:54.991571903 CEST	49954	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:54.991588116 CEST	443	49954	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:55.013442993 CEST	443	49950	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:55.013617039 CEST	443	49950	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:55.013694048 CEST	49950	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:55.013884068 CEST	49950	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:55.013906002 CEST	443	49950	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:55.013919115 CEST	49950	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:55.013926029 CEST	443	49950	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:55.016618013 CEST	49955	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:55.016664028 CEST	443	49955	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:55.016750097 CEST	49955	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:55.017111063 CEST	49955	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:55.017132044 CEST	443	49955	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:55.018534899 CEST	443	49951	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:55.018619061 CEST	443	49951	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:55.018688917 CEST	49951	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:55.018883944 CEST	49951	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:55.018901110 CEST	443	49951	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:55.018913031 CEST	49951	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:55.018918037 CEST	443	49951	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:55.021310091 CEST	49956	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:55.021395922 CEST	443	49956	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:55.021517038 CEST	49956	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:55.021646976 CEST	49956	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:55.021682024 CEST	443	49956	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:55.404380083 CEST	443	49952	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:55.405071974 CEST	49952	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:55.405154943 CEST	443	49952	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:55.405601978 CEST	49952	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:55.405622959 CEST	443	49952	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:55.540709972 CEST	443	49952	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:55.540738106 CEST	443	49952	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:55.540787935 CEST	49952	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:55.540797949 CEST	443	49952	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:55.540977955 CEST	49952	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:55.541249990 CEST	49952	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:55.541268110 CEST	443	49952	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:55.541279078 CEST	49952	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:55.541285038 CEST	443	49952	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:55.544250011 CEST	49957	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:55.544286966 CEST	443	49957	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:55.544368029 CEST	49957	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:55.544519901 CEST	49957	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:55.544533968 CEST	443	49957	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:55.642373085 CEST	443	49953	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:55.643207073 CEST	49953	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:55.643229008 CEST	443	49953	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:55.643502951 CEST	49953	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:55.643512964 CEST	443	49953	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:55.755428076 CEST	443	49954	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:55.756218910 CEST	49954	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:55.756285906 CEST	443	49954	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:55.756756067 CEST	49954	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:55.756772041 CEST	443	49954	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:55.761431932 CEST	443	49956	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:55.761821985 CEST	49956	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:55.761884928 CEST	443	49956	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:55.762269974 CEST	49956	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:55.762286901 CEST	443	49956	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:55.773168087 CEST	443	49953	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:55.773346901 CEST	443	49955	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:55.773402929 CEST	443	49953	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:55.773499012 CEST	49953	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:55.773499012 CEST	49953	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:55.773540020 CEST	49953	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:55.773559093 CEST	443	49953	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:55.773821115 CEST	49955	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:55.773832083 CEST	443	49955	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:55.774256945 CEST	49955	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:55.774262905 CEST	443	49955	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:55.776729107 CEST	49958	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:55.776787996 CEST	443	49958	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:55.776881933 CEST	49958	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:55.777041912 CEST	49958	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:55.777071953 CEST	443	49958	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:55.887810946 CEST	443	49954	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:55.887840986 CEST	443	49954	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:55.887892962 CEST	443	49954	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:55.887902975 CEST	49954	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:55.887968063 CEST	49954	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:55.888214111 CEST	49954	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:55.888257980 CEST	443	49954	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:55.888287067 CEST	49954	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:55.888303041 CEST	443	49954	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:55.891613007 CEST	49959	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:55.891654015 CEST	443	49959	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:55.891948938 CEST	49959	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:55.891948938 CEST	49959	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:55.891987085 CEST	443	49959	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:56.154436111 CEST	443	49955	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:56.154591084 CEST	443	49956	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:56.154601097 CEST	443	49955	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:56.154628038 CEST	443	49956	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:56.154671907 CEST	49955	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:56.154711008 CEST	443	49956	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:56.154887915 CEST	49956	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:56.154887915 CEST	49956	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:56.154887915 CEST	49956	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:56.154887915 CEST	49956	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:56.157891989 CEST	49960	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:56.157892942 CEST	49955	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:56.157893896 CEST	49955	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:56.157910109 CEST	443	49955	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:56.157917023 CEST	443	49960	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:56.157922983 CEST	443	49955	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:56.157938957 CEST	49961	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:56.157968998 CEST	443	49961	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:56.157985926 CEST	49960	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:56.158027887 CEST	49961	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:56.158158064 CEST	49961	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:56.158171892 CEST	443	49961	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:56.158202887 CEST	49960	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:56.158215046 CEST	443	49960	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:56.287530899 CEST	443	49957	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:56.288171053 CEST	49957	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:56.288194895 CEST	443	49957	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:56.288686991 CEST	49957	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:56.288691998 CEST	443	49957	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:56.423823118 CEST	443	49957	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:56.423906088 CEST	443	49957	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:56.424163103 CEST	49957	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:56.424472094 CEST	49957	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:56.424472094 CEST	49957	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:56.424488068 CEST	443	49957	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:56.424495935 CEST	443	49957	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:56.427434921 CEST	49962	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:56.427478075 CEST	443	49962	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:56.427567005 CEST	49962	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:56.427740097 CEST	49962	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:56.427750111 CEST	443	49962	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:56.469996929 CEST	49956	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:56.470025063 CEST	443	49956	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:56.522851944 CEST	443	49958	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:56.523545980 CEST	49958	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:56.523607016 CEST	443	49958	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:56.524061918 CEST	49958	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:56.524075031 CEST	443	49958	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:56.655535936 CEST	443	49958	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:56.656434059 CEST	443	49958	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:56.656523943 CEST	49958	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:56.656619072 CEST	49958	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:56.656663895 CEST	443	49958	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:56.656696081 CEST	49958	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:56.656712055 CEST	443	49958	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:56.663695097 CEST	49963	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:56.663722992 CEST	443	49963	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:56.663795948 CEST	49963	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:56.663978100 CEST	49963	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:56.663989067 CEST	443	49963	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:56.879472971 CEST	443	49959	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:56.880194902 CEST	49959	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:56.880217075 CEST	443	49959	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:56.880707979 CEST	49959	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:56.880712032 CEST	443	49959	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:56.906874895 CEST	443	49961	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:56.907586098 CEST	49961	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:56.907627106 CEST	443	49961	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:56.908205032 CEST	49961	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:56.908219099 CEST	443	49961	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:56.913688898 CEST	443	49960	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:56.914026022 CEST	49960	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:56.914062023 CEST	443	49960	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:56.914398909 CEST	49960	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:56.914407015 CEST	443	49960	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:57.016016006 CEST	443	49959	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:57.016099930 CEST	443	49959	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:57.016247034 CEST	49959	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:57.016498089 CEST	49959	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:57.016498089 CEST	49959	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:57.016516924 CEST	443	49959	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:57.016525030 CEST	443	49959	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:57.045469999 CEST	49964	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:57.045504093 CEST	443	49964	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:57.045577049 CEST	49964	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:57.046153069 CEST	49964	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:57.046168089 CEST	443	49964	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:57.051698923 CEST	443	49960	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:57.051764011 CEST	443	49960	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:57.051817894 CEST	49960	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:57.051841974 CEST	443	49960	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:57.051898956 CEST	443	49960	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:57.051939964 CEST	49960	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:57.052140951 CEST	49960	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:57.052153111 CEST	443	49960	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:57.052166939 CEST	49960	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:57.052170992 CEST	443	49960	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:57.054817915 CEST	49965	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:57.054852009 CEST	443	49965	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:57.054910898 CEST	49965	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:57.055048943 CEST	49965	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:57.055059910 CEST	443	49965	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:57.152930975 CEST	443	49961	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:57.153037071 CEST	443	49961	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:57.153103113 CEST	49961	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:57.153314114 CEST	49961	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:57.153342009 CEST	443	49961	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:57.153367996 CEST	49961	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:57.153378010 CEST	443	49961	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:57.156922102 CEST	49966	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:57.156970024 CEST	443	49966	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:57.157032967 CEST	49966	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:57.157203913 CEST	49966	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:57.157218933 CEST	443	49966	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:57.180928946 CEST	443	49962	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:57.181505919 CEST	49962	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:57.181535006 CEST	443	49962	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:57.181992054 CEST	49962	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:57.181999922 CEST	443	49962	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:57.317193031 CEST	443	49962	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:57.317468882 CEST	443	49962	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:57.317548037 CEST	49962	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:57.317600012 CEST	49962	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:57.317620039 CEST	443	49962	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:57.317631006 CEST	49962	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:57.317639112 CEST	443	49962	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:57.321016073 CEST	49967	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:57.321053982 CEST	443	49967	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:57.321141958 CEST	49967	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:57.321326971 CEST	49967	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:57.321336985 CEST	443	49967	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:57.398756981 CEST	443	49963	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:57.399533033 CEST	49963	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:57.399595976 CEST	443	49963	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:57.400032997 CEST	49963	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:57.400048018 CEST	443	49963	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:57.907789946 CEST	443	49963	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:57.907826900 CEST	443	49963	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:57.907898903 CEST	443	49963	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:57.907919884 CEST	49963	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:57.907968998 CEST	49963	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:57.908278942 CEST	49963	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:57.908296108 CEST	443	49963	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:57.908310890 CEST	49963	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:57.908318996 CEST	443	49963	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:57.912075996 CEST	49968	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:57.912101030 CEST	443	49968	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:57.912185907 CEST	49968	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:57.912370920 CEST	49968	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:57.912380934 CEST	443	49968	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:58.045490026 CEST	443	49965	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:58.046142101 CEST	49965	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:58.046159029 CEST	443	49965	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:58.046399117 CEST	443	49966	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:58.046689987 CEST	49965	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:58.046695948 CEST	443	49965	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:58.046935081 CEST	49966	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:58.046957970 CEST	443	49966	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:58.047298908 CEST	49966	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:58.047303915 CEST	443	49966	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:58.049494982 CEST	443	49964	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:58.060230017 CEST	49964	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:58.060242891 CEST	443	49964	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:58.060792923 CEST	49964	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:58.060797930 CEST	443	49964	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:58.094413042 CEST	443	49967	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:58.095361948 CEST	49967	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:58.095376968 CEST	443	49967	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:58.096410036 CEST	49967	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:58.096415043 CEST	443	49967	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:58.174551964 CEST	443	49966	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:58.174603939 CEST	443	49966	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:58.174657106 CEST	49966	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:58.174671888 CEST	443	49966	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:58.174751043 CEST	443	49966	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:58.174797058 CEST	49966	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:58.174992085 CEST	49966	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:58.175012112 CEST	443	49966	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:58.175024033 CEST	49966	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:58.175029039 CEST	443	49966	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:58.177484035 CEST	443	49965	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:58.177504063 CEST	443	49965	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:58.177567005 CEST	443	49965	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:58.177578926 CEST	49965	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:58.177618980 CEST	49965	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:58.177723885 CEST	49965	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:58.177742004 CEST	443	49965	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:58.177752972 CEST	49965	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:58.177758932 CEST	443	49965	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:58.178596020 CEST	49969	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:58.178678989 CEST	443	49969	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:58.178809881 CEST	49969	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:58.178947926 CEST	49969	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:58.178971052 CEST	443	49969	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:58.179824114 CEST	49970	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:58.179858923 CEST	443	49970	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:58.179919004 CEST	49970	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:58.180067062 CEST	49970	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:58.180079937 CEST	443	49970	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:58.187971115 CEST	443	49964	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:58.188271046 CEST	443	49964	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:58.188323021 CEST	49964	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:58.188349009 CEST	49964	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:58.188359022 CEST	443	49964	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:58.188369989 CEST	49964	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:58.188374043 CEST	443	49964	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:58.190371990 CEST	49971	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:58.190386057 CEST	443	49971	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:58.190459013 CEST	49971	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:58.190594912 CEST	49971	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:58.190608978 CEST	443	49971	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:58.226505995 CEST	443	49967	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:58.226527929 CEST	443	49967	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:58.226615906 CEST	443	49967	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:58.226617098 CEST	49967	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:58.226665020 CEST	49967	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:58.226917028 CEST	49967	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:58.226936102 CEST	443	49967	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:58.226947069 CEST	49967	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:58.226952076 CEST	443	49967	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:58.229898930 CEST	49972	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:58.229922056 CEST	443	49972	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:58.230001926 CEST	49972	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:58.230170965 CEST	49972	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:58.230182886 CEST	443	49972	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:58.863986969 CEST	443	49968	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:58.864623070 CEST	49968	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:58.864645004 CEST	443	49968	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:58.865173101 CEST	49968	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:58.865179062 CEST	443	49968	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:58.912151098 CEST	443	49969	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:58.912734032 CEST	49969	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:58.912763119 CEST	443	49969	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:58.913335085 CEST	49969	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:58.913341999 CEST	443	49969	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:58.918606997 CEST	443	49970	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:58.919012070 CEST	49970	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:58.919024944 CEST	443	49970	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:58.919454098 CEST	49970	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:58.919460058 CEST	443	49970	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:58.969197035 CEST	443	49972	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:58.969692945 CEST	49972	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:58.969713926 CEST	443	49972	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:58.970510006 CEST	49972	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:58.970520020 CEST	443	49972	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:58.996732950 CEST	443	49968	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:58.996771097 CEST	443	49968	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:58.996912956 CEST	49968	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:58.996932030 CEST	443	49968	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:58.997054100 CEST	443	49968	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:58.997101068 CEST	49968	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:58.997205019 CEST	49968	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:58.997225046 CEST	443	49968	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:58.997235060 CEST	49968	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:58.997242928 CEST	443	49968	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:59.000461102 CEST	49973	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:59.000495911 CEST	443	49973	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:59.000577927 CEST	49973	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:59.000752926 CEST	49973	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:59.000763893 CEST	443	49973	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:59.043261051 CEST	443	49969	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:59.043339014 CEST	443	49969	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:59.043432951 CEST	49969	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:59.043612003 CEST	49969	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:59.043665886 CEST	443	49969	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:59.043700933 CEST	49969	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:59.043718100 CEST	443	49969	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:59.046622038 CEST	49974	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:59.046667099 CEST	443	49974	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:59.046744108 CEST	49974	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:59.046901941 CEST	49974	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:59.046911955 CEST	443	49974	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:59.051206112 CEST	443	49970	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:59.051392078 CEST	443	49970	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:59.051456928 CEST	49970	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:59.051533937 CEST	49970	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:59.051551104 CEST	443	49970	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:59.051563025 CEST	49970	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:59.051568985 CEST	443	49970	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:59.054084063 CEST	49975	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:59.054130077 CEST	443	49975	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:59.054205894 CEST	49975	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:59.054352999 CEST	49975	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:59.054368973 CEST	443	49975	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:59.101175070 CEST	443	49972	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:59.101249933 CEST	443	49972	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:59.101294041 CEST	49972	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:59.111241102 CEST	49972	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:59.111263990 CEST	443	49972	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:59.111279011 CEST	49972	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:59.111285925 CEST	443	49972	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:59.117228985 CEST	49976	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:59.117285967 CEST	443	49976	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:59.117347002 CEST	49976	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:59.117733955 CEST	49976	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:59.117749929 CEST	443	49976	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:59.475018024 CEST	443	49971	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:59.475785017 CEST	49971	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:59.475809097 CEST	443	49971	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:59.476350069 CEST	49971	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:59.476356030 CEST	443	49971	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:59.620857000 CEST	443	49971	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:59.620930910 CEST	443	49971	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:59.621047974 CEST	49971	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:59.621346951 CEST	49971	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:59.621365070 CEST	443	49971	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:59.621378899 CEST	49971	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:59.621383905 CEST	443	49971	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:59.625092983 CEST	49977	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:59.625133991 CEST	443	49977	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:59.625224113 CEST	49977	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:59.625462055 CEST	49977	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:59.625473976 CEST	443	49977	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:59.754654884 CEST	443	49973	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:59.755263090 CEST	49973	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:59.755274057 CEST	443	49973	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:59.755819082 CEST	49973	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:59.755825996 CEST	443	49973	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:59.785828114 CEST	443	49975	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:59.786648035 CEST	49975	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:59.786667109 CEST	443	49975	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:59.787332058 CEST	49975	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:59.787342072 CEST	443	49975	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:59.824064970 CEST	443	49974	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:59.824594975 CEST	49974	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:59.824608088 CEST	443	49974	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:59.825100899 CEST	49974	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:59.825105906 CEST	443	49974	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:59.893452883 CEST	443	49973	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:59.893476009 CEST	443	49973	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:59.893536091 CEST	443	49973	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:59.893632889 CEST	49973	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:59.893680096 CEST	49973	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:59.894046068 CEST	49973	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:59.894046068 CEST	49973	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:59.894064903 CEST	443	49973	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:59.894076109 CEST	443	49973	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:59.897232056 CEST	49978	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:59.897277117 CEST	443	49978	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:59.897351980 CEST	49978	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:59.897536993 CEST	49978	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:59.897557974 CEST	443	49978	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:59.918870926 CEST	443	49976	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:59.919356108 CEST	49976	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:59.919368029 CEST	443	49976	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:59.919852018 CEST	49976	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:59.919857979 CEST	443	49976	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:59.953819036 CEST	443	49974	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:59.953852892 CEST	443	49974	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:59.953916073 CEST	443	49974	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:59.954051971 CEST	49974	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:59.954464912 CEST	49974	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:59.954483986 CEST	443	49974	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:59.954494953 CEST	49974	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:59.954499960 CEST	443	49974	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:59.959351063 CEST	49979	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:59.959446907 CEST	443	49979	13.107.246.45	192.168.2.6
Oct 24, 2024 19:30:59.959553003 CEST	49979	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:59.959688902 CEST	49979	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:30:59.959718943 CEST	443	49979	13.107.246.45	192.168.2.6
Oct 24, 2024 19:31:00.027576923 CEST	443	49975	13.107.246.45	192.168.2.6
Oct 24, 2024 19:31:00.027641058 CEST	443	49975	13.107.246.45	192.168.2.6
Oct 24, 2024 19:31:00.027690887 CEST	443	49975	13.107.246.45	192.168.2.6
Oct 24, 2024 19:31:00.027786970 CEST	49975	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:31:00.027805090 CEST	443	49975	13.107.246.45	192.168.2.6
Oct 24, 2024 19:31:00.027849913 CEST	49975	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:31:00.027849913 CEST	49975	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:31:00.040581942 CEST	443	49975	13.107.246.45	192.168.2.6
Oct 24, 2024 19:31:00.040658951 CEST	49975	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:31:00.040672064 CEST	443	49975	13.107.246.45	192.168.2.6
Oct 24, 2024 19:31:00.040735960 CEST	443	49975	13.107.246.45	192.168.2.6
Oct 24, 2024 19:31:00.040796995 CEST	49975	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:31:00.040822029 CEST	49975	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:31:00.040838003 CEST	443	49975	13.107.246.45	192.168.2.6
Oct 24, 2024 19:31:00.040877104 CEST	49975	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:31:00.040883064 CEST	443	49975	13.107.246.45	192.168.2.6
Oct 24, 2024 19:31:00.044186115 CEST	49980	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:31:00.044226885 CEST	443	49980	13.107.246.45	192.168.2.6
Oct 24, 2024 19:31:00.044367075 CEST	49980	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:31:00.044545889 CEST	49980	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:31:00.044559002 CEST	443	49980	13.107.246.45	192.168.2.6
Oct 24, 2024 19:31:00.051738977 CEST	443	49976	13.107.246.45	192.168.2.6
Oct 24, 2024 19:31:00.051758051 CEST	443	49976	13.107.246.45	192.168.2.6
Oct 24, 2024 19:31:00.051836014 CEST	443	49976	13.107.246.45	192.168.2.6
Oct 24, 2024 19:31:00.051836014 CEST	49976	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:31:00.051879883 CEST	49976	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:31:00.052042007 CEST	49976	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:31:00.052056074 CEST	443	49976	13.107.246.45	192.168.2.6
Oct 24, 2024 19:31:00.052067041 CEST	49976	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:31:00.052073002 CEST	443	49976	13.107.246.45	192.168.2.6
Oct 24, 2024 19:31:00.054841042 CEST	49981	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:31:00.054918051 CEST	443	49981	13.107.246.45	192.168.2.6
Oct 24, 2024 19:31:00.054992914 CEST	49981	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:31:00.055166006 CEST	49981	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:31:00.055200100 CEST	443	49981	13.107.246.45	192.168.2.6
Oct 24, 2024 19:31:01.154715061 CEST	443	49978	13.107.246.45	192.168.2.6
Oct 24, 2024 19:31:01.158731937 CEST	49978	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:31:01.158749104 CEST	443	49978	13.107.246.45	192.168.2.6
Oct 24, 2024 19:31:01.159529924 CEST	49978	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:31:01.159535885 CEST	443	49978	13.107.246.45	192.168.2.6
Oct 24, 2024 19:31:01.283518076 CEST	443	49977	13.107.246.45	192.168.2.6
Oct 24, 2024 19:31:01.284075022 CEST	49977	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:31:01.284101009 CEST	443	49977	13.107.246.45	192.168.2.6
Oct 24, 2024 19:31:01.284576893 CEST	49977	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:31:01.284584045 CEST	443	49977	13.107.246.45	192.168.2.6
Oct 24, 2024 19:31:01.287410021 CEST	443	49979	13.107.246.45	192.168.2.6
Oct 24, 2024 19:31:01.290308952 CEST	49979	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:31:01.290316105 CEST	443	49979	13.107.246.45	192.168.2.6
Oct 24, 2024 19:31:01.290792942 CEST	49979	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:31:01.290797949 CEST	443	49979	13.107.246.45	192.168.2.6
Oct 24, 2024 19:31:01.292725086 CEST	443	49978	13.107.246.45	192.168.2.6
Oct 24, 2024 19:31:01.292788029 CEST	443	49978	13.107.246.45	192.168.2.6
Oct 24, 2024 19:31:01.292855978 CEST	49978	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:31:01.292880058 CEST	443	49978	13.107.246.45	192.168.2.6
Oct 24, 2024 19:31:01.292920113 CEST	49978	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:31:01.293001890 CEST	443	49978	13.107.246.45	192.168.2.6
Oct 24, 2024 19:31:01.293039083 CEST	49978	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:31:01.293056011 CEST	443	49978	13.107.246.45	192.168.2.6
Oct 24, 2024 19:31:01.293075085 CEST	49978	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:31:01.293081045 CEST	443	49978	13.107.246.45	192.168.2.6
Oct 24, 2024 19:31:01.293076992 CEST	443	49980	13.107.246.45	192.168.2.6
Oct 24, 2024 19:31:01.293608904 CEST	49980	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:31:01.293629885 CEST	443	49980	13.107.246.45	192.168.2.6
Oct 24, 2024 19:31:01.294308901 CEST	49980	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:31:01.294312954 CEST	443	49980	13.107.246.45	192.168.2.6
Oct 24, 2024 19:31:01.296451092 CEST	49982	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:31:01.296483040 CEST	443	49982	13.107.246.45	192.168.2.6
Oct 24, 2024 19:31:01.296581030 CEST	49982	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:31:01.296683073 CEST	49982	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:31:01.296689987 CEST	443	49982	13.107.246.45	192.168.2.6
Oct 24, 2024 19:31:01.417484045 CEST	443	49979	13.107.246.45	192.168.2.6
Oct 24, 2024 19:31:01.417552948 CEST	443	49979	13.107.246.45	192.168.2.6
Oct 24, 2024 19:31:01.417618990 CEST	443	49979	13.107.246.45	192.168.2.6
Oct 24, 2024 19:31:01.417670012 CEST	49979	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:31:01.417705059 CEST	49979	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:31:01.418018103 CEST	49979	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:31:01.418035984 CEST	443	49979	13.107.246.45	192.168.2.6
Oct 24, 2024 19:31:01.418046951 CEST	49979	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:31:01.418052912 CEST	443	49979	13.107.246.45	192.168.2.6
Oct 24, 2024 19:31:01.421576023 CEST	49983	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:31:01.421595097 CEST	443	49983	13.107.246.45	192.168.2.6
Oct 24, 2024 19:31:01.421688080 CEST	49983	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:31:01.421875000 CEST	49983	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:31:01.421888113 CEST	443	49983	13.107.246.45	192.168.2.6
Oct 24, 2024 19:31:01.421928883 CEST	443	49980	13.107.246.45	192.168.2.6
Oct 24, 2024 19:31:01.422091961 CEST	443	49980	13.107.246.45	192.168.2.6
Oct 24, 2024 19:31:01.422146082 CEST	49980	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:31:01.422175884 CEST	49980	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:31:01.422194004 CEST	443	49980	13.107.246.45	192.168.2.6
Oct 24, 2024 19:31:01.422207117 CEST	49980	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:31:01.422213078 CEST	443	49980	13.107.246.45	192.168.2.6
Oct 24, 2024 19:31:01.424384117 CEST	49984	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:31:01.424392939 CEST	443	49984	13.107.246.45	192.168.2.6
Oct 24, 2024 19:31:01.424465895 CEST	49984	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:31:01.424623013 CEST	49984	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:31:01.424637079 CEST	443	49984	13.107.246.45	192.168.2.6
Oct 24, 2024 19:31:01.879085064 CEST	443	49977	13.107.246.45	192.168.2.6
Oct 24, 2024 19:31:01.879106998 CEST	443	49977	13.107.246.45	192.168.2.6
Oct 24, 2024 19:31:01.879125118 CEST	443	49977	13.107.246.45	192.168.2.6
Oct 24, 2024 19:31:01.879168987 CEST	49977	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:31:01.879199028 CEST	443	49977	13.107.246.45	192.168.2.6
Oct 24, 2024 19:31:01.879215002 CEST	443	49977	13.107.246.45	192.168.2.6
Oct 24, 2024 19:31:01.879225016 CEST	49977	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:31:01.879231930 CEST	443	49977	13.107.246.45	192.168.2.6
Oct 24, 2024 19:31:01.879266977 CEST	49977	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:31:01.879271984 CEST	443	49977	13.107.246.45	192.168.2.6
Oct 24, 2024 19:31:01.879390955 CEST	49977	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:31:01.879934072 CEST	49977	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:31:01.879947901 CEST	443	49977	13.107.246.45	192.168.2.6
Oct 24, 2024 19:31:01.879960060 CEST	49977	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:31:01.879966021 CEST	443	49977	13.107.246.45	192.168.2.6
Oct 24, 2024 19:31:01.883260012 CEST	49985	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:31:01.883295059 CEST	443	49985	13.107.246.45	192.168.2.6
Oct 24, 2024 19:31:01.883361101 CEST	49985	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:31:01.883552074 CEST	49985	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:31:01.883562088 CEST	443	49985	13.107.246.45	192.168.2.6
Oct 24, 2024 19:31:02.015573025 CEST	443	49981	13.107.246.45	192.168.2.6
Oct 24, 2024 19:31:02.016217947 CEST	49981	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:31:02.016232014 CEST	443	49981	13.107.246.45	192.168.2.6
Oct 24, 2024 19:31:02.016729116 CEST	49981	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:31:02.016736031 CEST	443	49981	13.107.246.45	192.168.2.6
Oct 24, 2024 19:31:02.026196003 CEST	443	49982	13.107.246.45	192.168.2.6
Oct 24, 2024 19:31:02.026901960 CEST	49982	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:31:02.026916981 CEST	443	49982	13.107.246.45	192.168.2.6
Oct 24, 2024 19:31:02.027589083 CEST	49982	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:31:02.027595997 CEST	443	49982	13.107.246.45	192.168.2.6
Oct 24, 2024 19:31:02.148153067 CEST	443	49981	13.107.246.45	192.168.2.6
Oct 24, 2024 19:31:02.148250103 CEST	443	49981	13.107.246.45	192.168.2.6
Oct 24, 2024 19:31:02.148313999 CEST	49981	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:31:02.148560047 CEST	49981	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:31:02.148578882 CEST	443	49981	13.107.246.45	192.168.2.6
Oct 24, 2024 19:31:02.148593903 CEST	49981	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:31:02.148601055 CEST	443	49981	13.107.246.45	192.168.2.6
Oct 24, 2024 19:31:02.152194023 CEST	49986	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:31:02.152221918 CEST	443	49986	13.107.246.45	192.168.2.6
Oct 24, 2024 19:31:02.152295113 CEST	49986	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:31:02.152519941 CEST	49986	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:31:02.152534008 CEST	443	49986	13.107.246.45	192.168.2.6
Oct 24, 2024 19:31:02.159542084 CEST	443	49982	13.107.246.45	192.168.2.6
Oct 24, 2024 19:31:02.160124063 CEST	443	49982	13.107.246.45	192.168.2.6
Oct 24, 2024 19:31:02.160190105 CEST	49982	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:31:02.161020994 CEST	49982	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:31:02.161042929 CEST	443	49982	13.107.246.45	192.168.2.6
Oct 24, 2024 19:31:02.161053896 CEST	49982	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:31:02.161058903 CEST	443	49982	13.107.246.45	192.168.2.6
Oct 24, 2024 19:31:02.166260958 CEST	443	49984	13.107.246.45	192.168.2.6
Oct 24, 2024 19:31:02.167262077 CEST	49987	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:31:02.167288065 CEST	443	49987	13.107.246.45	192.168.2.6
Oct 24, 2024 19:31:02.167360067 CEST	49987	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:31:02.167532921 CEST	49987	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:31:02.167546034 CEST	443	49987	13.107.246.45	192.168.2.6
Oct 24, 2024 19:31:02.168224096 CEST	49984	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:31:02.168250084 CEST	443	49984	13.107.246.45	192.168.2.6
Oct 24, 2024 19:31:02.168910027 CEST	49984	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:31:02.168915987 CEST	443	49984	13.107.246.45	192.168.2.6
Oct 24, 2024 19:31:02.188821077 CEST	443	49983	13.107.246.45	192.168.2.6
Oct 24, 2024 19:31:02.200766087 CEST	49983	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:31:02.200783014 CEST	443	49983	13.107.246.45	192.168.2.6
Oct 24, 2024 19:31:02.201971054 CEST	49983	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:31:02.201977015 CEST	443	49983	13.107.246.45	192.168.2.6
Oct 24, 2024 19:31:02.299381971 CEST	443	49984	13.107.246.45	192.168.2.6
Oct 24, 2024 19:31:02.299410105 CEST	443	49984	13.107.246.45	192.168.2.6
Oct 24, 2024 19:31:02.299454927 CEST	443	49984	13.107.246.45	192.168.2.6
Oct 24, 2024 19:31:02.299525023 CEST	49984	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:31:02.299567938 CEST	49984	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:31:02.299865961 CEST	49984	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:31:02.299880981 CEST	443	49984	13.107.246.45	192.168.2.6
Oct 24, 2024 19:31:02.299897909 CEST	49984	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:31:02.299905062 CEST	443	49984	13.107.246.45	192.168.2.6
Oct 24, 2024 19:31:02.302903891 CEST	49988	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:31:02.302949905 CEST	443	49988	13.107.246.45	192.168.2.6
Oct 24, 2024 19:31:02.303021908 CEST	49988	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:31:02.303175926 CEST	49988	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:31:02.303190947 CEST	443	49988	13.107.246.45	192.168.2.6
Oct 24, 2024 19:31:02.483571053 CEST	443	49983	13.107.246.45	192.168.2.6
Oct 24, 2024 19:31:02.483779907 CEST	443	49983	13.107.246.45	192.168.2.6
Oct 24, 2024 19:31:02.483871937 CEST	49983	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:31:02.489885092 CEST	49983	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:31:02.489897966 CEST	443	49983	13.107.246.45	192.168.2.6
Oct 24, 2024 19:31:02.489932060 CEST	49983	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:31:02.489939928 CEST	443	49983	13.107.246.45	192.168.2.6
Oct 24, 2024 19:31:02.628384113 CEST	443	49985	13.107.246.45	192.168.2.6
Oct 24, 2024 19:31:02.637970924 CEST	49985	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:31:02.637998104 CEST	443	49985	13.107.246.45	192.168.2.6
Oct 24, 2024 19:31:02.638492107 CEST	49985	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:31:02.638504028 CEST	443	49985	13.107.246.45	192.168.2.6
Oct 24, 2024 19:31:02.767265081 CEST	443	49985	13.107.246.45	192.168.2.6
Oct 24, 2024 19:31:02.767452002 CEST	443	49985	13.107.246.45	192.168.2.6
Oct 24, 2024 19:31:02.767527103 CEST	49985	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:31:02.779026031 CEST	49985	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:31:02.779057026 CEST	443	49985	13.107.246.45	192.168.2.6
Oct 24, 2024 19:31:02.779089928 CEST	49985	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:31:02.779094934 CEST	443	49985	13.107.246.45	192.168.2.6
Oct 24, 2024 19:31:02.884059906 CEST	443	49986	13.107.246.45	192.168.2.6
Oct 24, 2024 19:31:02.914288044 CEST	443	49987	13.107.246.45	192.168.2.6
Oct 24, 2024 19:31:02.938661098 CEST	49986	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:31:02.955935955 CEST	49987	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:31:03.040277958 CEST	443	49988	13.107.246.45	192.168.2.6
Oct 24, 2024 19:31:03.094942093 CEST	49988	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:31:03.111293077 CEST	49986	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:31:03.111325026 CEST	443	49986	13.107.246.45	192.168.2.6
Oct 24, 2024 19:31:03.111783981 CEST	49986	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:31:03.111789942 CEST	443	49986	13.107.246.45	192.168.2.6
Oct 24, 2024 19:31:03.112010956 CEST	49987	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:31:03.112021923 CEST	443	49987	13.107.246.45	192.168.2.6
Oct 24, 2024 19:31:03.112373114 CEST	49987	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:31:03.112379074 CEST	443	49987	13.107.246.45	192.168.2.6
Oct 24, 2024 19:31:03.112689018 CEST	49988	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:31:03.112711906 CEST	443	49988	13.107.246.45	192.168.2.6
Oct 24, 2024 19:31:03.113042116 CEST	49988	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:31:03.113054037 CEST	443	49988	13.107.246.45	192.168.2.6
Oct 24, 2024 19:31:03.238615036 CEST	443	49986	13.107.246.45	192.168.2.6
Oct 24, 2024 19:31:03.238693953 CEST	443	49986	13.107.246.45	192.168.2.6
Oct 24, 2024 19:31:03.238756895 CEST	49986	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:31:03.240686893 CEST	443	49988	13.107.246.45	192.168.2.6
Oct 24, 2024 19:31:03.240828037 CEST	443	49988	13.107.246.45	192.168.2.6
Oct 24, 2024 19:31:03.240904093 CEST	49988	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:31:03.241229057 CEST	443	49987	13.107.246.45	192.168.2.6
Oct 24, 2024 19:31:03.241430998 CEST	443	49987	13.107.246.45	192.168.2.6
Oct 24, 2024 19:31:03.241477966 CEST	49987	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:31:03.245280981 CEST	49986	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:31:03.245294094 CEST	443	49986	13.107.246.45	192.168.2.6
Oct 24, 2024 19:31:03.245305061 CEST	49986	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:31:03.245310068 CEST	443	49986	13.107.246.45	192.168.2.6
Oct 24, 2024 19:31:03.246860981 CEST	49988	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:31:03.246861935 CEST	49988	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:31:03.246911049 CEST	443	49988	13.107.246.45	192.168.2.6
Oct 24, 2024 19:31:03.246936083 CEST	49987	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:31:03.246936083 CEST	49987	443	192.168.2.6	13.107.246.45
Oct 24, 2024 19:31:03.246942043 CEST	443	49988	13.107.246.45	192.168.2.6
Oct 24, 2024 19:31:03.246979952 CEST	443	49987	13.107.246.45	192.168.2.6
Oct 24, 2024 19:31:03.246995926 CEST	443	49987	13.107.246.45	192.168.2.6
Oct 24, 2024 19:31:34.689408064 CEST	49706	80	192.168.2.6	93.184.221.240
Oct 24, 2024 19:31:34.696132898 CEST	80	49706	93.184.221.240	192.168.2.6
Oct 24, 2024 19:31:34.696214914 CEST	49706	80	192.168.2.6	93.184.221.240

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 24, 2024 19:30:02.548250914 CEST	1.1.1.1	192.168.2.6	0xc032	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 19:30:02.548250914 CEST	1.1.1.1	192.168.2.6	0xc032	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
Oct 24, 2024 19:30:04.077193022 CEST	1.1.1.1	192.168.2.6	0xd393	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 19:30:04.077193022 CEST	1.1.1.1	192.168.2.6	0xd393	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	13:29:57
Start date:	24/10/2024
Path:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.57841.15930.23271.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen29.57841.15930.23271.exe"
Imagebase:	0x180000
File size:	527'360 bytes
MD5 hash:	A904AE8B26C7D421140BE930266ED425
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000002.2192787560.00000000001AC000.00000004.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	13:29:58
Start date:	24/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Imagebase:	0x370000
File size:	262'432 bytes
MD5 hash:	8FDF47E0FF70C40ED3A17014AEEA4232
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	13:29:58
Start date:	24/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Imagebase:	0x6e0000
File size:	262'432 bytes
MD5 hash:	8FDF47E0FF70C40ED3A17014AEEA4232
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000003.00000002.2335270089.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000002.2336947884.0000000002A88000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	13:30:00
Start date:	24/10/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 1136 -s 268
Imagebase:	0x300000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	1.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	2.5%
Total number of Nodes:	1223
Total number of Limit Nodes:	7

Executed Functions

Function 00183EE0 Relevance: 1.5, APIs: 1, Instructions: 34
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(001F8050,000004E4,00000040,?), ref: 00183F33

Memory Dump Source

Source File: 00000000.00000002.2192734505.0000000000181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2192715688.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192766995.00000000001A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192861927.00000000001F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192878468.00000000001F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192895341.00000000001FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192913783.00000000001FE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192913783.0000000000201000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 8e25d3e678d02ef164738ed5ae7d3b48aa2d267eeba079aaaac7f69bba1f487c
Instruction ID: 43ee9c3232b07b54294580f82251e3b6c2ec658b180191afb6b832f066f17d0f
Opcode Fuzzy Hash: 8e25d3e678d02ef164738ed5ae7d3b48aa2d267eeba079aaaac7f69bba1f487c
Instruction Fuzzy Hash: 79F0E976640601AFD211FB14CC46F56B764FFA8B24F044415FB04A7691D770FA02CEE0

Function 00196E42 Relevance: 4.7, APIs: 3, Instructions: 202
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__freea.LIBCMT ref: 00196FF1

Part of subcall function 001952DA: HeapAlloc.KERNEL32(00000000,00A14480,00000000,?,001860EB,00A14480,?,001826F8,00000018,00000000,00A14480), ref: 0019530C

__freea.LIBCMT ref: 00197006
__freea.LIBCMT ref: 00197016

Memory Dump Source

Source File: 00000000.00000002.2192734505.0000000000181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2192715688.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192766995.00000000001A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192861927.00000000001F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192878468.00000000001F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192895341.00000000001FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192913783.00000000001FE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192913783.0000000000201000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: __freea$AllocHeap
String ID:
API String ID: 85559729-0
Opcode ID: e9d613fdace00843cd1a6f7c326e2a1d4a6cd5c9c19ceb635e6e3a6e0b8cd430
Instruction ID: a341d4be708e7bd88ee168cc72b5122380e5c4e52534a7f5b68a8deb672f950e
Opcode Fuzzy Hash: e9d613fdace00843cd1a6f7c326e2a1d4a6cd5c9c19ceb635e6e3a6e0b8cd430
Instruction Fuzzy Hash: 9A51F272604206AFEF269F64DC91EBF7AA9EF55750F190128FD08D7150EB31DC0087A0

Function 0019AA85 Relevance: 3.2, APIs: 2, Instructions: 177
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0019A5B5: GetOEMCP.KERNEL32(00000000,?,?,00000000,?), ref: 0019A5E0

IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,?,?,?,?,0019A8CC,?,00000000,?,00000000,?), ref: 0019AAE6
GetCPInfo.KERNEL32(00000000,?,?,?,?,?,?,?,?,0019A8CC,?,00000000,?,00000000,?), ref: 0019AB28

Memory Dump Source

Source File: 00000000.00000002.2192734505.0000000000181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2192715688.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192766995.00000000001A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192861927.00000000001F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192878468.00000000001F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192895341.00000000001FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192913783.00000000001FE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192913783.0000000000201000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: CodeInfoPageValid
String ID:
API String ID: 546120528-0
Opcode ID: 7bd74f51ac97be7bdc89b633915cc28fb4e101f3adca5fb625cc51a839f8b9d6
Instruction ID: 0365d5c3091a89b2d1bd28e3f88f70baf5aa49d1bf265d4ab3d1eeb2d973b5fc
Opcode Fuzzy Hash: 7bd74f51ac97be7bdc89b633915cc28fb4e101f3adca5fb625cc51a839f8b9d6
Instruction Fuzzy Hash: 36514570A002049FDF20CF39C8806BABBF6EF95300F58846ED0978B251E7749949CBD2

Function 00194EE3 Relevance: 3.0, APIs: 2, Instructions: 34
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LCMapStringEx.KERNELBASE(?,00196F30,?,?,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 00194F17
LCMapStringW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,?,?,00196F30,?,?,00000000,?,00000000), ref: 00194F35

Memory Dump Source

Source File: 00000000.00000002.2192734505.0000000000181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2192715688.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192766995.00000000001A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192861927.00000000001F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192878468.00000000001F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192895341.00000000001FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192913783.00000000001FE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192913783.0000000000201000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: String
String ID:
API String ID: 2568140703-0
Opcode ID: ec7eb99a23dfad97227e47f837b5ea4747e42d0d172387de5e33162457bd4699
Instruction ID: cbb580e008ba1caddbcb620f6139daa199ca45bdc24433d527bcaac3f50cfdaf
Opcode Fuzzy Hash: ec7eb99a23dfad97227e47f837b5ea4747e42d0d172387de5e33162457bd4699
Instruction Fuzzy Hash: 7AF0763240011ABBCF126F94EC15DDE3F26FF597A0F058010FA1926020CB32C972AB90

Function 0019A689 Relevance: 1.6, APIs: 1, Instructions: 147
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCPInfo.KERNEL32(E8458D00,?,0019A8D8,0019A8CC,00000000), ref: 0019A6BB

Memory Dump Source

Source File: 00000000.00000002.2192734505.0000000000181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2192715688.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192766995.00000000001A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192861927.00000000001F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192878468.00000000001F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192895341.00000000001FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192913783.00000000001FE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192913783.0000000000201000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Info
String ID:
API String ID: 1807457897-0
Opcode ID: 245d5563344b6542d5a3e63a4b30df524a951c6ec37336419025793e2c1f4a8b
Instruction ID: 369deedf1000593c9572c359389336797f38cc3a6467eac5cf6e55c77d1d8a8a
Opcode Fuzzy Hash: 245d5563344b6542d5a3e63a4b30df524a951c6ec37336419025793e2c1f4a8b
Instruction Fuzzy Hash: 6E517B719042589ADF218F68CC84AF67BBCEF15304F6405ADE59AC7182D3319D49CFA1

Non-executed Functions

Function 0019DC53 Relevance: 10.2, APIs: 1, Strings: 4, Instructions: 1436COMMONLIBRARYCODE

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 0019DE37

Strings

1#SNAN, xrefs: 0019DD5F
1#QNAN, xrefs: 0019DD66
1#IND, xrefs: 0019DD58
1#INF, xrefs: 0019DD89

Memory Dump Source

Source File: 00000000.00000002.2192734505.0000000000181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2192715688.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192766995.00000000001A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192861927.00000000001F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192878468.00000000001F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192895341.00000000001FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192913783.00000000001FE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192913783.0000000000201000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 1b2269d1e96354b5301790c3430e41eeb4e8866693f10d2bb8ddc645ebe9708f
Instruction ID: 114686bf7f84a3f12399973670d29118ca93b2cd10dca587b6ac8a18425ebff5
Opcode Fuzzy Hash: 1b2269d1e96354b5301790c3430e41eeb4e8866693f10d2bb8ddc645ebe9708f
Instruction Fuzzy Hash: F0D21571E082298BDF65CE28DD407EAB7F5EB55304F1545EAD40EE7240EB78AE818F81

Function 0019CFAD Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,0019D2CB,00000002,00000000,?,?,?,0019D2CB,?,00000000), ref: 0019D046
GetLocaleInfoW.KERNEL32(?,20001004,0019D2CB,00000002,00000000,?,?,?,0019D2CB,?,00000000), ref: 0019D06F
GetACP.KERNEL32(?,?,0019D2CB,?,00000000), ref: 0019D084

Strings

OCP, xrefs: 0019D001
ACP, xrefs: 0019CFCB

Memory Dump Source

Source File: 00000000.00000002.2192734505.0000000000181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2192715688.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192766995.00000000001A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192861927.00000000001F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192878468.00000000001F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192895341.00000000001FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192913783.00000000001FE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192913783.0000000000201000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: b4458ad06e2c721b86b35e4512903de34ea352b04e44cc13b79bc14a3fefbc88
Instruction ID: e33840cc966c59612c8999966cc2dcd6ca38d98adade6dbaceed691eb15d01f0
Opcode Fuzzy Hash: b4458ad06e2c721b86b35e4512903de34ea352b04e44cc13b79bc14a3fefbc88
Instruction Fuzzy Hash: 7B218032600101AADF348F65E905A97B7A7FB54B50F5E8424F94AE7114E733DE82D790

Function 0019D182 Relevance: 7.7, APIs: 5, Instructions: 183COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 001935E0: GetLastError.KERNEL32(?,00000008,001998D2,00000000,0018AC50), ref: 001935E4
Part of subcall function 001935E0: SetLastError.KERNEL32(00000000,00000002,000000FF), ref: 00193686

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 0019D28E
IsValidCodePage.KERNEL32(00000000), ref: 0019D2D7
IsValidLocale.KERNEL32(?,00000001), ref: 0019D2E6
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 0019D32E
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 0019D34D

Memory Dump Source

Source File: 00000000.00000002.2192734505.0000000000181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2192715688.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192766995.00000000001A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192861927.00000000001F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192878468.00000000001F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192895341.00000000001FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192913783.00000000001FE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192913783.0000000000201000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID:
API String ID: 415426439-0
Opcode ID: 9087bf6e7c06b23e7ec7c63924411cef9a9406cf34f8786d3aa673549111dda5
Instruction ID: 0c9e48e5e608b0ba1a66039c3f4964c8fe060c87a8aa03897ca0a98201e8e8ea
Opcode Fuzzy Hash: 9087bf6e7c06b23e7ec7c63924411cef9a9406cf34f8786d3aa673549111dda5
Instruction Fuzzy Hash: 61517D72A00205AFEF20EFA9EC41AAA73B8FF19700F094469F910E7191E770DA44CB61

Function 0019C81E Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 251COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 001935E0: GetLastError.KERNEL32(?,00000008,001998D2,00000000,0018AC50), ref: 001935E4
Part of subcall function 001935E0: SetLastError.KERNEL32(00000000,00000002,000000FF), ref: 00193686

GetACP.KERNEL32(?,?,?,?,?,?,001916BD,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 0019C8DF
IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,001916BD,?,?,?,00000055,?,-00000050,?,?), ref: 0019C90A
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 0019CA6D

Strings

utf8, xrefs: 0019C9DC

Memory Dump Source

Source File: 00000000.00000002.2192734505.0000000000181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2192715688.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192766995.00000000001A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192861927.00000000001F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192878468.00000000001F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192895341.00000000001FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192913783.00000000001FE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192913783.0000000000201000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ErrorLast$CodeInfoLocalePageValid
String ID: utf8
API String ID: 607553120-905460609
Opcode ID: f8ac673b6dac1efcd07f7e85105f21eb43788c19ee113e24f2fc17c7f136ee26
Instruction ID: c71fc5b9604ec5697da099ad55800aa26a3590380bcfa8d2fc4ee4b72266b9ab
Opcode Fuzzy Hash: f8ac673b6dac1efcd07f7e85105f21eb43788c19ee113e24f2fc17c7f136ee26
Instruction Fuzzy Hash: EB71F671A00606ABEF28EB75CC46FAA73A8EF59740F15402AF585D7181FB70ED4087E5

Function 001954E9 Relevance: 6.3, APIs: 4, Instructions: 337COMMONLIBRARYCODE

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00195576

Memory Dump Source

Source File: 00000000.00000002.2192734505.0000000000181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2192715688.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192766995.00000000001A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192861927.00000000001F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192878468.00000000001F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192895341.00000000001FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192913783.00000000001FE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192913783.0000000000201000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 8478f930c616c08ec86bcfb2cbc63da9681fd4d1ffd84115e55ed78ad104977b
Instruction ID: 9f6a9116ea1dfacf745bf5f3b9227de89efd77c035b73734ffbb663a96e7e00d
Opcode Fuzzy Hash: 8478f930c616c08ec86bcfb2cbc63da9681fd4d1ffd84115e55ed78ad104977b
Instruction Fuzzy Hash: 5BB13732D046459FDF1A8F68C891BFEBBA7EF55350F55816AE805BB242D3349E01CBA0

Function 00186D5B Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 00186D67
IsDebuggerPresent.KERNEL32 ref: 00186E33
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00186E4C
UnhandledExceptionFilter.KERNEL32(?), ref: 00186E56

Memory Dump Source

Source File: 00000000.00000002.2192734505.0000000000181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2192715688.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192766995.00000000001A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192861927.00000000001F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192878468.00000000001F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192895341.00000000001FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192913783.00000000001FE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192913783.0000000000201000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 9e225da89422fb5543f76c77f27dfd7cf8801b1936cdf26c03cdc4afb5dfb418
Instruction ID: 951fbb55fe45230c1ebc36915dd9e0b891180b1943cd98743173d71994b865ad
Opcode Fuzzy Hash: 9e225da89422fb5543f76c77f27dfd7cf8801b1936cdf26c03cdc4afb5dfb418
Instruction Fuzzy Hash: 7531E675D052199BDF21EFA4D989BCDBBB8AF08340F1041EAE50CAB250EB719B85CF45

Function 0019CC31 Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 001935E0: GetLastError.KERNEL32(?,00000008,001998D2,00000000,0018AC50), ref: 001935E4
Part of subcall function 001935E0: SetLastError.KERNEL32(00000000,00000002,000000FF), ref: 00193686

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0019CC85
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0019CCCF
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0019CD95

Memory Dump Source

Source File: 00000000.00000002.2192734505.0000000000181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2192715688.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192766995.00000000001A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192861927.00000000001F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192878468.00000000001F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192895341.00000000001FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192913783.00000000001FE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192913783.0000000000201000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: InfoLocale$ErrorLast
String ID:
API String ID: 661929714-0
Opcode ID: 4e9a1d52a46f0c2a5f3740b6afd3218e31d31e20ceef53b8254eb2544354e1e1
Instruction ID: ff4aa1197e3438c81cbe7afc96e669f7b18339d7186d093bb72c5a8fa32b8970
Opcode Fuzzy Hash: 4e9a1d52a46f0c2a5f3740b6afd3218e31d31e20ceef53b8254eb2544354e1e1
Instruction Fuzzy Hash: B761B0719102079FDF289F28CD82BBABBA9EF14700F14417AE946C6585EB34DA85DBD0

Function 0018AAD3 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 0018ABCB
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 0018ABD5
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 0018ABE2

Memory Dump Source

Source File: 00000000.00000002.2192734505.0000000000181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2192715688.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192766995.00000000001A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192861927.00000000001F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192878468.00000000001F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192895341.00000000001FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192913783.00000000001FE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192913783.0000000000201000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 543ff9b17259db1e5cc47ae0eaeac186f4dcfcec92e8d5d412a6c1b77ea6f6df
Instruction ID: 573e67885c2706b2ab31fcd6bf5d17c4e719422a7ce5a4e3dd469363f1dfd57a
Opcode Fuzzy Hash: 543ff9b17259db1e5cc47ae0eaeac186f4dcfcec92e8d5d412a6c1b77ea6f6df
Instruction Fuzzy Hash: 2D31A5759012199BCB21EF68D989B8DBBB8BF18310F5041DAE41CA7291EB709FC58F45

Function 0018F900 Relevance: 3.4, APIs: 2, Instructions: 449COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2192734505.0000000000181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2192715688.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192766995.00000000001A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192861927.00000000001F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192878468.00000000001F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192895341.00000000001FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192913783.00000000001FE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192913783.0000000000201000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a144cc7ffd934ae1dcebe0acf68312cf276377a27f4616597a1e33d083fe7e8f
Instruction ID: f40f50eca1bf187947d55fddd8c176018d1606dcad087a77fdbb4435a00357b3
Opcode Fuzzy Hash: a144cc7ffd934ae1dcebe0acf68312cf276377a27f4616597a1e33d083fe7e8f
Instruction Fuzzy Hash: 71F12175E002199FDF14DFA9D890AADB7B1FF88324F15826DE915AB390D7309E068F90

Function 001941F3 Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,001941EE,?,?,00000008,?,?,001A14B5,00000000), ref: 00194420

Memory Dump Source

Source File: 00000000.00000002.2192734505.0000000000181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2192715688.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192766995.00000000001A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192861927.00000000001F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192878468.00000000001F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192895341.00000000001FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192913783.00000000001FE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192913783.0000000000201000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 367d2485ae62c42e46be3288c22b52e77580df905f4008defc39b000f7f5aec6
Instruction ID: 34cca6715094a0b0f5640fa4ff3956ae67d042bb49d47c92fa9e4dfdfd491e0b
Opcode Fuzzy Hash: 367d2485ae62c42e46be3288c22b52e77580df905f4008defc39b000f7f5aec6
Instruction Fuzzy Hash: 47B11A35610609DFDB19CF28C486F657BE0FF45364F298658E89ACF2A1C335EA92CB40

Function 001866DC Relevance: 1.7, APIs: 1, Instructions: 242COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 001866F2

Memory Dump Source

Source File: 00000000.00000002.2192734505.0000000000181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2192715688.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192766995.00000000001A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192861927.00000000001F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192878468.00000000001F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192895341.00000000001FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192913783.00000000001FE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192913783.0000000000201000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: a5038acbcc427dee14898b285fa3db58a35aeb511dcf08044156951b90b926f6
Instruction ID: bd7cbd6ffca029b2cc4add8d7112b1ee470d811f6c396554743472648b4d1331
Opcode Fuzzy Hash: a5038acbcc427dee14898b285fa3db58a35aeb511dcf08044156951b90b926f6
Instruction Fuzzy Hash: 55A19CB1E01A05CFDB18DF58D8826ADBBF1FB48724F14812AD415EB7A1D7349A80CF95

Function 00183A65 Relevance: 1.7, APIs: 1, Instructions: 229COMMON

Download Yara Rule

APIs

_Deallocate.LIBCONCRT ref: 00183C81

Memory Dump Source

Source File: 00000000.00000002.2192734505.0000000000181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2192715688.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192766995.00000000001A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192861927.00000000001F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192878468.00000000001F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192895341.00000000001FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192913783.00000000001FE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192913783.0000000000201000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Deallocate
String ID:
API String ID: 1075933841-0
Opcode ID: 54488857644fe25c0da7a63b94d9330e41242f58a0e7cb7e7f1c8dfd8a4b2259
Instruction ID: f4f852291fbaf84bb6f41d51c204adbbdc97b4df7b7e77dff545b10adaac078c
Opcode Fuzzy Hash: 54488857644fe25c0da7a63b94d9330e41242f58a0e7cb7e7f1c8dfd8a4b2259
Instruction Fuzzy Hash: 6361FA729106194BC708EFB898915DEFBA9EB49720F54823AD925EB3D0D335DB02CF44

Function 00199FD9 Relevance: 1.6, APIs: 1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2192734505.0000000000181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2192715688.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192766995.00000000001A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192861927.00000000001F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192878468.00000000001F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192895341.00000000001FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192913783.00000000001FE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192913783.0000000000201000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32b8a9b4aeb207b6daa6cc15f18f38fd91c49807dac6169e5b4e0f743c80722e
Instruction ID: cdb841af63c9f8fc010eeb79b68af3e0cfb586331d5418e413cca3ea98aca122
Opcode Fuzzy Hash: 32b8a9b4aeb207b6daa6cc15f18f38fd91c49807dac6169e5b4e0f743c80722e
Instruction Fuzzy Hash: 9E41A2B5804219AFDF20DF69CC89EAABBB8EF55304F5442DDE419D3201EB359E858F60

Function 0018CC46 Relevance: 1.6, Strings: 1, Instructions: 344COMMONLIBRARYCODE

Download Yara Rule

Strings

0, xrefs: 0018CDD4

Memory Dump Source

Source File: 00000000.00000002.2192734505.0000000000181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2192715688.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192766995.00000000001A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192861927.00000000001F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192878468.00000000001F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192895341.00000000001FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192913783.00000000001FE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192913783.0000000000201000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 863be9e124adb27ea3e33de2eb97390832c6e8b968104bdff07ff8826b83de65
Instruction ID: cfd1d18b9a0d5e62c9d9c8d0ac6085be6d62d214e441b10a90046a451202c77c
Opcode Fuzzy Hash: 863be9e124adb27ea3e33de2eb97390832c6e8b968104bdff07ff8826b83de65
Instruction Fuzzy Hash: E9C1C1709006468FDB28FF68C4946BABBB2AF55310F24462DE5569B291C730EF45CFE1

Function 0019CE84 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 001935E0: GetLastError.KERNEL32(?,00000008,001998D2,00000000,0018AC50), ref: 001935E4
Part of subcall function 001935E0: SetLastError.KERNEL32(00000000,00000002,000000FF), ref: 00193686

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0019CED8

Memory Dump Source

Source File: 00000000.00000002.2192734505.0000000000181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2192715688.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192766995.00000000001A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192861927.00000000001F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192878468.00000000001F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192895341.00000000001FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192913783.00000000001FE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192913783.0000000000201000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: d5d56f6db0f2396c53735323ab39301463959dde9cc22e802fa8b57935f615c0
Instruction ID: f67c507e88bc8305a2510634a8947813f73123aab8c67c1447c9865d5a16fee8
Opcode Fuzzy Hash: d5d56f6db0f2396c53735323ab39301463959dde9cc22e802fa8b57935f615c0
Instruction Fuzzy Hash: 1A21D132615206ABDF289F29DC42EBA73A9EF54340F10007EF945C7181EB35EE45DB90

Function 0018C8FE Relevance: 1.6, Strings: 1, Instructions: 314COMMON

Download Yara Rule

Strings

0, xrefs: 0018CA88

Memory Dump Source

Source File: 00000000.00000002.2192734505.0000000000181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2192715688.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192766995.00000000001A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192861927.00000000001F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192878468.00000000001F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192895341.00000000001FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192913783.00000000001FE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192913783.0000000000201000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: e9d363d558b5db7472c6e393cb866b6afb50efc5f257b152e26a2e7f724c252f
Instruction ID: b9af1aac7a450bdf4574201985b6d4c94e5c480d41d041ef8733b69f83929c2f
Opcode Fuzzy Hash: e9d363d558b5db7472c6e393cb866b6afb50efc5f257b152e26a2e7f724c252f
Instruction Fuzzy Hash: BEB1F270900B0A8BCB28FF68D4926BEB7B1AF11314F14465EE4A6E7291D7319B41CFE1

Function 0019CB0B Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 001935E0: GetLastError.KERNEL32(?,00000008,001998D2,00000000,0018AC50), ref: 001935E4
Part of subcall function 001935E0: SetLastError.KERNEL32(00000000,00000002,000000FF), ref: 00193686

EnumSystemLocalesW.KERNEL32(0019CC31,00000001,00000000,?,-00000050,?,0019D262,00000000,?,?,?,00000055,?), ref: 0019CB7D

Memory Dump Source

Source File: 00000000.00000002.2192734505.0000000000181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2192715688.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192766995.00000000001A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192861927.00000000001F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192878468.00000000001F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192895341.00000000001FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192913783.00000000001FE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192913783.0000000000201000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: dbc4d1f62d7cc78e005a4e8b8bc3f34c58ef4133249f4419c6ca99578cfa85b5
Instruction ID: 2a7430b515e3414a23844840afb97feb886ef682a98892bab6bf9efccf9d7a62
Opcode Fuzzy Hash: dbc4d1f62d7cc78e005a4e8b8bc3f34c58ef4133249f4419c6ca99578cfa85b5
Instruction Fuzzy Hash: 98110C372007055FDF189F39D89257ABB92FF84369B15442DE98787A40D771B943C790

Function 0019D0B3 Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 001935E0: GetLastError.KERNEL32(?,00000008,001998D2,00000000,0018AC50), ref: 001935E4
Part of subcall function 001935E0: SetLastError.KERNEL32(00000000,00000002,000000FF), ref: 00193686

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,0019CE4D,00000000,00000000,?), ref: 0019D0DF

Memory Dump Source

Source File: 00000000.00000002.2192734505.0000000000181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2192715688.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192766995.00000000001A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192861927.00000000001F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192878468.00000000001F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192895341.00000000001FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192913783.00000000001FE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192913783.0000000000201000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 334607f07d12dc2323ce0dff42f7b4841b2ae255b2944aa159966481b1a07bb5
Instruction ID: f31b992405b4e653ad6b8cf4b96832534197f5fb31f5b6ebf89af4bda18647d1
Opcode Fuzzy Hash: 334607f07d12dc2323ce0dff42f7b4841b2ae255b2944aa159966481b1a07bb5
Instruction Fuzzy Hash: 05F0A433600116BBDF289A35DD46ABA7768FB41794F154438EC16A3180EB75FE82C6E0

Function 0019CBA6 Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 001935E0: GetLastError.KERNEL32(?,00000008,001998D2,00000000,0018AC50), ref: 001935E4
Part of subcall function 001935E0: SetLastError.KERNEL32(00000000,00000002,000000FF), ref: 00193686

EnumSystemLocalesW.KERNEL32(0019CE84,00000001,?,?,-00000050,?,0019D226,-00000050,?,?,?,00000055,?,-00000050,?,?), ref: 0019CBF0

Memory Dump Source

Source File: 00000000.00000002.2192734505.0000000000181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2192715688.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192766995.00000000001A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192861927.00000000001F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192878468.00000000001F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192895341.00000000001FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192913783.00000000001FE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192913783.0000000000201000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 68db11c22f25126b1d98d2cc2958d16edece74daa1a321397d0a6577a270a75a
Instruction ID: 1f5b6b304df2d82b1c24db02c9e6ab227efb23f7ca030497af842de186c193ce
Opcode Fuzzy Hash: 68db11c22f25126b1d98d2cc2958d16edece74daa1a321397d0a6577a270a75a
Instruction Fuzzy Hash: A5F0F6362003045FDF249F399C81A7A7B95FF817A8B05442CF9868B680D771AC42C690

Function 001948DD Relevance: 1.5, APIs: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0018D980: EnterCriticalSection.KERNEL32(?,?,001932B8,?,001AB4D0,00000008,0019347C,?,?,?), ref: 0018D98F

EnumSystemLocalesW.KERNEL32(001948D0,00000001,001AB570,0000000C,00194CA2,00000000), ref: 00194915

Memory Dump Source

Source File: 00000000.00000002.2192734505.0000000000181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2192715688.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192766995.00000000001A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192861927.00000000001F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192878468.00000000001F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192895341.00000000001FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192913783.00000000001FE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192913783.0000000000201000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: 339fb167bfe486bfc9deb9d1252d30e6532e308c93a087adb3776f3adfec1117
Instruction ID: ce3f21f78cf148554acf0859229cedd7122677af35569ef1e9515cf55f6a9114
Opcode Fuzzy Hash: 339fb167bfe486bfc9deb9d1252d30e6532e308c93a087adb3776f3adfec1117
Instruction Fuzzy Hash: 34F04976A10214DFDB04EF98E842BAD7BF0EB59725F10415AF410DB2E1DB755980CF40

Function 0019CAC0 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 001935E0: GetLastError.KERNEL32(?,00000008,001998D2,00000000,0018AC50), ref: 001935E4
Part of subcall function 001935E0: SetLastError.KERNEL32(00000000,00000002,000000FF), ref: 00193686

EnumSystemLocalesW.KERNEL32(0019CA19,00000001,?,?,?,0019D284,-00000050,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 0019CAF7

Memory Dump Source

Source File: 00000000.00000002.2192734505.0000000000181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2192715688.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192766995.00000000001A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192861927.00000000001F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192878468.00000000001F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192895341.00000000001FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192913783.00000000001FE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192913783.0000000000201000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: e1a7d4579d323b7eef7ff391637cb555bdaba9d099cfa37b10db9c2cf09a16b2
Instruction ID: d5435cddefc2b37a0a029cd324c5f6f0290102b59d7747638fa171a6b52006d4
Opcode Fuzzy Hash: e1a7d4579d323b7eef7ff391637cb555bdaba9d099cfa37b10db9c2cf09a16b2
Instruction Fuzzy Hash: B9F0E53630020997CF14DF7AD855A6ABF94FFC1794B064059EA058B690D771A942C7A0

Function 00194DA6 Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,?,?,00192223,?,20001004,00000000,00000002,?,?,00191825), ref: 00194DDA

Memory Dump Source

Source File: 00000000.00000002.2192734505.0000000000181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2192715688.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192766995.00000000001A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192861927.00000000001F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192878468.00000000001F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192895341.00000000001FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192913783.00000000001FE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192913783.0000000000201000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: b58e20c163ddc8afbc68b93dbd013428eed6a0c615454c40e41bd4edbaa0b763
Instruction ID: 1b43750edbcc7ab64049d78f6b2896ef04fc148cbff3a3a0e77ac5a589b98e00
Opcode Fuzzy Hash: b58e20c163ddc8afbc68b93dbd013428eed6a0c615454c40e41bd4edbaa0b763
Instruction Fuzzy Hash: A4E04F36500128BBCF132F65EC05FAE3E6AEF55761F054010FD0566160CB319D62AAD9

Function 00186EE8 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00006EF4,001862BF), ref: 00186EED

Memory Dump Source

Source File: 00000000.00000002.2192734505.0000000000181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2192715688.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192766995.00000000001A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192861927.00000000001F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192878468.00000000001F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192895341.00000000001FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192913783.00000000001FE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192913783.0000000000201000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 0a956e98bbe3c45909df15e9b26c7f68962477e572159139ad2b74412f76775d
Instruction ID: c94ed0e00b679ba20aafa226caf60a82dedf03dee2586a2fb477d7d74d29a5b8
Opcode Fuzzy Hash: 0a956e98bbe3c45909df15e9b26c7f68962477e572159139ad2b74412f76775d
Instruction Fuzzy Hash:

Function 0019D3E4 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0019D3E4

Memory Dump Source

Source File: 00000000.00000002.2192734505.0000000000181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2192715688.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192766995.00000000001A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192861927.00000000001F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192878468.00000000001F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192895341.00000000001FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192913783.00000000001FE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192913783.0000000000201000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 7451aa0a40fa0f0b7a8ca60440b20818d8c7a9cfa36d8ff27e780ab3a49b4e71
Instruction ID: 2c297037e25336c30f58b0703cddc21dd3dad492ca82f78e824ab488b4756556
Opcode Fuzzy Hash: 7451aa0a40fa0f0b7a8ca60440b20818d8c7a9cfa36d8ff27e780ab3a49b4e71
Instruction Fuzzy Hash: 14A001B06062028B97408F3AAA4A2197AA9AB466D17598069A509C5A60EA3984D29A02

Function 001B253D Relevance: .9, Instructions: 938COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2192787560.00000000001AC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2192715688.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192734505.0000000000181000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192766995.00000000001A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192861927.00000000001F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192878468.00000000001F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192895341.00000000001FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192913783.00000000001FE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192913783.0000000000201000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6778496f5081a9b405c458b903f801b8a4a3c46c0780170bc51a7578a18a6f20
Instruction ID: 0414aef94a006f97ca4c2b820c3240926305f9b4e72670049c09e793e2fb9e4f
Opcode Fuzzy Hash: 6778496f5081a9b405c458b903f801b8a4a3c46c0780170bc51a7578a18a6f20
Instruction Fuzzy Hash: BF72336144F3C19FD7235B749C749E27FB0AE6721431E08DBD8C18B0A3E6291A6AD772

Function 001B1DB8 Relevance: .6, Instructions: 557COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2192787560.00000000001AC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2192715688.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192734505.0000000000181000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192766995.00000000001A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192861927.00000000001F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192878468.00000000001F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192895341.00000000001FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192913783.00000000001FE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192913783.0000000000201000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4002d440324dbdccbdb3959df6531a64b05f82c9e70eb71a3797617d6bf68e7
Instruction ID: 3a6500a4f1361d847ae214098908cdd341a19ebc6ac16a9c4379dc15dc39a2bd
Opcode Fuzzy Hash: f4002d440324dbdccbdb3959df6531a64b05f82c9e70eb71a3797617d6bf68e7
Instruction Fuzzy Hash: EC22016144E3C29FC7138B749CB56D17FB0AE6722431E45DBD8C0CF4A3E2291A5ADB62

Function 0019C2CF Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2192734505.0000000000181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2192715688.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192766995.00000000001A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192861927.00000000001F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192878468.00000000001F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192895341.00000000001FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192913783.00000000001FE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192913783.0000000000201000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ErrorLastProcess$CurrentFeatureInfoLocalePresentProcessorTerminate
String ID:
API String ID: 3471368781-0
Opcode ID: 063a39ee30ba673270dcc35a762800f870b73e738d2b91ccff908b06b4025bfc
Instruction ID: 3ea4a28c5bb355bbd4228a4bd7c00e631bb7af1ac1efd0ca14ba94ca2771b9e3
Opcode Fuzzy Hash: 063a39ee30ba673270dcc35a762800f870b73e738d2b91ccff908b06b4025bfc
Instruction Fuzzy Hash: 7DB1E4756007029BDF289B28CC92AB7B3E9EF54708F54452DE9C3C6580EB75FA85CB90

Function 00183DE5 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2192734505.0000000000181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2192715688.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192766995.00000000001A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192861927.00000000001F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192878468.00000000001F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192895341.00000000001FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192913783.00000000001FE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192913783.0000000000201000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae15b492cde49f291d06578cc38fd0215e2ecb0b0bd58041494fb56a1f188701
Instruction ID: 58a0eb33a4d837037004b231b4ab7f1a711609b25a9b5c5808ae3bd933ec5434
Opcode Fuzzy Hash: ae15b492cde49f291d06578cc38fd0215e2ecb0b0bd58041494fb56a1f188701
Instruction Fuzzy Hash: 58E092B9646300A7F314AB14CA16B5B36D9EBCA704F40843CB549DB2C0DFB85908CBD6

Function 0019ADE5 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2192734505.0000000000181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2192715688.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192766995.00000000001A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192861927.00000000001F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192878468.00000000001F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192895341.00000000001FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192913783.00000000001FE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192913783.0000000000201000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85171dc8ea8e7c57f9179008db372b7c75af3a104642637dc397ecef40a785e7
Instruction ID: 41cdc33efd67a68a4eba47b9a3350a7c384003aa2d21a26ab38d4fe6501971dc
Opcode Fuzzy Hash: 85171dc8ea8e7c57f9179008db372b7c75af3a104642637dc397ecef40a785e7
Instruction Fuzzy Hash: C0E08C32911238EBCB24DB8CC904D8AF3ECEB44B00B5100AAF501D3100C370DE00C7D0

Function 00190DA3 Relevance: .0, Instructions: 12COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2192734505.0000000000181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2192715688.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192766995.00000000001A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192861927.00000000001F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192878468.00000000001F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192895341.00000000001FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192913783.00000000001FE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192913783.0000000000201000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27f584038b5e21ceb5b3e3197a16a021563d1f621ad6a363097679ac6bf20d33
Instruction ID: 4f4ab0b048e0a0a049d5d3f76da463338803742c0c04be871514f8ebc41e701f
Opcode Fuzzy Hash: 27f584038b5e21ceb5b3e3197a16a021563d1f621ad6a363097679ac6bf20d33
Instruction Fuzzy Hash: 21C08C346029104ECE2AD99082713B433E4B7AA7C2F90088CC5420BA43CB1EBC86D601

Function 00198EB9 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 298
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

, xrefs: 00199132

Memory Dump Source

Source File: 00000000.00000002.2192734505.0000000000181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2192715688.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192766995.00000000001A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192861927.00000000001F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192878468.00000000001F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192895341.00000000001FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192913783.00000000001FE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192913783.0000000000201000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID: 0-3907804496
Opcode ID: d097efbf97ebbb0ad17cdb7e5690785e8af13761b3ac74696dc5c1e6c12ee161
Instruction ID: 2d42d9c4c35b3de4a012a913b4fe42e930b9a1442ea8faa07b56d7ebeadc1ce9
Opcode Fuzzy Hash: d097efbf97ebbb0ad17cdb7e5690785e8af13761b3ac74696dc5c1e6c12ee161
Instruction Fuzzy Hash: DFB1E070A0420AAFDF15EF9DC885BAEBBB1BF56310F144169E805AB392C7719E41CF61

Function 001899E8 Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 303
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

type_info::operator==.LIBVCRUNTIME ref: 00189B07
___TypeMatch.LIBVCRUNTIME ref: 00189C15
CallUnexpected.LIBVCRUNTIME ref: 00189D82

Strings

csm, xrefs: 00189B3E
csm, xrefs: 00189A92
csm, xrefs: 00189A25

Memory Dump Source

Source File: 00000000.00000002.2192734505.0000000000181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2192715688.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192766995.00000000001A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192861927.00000000001F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192878468.00000000001F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192895341.00000000001FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192913783.00000000001FE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192913783.0000000000201000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: CallMatchTypeUnexpectedtype_info::operator==
String ID: csm$csm$csm
API String ID: 1206542248-393685449
Opcode ID: a720d9e6b31ffbaa82ef9b1b76a16ee25469c367ae8aa97239e2a385e5c7aa3c
Instruction ID: 4a7cf66af1cf5243d1dd8eccc1174a8d11d105968d9effcc3878716135697907
Opcode Fuzzy Hash: a720d9e6b31ffbaa82ef9b1b76a16ee25469c367ae8aa97239e2a385e5c7aa3c
Instruction Fuzzy Hash: 65B15971800209AFCF29EFA4D8819BEBBB5FF24310F18465AE8056B252D335EB51CF95

Function 00194AA6 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,00000000,?,083E58C8,?,00194BB3,?,?,00000000,00000000), ref: 00194B67

Strings

api-ms-, xrefs: 00194AFD
ext-ms-, xrefs: 00194B11

Memory Dump Source

Source File: 00000000.00000002.2192734505.0000000000181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2192715688.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192766995.00000000001A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192861927.00000000001F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192878468.00000000001F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192895341.00000000001FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192913783.00000000001FE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192913783.0000000000201000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 4e316943fe6dd21c494120b166671b2c780e75027c103d2cfb8ba9d2eb910e5a
Instruction ID: 676abf129f4aa5faad6f266ac3dde6dfdf3227e76e6dc5ca5b4597f0f862154f
Opcode Fuzzy Hash: 4e316943fe6dd21c494120b166671b2c780e75027c103d2cfb8ba9d2eb910e5a
Instruction Fuzzy Hash: 8C21D332A41211ABCF26DB25DC41F6A7769AF527B4F250221FE17A7690D730ED02CAE0

Function 00185DAD Relevance: 9.2, APIs: 6, Instructions: 175
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000001,?,00000000,00000000,?,?,?,00000001), ref: 00185DF6
MultiByteToWideChar.KERNEL32(00000001,00000001,00000000,?,00000000,00000000), ref: 00185E61
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00185E7E
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 00185EBD
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00185F1C
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 00185F3F

Memory Dump Source

Source File: 00000000.00000002.2192734505.0000000000181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2192715688.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192766995.00000000001A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192861927.00000000001F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192878468.00000000001F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192895341.00000000001FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192913783.00000000001FE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192913783.0000000000201000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ByteCharMultiStringWide
String ID:
API String ID: 2829165498-0
Opcode ID: 1caf28bb2efe9bf5c7e29ebde90fff05848ab3866638b2ad42559ed2ef4b12b5
Instruction ID: 8714c3db77180c5a69f92bc011577dc70c5916e861155d2114ea0ca7956157f4
Opcode Fuzzy Hash: 1caf28bb2efe9bf5c7e29ebde90fff05848ab3866638b2ad42559ed2ef4b12b5
Instruction Fuzzy Hash: 3651B172900A06ABEF20AF64CC85FAB7BAAEF55744F154569FE05E6190E730CE50CF50

Function 0018967A Relevance: 9.1, APIs: 6, Instructions: 60
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(?,?,00189671,00187D9A,00186F38), ref: 00189688
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00189696
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 001896AF
SetLastError.KERNEL32(00000000,00189671,00187D9A,00186F38), ref: 00189701

Memory Dump Source

Source File: 00000000.00000002.2192734505.0000000000181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2192715688.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192766995.00000000001A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192861927.00000000001F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192878468.00000000001F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192895341.00000000001FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192913783.00000000001FE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192913783.0000000000201000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 5b9740390eaabf071a6f16f8351c2e87d62dcb5e9081a9583bbef89a1ca07c65
Instruction ID: 7f3318d68ddde555a9676fcd2cf80e830c3b904a945667fea23595125ccfaed8
Opcode Fuzzy Hash: 5b9740390eaabf071a6f16f8351c2e87d62dcb5e9081a9583bbef89a1ca07c65
Instruction Fuzzy Hash: 6601D4321196115FBB243A787C8553A2645EF127B1334022AF520956E0FF614E46DF51

Function 0018497D Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00184984
std::_Lockit::_Lockit.LIBCPMT ref: 0018498E
int.LIBCPMT ref: 001849A5

Part of subcall function 001820EF: std::_Lockit::_Lockit.LIBCPMT ref: 00182100
Part of subcall function 001820EF: std::_Lockit::~_Lockit.LIBCPMT ref: 0018211A

codecvt.LIBCPMT ref: 001849C8
std::_Facet_Register.LIBCPMT ref: 001849DF
std::_Lockit::~_Lockit.LIBCPMT ref: 001849FF

Memory Dump Source

Source File: 00000000.00000002.2192734505.0000000000181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2192715688.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192766995.00000000001A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192861927.00000000001F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192878468.00000000001F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192895341.00000000001FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192913783.00000000001FE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192913783.0000000000201000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registercodecvt
String ID:
API String ID: 712880209-0
Opcode ID: 48817e695bd9a175b9d872a2db6a2ef18714467bddda89aff0db89d17079407b
Instruction ID: 9fcdedc7694837527d8e7d5bea19aff510b015924f19ce174cebb9de6d562387
Opcode Fuzzy Hash: 48817e695bd9a175b9d872a2db6a2ef18714467bddda89aff0db89d17079407b
Instruction Fuzzy Hash: DE01D275D001168BCB16FBA4C8466BE7BB1AFA4320F150509F911AB2D2DF349F41CF80

Function 00190DC5 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,083E58C8,?,?,00000000,001A1E6B,000000FF,?,00190D55,?,?,00190D29,00000000), ref: 00190DFA
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00190E0C
FreeLibrary.KERNEL32(00000000,?,00000000,001A1E6B,000000FF,?,00190D55,?,?,00190D29,00000000), ref: 00190E2E

Strings

CorExitProcess, xrefs: 00190E04
mscoree.dll, xrefs: 00190DF3

Memory Dump Source

Source File: 00000000.00000002.2192734505.0000000000181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2192715688.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192766995.00000000001A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192861927.00000000001F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192878468.00000000001F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192895341.00000000001FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192913783.00000000001FE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192913783.0000000000201000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 7d13436c7ef4e1443ca9c3e0e7ce74f9af80abc34ac0722e94db63713924dded
Instruction ID: 3494a30fef8174ae82d24e9a374714c9b33cfddc6dc030d752faef6411df49b9
Opcode Fuzzy Hash: 7d13436c7ef4e1443ca9c3e0e7ce74f9af80abc34ac0722e94db63713924dded
Instruction Fuzzy Hash: 6D01A232A04A19AFCF128B54CC09BAFBBB8FB09B14F000629F811E2690DBB49840CA50

Function 00184380 Relevance: 7.5, APIs: 5, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00184387
std::_Lockit::_Lockit.LIBCPMT ref: 00184392
std::_Lockit::~_Lockit.LIBCPMT ref: 00184400

Part of subcall function 001844E3: std::locale::_Locimp::_Locimp.LIBCPMT ref: 001844FB

std::locale::_Setgloballocale.LIBCPMT ref: 001843AD
_Yarn.LIBCPMT ref: 001843C3

Memory Dump Source

Source File: 00000000.00000002.2192734505.0000000000181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2192715688.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192766995.00000000001A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192861927.00000000001F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192878468.00000000001F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192895341.00000000001FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192913783.00000000001FE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192913783.0000000000201000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_SetgloballocaleYarn
String ID:
API String ID: 1088826258-0
Opcode ID: 1871693b3c53be536659149d226951642d26dffc4a8f0faed68c744e98dc89ff
Instruction ID: 81391c5460de9866f359cb2c634f03cf6ce8773136f1e458ec984a57e396547c
Opcode Fuzzy Hash: 1871693b3c53be536659149d226951642d26dffc4a8f0faed68c744e98dc89ff
Instruction Fuzzy Hash: 12017C79A001229BC706FF20D88567D7B71FF96350B15400AF95257392CF746B42CF81

Function 0018A7C2 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,00000000,00000800,?,0018A773,00000000,00000000,?,?,?,?,0018A89D,00000002,FlsGetValue,001A3CD8,FlsGetValue), ref: 0018A7CF
GetLastError.KERNEL32(?,0018A773,00000000,00000000,?,?,?,?,0018A89D,00000002,FlsGetValue,001A3CD8,FlsGetValue,00000000,?,0018972D), ref: 0018A7D9
LoadLibraryExW.KERNEL32(?,00000000,00000000,001A3CD8,FlsGetValue,00000000,?,0018972D), ref: 0018A801

Strings

api-ms-, xrefs: 0018A7E6

Memory Dump Source

Source File: 00000000.00000002.2192734505.0000000000181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2192715688.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192766995.00000000001A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192861927.00000000001F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192878468.00000000001F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192895341.00000000001FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192913783.00000000001FE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192913783.0000000000201000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: efbbb1759a633a003c0b6ca45e57c4c66e46441b2fd2dcf9f6aba865b35181f9
Instruction ID: dc4c131e090ccbb8c4dd3b939f46c326534de049758430b782cdae549efaa2f6
Opcode Fuzzy Hash: efbbb1759a633a003c0b6ca45e57c4c66e46441b2fd2dcf9f6aba865b35181f9
Instruction Fuzzy Hash: 9BE04F30780204BBFF202B75ED06B183A59AF02B55F600032FA0EE84E0E7719A52DAD5

Function 0019740B Relevance: 6.3, APIs: 4, Instructions: 338fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(083E58C8,00000000,00000000,00000000), ref: 0019746E

Part of subcall function 0019997A: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,00196FE7,?,00000000,-00000008), ref: 00199A26

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 001976C9
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00197711
GetLastError.KERNEL32 ref: 001977B4

Memory Dump Source

Source File: 00000000.00000002.2192734505.0000000000181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2192715688.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192766995.00000000001A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192861927.00000000001F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192878468.00000000001F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192895341.00000000001FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192913783.00000000001FE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192913783.0000000000201000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: ddfb002e5c00d57bd7d811526a96b2b3fc407d6fccbb9c7532f5b6c54e2b3ec0
Instruction ID: 4d7cd07e3881480e419f9cffb8f7b3b67e781efea603a7fc0565f2b42f99a9d9
Opcode Fuzzy Hash: ddfb002e5c00d57bd7d811526a96b2b3fc407d6fccbb9c7532f5b6c54e2b3ec0
Instruction Fuzzy Hash: E9D16A75E142489FCF05CFE8D884AADBBB5FF09314F18812AE926E7391D730A941CB60

Function 00189791 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00189858
___AdjustPointer.LIBCMT ref: 0018987B
___AdjustPointer.LIBCMT ref: 00189917

Memory Dump Source

Source File: 00000000.00000002.2192734505.0000000000181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2192715688.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192766995.00000000001A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192861927.00000000001F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192878468.00000000001F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192895341.00000000001FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192913783.00000000001FE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192913783.0000000000201000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 7fd3069b317a591f9fe626bed30261cd9336b54fdc48f1e793bf76f97360111e
Instruction ID: a77870625e5ac22b02c3b8fcad2f72fe862a544b7a80a579dbc5a1299b90244e
Opcode Fuzzy Hash: 7fd3069b317a591f9fe626bed30261cd9336b54fdc48f1e793bf76f97360111e
Instruction Fuzzy Hash: C651F172A0420BDFEB29BF54D840BBAB3A4EF52314F28412DE90157291E732EE40CF90

Function 00199D96 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 0019997A: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,00196FE7,?,00000000,-00000008), ref: 00199A26

GetLastError.KERNEL32 ref: 00199DFA
__dosmaperr.LIBCMT ref: 00199E01
GetLastError.KERNEL32(?,?,?,?), ref: 00199E3B
__dosmaperr.LIBCMT ref: 00199E42

Memory Dump Source

Source File: 00000000.00000002.2192734505.0000000000181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2192715688.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192766995.00000000001A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192861927.00000000001F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192878468.00000000001F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192895341.00000000001FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192913783.00000000001FE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192913783.0000000000201000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: 1592bb02f63f6e4308fcce0e820497625aa719ff401d9f804345515bdf32722d
Instruction ID: 8baed22039873fa0c2664ca5d4d00d4da8cb6dd063e86395323bad4d739e3869
Opcode Fuzzy Hash: 1592bb02f63f6e4308fcce0e820497625aa719ff401d9f804345515bdf32722d
Instruction Fuzzy Hash: 8B21A172600609AFDF20FFA9C88096BB7E9FF15364714892CF91997641EB31ED50CBA1

Function 0018FEAA Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2192734505.0000000000181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2192715688.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192766995.00000000001A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192861927.00000000001F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192878468.00000000001F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192895341.00000000001FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192913783.00000000001FE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192913783.0000000000201000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67ce401a7dbb8ddcc02fe4ddd5c254f72554e354ab6a575ccdba3997fc701515
Instruction ID: 4feb15651a9162013477fd56af2902e5f7db00d923af87b1475eb2801a470c29
Opcode Fuzzy Hash: 67ce401a7dbb8ddcc02fe4ddd5c254f72554e354ab6a575ccdba3997fc701515
Instruction Fuzzy Hash: 03219D72604215AFCB20BF75988092A77A9FF22364B15493DFA15D7151EB30EE02CFA0

Function 0019AD45 Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 0019AD4D

Part of subcall function 0019997A: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,00196FE7,?,00000000,-00000008), ref: 00199A26

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0019AD85
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0019ADA5

Memory Dump Source

Source File: 00000000.00000002.2192734505.0000000000181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2192715688.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192766995.00000000001A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192861927.00000000001F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192878468.00000000001F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192895341.00000000001FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192913783.00000000001FE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192913783.0000000000201000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: 39be37d1779aeb0b45e5ccb64e58df5a916efc23e985ed00c69e4bcf62108439
Instruction ID: 69761cffd5c6a56b3208ed3b7677c7829276cf0755912ea83e9ed40632922b76
Opcode Fuzzy Hash: 39be37d1779aeb0b45e5ccb64e58df5a916efc23e985ed00c69e4bcf62108439
Instruction Fuzzy Hash: B111C0F2A016157FAF1527F95C8ADAF2AACDF9A3D93600428F901A1501FF30DD0581F2

Function 0018195F Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0018196B
int.LIBCPMT ref: 0018197E

Part of subcall function 001820EF: std::_Lockit::_Lockit.LIBCPMT ref: 00182100
Part of subcall function 001820EF: std::_Lockit::~_Lockit.LIBCPMT ref: 0018211A

std::_Facet_Register.LIBCPMT ref: 001819B1
std::_Lockit::~_Lockit.LIBCPMT ref: 001819C7

Memory Dump Source

Source File: 00000000.00000002.2192734505.0000000000181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2192715688.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192766995.00000000001A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192861927.00000000001F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192878468.00000000001F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192895341.00000000001FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192913783.00000000001FE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192913783.0000000000201000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID:
API String ID: 459529453-0
Opcode ID: 14d6576c8ad808e2d867b5b4b6a9845c531d802f10b3ad4a1cb10eb5798142ed
Instruction ID: dd5716f0cfcf53a76d66e5a40871a269bfaf31dd39d9640c7442976cb1b1598a
Opcode Fuzzy Hash: 14d6576c8ad808e2d867b5b4b6a9845c531d802f10b3ad4a1cb10eb5798142ed
Instruction Fuzzy Hash: CE01D632900119BBCB1ABB64DC559EE77ACDF50764B200149F905AB2A1EF30AF82CFC0

Function 001819D8 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 001819E4
int.LIBCPMT ref: 001819F7

Part of subcall function 001820EF: std::_Lockit::_Lockit.LIBCPMT ref: 00182100
Part of subcall function 001820EF: std::_Lockit::~_Lockit.LIBCPMT ref: 0018211A

std::_Facet_Register.LIBCPMT ref: 00181A2A
std::_Lockit::~_Lockit.LIBCPMT ref: 00181A40

Memory Dump Source

Source File: 00000000.00000002.2192734505.0000000000181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2192715688.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192766995.00000000001A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192861927.00000000001F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192878468.00000000001F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192895341.00000000001FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192913783.00000000001FE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192913783.0000000000201000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID:
API String ID: 459529453-0
Opcode ID: 431def5ef11c8794bdf8c59d3ded586c57b5fb16fb31783be30f63a06a8fe80e
Instruction ID: 2303dad53e2be494c9e4c58ee53ece903e1f7a0c489e9d017a61b489875ae929
Opcode Fuzzy Hash: 431def5ef11c8794bdf8c59d3ded586c57b5fb16fb31783be30f63a06a8fe80e
Instruction Fuzzy Hash: 0B01A276900115BBCB1ABB64DC469AE776CDF60760B114159F905AB2A1EF70AF42CFC0

Function 00181A51 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00181A5D
int.LIBCPMT ref: 00181A70

Part of subcall function 001820EF: std::_Lockit::_Lockit.LIBCPMT ref: 00182100
Part of subcall function 001820EF: std::_Lockit::~_Lockit.LIBCPMT ref: 0018211A

std::_Facet_Register.LIBCPMT ref: 00181AA3
std::_Lockit::~_Lockit.LIBCPMT ref: 00181AB9

Memory Dump Source

Source File: 00000000.00000002.2192734505.0000000000181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2192715688.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192766995.00000000001A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192861927.00000000001F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192878468.00000000001F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192895341.00000000001FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192913783.00000000001FE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192913783.0000000000201000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID:
API String ID: 459529453-0
Opcode ID: 717edac8f472b5091e16459574161cd961c4bb09457a7c2dc11352fb3f4e9ade
Instruction ID: 44a534844a99f209d6e4defd0aed345a4b62949be41d05d16d51affea7ca4e19
Opcode Fuzzy Hash: 717edac8f472b5091e16459574161cd961c4bb09457a7c2dc11352fb3f4e9ade
Instruction Fuzzy Hash: E3018F76900154ABCB1AFB64D8059EE77ACAFA0760B110649F915A7291EF30AF82CF90

Function 001A05BF Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,0000000C,?,00000000,00000000,?,0019F5F5,00000000,00000001,00000000,00000000,?,00197808,00000000,00000000,00000000), ref: 001A05D6
GetLastError.KERNEL32(?,0019F5F5,00000000,00000001,00000000,00000000,?,00197808,00000000,00000000,00000000,00000000,00000000,?,00197D8F,00000000), ref: 001A05E2

Part of subcall function 001A05A8: CloseHandle.KERNEL32(FFFFFFFE,001A05F2,?,0019F5F5,00000000,00000001,00000000,00000000,?,00197808,00000000,00000000,00000000,00000000,00000000), ref: 001A05B8

___initconout.LIBCMT ref: 001A05F2

Part of subcall function 001A056A: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,001A0599,0019F5E2,00000000,?,00197808,00000000,00000000,00000000,00000000), ref: 001A057D

WriteConsoleW.KERNEL32(00000000,0000000C,?,00000000,?,0019F5F5,00000000,00000001,00000000,00000000,?,00197808,00000000,00000000,00000000,00000000), ref: 001A0607

Memory Dump Source

Source File: 00000000.00000002.2192734505.0000000000181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2192715688.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192766995.00000000001A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192861927.00000000001F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192878468.00000000001F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192895341.00000000001FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192913783.00000000001FE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192913783.0000000000201000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 8782354e7ba9d26e88a27b49b6f4b65644a27a73b3253907de24ea75344cdd08
Instruction ID: f1aaa98ef46af7dddce9723d37f2ec10bf5d93dbbe43ffeaa0c4f0619246ea8f
Opcode Fuzzy Hash: 8782354e7ba9d26e88a27b49b6f4b65644a27a73b3253907de24ea75344cdd08
Instruction Fuzzy Hash: 95F0AC3A540154BBCF676F95EC08A993FA6FB5E7A1F044010FA1995520CB328960DF90

Function 00189480 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 001894BF
__IsNonwritableInCurrentImage.LIBCMT ref: 00189573

Strings

csm, xrefs: 0018955D

Memory Dump Source

Source File: 00000000.00000002.2192734505.0000000000181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2192715688.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192766995.00000000001A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192861927.00000000001F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192878468.00000000001F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192895341.00000000001FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192913783.00000000001FE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192913783.0000000000201000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 3480331319-1018135373
Opcode ID: 8654fc593fa30eb70dc3d3183d40c2d1a8719d42dc6270be04c0d96445f4b771
Instruction ID: 403d2c2c811e18ca0c04ee202b95c5ad3e9a5ccdbf5e80137243d7fd3af3c5a2
Opcode Fuzzy Hash: 8654fc593fa30eb70dc3d3183d40c2d1a8719d42dc6270be04c0d96445f4b771
Instruction Fuzzy Hash: FF41C634A002189FCF11EF68C884AAEBBB5AF45314F188156F8199B352D731EB55CF91

Function 00189D8D Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?), ref: 00189DB2

Strings

RCC, xrefs: 00189DCC
MOC, xrefs: 00189DC4

Memory Dump Source

Source File: 00000000.00000002.2192734505.0000000000181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2192715688.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192766995.00000000001A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192861927.00000000001F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192878468.00000000001F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192895341.00000000001FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192913783.00000000001FE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192913783.0000000000201000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 51679700a214bcdbd2076b25744940a2dfcd563d85e191d28f23312c7cd4464c
Instruction ID: 7d3689e62a4515ee4e7cbaad0b479f7c826cddee19810da6b800ff204a21f80d
Opcode Fuzzy Hash: 51679700a214bcdbd2076b25744940a2dfcd563d85e191d28f23312c7cd4464c
Instruction Fuzzy Hash: 7A412772900209AFCF16EF98CD81AEEBBB5FF58304F198199FA0466261D3359A50DF90

Function 00181BA3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00181BAA
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00181BE2

Part of subcall function 0018447E: _Yarn.LIBCPMT ref: 0018449D
Part of subcall function 0018447E: _Yarn.LIBCPMT ref: 001844C1

Strings

bad locale name, xrefs: 00181BF0

Memory Dump Source

Source File: 00000000.00000002.2192734505.0000000000181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2192715688.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192766995.00000000001A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192787560.00000000001EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192861927.00000000001F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192878468.00000000001F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192895341.00000000001FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192913783.00000000001FE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2192913783.0000000000201000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Yarnstd::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 1908188788-1405518554
Opcode ID: 59c17ecc5b9f1303e0cd8cc0b0666abd93d3324b83230d4c841a2baf94962de3
Instruction ID: 470a48e70ce6a17815b2474fc8b58e2ffb9126c83e50255f2861e2952d70c176
Opcode Fuzzy Hash: 59c17ecc5b9f1303e0cd8cc0b0666abd93d3324b83230d4c841a2baf94962de3
Instruction Fuzzy Hash: C9F01772545B519E8331AF6A8481543FBE4BF29250390CA2FE1DEC3A11DB30E504CFAA

Analysis Process: MSBuild.exePID: 6108, Parent PID: 1136COMMON

Execution Graph

Execution Coverage:	15.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	194
Total number of Limit Nodes:	18

Executed Functions

Function 065EAB80 Relevance: 6.3, APIs: 1, Strings: 2, Instructions: 1088
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

;T, xrefs: 065EB242, 065EB247
CL, xrefs: 065EAC60, 065EAC65

Memory Dump Source

Source File: 00000003.00000002.2350106853.00000000065E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_65e0000_MSBuild.jbxd

Similarity

API ID:
String ID: ;T$CL
API String ID: 0-212969120
Opcode ID: 3a163836e215e7311d2efebe27873e5640ddd67fe3a179c86b6342663d83be38
Instruction ID: fe6944dbda8643d22754a5b5937e97d53a4dbb7529950630c21c7b7cf262889b
Opcode Fuzzy Hash: 3a163836e215e7311d2efebe27873e5640ddd67fe3a179c86b6342663d83be38
Instruction Fuzzy Hash: A4C2AE74E012698FDBA4EF28D998B9DB7B2FB89300F1085E9D509A7354DB316E81CF50

Function 065EC310 Relevance: 2.9, Strings: 2, Instructions: 364
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

., xrefs: 065EC590
1, xrefs: 065EC615

Memory Dump Source

Source File: 00000003.00000002.2350106853.00000000065E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_65e0000_MSBuild.jbxd

Similarity

API ID:
String ID: .$1
API String ID: 0-1839485796
Opcode ID: 59cd10a20a5ee82d7ea20e5a980ea15c7f6017aaa6646d34cd91f6f0f7858b12
Instruction ID: 864044e78c587c40c8ee78ae95fe8a28f081a5bbe601fc79906ad67fd6e0324f
Opcode Fuzzy Hash: 59cd10a20a5ee82d7ea20e5a980ea15c7f6017aaa6646d34cd91f6f0f7858b12
Instruction Fuzzy Hash: D7F1BF74E01328CFDB68DF65D984B9DBBB2BF89301F1085A9D509AB250DB719E81CF50

Function 065E9BA8 Relevance: 1.4, Strings: 1, Instructions: 192COMMON

Download Yara Rule

Strings

;4, xrefs: 065E9DA5, 065E9DAA

Memory Dump Source

Source File: 00000003.00000002.2350106853.00000000065E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_65e0000_MSBuild.jbxd

Similarity

API ID:
String ID: ;4
API String ID: 0-4181167889
Opcode ID: 8986e6e020c300f6defd79be5840d340d77738e5607c4c6d33789c528af28350
Instruction ID: bea76501a391e072fcf240e39d71cb2d6b741906290457eb2df28461f45d5437
Opcode Fuzzy Hash: 8986e6e020c300f6defd79be5840d340d77738e5607c4c6d33789c528af28350
Instruction Fuzzy Hash: 7C910374E01219CFDB68DFA8C990B9DBBB2FF89300F1085A9D509AB351DB306A85CF51

Function 0657EF40 Relevance: .8, Instructions: 784COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2349358688.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3f41c7e624dc1e875f1869495c55af60869d98a8cbf4d758fbf986c934628cc
Instruction ID: 8ffe7ea15ab2796ca3868d06c18020bcce98fdc44b9d5a90ec7f9a8155e67303
Opcode Fuzzy Hash: b3f41c7e624dc1e875f1869495c55af60869d98a8cbf4d758fbf986c934628cc
Instruction Fuzzy Hash: 85622735A002049FDB54DF68D894AADBBF6FF88310F1584A9E905EB361DB31ED46CB90

Function 0657C588 Relevance: .7, Instructions: 706COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2349358688.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6030749fd66ff10767272d8662952558e3244b5c21e2441e715c0d8ec01b6536
Instruction ID: f241bd140b46b0686439dba53a34648ddc6f05569d9d34621f6a59b30d01ccee
Opcode Fuzzy Hash: 6030749fd66ff10767272d8662952558e3244b5c21e2441e715c0d8ec01b6536
Instruction Fuzzy Hash: B6528C30A002058FDB55DF78D854B6EBBF2AF89300F1585A9D90AAB392DB31DD85CB91

Function 062C3F50 Relevance: .5, Instructions: 524COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2348854653.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_62c0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 192bbe25966656776180db3f4a11440e891c0bd0ca0f14686891f95da268e070
Instruction ID: f8966146009b5a53939c4ec4845fae1ef0e05fe2c87ebd0faa1a37a32d44be4e
Opcode Fuzzy Hash: 192bbe25966656776180db3f4a11440e891c0bd0ca0f14686891f95da268e070
Instruction Fuzzy Hash: 1F127134B102058FDB54EF69C894AAEBBF6BF88710B148269D906EB365DB71DC41CB90

Function 065BC7E2 Relevance: .4, Instructions: 436COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2349584262.00000000065B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_65b0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0c4d74a698582ea0375b7307ce7b7429225c02af7f6abb24eb12bf6b0358c46
Instruction ID: 076a04e666216c9b2a554d334f21de507c11b84a740703a2fc43abc3e2b9e44c
Opcode Fuzzy Hash: a0c4d74a698582ea0375b7307ce7b7429225c02af7f6abb24eb12bf6b0358c46
Instruction Fuzzy Hash: 56228E74D01229CFDBA5DF64C890BD9BBB2BF89300F1095EAD509AB250EB355E85CF90

Function 062C67D8 Relevance: .4, Instructions: 413COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2348854653.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_62c0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 497863c89275e3843bf84c074be32abebbbd44033c0e2114d6b452f21e678974
Instruction ID: e7fdf3423a7a8c3ec80a2c4d827577beb4e0c4e8ebd8f81e8a9df52a3d42d862
Opcode Fuzzy Hash: 497863c89275e3843bf84c074be32abebbbd44033c0e2114d6b452f21e678974
Instruction Fuzzy Hash: 22F1B230A10256DFDB04DF68D884B9EBBF2EF84310F148669E905EB2A1DB71ED45CB91

Function 06570A0C Relevance: .4, Instructions: 356COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2349358688.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce79870e6d0156808aa74ac47326ad5fa3c2bf364b7101a59ebd5e8797017d33
Instruction ID: d6922e25d8b003acb68b7eb68d9a9f33742c1676356274dd47f060bdc5a03012
Opcode Fuzzy Hash: ce79870e6d0156808aa74ac47326ad5fa3c2bf364b7101a59ebd5e8797017d33
Instruction Fuzzy Hash: D3D16D31A00249DFCB45CF69D884AAEBBF6FF89300B158569E505EB362D730EC55CBA1

Function 062CA688 Relevance: .3, Instructions: 307COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2348854653.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_62c0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab31b260f33b99e8dceb0ad114e145bbfd5e34f7831a963976206baabacaedc7
Instruction ID: 26fbed49873d379ed64eda59e7e1d235fbf5e56d817ae91f21dbaa91bef03b0c
Opcode Fuzzy Hash: ab31b260f33b99e8dceb0ad114e145bbfd5e34f7831a963976206baabacaedc7
Instruction Fuzzy Hash: 51D1E334A01218CFDB18EFB4D854A9DBBB2FF8A311F1085ADD50AAB394DB319985CF51

Function 062CA6B8 Relevance: .3, Instructions: 289COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2348854653.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_62c0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a5d85e9675704da45ed5b97b148f456f1f95f9b44e75a06a26587d0a568db8b
Instruction ID: 69116f296072ce40598b16e9fd15591ec55ef4cb60453cfaf8253250ae57a38a
Opcode Fuzzy Hash: 2a5d85e9675704da45ed5b97b148f456f1f95f9b44e75a06a26587d0a568db8b
Instruction Fuzzy Hash: D3D1C334A01218CFDB18EFB4D854A9DBBB2FF8A311F1085A9D50AAB394DB319985CF51

Function 065E9439 Relevance: .3, Instructions: 275COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2350106853.00000000065E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_65e0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8b11961012dff642ccb72c56b704cca2bed658d2f53ed819d4eb5f51c930369
Instruction ID: ab81c8ce1e41e3241d96e1c18bba716d1061587cec64c4d2f76bfa8bcf6129a7
Opcode Fuzzy Hash: d8b11961012dff642ccb72c56b704cca2bed658d2f53ed819d4eb5f51c930369
Instruction Fuzzy Hash: A9C1C870E01218CFDF68DFA5C89079EBBB2BF89300F10856AD509AB355DB345A86CF51

Function 065B9740 Relevance: .2, Instructions: 233COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2349584262.00000000065B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_65b0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: edafebf3e30e281b6bcba566fe104cf9615896614272738b3af5e5823cddbdfc
Instruction ID: 2188e144c73e8e816a6af5cee724bab1cffdefd7dd3e08359d652645ab57ae1e
Opcode Fuzzy Hash: edafebf3e30e281b6bcba566fe104cf9615896614272738b3af5e5823cddbdfc
Instruction Fuzzy Hash: 3DA1F474E01258CFDB64DFA5C854BEEBBB2BF8A300F1094A9D50AAB351DB305A85CF51

Function 06570D20 Relevance: 2.9, Strings: 2, Instructions: 412
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4aj, xrefs: 06570F77
t]j, xrefs: 06570EAD

Memory Dump Source

Source File: 00000003.00000002.2349358688.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID: 4aj$t]j
API String ID: 0-1736062215
Opcode ID: a7c44a986e8dfc75477de342ec1ad2666854fa60760e0c8d3cdd2a44886bd7ab
Instruction ID: ae33d3e18c37aa0e72c6d3bdd83d4cc29f60f93c37164d2e36186a4ea8da8e18
Opcode Fuzzy Hash: a7c44a986e8dfc75477de342ec1ad2666854fa60760e0c8d3cdd2a44886bd7ab
Instruction Fuzzy Hash: 04F15774A002499FDB55DFA8E858AAE7BF2FF88300F154469E906EB391DB31AC41CF51

Function 06578B68 Relevance: 2.8, Strings: 2, Instructions: 305
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Dj, xrefs: 06578BDE
Dj, xrefs: 06578C4B

Memory Dump Source

Source File: 00000003.00000002.2349358688.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID: Dj$Dj
API String ID: 0-4053781439
Opcode ID: cfdb4f2454922e21f70aeec58a68790666072ee975b1700d70a95c529dde39ed
Instruction ID: 9caacb3e1a792895a17e317291b36a1708f30bea64b66ac7fc525315c9093416
Opcode Fuzzy Hash: cfdb4f2454922e21f70aeec58a68790666072ee975b1700d70a95c529dde39ed
Instruction Fuzzy Hash: 05C19D3060A209CFF78AEB69F988A6977B5F7443C47016E15E1278F669C730ED428F91

Function 06577D78 Relevance: 2.5, Strings: 2, Instructions: 36
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

st, xrefs: 06577DD8
|j, xrefs: 06577DC4

Memory Dump Source

Source File: 00000003.00000002.2349358688.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID: |j$st
API String ID: 0-2078023383
Opcode ID: accf36d15d05e86db309915f8dc58d3e10c4bceb8dd29e8f42658c4f3de9b916
Instruction ID: 8e36d3a59f1eec61259de15912f04ed2b06886c20db387ecafad69401b0ff2cb
Opcode Fuzzy Hash: accf36d15d05e86db309915f8dc58d3e10c4bceb8dd29e8f42658c4f3de9b916
Instruction Fuzzy Hash: 2AF062312002019BC349EB68D90095EBFA6EFC6350740DA3ED30A8F711DFB1BA068BD1

Function 06577D7A Relevance: 2.5, Strings: 2, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

st, xrefs: 06577DD8
|j, xrefs: 06577DC4

Memory Dump Source

Source File: 00000003.00000002.2349358688.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID: |j$st
API String ID: 0-2078023383
Opcode ID: 92d35d1277ecd98c458dd318f4bfb3c3155f09342cfb6eabaf1a1d19b5c2e4a0
Instruction ID: e5bf726e856df7adb837aa6cef5d1e5692c11689f03d1c842f815fe1ae32ba11
Opcode Fuzzy Hash: 92d35d1277ecd98c458dd318f4bfb3c3155f09342cfb6eabaf1a1d19b5c2e4a0
Instruction Fuzzy Hash: 4CF012312006019BC359EB68E54099EBFA6EFC6350750DA3ED30A8F615DFB5BA068BD1

Function 00F4AE30 Relevance: 1.7, APIs: 1, Instructions: 198
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00F4B086

Memory Dump Source

Source File: 00000003.00000002.2336644599.0000000000F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_f40000_MSBuild.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 2e5020b6a20d7e014606a9ccfebd57bdc0fddf1550d03a57db914eabad531d2d
Instruction ID: da01154f55326101b2dbac367e53972035bf1f87cb17cc5b23c886fe5732d2c5
Opcode Fuzzy Hash: 2e5020b6a20d7e014606a9ccfebd57bdc0fddf1550d03a57db914eabad531d2d
Instruction Fuzzy Hash: 4B7126B0A00B058FDB24DF2AD44579ABBF1FF88714F00892DE85AD7A40DB75E949CB91

Function 065B3F3F Relevance: 1.6, APIs: 1, Instructions: 131
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserExceptionDispatcher.NTDLL ref: 065B4098

Memory Dump Source

Source File: 00000003.00000002.2349584262.00000000065B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_65b0000_MSBuild.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: f2ef4ba78997212b9ad50d851548bf27c57004b5716d92b55e077ab8c50a77d0
Instruction ID: 70b0482818e2171d4da6b6aea0107c61eba96954a6c86a0877cc8ce665e453ae
Opcode Fuzzy Hash: f2ef4ba78997212b9ad50d851548bf27c57004b5716d92b55e077ab8c50a77d0
Instruction Fuzzy Hash: AA51C074E01248DFDB48EFA5D8846EDBBF2FF88304F14942AE505AB258EB349956CF50

Function 04FB0BFC Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 04FB4381

Memory Dump Source

Source File: 00000003.00000002.2347386975.0000000004FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4fb0000_MSBuild.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 72995a7c8f094d504ac302f7f139641fc72fe1cd00aac0871ce4bd30e4ca5332
Instruction ID: f2ad8c20c58641f42dc657f409d8e12e435049a83461163a0f0d0f0a13a90e25
Opcode Fuzzy Hash: 72995a7c8f094d504ac302f7f139641fc72fe1cd00aac0871ce4bd30e4ca5332
Instruction Fuzzy Hash: 40415AB5A00309DFDB04CF9AC448AAEBBF5FF89314F288449D559AB321D775E841CBA0

Function 06576918 Relevance: 1.6, Strings: 1, Instructions: 347
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

t]j, xrefs: 06576980

Memory Dump Source

Source File: 00000003.00000002.2349358688.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID: t]j
API String ID: 0-4143265272
Opcode ID: 100d6746bbc9f2cfe17b77dd70f26b361ee53d12ec88896e7c4b72272bf5900e
Instruction ID: 66d4c6a27e9cdb79acd7f15da7cef91534514266a40a7640297baad8b10f9a64
Opcode Fuzzy Hash: 100d6746bbc9f2cfe17b77dd70f26b361ee53d12ec88896e7c4b72272bf5900e
Instruction Fuzzy Hash: 89D18A34B006048FDB55DF68D858A6E7BF6FB89300B148869EA06DB391DB75EC05CB91

Function 00F44248 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 00F459F1

Memory Dump Source

Source File: 00000003.00000002.2336644599.0000000000F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_f40000_MSBuild.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 1dc738a86a4e2351dd20bfa449ef53947c0702d0622f1c354fb61f7527524d98
Instruction ID: 746b69b372fa9d8a36080392f61e98b9badd20bda0de89a19e249a4a4d994cae
Opcode Fuzzy Hash: 1dc738a86a4e2351dd20bfa449ef53947c0702d0622f1c354fb61f7527524d98
Instruction Fuzzy Hash: 0741E270D0071DCBEB24DFA9C844B8DBBB5FF45714F20816AD408AB252DBB56945CF90

Function 00F45935 Relevance: 1.6, APIs: 1, Instructions: 95COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 00F459F1

Memory Dump Source

Source File: 00000003.00000002.2336644599.0000000000F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_f40000_MSBuild.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 51e349c1d82753b631b4476d165fa6d1563c3bdb0be5aab62b73199ddcdb43e5
Instruction ID: 415c058b4816eb87b08a1e50e7dfac1f8a395943d74eb08a115ea44859309d6b
Opcode Fuzzy Hash: 51e349c1d82753b631b4476d165fa6d1563c3bdb0be5aab62b73199ddcdb43e5
Instruction Fuzzy Hash: A141D170D00719CFEB24DFA9C98478DBBB5FF48714F20815AD408AB251DBB56946CF50

Function 065B3FC2 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 065B4098

Memory Dump Source

Source File: 00000003.00000002.2349584262.00000000065B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_65b0000_MSBuild.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: dd877a21166699192d027d936943e84184564025e38e60ad89b26bf8b0777692
Instruction ID: b7943f9eda5a4ed6532e74c46347219f7c1c33c32b6663f83848f599b9b6de30
Opcode Fuzzy Hash: dd877a21166699192d027d936943e84184564025e38e60ad89b26bf8b0777692
Instruction Fuzzy Hash: 9831B374E01209CFCB44EFA4D494AEDBBB2FF88304F20942AE516AB358DB349956CF50

Function 00F4C9A0 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,00F4D2C6,?,?,?,?,?), ref: 00F4D387

Memory Dump Source

Source File: 00000003.00000002.2336644599.0000000000F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_f40000_MSBuild.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: bb7cf3d0143f64e001690ef575e762a9f36b078c51f0bfa7b37388df82fe8b30
Instruction ID: a3f36559380eb62b040c46674be91e9006bf9faef17140b52e82eaa79a926e57
Opcode Fuzzy Hash: bb7cf3d0143f64e001690ef575e762a9f36b078c51f0bfa7b37388df82fe8b30
Instruction Fuzzy Hash: 4521E3B5900349DFDB10CF9AD984AEEBFF4EB48324F14841AE918A7350D374A950CFA5

Function 00F4D2F9 Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,00F4D2C6,?,?,?,?,?), ref: 00F4D387

Memory Dump Source

Source File: 00000003.00000002.2336644599.0000000000F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_f40000_MSBuild.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 5b3b73b6f9b8ce0454d69c102d878c401f451d6ce6b7c938e5ddd42599fefcc2
Instruction ID: aadef54ec3fdfd462d1c8d825b0e00c533b6f16fcd2d71f0efe95ba985b23367
Opcode Fuzzy Hash: 5b3b73b6f9b8ce0454d69c102d878c401f451d6ce6b7c938e5ddd42599fefcc2
Instruction Fuzzy Hash: B82103B5900209DFDB10CFAAD584AEEBFF4FB48324F10801AE918A3310C374A950CFA5

Function 065B4120 Relevance: 1.6, APIs: 1, Instructions: 60libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 065B4185

Memory Dump Source

Source File: 00000003.00000002.2349584262.00000000065B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_65b0000_MSBuild.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: c00e24a1c91de25b024d6f935ca9cef5f3210e8e05903a625c53a0c271ef48cc
Instruction ID: 1b9048f49ea29ddddc1569f3808462d92a65c623f00236be93011c6c7893a506
Opcode Fuzzy Hash: c00e24a1c91de25b024d6f935ca9cef5f3210e8e05903a625c53a0c271ef48cc
Instruction Fuzzy Hash: D821E074E012189FDB08DFA9E880ADDBBF2FB89310F14A02AE405BB324DB305841CF64

Function 00F4B020 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00F4B086

Memory Dump Source

Source File: 00000003.00000002.2336644599.0000000000F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_f40000_MSBuild.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: ae932e260a9fad4e46d766e419f74bb7dfa80ce1669997b5952fa6bdf3aa66d0
Instruction ID: 5976a97240a149e4f2b7d2ea558716ba7470cd9fc722539cf1c300513000e47b
Opcode Fuzzy Hash: ae932e260a9fad4e46d766e419f74bb7dfa80ce1669997b5952fa6bdf3aa66d0
Instruction Fuzzy Hash: B511DFB6C007498FDB20CF9AC444A9EFBF4AB88724F10841AD829A7211D3B9A545CFA5

Function 065B37E4 Relevance: 1.5, APIs: 1, Instructions: 46comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 065B3ECD

Memory Dump Source

Source File: 00000003.00000002.2349584262.00000000065B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_65b0000_MSBuild.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 740bcb4fcfea38abef536daeae25f287e0ad145c05ac24d75eaa38cbe5416b40
Instruction ID: 2ba2ca58c50f220dc912e454bf2db179afa370ce2d909ed9dc006c520f0f8beb
Opcode Fuzzy Hash: 740bcb4fcfea38abef536daeae25f287e0ad145c05ac24d75eaa38cbe5416b40
Instruction Fuzzy Hash: 051133B1804349CFDB50DF9AC444BDEBBF4EB48220F20845AD519B7200C3B4A944CFA4

Function 065B3E70 Relevance: 1.5, APIs: 1, Instructions: 42comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 065B3ECD

Memory Dump Source

Source File: 00000003.00000002.2349584262.00000000065B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_65b0000_MSBuild.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: d9abb836e03b94d14a9fcdc77c148a3c28e95e8a952258898e7861ccff0a26fe
Instruction ID: 131359bb90a53e7fa4700fe4467c9d68bc0682c113e5a6cda92e68a0ffe2caac
Opcode Fuzzy Hash: d9abb836e03b94d14a9fcdc77c148a3c28e95e8a952258898e7861ccff0a26fe
Instruction Fuzzy Hash: F01112B5900349CFCB10CF99D584BDEFBF4AB48324F20885AD519B7250C379A944CFA4

Function 062C59D8 Relevance: 1.5, Strings: 1, Instructions: 291COMMON

Download Yara Rule

Strings

d, xrefs: 062C5C29

Memory Dump Source

Source File: 00000003.00000002.2348854653.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_62c0000_MSBuild.jbxd

Similarity

API ID:
String ID: d
API String ID: 0-2564639436
Opcode ID: 59902a2c91d33e111f44e7b6a1980605e914c0113f6126158a41c3b5dded4ba6
Instruction ID: ab1c0af094dfabfa4be339ba441227139b50522207f9262fef606a75ab8d0d00
Opcode Fuzzy Hash: 59902a2c91d33e111f44e7b6a1980605e914c0113f6126158a41c3b5dded4ba6
Instruction Fuzzy Hash: CCC14C34600602CFC725CF28C58096ABBF2FF89320B65CA5DD55A9B6A6D730FD56CB90

Function 062B1BA0 Relevance: 1.5, Instructions: 1451COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2348805354.00000000062B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_62b0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b59f5b5781a943408a10046c3611f2e26715bbbebc849e52baccd7ceea2366e7
Instruction ID: 1cf4ce55a98bc832119dc8f6fde2319edc201344ba2049c692b949b7745c4e99
Opcode Fuzzy Hash: b59f5b5781a943408a10046c3611f2e26715bbbebc849e52baccd7ceea2366e7
Instruction Fuzzy Hash: DEC26C70A10218DFDB54DF64C854AEEBBB6FF88704F105099EA06AB3A1DB71AE41CF51

Function 06570B64 Relevance: 1.4, Strings: 1, Instructions: 187COMMON

Download Yara Rule

Strings

d^j, xrefs: 065728D0

Memory Dump Source

Source File: 00000003.00000002.2349358688.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID: d^j
API String ID: 0-2762660926
Opcode ID: 4dfd9c4a799cfd6edf94f8c74e890ac72e464c627cb252253cc39cb1463cdbfd
Instruction ID: b724a16f4e0e2a207385bc68c9385e8e76571e598f705687dd565032bdcb86a6
Opcode Fuzzy Hash: 4dfd9c4a799cfd6edf94f8c74e890ac72e464c627cb252253cc39cb1463cdbfd
Instruction Fuzzy Hash: 70519B31B007049FCB649FB9D88496EBBF2FFC92107148A2DE946C7762DA30ED058B91

Function 06576908 Relevance: 1.4, Strings: 1, Instructions: 177COMMON

Download Yara Rule

Strings

t]j, xrefs: 06576980

Memory Dump Source

Source File: 00000003.00000002.2349358688.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID: t]j
API String ID: 0-4143265272
Opcode ID: bf661704719b8546b67924ea41219b2b4709d4a8a24b7fa03eceb77ccd0d5881
Instruction ID: 49c5f445fe3645d4a1a8236dadd421897d8e13d31d9d0b119b8dbf2e45203010
Opcode Fuzzy Hash: bf661704719b8546b67924ea41219b2b4709d4a8a24b7fa03eceb77ccd0d5881
Instruction Fuzzy Hash: 7F614634A00605DFDB55DF68D484A9EBBF2FF88300F148529E906AB361DB71AD46CF91

Function 06570D11 Relevance: 1.4, Strings: 1, Instructions: 168COMMON

Download Yara Rule

Strings

t]j, xrefs: 06570EAD

Memory Dump Source

Source File: 00000003.00000002.2349358688.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID: t]j
API String ID: 0-4143265272
Opcode ID: 4a8f3709835b9887e2e1cfc25ec474a43f20e960c7220d24f308ae0778dc2254
Instruction ID: c11a2d5cce165530b81f553418db6ffbb860e6d0d62b8644387bfa83c9f010b6
Opcode Fuzzy Hash: 4a8f3709835b9887e2e1cfc25ec474a43f20e960c7220d24f308ae0778dc2254
Instruction Fuzzy Hash: BE71F674A00209DFDB65DF64E488AADBBF2FF88310F054559E905AB3A1DB70E885CF91

Function 06578B58 Relevance: 1.3, Strings: 1, Instructions: 74COMMON

Download Yara Rule

Strings

Dj, xrefs: 06578BDE

Memory Dump Source

Source File: 00000003.00000002.2349358688.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID: Dj
API String ID: 0-1351674516
Opcode ID: dc8f4991a6697c8b120aa83f64eddc20c9c0677124228c22b41e48294587df15
Instruction ID: cd01a0b591bbd69681ec7ef58dda2b39869c71e35a3b4eb79374d65c79c6b02e
Opcode Fuzzy Hash: dc8f4991a6697c8b120aa83f64eddc20c9c0677124228c22b41e48294587df15
Instruction Fuzzy Hash: 0221C271A002019FC711CFA9E8449AFBBB6FFC5310B11857AD519DB222CB70AD45CBA1

Function 062B4642 Relevance: .9, Instructions: 910COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2348805354.00000000062B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_62b0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e455bd8a61f79753a0945c81d1868e74c3960d0177cd92726d5cf389ccbbea4e
Instruction ID: 514b8104261b9593aab7cda40e3b640f4d067263006800a7298c39544694492c
Opcode Fuzzy Hash: e455bd8a61f79753a0945c81d1868e74c3960d0177cd92726d5cf389ccbbea4e
Instruction Fuzzy Hash: A1427434B102059FCB45DB68D898E6EBBF6FF89710B15806AE506DB3A6CB71DC01CB61

Function 062B3838 Relevance: .8, Instructions: 784COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2348805354.00000000062B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_62b0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1880e09e0f090b0bc87df5a26f6bce220b0c37af66f02efcb79bb97cdb7508f
Instruction ID: fe65a96a903e87927d7d25431d65e4508953a24cc41e4eb260b192e0d35f2427
Opcode Fuzzy Hash: b1880e09e0f090b0bc87df5a26f6bce220b0c37af66f02efcb79bb97cdb7508f
Instruction Fuzzy Hash: 2A623B34B102059FCB54DF68C894EAEBBF6FF88704F118099E605DB3A5DA71ED418B61

Function 062B00D8 Relevance: .7, Instructions: 676COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2348805354.00000000062B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_62b0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c6b2fe0906c0a56f0b5bad7c6a8facc2c4a5c6c756fd3858db10cfaad6975c6
Instruction ID: d7a69566cbb86c5401dcc0ad58be9674200afe3be40970faeb2bfd948c4e3ef0
Opcode Fuzzy Hash: 9c6b2fe0906c0a56f0b5bad7c6a8facc2c4a5c6c756fd3858db10cfaad6975c6
Instruction Fuzzy Hash: E7428C307107198FDB699B78D49466E7BE2FBC5744B005A1DD603AB390CFB6ED068B82

Function 062B0D80 Relevance: .6, Instructions: 622COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2348805354.00000000062B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_62b0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33a1c35e732014a4b44dbed18c8c7e628d3421eefa55289c04814f4494f96e97
Instruction ID: 31df4074918c9c15fe0ad409104d676c7d8eeb1242366247abb45edf55571b75
Opcode Fuzzy Hash: 33a1c35e732014a4b44dbed18c8c7e628d3421eefa55289c04814f4494f96e97
Instruction Fuzzy Hash: 8F22C530B202059FDB559B65C898ABEBBF6FF89340B14946AE906C73A6CF70DC11CB51

Function 062C48B8 Relevance: .6, Instructions: 593COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2348854653.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_62c0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb06ba5cbee840e62ff60f63b64ee938e0613ffceff35dbddc648f8f77063b2f
Instruction ID: 264921c45fd465fd41426caefa7c66f69808a6b5d3b3c6372618cdec21a9bb14
Opcode Fuzzy Hash: eb06ba5cbee840e62ff60f63b64ee938e0613ffceff35dbddc648f8f77063b2f
Instruction Fuzzy Hash: 9D3239347106018FDB54EF29C894A6ABBF6FF89310B1585ADE906CB362DB70EC45CB90

Function 0657B920 Relevance: .4, Instructions: 381COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2349358688.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53b34d005ce54732be2029f16ae2276a1cc0a40ee28158e27ffc50fee78061f4
Instruction ID: 6d869fba273bf0f51c17f614d6dc5450e5bb18091f678534323c0149ebdd2352
Opcode Fuzzy Hash: 53b34d005ce54732be2029f16ae2276a1cc0a40ee28158e27ffc50fee78061f4
Instruction Fuzzy Hash: 60025D35A00715CFDB54EF78D854A99BBB1FF89310F118699E949AB361EB30E981CF80

Function 065778B0 Relevance: .4, Instructions: 364COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2349358688.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd2d4bb5d90979d884e2f18770f70ed1c29a0aa32bbd1aa796df1e7d9dc5823b
Instruction ID: 06bea9c29f45d40d2b98d200d918259541647c37e115573530aca45ede428fb6
Opcode Fuzzy Hash: cd2d4bb5d90979d884e2f18770f70ed1c29a0aa32bbd1aa796df1e7d9dc5823b
Instruction Fuzzy Hash: B2D19E34B002499FDB54DFB9E854AAE7BF2AFC9310F158429E906EB341EF709D418B91

Function 062B00B7 Relevance: .3, Instructions: 340COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2348805354.00000000062B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_62b0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69a5c364eb7665db7faa597e8a59b252afaab1c697bdadc5bb2345b302d6b42b
Instruction ID: 235a82fba8139e5d17896aecd97a8d7e3553e5a3423d11a27d7b95c2dd7dc450
Opcode Fuzzy Hash: 69a5c364eb7665db7faa597e8a59b252afaab1c697bdadc5bb2345b302d6b42b
Instruction Fuzzy Hash: E2C1AE30B20305DFEB458B64C858BAA7BA6FF89744F049165EA02DB3A1CFB5DD41CB52

Function 062B1584 Relevance: .3, Instructions: 336COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2348805354.00000000062B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_62b0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7be6c9928f3ddfca42f47474bcd02b022220eb7fbfdcfd90ffba6865c4e50007
Instruction ID: 43cbee4e34a768b4805f7503a057fdf9465184a4b7671c136b278217ec67ecd1
Opcode Fuzzy Hash: 7be6c9928f3ddfca42f47474bcd02b022220eb7fbfdcfd90ffba6865c4e50007
Instruction Fuzzy Hash: EAC1F8307202059FDB549B64C4A8AAE7BE6FFC6744F10546ADA02CB392DFB5DC12CB51

Function 06577EF0 Relevance: .3, Instructions: 316COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2349358688.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d0ef1c0f07ed287d32dcb2f567d32e024bcdcfdba6ad8dc7824fedf64cbf5d9
Instruction ID: a50e530cf3544157c372c5f4028187de4bca7725496852b525f475c62789d70b
Opcode Fuzzy Hash: 6d0ef1c0f07ed287d32dcb2f567d32e024bcdcfdba6ad8dc7824fedf64cbf5d9
Instruction Fuzzy Hash: 5AC16D31B002059FDB54DF69E84896EB7F6FF88340B158969E915EB365EB30EC06CB90

Function 0657C579 Relevance: .3, Instructions: 310COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2349358688.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8bbf01c616f354de6eaf8bd9148ad4e69870c67bcc8ef1378f0ae0ca395c7340
Instruction ID: d9d4b480e0181d4d971ee9772c432866cdf6b46b682ad3f22aa70c42cc3a44fb
Opcode Fuzzy Hash: 8bbf01c616f354de6eaf8bd9148ad4e69870c67bcc8ef1378f0ae0ca395c7340
Instruction Fuzzy Hash: 33E16870A00755CFDB61DF28D884B99BBB1FF89304F158699D849AB352DB30EA85CF90

Function 062B0756 Relevance: .3, Instructions: 309COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2348805354.00000000062B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_62b0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ed25b228d6053d2d60bf6f8be3270230dbdddadd3e3414f70c148144ab9d5a5
Instruction ID: 8fb1d3f26a80b19aa7a8731359add50ccb99ba27a48547cc99aa79409275390d
Opcode Fuzzy Hash: 2ed25b228d6053d2d60bf6f8be3270230dbdddadd3e3414f70c148144ab9d5a5
Instruction Fuzzy Hash: 3AB1AD30B20305DFEB458B64C898BBA77A6FF89744F049165EA029B3A1CFB5DC52CB51

Function 062B0666 Relevance: .3, Instructions: 308COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2348805354.00000000062B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_62b0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6599aa6ebbf1a7bf27ebd7fb02449ba2a5e28dd371a553a2a3f4b4f573398bc9
Instruction ID: d4e81352beb0dd5f33ff5d8d45ebeef92037db32ace0c5df20080cb97cf0645a
Opcode Fuzzy Hash: 6599aa6ebbf1a7bf27ebd7fb02449ba2a5e28dd371a553a2a3f4b4f573398bc9
Instruction Fuzzy Hash: DAB19D30B20305DFEB458B64C898BBA77A6FF89744F049165EA029B3A1CFB5DD42CB51

Function 062B06DE Relevance: .3, Instructions: 308COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2348805354.00000000062B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_62b0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cdfe1f96c4d64ea67913e67c09cc43771085313386127303147fde1d6ef6fd31
Instruction ID: f6cec3fd1bc1e83b3f349265b16d7c8e1164cdf89995d32b09051ff033020b1e
Opcode Fuzzy Hash: cdfe1f96c4d64ea67913e67c09cc43771085313386127303147fde1d6ef6fd31
Instruction Fuzzy Hash: B6B1AE30B20305DFEB458B64C898BBA77A6FF89744F049165EA029B3A1CFB5DD42CB51

Function 062B05EE Relevance: .3, Instructions: 307COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2348805354.00000000062B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_62b0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c485136ed3e022d24fabf5073c18565899e293381bedd719dde506e679835f5
Instruction ID: f89d06854e58768094bd0bd99172c2e51960d81cbb58af2dcd40f23dfbc6c900
Opcode Fuzzy Hash: 7c485136ed3e022d24fabf5073c18565899e293381bedd719dde506e679835f5
Instruction Fuzzy Hash: 7BB19F30B20305DFEB458B64C898BBA77A6FF89744F049165EA029B3A1CFB5DD42CB51

Function 06570300 Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2349358688.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5ab27170495759b36fd34c48f3350546e3c0049555bfe26daf3551c7f0bd129
Instruction ID: a593319b442c50b2729a03622afbe9fb9a894f4de86b8e8b3efcb68afeb10f90
Opcode Fuzzy Hash: e5ab27170495759b36fd34c48f3350546e3c0049555bfe26daf3551c7f0bd129
Instruction Fuzzy Hash: C0B1B370A002048FDB55DFB4E854AAEBBF6FF88310F148469E546EB391DF349946CB91

Function 062C48A8 Relevance: .3, Instructions: 279COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2348854653.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_62c0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b37d9a416177fcdb3404e98cc054da5d850a51cd1199f1b5606ed0f20468d479
Instruction ID: 9da383f4d733be0b0b021a94b99bacab6e2c1f68d6b3b39f31f6d607535075b4
Opcode Fuzzy Hash: b37d9a416177fcdb3404e98cc054da5d850a51cd1199f1b5606ed0f20468d479
Instruction Fuzzy Hash: EEB14834B10605CFCB54EF29D498A6ABBF6BF88314B1581ADE946DB362DB30ED05CB50

Function 0657B911 Relevance: .3, Instructions: 257COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2349358688.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a805805a90e912b52df178e94a006ddbbd471bc72925051d009fdfb4bc9dbb2
Instruction ID: c0fae40be26aae3e9c6b03064de339e6ab8de15f61ccdd414aba6c3f21f21e6c
Opcode Fuzzy Hash: 0a805805a90e912b52df178e94a006ddbbd471bc72925051d009fdfb4bc9dbb2
Instruction Fuzzy Hash: F8C13B3191071ACFDB51EF78D854A99B7B1FF49304F118699E949AB261EB30EAC1CF80

Function 06574EF0 Relevance: .2, Instructions: 235COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2349358688.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9f9cbf675d87b25d57f68b64a5599e1727c13a8571864263a96844fd10de952
Instruction ID: 07e7bc18ca2472f2638a85bb7d46ab398661468092e91b30a6206e243a108382
Opcode Fuzzy Hash: a9f9cbf675d87b25d57f68b64a5599e1727c13a8571864263a96844fd10de952
Instruction Fuzzy Hash: 5181C031A042459FCB44EFB8D854AAE7FF6EF89310B11852AE909DB351EF309945CBA1

Function 06575DE0 Relevance: .2, Instructions: 234COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2349358688.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79e8b0c0dc9b5b784e159ff8c8af34ead95d75412c257659e3503422434ba2e5
Instruction ID: ad0c45c708161046b6c1325eaac33fc66091342d423edf51204af1c82dd2cb62
Opcode Fuzzy Hash: 79e8b0c0dc9b5b784e159ff8c8af34ead95d75412c257659e3503422434ba2e5
Instruction Fuzzy Hash: 59A1D375A00609DFDB44DF68E888E99BBB2FF89320F154599E9059B362DB30EC85CB50

Function 0657FB40 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2349358688.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 796266b6382a79e2e417b5d552983cb91216805080fa2ce0a3089724ad47c879
Instruction ID: 8de0373312030bf80f7791143d1110d8cb12fa7ef42c6fcc47684bb1fad06b7e
Opcode Fuzzy Hash: 796266b6382a79e2e417b5d552983cb91216805080fa2ce0a3089724ad47c879
Instruction Fuzzy Hash: 01818E34B042118FDB59DF68D854A6E7BF6BFC9640B158069E906CB3A6DA30DD02CBA1

Function 0657DC48 Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2349358688.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7613a506bd77788225e6f3766843b5202d34538eeaefb1617c3ad98d87b8c6c3
Instruction ID: 4afb1ffa8779fa73e2f027af4a4c9192c8b7f89550fed565a1e52b09e194cfc9
Opcode Fuzzy Hash: 7613a506bd77788225e6f3766843b5202d34538eeaefb1617c3ad98d87b8c6c3
Instruction Fuzzy Hash: D171F730A0030A9FDB45EB74E844BAEBBB5FF85300F01862DE545AB351EBB0A945CF95

Function 06573D68 Relevance: .2, Instructions: 194COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2349358688.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3ea5b4040b3226a14c4b51ff3a5b66adfd4e4e0525df4c4b65e41c339ff19da
Instruction ID: 94f7d58951dbe89332bc77415e545e63260d77379a31aea986fb42eb6821c483
Opcode Fuzzy Hash: c3ea5b4040b3226a14c4b51ff3a5b66adfd4e4e0525df4c4b65e41c339ff19da
Instruction Fuzzy Hash: 5A51C4327143158FD724DFA9F880A6AB7F6FB84330B10863AE505CB281DB31AC45CBA1

Function 065734F8 Relevance: .2, Instructions: 178COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2349358688.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b8a547e508a6eeefe4a4cd423d45ad0c4ee92680712131307e175496ae3f61c
Instruction ID: a284b200e99bc2fd36d407662984c22bfe46d0dedc4a3905b11c90acff998107
Opcode Fuzzy Hash: 6b8a547e508a6eeefe4a4cd423d45ad0c4ee92680712131307e175496ae3f61c
Instruction Fuzzy Hash: D1510630B002468FDB45AB79A85462EBBE2FFC9310B118079D906CB346DF30DD45CBA2

Function 06573A08 Relevance: .2, Instructions: 178COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2349358688.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 479e964a5b0f4a194fa8e9a4d08759bdec1e7e616276dff6f5c6149296e12357
Instruction ID: 6fd7ba3e33fdb33d0a53504ee6922c995baf9913463ab938014edb8b02176938
Opcode Fuzzy Hash: 479e964a5b0f4a194fa8e9a4d08759bdec1e7e616276dff6f5c6149296e12357
Instruction Fuzzy Hash: 78510630B002569FDB45ABB9985062EBBE6FFC9310B118079D90ADB346DF30DD45CB92

Function 065700A8 Relevance: .2, Instructions: 165COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2349358688.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 141afc5ce904dbf4f931457066227820c965545fa0d0c2d37afb1c76561c1286
Instruction ID: 34833e5f25c806f1b032701000b4f2a5edfa445aa3344961002c92c0a9dbe319
Opcode Fuzzy Hash: 141afc5ce904dbf4f931457066227820c965545fa0d0c2d37afb1c76561c1286
Instruction Fuzzy Hash: EC51D074B043018FDB54AF28E854A6E7BE6FFC9214B15856AE906DF391DB31EC01CBA1

Function 06572980 Relevance: .2, Instructions: 165COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2349358688.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b0b7c1d027732f82a70b3414925ca6c943bb98beb572500da2cace451f0821d
Instruction ID: b0a0b9515f046c5bde01003a353151431289f0f8d44345a4be9324edc550a876
Opcode Fuzzy Hash: 0b0b7c1d027732f82a70b3414925ca6c943bb98beb572500da2cace451f0821d
Instruction Fuzzy Hash: 3E519034B143098FCB49AB78E42826FB7E3FFD9201B11852ED506D7385EF3899068B59

Function 06575DCF Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2349358688.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2e08fcbe053dced4dc0e82ff5d75593abbe6fc4339defd436ea590fa2fe7b63
Instruction ID: 49af78155ac2236dbe3105df80970f30b1ee5b38d2da6615fbfabdd8692246b5
Opcode Fuzzy Hash: d2e08fcbe053dced4dc0e82ff5d75593abbe6fc4339defd436ea590fa2fe7b63
Instruction Fuzzy Hash: 5A51E675A01209EFDB44CF59E884E99BBB2FF88320F158599E9059B361DB70EC85CF90

Function 06571471 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2349358688.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3c15473bcbaaeb5a9b7cce941f94c717470be67290bbd48a8fc2af09243a2ef
Instruction ID: eef7028385664e4c944103408cc714ff26c3e8e2dd2fb72bd957e6845e736652
Opcode Fuzzy Hash: c3c15473bcbaaeb5a9b7cce941f94c717470be67290bbd48a8fc2af09243a2ef
Instruction Fuzzy Hash: A4512575A016059FCB59CF68E884C9DBBF2FF89310B29859AE815EB361CB30EC41CB50

Function 06572D30 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2349358688.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1fad19210f443278b982a8c8f61ce71988d89d25664c33ef0389f5db0c329bb6
Instruction ID: 1cc2506bc6ce347db0991a97fc4c04d42b4d239c45a69509b0698f1c403c8d91
Opcode Fuzzy Hash: 1fad19210f443278b982a8c8f61ce71988d89d25664c33ef0389f5db0c329bb6
Instruction Fuzzy Hash: 26518D70B002168FCB58EF78D494A7EBBF2FF89250B114529E906DB365CB34AD02CB90

Function 062C8C88 Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2348854653.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_62c0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9491e0cea1a169dae965f654e115965d3168b98a39e0faa91237e7b1f8ebb8e5
Instruction ID: d18641c9f59fe79184d413d90f14cc26e71693eef0e4f96221fbc3aa3b051e21
Opcode Fuzzy Hash: 9491e0cea1a169dae965f654e115965d3168b98a39e0faa91237e7b1f8ebb8e5
Instruction Fuzzy Hash: BF41F531B043595FDB89AF74941076F3BA6AFC5650F24806AE909DB394CF389D02C7E6

Function 06578738 Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2349358688.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4c55a71b6178e9077813c9ac0cf7a5d02920526170d2d58e64ddf8f23e67b24
Instruction ID: d157b6a243629bacb80380c88891e7bdeb1738ef55197d14ebfb53283c1951f1
Opcode Fuzzy Hash: b4c55a71b6178e9077813c9ac0cf7a5d02920526170d2d58e64ddf8f23e67b24
Instruction Fuzzy Hash: 565194317043018FD729EF29E444A6EBBE2EFC4310B158A6ED1468B652DF70AD4ACBD1

Function 062C7D58 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2348854653.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_62c0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 135c1b9c8f49cf4304a75d15dfc0127e0d020122aefc57abc416022e3a710375
Instruction ID: c4d5fd8867bf212c570a4847e1108cc4c037fd84b224fb3ff0ca614a6c6991dd
Opcode Fuzzy Hash: 135c1b9c8f49cf4304a75d15dfc0127e0d020122aefc57abc416022e3a710375
Instruction Fuzzy Hash: C0511471E10359CFDB54CFA9C881BDEBBF5AF88720F148629E815AB244DB74A945CF80

Function 0657DEE0 Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2349358688.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4901d9dbfbe751f75f3cbf09315e9e9beb497e6b7c2bd26a0d76cf8efeac72d6
Instruction ID: 58c740d763c15ee078b7152146f4cbbce14eda00f0e12aca2c91e8ee44ad7e63
Opcode Fuzzy Hash: 4901d9dbfbe751f75f3cbf09315e9e9beb497e6b7c2bd26a0d76cf8efeac72d6
Instruction Fuzzy Hash: BF410331A043458FD766CF2AE84476AFFB2BF81210F0882AED4498B252DB31D881CBD1

Function 062B3688 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2348805354.00000000062B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_62b0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec2de1593fcee905bf3cb4b3fc7cedc26c8f526304d12b4a874d448ec5fb3d1e
Instruction ID: 1f1d8aeffc0dd55598496ea678a41d315dbb723ffdfd5d5cd2a75f8c3a420947
Opcode Fuzzy Hash: ec2de1593fcee905bf3cb4b3fc7cedc26c8f526304d12b4a874d448ec5fb3d1e
Instruction Fuzzy Hash: 24513735B101199FCB54DF69D8849AEBBF2EF89710B158069ED05AB361DB71EC01CB60

Function 062B34D8 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2348805354.00000000062B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_62b0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a656fb4596d7372735fba270548ea9ad1fb0cadb2e5d1a740862743c6473c1b2
Instruction ID: 1fe86d644ae0a7b8c3dc986adf56ad2b2d1793bdae97212f0db11059d0a7a582
Opcode Fuzzy Hash: a656fb4596d7372735fba270548ea9ad1fb0cadb2e5d1a740862743c6473c1b2
Instruction Fuzzy Hash: 42512635B105199FCB54DF69C8849AEBBF2FF8D314B1180A9E906AB361DB71EC05CB60

Function 0657CF00 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2349358688.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e3804a987bb4979e91fc4109fa5b04db1bd4f3b5bd0977de2eff5fe0e6a2b76
Instruction ID: 95573a7fe44b248c32a761ed7d01995a0d1f0eea65534ef070d814d133ce4783
Opcode Fuzzy Hash: 9e3804a987bb4979e91fc4109fa5b04db1bd4f3b5bd0977de2eff5fe0e6a2b76
Instruction Fuzzy Hash: 7141F430B043499FCB05AB78E81866EBBF6FF8A300B11416EE506D7352EF309941CBA5

Function 06571480 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2349358688.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b8f31158490f7d9109f5b9f686c2de661ca0ca41e622c24b30ba8b2b5d2c0a9
Instruction ID: 9120bc2701071ba4b54b42c6364b49efaa439303d1ff4717a5069cf2cdb5238f
Opcode Fuzzy Hash: 3b8f31158490f7d9109f5b9f686c2de661ca0ca41e622c24b30ba8b2b5d2c0a9
Instruction Fuzzy Hash: 9D51F575A01519DFCB58DF68E58489EB7F2FF88310B298699E8159B371CB30EC42CB50

Function 06573892 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2349358688.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d43d0f80414b33659b65bd37a193d684c673ced1a1b4056cc537b3e04949b284
Instruction ID: 250a0856e486d163b205d6cdc198881b2fa9ca197a5a3278745b1e0a6623e1ca
Opcode Fuzzy Hash: d43d0f80414b33659b65bd37a193d684c673ced1a1b4056cc537b3e04949b284
Instruction Fuzzy Hash: C951F6753152509FC345DF29E998C167BF6FF8A62032A41DAE845CB372CA31EC44CBA1

Function 062C7D4C Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2348854653.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_62c0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77cc2bcc47cb10e47454ee1c5b8e55db49551076b69687b769228d1a4e0cff19
Instruction ID: b8073d15acb480227f0a32fac87d14e4812d50f51527bf9922da7ad61dca8481
Opcode Fuzzy Hash: 77cc2bcc47cb10e47454ee1c5b8e55db49551076b69687b769228d1a4e0cff19
Instruction Fuzzy Hash: 875115B1E10259DFDB54CFA9C981BDEBBF5AF48720F14862DE815AB280DB749845CF80

Function 0657E432 Relevance: .1, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2349358688.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0071aaae2d5c9136fef89d71d29329c39c61f59ff863fe20d31ed741194fbfa7
Instruction ID: 0ecc235e1a58433e3fccdf71479c710df06d4c9b7d7b794cc107de5374cba41f
Opcode Fuzzy Hash: 0071aaae2d5c9136fef89d71d29329c39c61f59ff863fe20d31ed741194fbfa7
Instruction Fuzzy Hash: 6F41B07190A3999FDB42CB68EC516EEBFB1BF46310F1445AAE480E72A2C2344D45CB61

Function 062C59C8 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2348854653.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_62c0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: addbec7ee3e0defb2c52afcbfff030bf3663e349b610576fd98f2765dbba1439
Instruction ID: 3d1984de54fe835bd97092b16e8d04d4f4415bc4b98ab5c36453a89e99d5e007
Opcode Fuzzy Hash: addbec7ee3e0defb2c52afcbfff030bf3663e349b610576fd98f2765dbba1439
Instruction Fuzzy Hash: D2416D35A10606CFCB10CF59C8809AABBF6FF89320B55CA59E955AB361D730F951CB90

Function 0657ADD0 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2349358688.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ec5b159d613b0fa070710b5d1d68bef51e6fa8b95c645e89c12321dec943ea1
Instruction ID: 041b47b1be553dfff9536aa545028ff5dc3c0fd7f2f6bacf7a99e6611d0a3312
Opcode Fuzzy Hash: 1ec5b159d613b0fa070710b5d1d68bef51e6fa8b95c645e89c12321dec943ea1
Instruction Fuzzy Hash: F6416D31A0030A8FDB54EF78D854AAE7BB2FF88304F14496DE546EB295EB75D842CB50

Function 0657E3F0 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2349358688.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09b5038160d2477d046ec7903ffd176868bbfa760006064e6151d19709cb6cf1
Instruction ID: a6c61da5e9a2ce0df4e37a78d0ca4342cc1768a237806b9c1348b18d43d26e76
Opcode Fuzzy Hash: 09b5038160d2477d046ec7903ffd176868bbfa760006064e6151d19709cb6cf1
Instruction Fuzzy Hash: AA31A03090A3C5AFDB42CB74EC556DEBFB5BF46210F0942EAE480EB2A2C6354D44CB61

Function 0657ADE0 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2349358688.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a55f62be305d254c7a90aafc15256ee16d652afc10ab10af4948d6ffec9bfbf
Instruction ID: ee75b12b939680b84a22211812c7cce9e857c02ddd147d437554e5f2e2201c25
Opcode Fuzzy Hash: 7a55f62be305d254c7a90aafc15256ee16d652afc10ab10af4948d6ffec9bfbf
Instruction Fuzzy Hash: FC412E35A0030A8FDB54EF74D8546AEBBB2FF88300B14496DD545AB355DF75E842CB50

Function 062B4470 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2348805354.00000000062B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_62b0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 598638b5badec893bb50ad446f7f1c0452a744e9bce09edc4e3ced1111c971f0
Instruction ID: 17bcdfba5a5b7bd5ed3eab446dc585a6df06644617643cae0bec1025315136f2
Opcode Fuzzy Hash: 598638b5badec893bb50ad446f7f1c0452a744e9bce09edc4e3ced1111c971f0
Instruction Fuzzy Hash: 25410834B102149FCB44DF69C898AAEBBF6FF88715B214069E906DB3A1DB71EC00CB51

Function 062C3DE0 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2348854653.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_62c0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 297dcfae50b6562b118713c58ecba15281444c0b684ebb27f517d2a201714c81
Instruction ID: cb375d59f64c0e531f27c39d8a2ecbb0e4e7f53bafd484079ddbb542fa5fd0c1
Opcode Fuzzy Hash: 297dcfae50b6562b118713c58ecba15281444c0b684ebb27f517d2a201714c81
Instruction Fuzzy Hash: 3331D1317102128BC719A768E8506AE7BE6DFCA324715887EE54ACB780DE35EC0787E1

Function 062C5579 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2348854653.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_62c0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f0d90d60fcc3f4881a2480fa8e5b5bf70fef396573aa944720ef660f4cfc2a9
Instruction ID: 01392ac66aa30350a6d925a420bd8afe129f99ba7b4401426011bb43a00cfb51
Opcode Fuzzy Hash: 7f0d90d60fcc3f4881a2480fa8e5b5bf70fef396573aa944720ef660f4cfc2a9
Instruction Fuzzy Hash: 24316835B102119FCB09DF38D884AAEBBB6FF89310B508569E906DB355DB34ED12CB90

Function 062C84C8 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2348854653.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_62c0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b4fc1ee8c1b1e299393fe06cbfe2f280fc4f86e86c633b35de06f7a4c59f2a8
Instruction ID: dc3f202910da4c4a4190ca63a0617ea92bc418625cd2d8d547d17a146073c47f
Opcode Fuzzy Hash: 6b4fc1ee8c1b1e299393fe06cbfe2f280fc4f86e86c633b35de06f7a4c59f2a8
Instruction Fuzzy Hash: C5319A717002158FDB08AF79A85457E3BE7EFC8211B50443ADA0ACF384EE759E0697D2

Function 065738C8 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2349358688.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14e7c60a601b4fe613d361693f94769b02efe1ff8691ff1c0c23cdc207df5978
Instruction ID: 2c5355516ef433a807ab30e5f69f1cfee096cb85277a9357490410a8d6330391
Opcode Fuzzy Hash: 14e7c60a601b4fe613d361693f94769b02efe1ff8691ff1c0c23cdc207df5978
Instruction Fuzzy Hash: B44191757105109FC748DF29E988D1ABBFAFF896153268199E909CB376CA31EC41CBA0

Function 06576A0D Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2349358688.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be3cb976e9e09832f985d397ea2575a43d6d480b37b151a70de1f2aae1178ade
Instruction ID: 1558395d8db109b08823fdcad9c4b5a62a4c17151105480776e06fdbc413ea49
Opcode Fuzzy Hash: be3cb976e9e09832f985d397ea2575a43d6d480b37b151a70de1f2aae1178ade
Instruction Fuzzy Hash: F241F634A00214DFDB44DFA4D494AADB7F2FF88305F148469EA06AB390DB72AC46CF50

Function 062C5588 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2348854653.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_62c0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f01e541bbc534dee4c08a367d3f7c42f4ec493a9575a4cf991d1cabcee2a18cf
Instruction ID: 3c54bb993ceec51bd5d21515d7159062ebb37903a57db61a68f0ff0514413f22
Opcode Fuzzy Hash: f01e541bbc534dee4c08a367d3f7c42f4ec493a9575a4cf991d1cabcee2a18cf
Instruction Fuzzy Hash: A7317334B102119FCB09DF38D8849AEBBB6BF89310B508569E906DB365DB30ED11CBA0

Function 06572D20 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2349358688.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f3060b656cbbe068ad069caa83f1e3d8b778227ec2ad1cb64127d216819d0cf
Instruction ID: 60a0324eca19ff5163afb52cb47b97a23d6299f562aa8a8425a3e3eb637589c2
Opcode Fuzzy Hash: 8f3060b656cbbe068ad069caa83f1e3d8b778227ec2ad1cb64127d216819d0cf
Instruction Fuzzy Hash: 67314D75A006598FCB54DF68D894ABDBBF1FF49214F1080A9E915EB362C730AD45CF90

Function 062C87A0 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2348854653.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_62c0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ba66970df5f8295408be82ba2a719089670088f076dcf889522a4f799c0ac93
Instruction ID: 677617b16cb62e8401378c09374c5a7f2cda8461f3544c8cf31395c84bcafceb
Opcode Fuzzy Hash: 9ba66970df5f8295408be82ba2a719089670088f076dcf889522a4f799c0ac93
Instruction Fuzzy Hash: 7641F0B1D1124C9FDB54CFAAD940ADEFFB6AF88310F10812AE815B7250DB74A945CF90

Function 062CFEE0 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2348854653.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_62c0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f44e824d7228b634ee84ca0e17736379b13fd6b7e9db269202d1d39438760b7d
Instruction ID: 1d18e5d112c7d577af84af9395f82547c6a5347b7729961d3ec7eb3d9d25c2ae
Opcode Fuzzy Hash: f44e824d7228b634ee84ca0e17736379b13fd6b7e9db269202d1d39438760b7d
Instruction Fuzzy Hash: AE2137307143455FDB1A9B78981866E7FAADFC2214F1541AEAC09CB382DE32CC42C791

Function 065702F1 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2349358688.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69ee41ebf3323e3f39ac2b0fc8ca8759a747cf5591862fd7b82938921e72c2b1
Instruction ID: 2ddd649a07e3e66359f97360415881568d308bc9a4a58e65f5770a19cf61fbe2
Opcode Fuzzy Hash: 69ee41ebf3323e3f39ac2b0fc8ca8759a747cf5591862fd7b82938921e72c2b1
Instruction Fuzzy Hash: 3B314530A10608CFCB54EF74E858AADBBB2FF49700F158569E505AB3A0DF749946CB91

Function 062CFDCF Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2348854653.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_62c0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae0182b65d51cdd9308080a967f7003bbb9f74a91a9b374b854d0134875ebfd5
Instruction ID: fa075dc2ada2e9ff6692e3f560e48fb8eee82b722b5877bf1899aa6643564da2
Opcode Fuzzy Hash: ae0182b65d51cdd9308080a967f7003bbb9f74a91a9b374b854d0134875ebfd5
Instruction Fuzzy Hash: 60219C34A193808FCB4B6B74A42C19E3FA3EFCA15132544BED902CB392DE358C42CB91

Function 06571D98 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2349358688.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd78b5435f7c04ad5be16ee9be403014753c85ddde888687af0facf7f695dcc1
Instruction ID: bfeac747f027a3233e3b6625b25ebbc3e6a674cae61cafdfa83491901aa5de58
Opcode Fuzzy Hash: cd78b5435f7c04ad5be16ee9be403014753c85ddde888687af0facf7f695dcc1
Instruction Fuzzy Hash: D6214430A042098FD751AF78F41876E7FA1FB81301F0548AAE65ADB681DB748909CFE1

Function 062C8796 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2348854653.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_62c0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7c69783b81743b089d5d78f26202ce008a9727209e3856942785df041cea09d
Instruction ID: aade11f70ccbac2f93488033c481602801046047c7983f9730728535d8b69029
Opcode Fuzzy Hash: e7c69783b81743b089d5d78f26202ce008a9727209e3856942785df041cea09d
Instruction Fuzzy Hash: 313112B1D1124D9FDB14CFAAC980BDEBFF6AF88310F24812AD815A7250DB789945CF50

Function 06571BD8 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2349358688.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97185230f2f7a0b80a57e6b3653c3d08a0373878ba7c7d15180545e5d91cf575
Instruction ID: df1dfb9ed5df9793e0e6db42d706f5fdaf667e61813f6a8616379c991085efee
Opcode Fuzzy Hash: 97185230f2f7a0b80a57e6b3653c3d08a0373878ba7c7d15180545e5d91cf575
Instruction Fuzzy Hash: 00219E30B006058FCB65EFA8E8849AE77F9FFC8201B144669D5069B359EF24ED05CB91

Function 065739E0 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2349358688.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e00df87d9c737f42a26b6f93b5f5791eb2b1187a6fae8a7b8c9ea2e9fd0b2aa6
Instruction ID: e7d692b43a24f7af15560f72411ed1bcc2a157e4413af43c49a8a1165353278a
Opcode Fuzzy Hash: e00df87d9c737f42a26b6f93b5f5791eb2b1187a6fae8a7b8c9ea2e9fd0b2aa6
Instruction Fuzzy Hash: 7A212736A06295AFDF528B25FC408A6FF29FB8237171481B3E544C7016D331A958DBE2

Function 06571BC9 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2349358688.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20d2df6670e08e666942f7122ae963d3dd00fba4b79a7a8858ca0f6fd5b4c5c6
Instruction ID: 31616f8db230e462788a30a19fe36783ebb6180350dea0c0bf6fa47591fee702
Opcode Fuzzy Hash: 20d2df6670e08e666942f7122ae963d3dd00fba4b79a7a8858ca0f6fd5b4c5c6
Instruction Fuzzy Hash: 4D21F130B007458FCB65EFA8E880AAE7BB5FFC4200B04466AD5069B359EF24AD05CB91

Function 0657A930 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2349358688.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6008912dfae6ab95beb5e99b8438a677029df264d10a5fab6b8c0a59a8a79f5
Instruction ID: 37285dbd719f343331af9b15d8ae1f0e0378f4f9aa7531dfefa4e914095ac493
Opcode Fuzzy Hash: f6008912dfae6ab95beb5e99b8438a677029df264d10a5fab6b8c0a59a8a79f5
Instruction Fuzzy Hash: E42106357043405FCB156B78A81496B7BFADFCA62031A44BBE50ACB362CE65CC06C7A1

Function 062C8A98 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2348854653.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_62c0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 799c619c690f1dfa49bc7926da422424ace0db26ccda3cb734461e9db3c5d7eb
Instruction ID: 123b444659f114568abaef512eb3a209e06ebde0deddb13852d9f229a14cdd0b
Opcode Fuzzy Hash: 799c619c690f1dfa49bc7926da422424ace0db26ccda3cb734461e9db3c5d7eb
Instruction Fuzzy Hash: 323116B1D11258DFDB14CFA9D880BDEBFF5AF48320F14812AE809B7240C778A845CB90

Function 00CDD4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2335776711.0000000000CDD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CDD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_cdd000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98ec403f7e342978170fd130746397d550447cb91a7313fa0101ff96ce41b0ca
Instruction ID: e2d78308f262f509367be485484e9cb1357d8805feb87e153ad4d1bb60f120a2
Opcode Fuzzy Hash: 98ec403f7e342978170fd130746397d550447cb91a7313fa0101ff96ce41b0ca
Instruction Fuzzy Hash: 3B2106B2904240EFDB15DF14E9C0B26BF65FB84318F20C56AEA0A0B356D336D956CBA1

Function 00CDD3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2335776711.0000000000CDD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CDD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_cdd000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30d7cdec3e5547462aaf3a09b12ac8e732d3db96260bccf17f791ecbf1d9d8b0
Instruction ID: 3f2ec3a5187efccd6a178e0f36053aa9469502516b7c0b440b4916f35dae9be3
Opcode Fuzzy Hash: 30d7cdec3e5547462aaf3a09b12ac8e732d3db96260bccf17f791ecbf1d9d8b0
Instruction Fuzzy Hash: 3B212876904204EFDB14DF14D9C0B26BF65FB94324F20C16EEA0B0B356C336E856CAA2

Function 00CED01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2335820623.0000000000CED000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ced000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e961e7c82b2c4304a26743c0ed10555f8501f802494876eab462804336c6119b
Instruction ID: a952dece41f9d61eb8b8c1881d4a0e6e60a76ee5b857b0cfd8df95d9e6ef35a1
Opcode Fuzzy Hash: e961e7c82b2c4304a26743c0ed10555f8501f802494876eab462804336c6119b
Instruction Fuzzy Hash: 6A212275604380EFCB14DF15D9C0B26BB61FB84314F28C56DE90A0B292C37AD807CA61

Function 06572731 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2349358688.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7bd7b5587d1cf1d5bf0a149403ad258ed7ab668bee1bf457fbff8e46af13b73e
Instruction ID: 1c429480f811be914007e7cbbb1badfae59522184c1b0abc5c0674a1af8ba984
Opcode Fuzzy Hash: 7bd7b5587d1cf1d5bf0a149403ad258ed7ab668bee1bf457fbff8e46af13b73e
Instruction Fuzzy Hash: 09214232A007059FC760CEA9E9809ABB7F6FF982207148729E459D7615D730E9458F50

Function 0657FE98 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2349358688.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afc90cecef3fac0594ac6ab94cc1728e7980f3d3384eb5a03356da90e998c36d
Instruction ID: 32a4dbdb5c2a26ffa07c12d0041773b9fe986a27d4a293e95b4ca26618de1f0a
Opcode Fuzzy Hash: afc90cecef3fac0594ac6ab94cc1728e7980f3d3384eb5a03356da90e998c36d
Instruction Fuzzy Hash: 71215C757040159FC784DF29E888D6ABBEAFFC9611715816AE509CB362CB30EC01CBA0

Function 06572C10 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2349358688.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1680484f34f66546c44f1a3bb3153fc830cfc8c9f680b13becb5a0083c0fd95d
Instruction ID: 003826c036622bd1f66f4ed448135fcd36bdd24b8e2ffc3716c9843dabdd9b5b
Opcode Fuzzy Hash: 1680484f34f66546c44f1a3bb3153fc830cfc8c9f680b13becb5a0083c0fd95d
Instruction Fuzzy Hash: A4211374B004018FC744CF69DA88C5ABBFAFF99615B2540A9E506EB331CB70ED01CB60

Function 0657EDE2 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2349358688.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59a459825a5bb5d4716b510632b895e9c97ce294c530141dbf13a75fbcbd29c3
Instruction ID: d890de8ab96b1357d2b1425f88ca2f07a10f2a6e8f49368049d7297f32b4132d
Opcode Fuzzy Hash: 59a459825a5bb5d4716b510632b895e9c97ce294c530141dbf13a75fbcbd29c3
Instruction Fuzzy Hash: E82104369043689FCB11CF94E8119EEBFF2BF89310F14499AE940EB251C7319E15CBA0

Function 06571730 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2349358688.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbbd3fb7e66d1fc2096d929da255fe03cd4b8490c87cd2dcca8e80e1a37d46c5
Instruction ID: d8767ace5066c022d140b3a707f61a76d104899dbd302f928c84ca26df953fae
Opcode Fuzzy Hash: cbbd3fb7e66d1fc2096d929da255fe03cd4b8490c87cd2dcca8e80e1a37d46c5
Instruction Fuzzy Hash: 79216D34700A018FC7699F78E598A2A7BE6FF883117188929E55BC7751DF34EC46CBA0

Function 06571638 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2349358688.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0bebaf6e4b24c1c1fd41d4ca25fb857cf4d98a3792fef4712ae0aaaac18f9d0
Instruction ID: 928abd9637b20366f0906f388b583913ebc84b5d40a9d782e0d10967be5d8897
Opcode Fuzzy Hash: b0bebaf6e4b24c1c1fd41d4ca25fb857cf4d98a3792fef4712ae0aaaac18f9d0
Instruction Fuzzy Hash: 7821E4326047509FD325CF29D840957BBF6FFC6310B188A6EE489CB662DA71ED46CB90

Function 0657DD40 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2349358688.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7ce741b2d6779005be49f1492013272c79f088db49db7e2e32d2b145df0a181
Instruction ID: 60e513984ffde15ac58591a57cc7064554212b49f05a8c393e330df00a60029e
Opcode Fuzzy Hash: b7ce741b2d6779005be49f1492013272c79f088db49db7e2e32d2b145df0a181
Instruction Fuzzy Hash: A821D131A103099FCB45EB74D848A9AB7B6FF89300F11862EE546A7350EFB0A844CB91

Function 0657CB42 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2349358688.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e64062943cb795dee95b77a0028a867c4ee85063fd301827e274aa3eb4fb769
Instruction ID: 6a61ad87f803891664788aecdc15870b1796985e35f2f9779ca17dda50e5638b
Opcode Fuzzy Hash: 5e64062943cb795dee95b77a0028a867c4ee85063fd301827e274aa3eb4fb769
Instruction Fuzzy Hash: D0215E31E001099FDB54CEA9E485AEEBBF6FB8C711F548029E919E3350DA30AC45CFA0

Function 062C8A8C Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2348854653.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_62c0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5aa44783d91fd09b25396302c49ab042feb46e8c9dd8ce4cdfb5650ef6108f9a
Instruction ID: c127a987cb0fefa4152ea799c0afd3c9cb1fd72c1c502202306675a1103a476a
Opcode Fuzzy Hash: 5aa44783d91fd09b25396302c49ab042feb46e8c9dd8ce4cdfb5650ef6108f9a
Instruction Fuzzy Hash: 3C21F3B1D113499FDB14CFA9C895B9EBFF9AF48310F14812AE409A7240DB78A845CBA0

Function 06572C20 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2349358688.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6f2c9ceb34344f98f34650ec0a68f5c83782912d2ae9b9dfe2acb73fb413b31
Instruction ID: f545462ed9e9e5546b09d043ad047d8b55442d00ddd40da4dd2164c3635547e8
Opcode Fuzzy Hash: d6f2c9ceb34344f98f34650ec0a68f5c83782912d2ae9b9dfe2acb73fb413b31
Instruction Fuzzy Hash: 7A21DD74B104158FCB44DF69DA8886AB7FAFF99615B2180A9E506EB331CB30ED01CB60

Function 0657DF98 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2349358688.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c69947ce67278392180d8361b2e94c41cb44ad5b4aa5ae18e568c7025ec166c
Instruction ID: f93fdd80eab7ca71a90800fc09e586b2e41edcd3ec490bf6166d2009ab0dea6a
Opcode Fuzzy Hash: 2c69947ce67278392180d8361b2e94c41cb44ad5b4aa5ae18e568c7025ec166c
Instruction Fuzzy Hash: 7F115B267093C15BD7628A6AF8847A6FF71BFC2120F0C45EFC5980F512CA71C486CB91

Function 062C5089 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2348854653.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_62c0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fe441933a09eb753deae8d19b9be573a7603bb4025d9828ab5e9c29fc7144c3
Instruction ID: 6f47e3141c040987a4c50241f49fc48622de20c17311bb7431ba6f8acffee33d
Opcode Fuzzy Hash: 9fe441933a09eb753deae8d19b9be573a7603bb4025d9828ab5e9c29fc7144c3
Instruction Fuzzy Hash: FD11A376B001059BC7149A59DC89A6BBBEAEBC8760F048629EA1DDB345C670E81187D0

Function 06575D20 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2349358688.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39fee0194598c59c323658afaff1e197ec4bd77cd8a1660c904cfa3b29746b16
Instruction ID: 53c668347d1344a43ca4c64ef6fcdbf2129468d4ba0ce03cf781bdfabbb92d56
Opcode Fuzzy Hash: 39fee0194598c59c323658afaff1e197ec4bd77cd8a1660c904cfa3b29746b16
Instruction Fuzzy Hash: 592190326106089FC754EFA8D444D9BBBF8FF4A210F40456EE146D7610EB70FA49CB91

Function 00CED005 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2335820623.0000000000CED000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ced000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64a492a1c5a483ce70a52e0153bc2df809468915b7b0fad6faee1f4fa7333600
Instruction ID: f6030fac240f95922d72c502ef6393fc97c735272c566ff2deec62d91c56235e
Opcode Fuzzy Hash: 64a492a1c5a483ce70a52e0153bc2df809468915b7b0fad6faee1f4fa7333600
Instruction Fuzzy Hash: 57215E755093C08FCB12CF24D994715BF71EB46314F28C5EAD8498B6A7C33A990ACB62

Function 065734E9 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2349358688.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69899290da9da76ee22898b251c39bbadf13692703c5f8f220444894fe637de1
Instruction ID: 88471c35b6567bfc6b94dd92ea50744a86dcf0c38f12ddceb3970a3ea5a30f0f
Opcode Fuzzy Hash: 69899290da9da76ee22898b251c39bbadf13692703c5f8f220444894fe637de1
Instruction Fuzzy Hash: 8C112536A0114AEFCF51CE1AF88489AF726FB95331B04C1B2D91587100C732E959EFE6

Function 06575830 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2349358688.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc557cbaab2f1cd4acf84356d4b33629b6a2c0efedc2ba764cd2415517d86513
Instruction ID: 64f7752fa8d6dc63f04f005f9cfeceecb314de81b253d6bd0ff666a4f4def908
Opcode Fuzzy Hash: cc557cbaab2f1cd4acf84356d4b33629b6a2c0efedc2ba764cd2415517d86513
Instruction Fuzzy Hash: E411A1363102009FDF496BB8E41895D77E3EB883117058465F60ACB765CF36DC109B44

Function 06575758 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2349358688.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 647cb0dcd6a9d47ef0b903c64d8ba43c16c74b2c3800d8d81db68feaabfb9bd1
Instruction ID: 65d9c729cb4c74dbca4c646bc8e8478a07f9dbe5a35904f0bbd43093533612a3
Opcode Fuzzy Hash: 647cb0dcd6a9d47ef0b903c64d8ba43c16c74b2c3800d8d81db68feaabfb9bd1
Instruction Fuzzy Hash: 5A21E271E10608CFDB58DFA9D8486DDBBF2BF8C311F24806AD505B7260EB319985CB64

Function 0657EF32 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2349358688.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c380ca759211872037e023b4ba32c7ddd1e63f04a939c61a9622be4f9a50ede
Instruction ID: bff400fd8eab2394009f718aa95b709b16805aca0a3d1aa097215f08750d22a3
Opcode Fuzzy Hash: 4c380ca759211872037e023b4ba32c7ddd1e63f04a939c61a9622be4f9a50ede
Instruction Fuzzy Hash: 9B114F316002109FDB55CF29E888E66BBBAFF85610B198095F909CF6A6C730DD50CBA0

Function 062C8E70 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2348854653.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_62c0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac3c169f8c215a421c205c9979c5690fb747fe3cffe66a695f76816164e6b452
Instruction ID: 7d6d0784f54b29b078ef483410e1c11ebffbaa145cb40386136bef9da7c8a8f8
Opcode Fuzzy Hash: ac3c169f8c215a421c205c9979c5690fb747fe3cffe66a695f76816164e6b452
Instruction Fuzzy Hash: D321D374E11218EFCB48DFA9E8846EDBBB6FF88310F10912AE805B7360EB741945CB54

Function 0657E4CA Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2349358688.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 156e8a10769ca4def491c4c3b96cefd82c9e4e677f54f09f21f1000337312101
Instruction ID: fdb639e408b1fd74472d45533ac126cb0c8c2bb751c4506b208d45653c852eca
Opcode Fuzzy Hash: 156e8a10769ca4def491c4c3b96cefd82c9e4e677f54f09f21f1000337312101
Instruction Fuzzy Hash: 7F110475E012589FDF44DFA8E885AEDBBB2FF88310F50916AE504B7250C7355D45CBA0

Function 00CDD3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2335776711.0000000000CDD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CDD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_cdd000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fed46cca7f742b7caa711e8ed735342f41d2c2d3303e466d284e334843d61363
Instruction ID: ffc6859fd8f23a8bb70d14e09fe02bb60628d64605b83f4485eacbf5ee57d78e
Opcode Fuzzy Hash: fed46cca7f742b7caa711e8ed735342f41d2c2d3303e466d284e334843d61363
Instruction Fuzzy Hash: E111D3B6904280DFCB15CF10D5C4B16BF71FB94324F24C6AAD90A0B756C33AE956CBA1

Function 00CDD4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2335776711.0000000000CDD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CDD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_cdd000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fed46cca7f742b7caa711e8ed735342f41d2c2d3303e466d284e334843d61363
Instruction ID: 9fde2a83ab8efe35b0c087272a4da201452b37a1c51a8e996df13439c266ba6d
Opcode Fuzzy Hash: fed46cca7f742b7caa711e8ed735342f41d2c2d3303e466d284e334843d61363
Instruction Fuzzy Hash: 4311E6B6904280DFCB15CF10D5C4B16BF71FB94318F24C6AAD94A0B756C33AD956CBA1

Function 062CBF2F Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2348854653.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_62c0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5137a720d501410e52bcb675ffe5d235c448b1831eb61a0fa50367b5dcca2260
Instruction ID: 4d16d474a254f315ca1e189903d87b1471cc8d093af81c96120898ee7b034b04
Opcode Fuzzy Hash: 5137a720d501410e52bcb675ffe5d235c448b1831eb61a0fa50367b5dcca2260
Instruction Fuzzy Hash: 310108312006408FC749BB78E45466F3FA3EEC2252306142DD206CBA52DD747D068FE7

Function 06571D21 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2349358688.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2804b26180c9a2c8af679e49ca3b9b0e067a4a557427dfafa92aae3720ec3443
Instruction ID: ce8542c1f9ad8d6fa08c70074f9d58e4b352129d94459bd38cf32c6935a8db84
Opcode Fuzzy Hash: 2804b26180c9a2c8af679e49ca3b9b0e067a4a557427dfafa92aae3720ec3443
Instruction Fuzzy Hash: EF01F532609BD10FD7B24364F8647E83F71AB82260F0D06A7D05DCF693C6558849CFA5

Function 0657009A Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2349358688.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a4cb4b7fdd6be5002a41025673038c47078236b42b9058b9e5c63b3caa9c231
Instruction ID: a0987f2de1fecff7227479bfb2693a4666acc258b5496d440339927f9101f19b
Opcode Fuzzy Hash: 0a4cb4b7fdd6be5002a41025673038c47078236b42b9058b9e5c63b3caa9c231
Instruction Fuzzy Hash: D811D2757006118FC744DE1CEC9086A7BEAFF85225314859AE905DF361EB70DC02CBA0

Function 06575910 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2349358688.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56ac6cf8f680ce7512c8b8b2194031677c323454a6f28536ebc307da768acb08
Instruction ID: d2b4d0b85c2e468797b70eae2d3bb2c5b91477b3ed6ebdb2cce3be17d5b901e9
Opcode Fuzzy Hash: 56ac6cf8f680ce7512c8b8b2194031677c323454a6f28536ebc307da768acb08
Instruction Fuzzy Hash: 7C114930920219CFCB44EFA4E9549ADBBB1FF45700F104529E5057B250EF30AA8ACB81

Function 065707E0 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2349358688.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18d0169b1a1ef8808c564870a6426726850c7257296d46611e6c7e7921e9a38a
Instruction ID: e62de7dcfab7ff9256984c6bcb51242f825e2f25e67f9ba6344bc37491c9f1bc
Opcode Fuzzy Hash: 18d0169b1a1ef8808c564870a6426726850c7257296d46611e6c7e7921e9a38a
Instruction Fuzzy Hash: C511A1B6A00204CFCB40DF78D8489AEBBF5FF89221B11066AE945E7321E730D945CBA0

Function 062C8350 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2348854653.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_62c0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9be52a4c63e55bbdde263b3ba03bd420cc019ed6b7deba4b9ac3261592b4c148
Instruction ID: aecd51fcd3a4d095aabb4e25b1a793823c6e6ab843b7949c79749130ee8a4380
Opcode Fuzzy Hash: 9be52a4c63e55bbdde263b3ba03bd420cc019ed6b7deba4b9ac3261592b4c148
Instruction Fuzzy Hash: 50018431B0011A9BDB10DEA9EC44ABFFBFAEBD4361B14813BE604D3240DF7099158BA1

Function 062C8F28 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2348854653.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_62c0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 759dfd8761795e6bce94bef481457c169697477e3a170b01011f1a55b3d1e549
Instruction ID: 30cdbbaa07e639e7fc400200b1f12f7570d877f156a3b228eeb0129e746bb45d
Opcode Fuzzy Hash: 759dfd8761795e6bce94bef481457c169697477e3a170b01011f1a55b3d1e549
Instruction Fuzzy Hash: 1C111871E0024ACFDB04DFA5D844AEEBBB6EF89305F10816AD815B7260D7755A41CFA0

Function 062CC769 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2348854653.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_62c0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99391d8331160ada4cdc1562412d070ef955556b6e026f3c59513f6824e20b08
Instruction ID: 840a22b2986415654833475f6d328f927c9d8239d8968f87bfa3236a3335d0e0
Opcode Fuzzy Hash: 99391d8331160ada4cdc1562412d070ef955556b6e026f3c59513f6824e20b08
Instruction Fuzzy Hash: 8711C2302042448FD316AB78E41865F7FE2EFC6311B158A6ED14A9B752CFB4980A8B92

Function 062C8C78 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2348854653.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_62c0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7bfbc62a5a7f7a8c4f75689531140cfa26a9c61314c9ccfd828092f68712da8c
Instruction ID: e61947a275d849b9ef37946310200b544d0e5bb5f5041635aa0e3f54f33f296d
Opcode Fuzzy Hash: 7bfbc62a5a7f7a8c4f75689531140cfa26a9c61314c9ccfd828092f68712da8c
Instruction Fuzzy Hash: CB01D63530020A6BF7045E69D845BAB3A9AEBC4620F00812AFD09C3340CA79DD12CB91

Function 0657EEA8 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2349358688.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59ee331f61b65c92395cd71d7f9479e6eef9cdf1d43fbd1e9cfc32195d2e51f9
Instruction ID: b73aba8a736f66dba4058dd12689b4de87f6bbd5f1503c0e655683a29daf0359
Opcode Fuzzy Hash: 59ee331f61b65c92395cd71d7f9479e6eef9cdf1d43fbd1e9cfc32195d2e51f9
Instruction Fuzzy Hash: F011C875900209EFCB41CFA8D5449ADBBF1FF08210F1484E9E819DB251E332DA61EF50

Function 0657E4D8 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2349358688.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d4926c1cdfc43406befb7542acd8637d531bd865f6b54b2497d6c5cc58561b2
Instruction ID: bd70555062c7155758c36628b6b018d63d2fafc71a5f66e75fca6091a2c6ce5f
Opcode Fuzzy Hash: 9d4926c1cdfc43406befb7542acd8637d531bd865f6b54b2497d6c5cc58561b2
Instruction Fuzzy Hash: 4B11D074E002189FDB04DFA8E985ADDBBB5FF89310F50512AE504B7360DB35A845CBA4

Function 06575D11 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2349358688.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2af07d0091cfe2c35ebd0cb72f35d698c08422c8883eac1aa134abe539b820cd
Instruction ID: 57e77a747ebcbfcedcb6b5afa45a039868401e661e196239aac2707533d201b4
Opcode Fuzzy Hash: 2af07d0091cfe2c35ebd0cb72f35d698c08422c8883eac1aa134abe539b820cd
Instruction Fuzzy Hash: 3F11C032A003889FD765DF64D848AD77BB8FB06210F0441AAE146CB551EA60EA89CBA1

Function 062CB5A9 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2348854653.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_62c0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3d7ba0e936c4984e90bb63c41876d16ccdf19e81515fefbcc93e90453f0ec3b
Instruction ID: e12067e0ff342d2798cdabe76a848234d3bfa9fc6d0ee92d42f627bf0b5ad32f
Opcode Fuzzy Hash: b3d7ba0e936c4984e90bb63c41876d16ccdf19e81515fefbcc93e90453f0ec3b
Instruction Fuzzy Hash: 3F11C230906286DFCB02EB78E84599D7FB1EF82310B1445DED446DB316CA701E44CF52

Function 065707F0 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2349358688.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b9024fa7180812aead59d76bf481e5a7b5c57903d196c8dbb814ab61e5f69cb
Instruction ID: 3932fe453572aa5c01c6b0dc9df03cddf32a342d4864e01a40505bc43e7c3702
Opcode Fuzzy Hash: 5b9024fa7180812aead59d76bf481e5a7b5c57903d196c8dbb814ab61e5f69cb
Instruction Fuzzy Hash: AB014075A006159FCB44DFA8D848CAEBBF9FF89621B100669E905D7320D730A945CBA0

Function 065708A0 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2349358688.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e54063572ff59d6e1fcbcaf6ef79a5368b3e62532a1e14a8535ad0a1efd6088c
Instruction ID: 447cec30873e7bcafa6c4291d6bb20da1ff75831aa7c6e1b99c96da64810ef9e
Opcode Fuzzy Hash: e54063572ff59d6e1fcbcaf6ef79a5368b3e62532a1e14a8535ad0a1efd6088c
Instruction Fuzzy Hash: 25017C36901109AFCB01CFA4DD05DEFBBB9EF4A311B1041A6E614FB171D6319E15CBA2

Function 0657AD60 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2349358688.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33c3b01e555f6ed51ec882271178e6f3e4d8a00350325ac5934c94d139a08b6f
Instruction ID: 7477c9cbb7261e30b4e38cfc72f7e49729be436544c9269cb91e7ea9ae10d766
Opcode Fuzzy Hash: 33c3b01e555f6ed51ec882271178e6f3e4d8a00350325ac5934c94d139a08b6f
Instruction Fuzzy Hash: 3F01F734B002545FCB118B79E848AEEBFF5FB89210F14056AE545C7361C6709D45CBA0

Function 062C8F38 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2348854653.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_62c0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c3c36bfd018a745d48b31f96be9c9f52b8272f3ef539cb9f877ae6070e42330
Instruction ID: 2a7843b700f55bb0570a91cc9b1f94205de5b4944c8e36ea9e209b08be8fb2ab
Opcode Fuzzy Hash: 7c3c36bfd018a745d48b31f96be9c9f52b8272f3ef539cb9f877ae6070e42330
Instruction Fuzzy Hash: 33110570E002098FDB08DFA9D8445EEBBB6EF88311F10816AD514B7260DB755E41CFA0

Function 062CBF40 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2348854653.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_62c0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2f53fc49f723b58da94274cd347b2359e991e2a09a2679b084a6ffbec8a0b09
Instruction ID: 66120fa7925c404cfb88042fca1c5384afedfd647f02ada0602dce1d722910e1
Opcode Fuzzy Hash: f2f53fc49f723b58da94274cd347b2359e991e2a09a2679b084a6ffbec8a0b09
Instruction Fuzzy Hash: A401B1312009058B8749BB78E45462F3AA3EFC1251356582DE2068BB81DEB47D069FEB

Function 062C6E90 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2348854653.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_62c0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6f1bbd63f2ff8df4f0b39707d7ed6661957b9e41222b3309ca8913354f9a971
Instruction ID: 4d2c559e5869245a0aeffa39c1c6b090228380f9e761a8e6706543a3b9e244b2
Opcode Fuzzy Hash: a6f1bbd63f2ff8df4f0b39707d7ed6661957b9e41222b3309ca8913354f9a971
Instruction Fuzzy Hash: ADF0FC661041D87FCB514EAA5C41EFB3FEDDB8E261B084156FED8D2241C428C921A770

Function 00CDD885 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2335776711.0000000000CDD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CDD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_cdd000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 304a216b7644c7de970501e21dff5ad43d0adc0ec77864aabafc09613d9df789
Instruction ID: d160160cd4e1e3a4375862c4a7ba3136abe9b0f8e14e12ceb1375e22f61cd5c8
Opcode Fuzzy Hash: 304a216b7644c7de970501e21dff5ad43d0adc0ec77864aabafc09613d9df789
Instruction Fuzzy Hash: DB01F771904340DAE7114E2ACD80726BF98DF41724F18C45BEF1A5E3D2C6B9A840EBB1

Function 0657ACF0 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2349358688.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b281b176b98c5a20b5fdfc5a185ebc32440ad69b46f7674d206fef7cdafd6270
Instruction ID: 12a800b4d74acda6212b1902f689bc4ec2039f1fa0141c52e6eed1ccb1ada2c7
Opcode Fuzzy Hash: b281b176b98c5a20b5fdfc5a185ebc32440ad69b46f7674d206fef7cdafd6270
Instruction Fuzzy Hash: 8F01A432705210CFC7558B39F5185B977EAFF89263715087BE94ACB260CB358C42CB50

Function 062C8C10 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2348854653.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_62c0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a9f7d851933c02452648147f9ff5fa3a2ee25407f7cdc979ab324fedbe89199
Instruction ID: 6e463b1da7d311582adbb6d74d2a1d3213f7c9048dac426d1dd9b50f7f3641eb
Opcode Fuzzy Hash: 7a9f7d851933c02452648147f9ff5fa3a2ee25407f7cdc979ab324fedbe89199
Instruction Fuzzy Hash: 44F062723402055FE714DF65DC84BAB7BAEEB88324F11453AE216D7281DAB5E80187A0

Function 062CEB70 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2348854653.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_62c0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cac197e0acfd1433b65bd66721645b2098a4829a0832d06e838a0e1c1aa21fb
Instruction ID: 58e7ac37d7343737fee24fcb9712fbac0da0b05bd4881cb7542adf51f6d59eea
Opcode Fuzzy Hash: 5cac197e0acfd1433b65bd66721645b2098a4829a0832d06e838a0e1c1aa21fb
Instruction Fuzzy Hash: E70149342183499FCB06EB78C8148AA3FB6FF8621071584EDE841CB322DB32DC01CB80

Function 0657F060 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2349358688.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c79210e34f268aeeb3e3a415a956605d986f37b80d3607d65d5933c3e5654e6e
Instruction ID: 48e180534f28e8a15890fa7d570fce3d0cd4a0be7cd3f33de3e3b1ca6042456b
Opcode Fuzzy Hash: c79210e34f268aeeb3e3a415a956605d986f37b80d3607d65d5933c3e5654e6e
Instruction Fuzzy Hash: 74012836604214AF8755CF59D884C5ABBF9FB48320705C69AF929CB392CA71E945CB90

Function 062CC778 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2348854653.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_62c0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6c71c591a2e0e298961f4ae1d3afdae6304a56d8274b7ff7b505451cd1e1a5b
Instruction ID: 5ed5b314e66bf13c9b947763a70891741500a13bed447302647c15c9f2b29d80
Opcode Fuzzy Hash: e6c71c591a2e0e298961f4ae1d3afdae6304a56d8274b7ff7b505451cd1e1a5b
Instruction Fuzzy Hash: B00175303046048FD319AF65E41865F7BE3EFC5315B518A2DD14B87745CFB4A9058B96

Function 062C5508 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2348854653.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_62c0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4de72936e638a3aabf6103d37cd90c95783dc24d14f1a731f664457cc565407b
Instruction ID: e13fa3d93c14d7567da40c6df67b2664fc81ac7dce027fe6cde2860c4418e8bc
Opcode Fuzzy Hash: 4de72936e638a3aabf6103d37cd90c95783dc24d14f1a731f664457cc565407b
Instruction Fuzzy Hash: CA01A430A31703CFDBA99A39E804527B7F7BF84365B148A3CE90696615DEB5F490CB90

Function 062C9158 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2348854653.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_62c0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 296b438efb324a09eac1c34b2f892369e1312db7cbc8fcbf8a76f5938bee2458
Instruction ID: 1e0b130d0589a90512040bdbee5de004ea9c17bc2d12c23bc30459701252c0d4
Opcode Fuzzy Hash: 296b438efb324a09eac1c34b2f892369e1312db7cbc8fcbf8a76f5938bee2458
Instruction Fuzzy Hash: 050148B4D0824ADFCB00DFA8D94A7ADBFF4FB09300F1046AAD914A3391D3B45A80DB91

Function 0657EE08 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2349358688.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e052190555ca4a185554ec522a5f896e97c0c87ef555d5687c7579ee5db59445
Instruction ID: f1aaaba54e50645f404c791f022e840fd8e523cc01cf2a0ed390968be3f6b9a8
Opcode Fuzzy Hash: e052190555ca4a185554ec522a5f896e97c0c87ef555d5687c7579ee5db59445
Instruction Fuzzy Hash: E301D471A043289FCF25CFA4D8116AEBFF2BF88300F04496DD942B3251CB359900DBA0

Function 06577EDF Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2349358688.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d86c76dea2519c6a96126d920c1e049b316d93b4941e31eccd132b6651b7f133
Instruction ID: 87dbf332b24a75e55d495ba10fc0e89b3298326c2cde851c8b04f6f1e243825a
Opcode Fuzzy Hash: d86c76dea2519c6a96126d920c1e049b316d93b4941e31eccd132b6651b7f133
Instruction Fuzzy Hash: 27F02432B152146FEB048E51FC148EBBBB9EBC9360B01486BED11E7341D6304D198BF1

Function 06572CC2 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2349358688.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2459e553db1822a0a6405816ec7ff3e7aa28aa7441a45a1fbf32187f3d8ccba
Instruction ID: 5e955a0345178f2f59580d5f5acf734515c585e88474d030a7492a8a91324832
Opcode Fuzzy Hash: b2459e553db1822a0a6405816ec7ff3e7aa28aa7441a45a1fbf32187f3d8ccba
Instruction Fuzzy Hash: 8AF0EC753151109F8704DB19E894C767BB6FF8932532A41DAE509CB332C621DC42CB65

Function 062CB628 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2348854653.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_62c0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc383430e81c2f94bf25965681f8075deef7f43c7cf179db36ac9823b6e39cd5
Instruction ID: fae4665da8ccc66f372a05fcf81ff946c9cddaa350915ad18d74a1df99eaf263
Opcode Fuzzy Hash: dc383430e81c2f94bf25965681f8075deef7f43c7cf179db36ac9823b6e39cd5
Instruction Fuzzy Hash: 97017C34D06289EFCB06EBB8E84989C7FB1EF86310B1551AEE446EB316DA701E44CF55

Function 062C9168 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2348854653.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_62c0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 195c007532346a03529daa5908838eb0aeb1650bbc8b0ba545b64757e05da801
Instruction ID: 46d2fdedc46d65d5ce4dd24dfdb3462d4e8fd633d63ebe8a74c4f8164d82e30a
Opcode Fuzzy Hash: 195c007532346a03529daa5908838eb0aeb1650bbc8b0ba545b64757e05da801
Instruction Fuzzy Hash: 8901D6B4D1420ADFCB44DFA9D9496AEBBF5FF48300F1086A9D915A3350E7B40A80DF90

Function 06577D5D Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2349358688.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc795db65dd69c74288b7cc550604131204140610ffc650c72525c3994b59a40
Instruction ID: d16d81d897df00d8f57acb32a0f881bc04b234a17865e434c7d574fe1e2e2f5f
Opcode Fuzzy Hash: bc795db65dd69c74288b7cc550604131204140610ffc650c72525c3994b59a40
Instruction Fuzzy Hash: F5F06935B001058FDB45DF69E408AAC3BF2FBC8221B140069EA06EB350CF31DD01CB91

Function 0657AD70 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2349358688.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db29ab7b448589e635b8a4207656a9b987b52548cab0d1cb79e61d5c2c452cf9
Instruction ID: c304fa1e8cc74078f5e2d0f35c1633374ebda64d99e4bba3d6d3af0d2d21519c
Opcode Fuzzy Hash: db29ab7b448589e635b8a4207656a9b987b52548cab0d1cb79e61d5c2c452cf9
Instruction Fuzzy Hash: E9F0AF31B001149FCB149BA9E888AAEBBF6FB88751F04052AE60597360CB709D05CB90

Function 065709EC Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2349358688.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 791479a9303e465f1d5a36101f81977a9d14a1e896574494bbd864a2109651a8
Instruction ID: 39ccc2bed707a98bb584d6c861d9d58e533dabc42af2c184af981bd5b28c7a57
Opcode Fuzzy Hash: 791479a9303e465f1d5a36101f81977a9d14a1e896574494bbd864a2109651a8
Instruction Fuzzy Hash: 2001FB71600B04DFD724DF2AD884957BBF5FF88310B009A2EE54A87661DBB1F945CB94

Function 062CC440 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2348854653.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_62c0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a93a8f8451d6a23e4e8b8fb15231fade58e2b743e0305dd6da4ecc6bc36b1373
Instruction ID: 5227ffd015df8151ea4153cf98e657b0fdaecfe68675bb52414365dd3f8b738e
Opcode Fuzzy Hash: a93a8f8451d6a23e4e8b8fb15231fade58e2b743e0305dd6da4ecc6bc36b1373
Instruction Fuzzy Hash: 7D01A234505B418FD326AF25E418166BFF1FF89311701865ED48AC7A22CB30A845CFC9

Function 062CB4B9 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2348854653.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_62c0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07ce0669cbda2b74f9ad9e41076eef8885d4f924a7f3427ff36501f94413d61b
Instruction ID: 5196d67038da9a9c3f44e72527b0ae27392aba40b3c238aa24d2c88f3e638002
Opcode Fuzzy Hash: 07ce0669cbda2b74f9ad9e41076eef8885d4f924a7f3427ff36501f94413d61b
Instruction Fuzzy Hash: 5CF0E2302082809FD310276AA859A9F7FEAEFCA755B04447EE24EC3243C965280587A6

Function 062C3EC8 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2348854653.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_62c0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5040d9ad6cdd805bb35d204801bfa5102d8a954a266723e11d4f99eb82850e7
Instruction ID: 4456d1773bfaa9829dcc9289124e784964a26068bee0e04907b4d19e07f4f0e3
Opcode Fuzzy Hash: f5040d9ad6cdd805bb35d204801bfa5102d8a954a266723e11d4f99eb82850e7
Instruction Fuzzy Hash: 69F090303001018BC218E729E85096E7BD6EFC9210310592DD50A9B744EFA0FD0787E1

Function 062C8C20 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2348854653.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_62c0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ff5422f83b7666f8ccbd5bdd755d243e156271e2750a00ef3ae2659a516108a
Instruction ID: a3660825606676b8fd20396ab188101917e84f572fb7081fb4a8503469c72cce
Opcode Fuzzy Hash: 3ff5422f83b7666f8ccbd5bdd755d243e156271e2750a00ef3ae2659a516108a
Instruction Fuzzy Hash: 8FF054717002155FD714DA55EC44EAB77AEEBC8314F10452AE109C7281DAB5EC0587A0

Function 00CDD884 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2335776711.0000000000CDD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CDD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_cdd000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f17760d72f06fa955b7752e486b2d4afe4d76aaff71538096ddf35581b27f57
Instruction ID: 9f55f259c035479b63ee51e98135deccd362ad22bb9d74bc2a56efeb0922627d
Opcode Fuzzy Hash: 2f17760d72f06fa955b7752e486b2d4afe4d76aaff71538096ddf35581b27f57
Instruction Fuzzy Hash: 16F0C2718053449AE7118E19CD84B62FF98EB41734F18C45BEE194F286C2B9AC44DBB1

Function 0657DED0 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2349358688.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6965aeea006c3751ac90748502c0d657bec9f79b51ea76f216585c4533e3868a
Instruction ID: 2f1fc2be939a8086029aaf862d9812e3d6e7e9aba31fb3fd0224197bcf926667
Opcode Fuzzy Hash: 6965aeea006c3751ac90748502c0d657bec9f79b51ea76f216585c4533e3868a
Instruction Fuzzy Hash: 24F03C70D052098FCB98CFBAA4446BEBFF5BF48214F148669E419E7350E6309541CF90

Function 06577EB9 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2349358688.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4591f17a12b51c2555358de7a3711877a6e31cfc7125483bc7725c22244ce6c
Instruction ID: 5cdaae2446fb2ec0060fd711bcbf4af4fdf25370014bbcbe520d8d7200f00abd
Opcode Fuzzy Hash: d4591f17a12b51c2555358de7a3711877a6e31cfc7125483bc7725c22244ce6c
Instruction Fuzzy Hash: E1F052323282949FDB529B20FC14BF73F26F785211F0504ABEE00CB287D2704A29C361

Function 062C67C8 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2348854653.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_62c0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 342f560c57b5295acbf483c90efdf23307e008d51bdf1572378e2c5b0ad52a44
Instruction ID: e8064a5639f3e5554f40b1d421ff01cbef9d29f075f1688a03368627f4f1d9c7
Opcode Fuzzy Hash: 342f560c57b5295acbf483c90efdf23307e008d51bdf1572378e2c5b0ad52a44
Instruction Fuzzy Hash: 86F0F032B103019BD7208A68EC01F927FE4DB82764F15836AF614CF1E2D6B1E8098340

Function 062C5098 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2348854653.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_62c0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a03891661e1af55ed96bf6f6725a33c85833c8720adff16aded0752e24f1c39
Instruction ID: 1d486d947dcf6ce4c4e2e7cc1adcbaf1f2b86c05b070b630c2c2cee4836a2d33
Opcode Fuzzy Hash: 6a03891661e1af55ed96bf6f6725a33c85833c8720adff16aded0752e24f1c39
Instruction Fuzzy Hash: 4CF0F835304104ABD714DB5AD988D7BBBEBEBC9760B54C529FA0D8B385CA70EC019BE0

Function 062C6EA0 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2348854653.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_62c0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f347c8f0a18245e3b187d04b84e238299d4967d7eccbb3efe19a907d97740cfe
Instruction ID: e96b0a83be82cfec5e6d90e06e01456f004c0ddbbba7ea8f3ea29411472b8dc5
Opcode Fuzzy Hash: f347c8f0a18245e3b187d04b84e238299d4967d7eccbb3efe19a907d97740cfe
Instruction Fuzzy Hash: E9F012662041E87F8B518E9A5C11CFB7FEDDA8E161B084156FF98D2241C429C921ABB0

Function 062CAF88 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2348854653.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_62c0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e35226ea50f992213c46e89d84cf6dfdcd9dd3608de0051b4ad20614a870718e
Instruction ID: c065c0cad1b3e9c2c54de11e573c15be711c553864b393ed0a5526d4aea5e021
Opcode Fuzzy Hash: e35226ea50f992213c46e89d84cf6dfdcd9dd3608de0051b4ad20614a870718e
Instruction Fuzzy Hash: A1F0597270D1A45FD75617286C240AD3F75D9C26A130841DEE646C7246CE545502C3E6

Function 0657AD00 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2349358688.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9e849d25c4056055c005188b42cad0f3886308b3602af27727406541d118397
Instruction ID: 27088358a978b62ec3bb9461acf801c90b5d4e2f891bdcac1a293de30742a2bc
Opcode Fuzzy Hash: c9e849d25c4056055c005188b42cad0f3886308b3602af27727406541d118397
Instruction Fuzzy Hash: 23F01D31700214CFC7699A3AE40856A77EBBBC9252714447AE90ACB360DF71DC42CB54

Function 065708B0 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2349358688.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3c0e85e80bf3e014e4e7904492ea4705f30948ab91bdc376ec4dc5b86403b67
Instruction ID: 353a73a4a9e87df1409eb9462e6290ff0303dc2671d43ed746278b78598d3496
Opcode Fuzzy Hash: d3c0e85e80bf3e014e4e7904492ea4705f30948ab91bdc376ec4dc5b86403b67
Instruction Fuzzy Hash: E0F0373690011AEFCF00DFA8D904DDEBBB6FF49310B104165E618AB271E732AA15CB91

Function 062CC3E0 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2348854653.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_62c0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cdb522525ed9a94a38cb0667d32efe001548695941cc48ce4d2a85a687bda4b4
Instruction ID: fb5f55b8857363b5233f34de98c9040a376c35406daa797621205c7afe7a8a5e
Opcode Fuzzy Hash: cdb522525ed9a94a38cb0667d32efe001548695941cc48ce4d2a85a687bda4b4
Instruction Fuzzy Hash: 60F090312087D44FC312A77CE81969A7FE5DFC3315B09049FD286CF693CAA56C058BA6

Function 062C91E8 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2348854653.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_62c0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec0038ecb52b4df043754afb6263eb7db273c660e6a8d0b4c0a0a499861d165d
Instruction ID: 1ed56819e52ce6384621f2c236696af8bf640aa1097cd2fbda594946802c62a3
Opcode Fuzzy Hash: ec0038ecb52b4df043754afb6263eb7db273c660e6a8d0b4c0a0a499861d165d
Instruction Fuzzy Hash: CCF082317042048B8754DBA9D550566F7D9DF88324318C96EDE4EC7B40DA32FC03C780

Function 062C8341 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2348854653.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_62c0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cac2273997c6612eecb67d78e5c701bb44fd7dc41de98d781a51d4816e5ea438
Instruction ID: 89851227c21c484f3a1e18089c23e175565b1f25203c7389c777f07490617492
Opcode Fuzzy Hash: cac2273997c6612eecb67d78e5c701bb44fd7dc41de98d781a51d4816e5ea438
Instruction Fuzzy Hash: B8F05C31F1011A5B8B10A969AC489FF7BFDEF94262B08003BDA18D3140FB34C805C7A0

Function 06572CD0 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2349358688.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0e21c8518bdaa4f07e142da335c05c366dfbf11ac75f8859a0e047dd5c45e58
Instruction ID: 8f65020c2926b4efb6643b6dfabcc48ad2631f4161594e9e121d360f30265a0a
Opcode Fuzzy Hash: f0e21c8518bdaa4f07e142da335c05c366dfbf11ac75f8859a0e047dd5c45e58
Instruction Fuzzy Hash: 59F07A753105109F8744DB59E898C6ABBEAFF8D72532541E9E509CB331CA61EC42CBA1

Function 062CB638 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2348854653.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_62c0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7f37ec7b15d75cf910b88766508dabae5c857ddd84078485c52b3eab05160ca
Instruction ID: 27a9125073aa939e4b8ffacebb91f0bd29e984ad8ced0e971bda69a7eac6713d
Opcode Fuzzy Hash: e7f37ec7b15d75cf910b88766508dabae5c857ddd84078485c52b3eab05160ca
Instruction Fuzzy Hash: A7F03C70E01249EFCB05EFB8E84995D7BB1FB85300B1155AED406AB355DB702E449F45

Function 06573F70 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2349358688.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76aa80c3c3ff8c8e822d7c9e74525c47f237189874d40c880819b26da564b36d
Instruction ID: 7ececf5727bbb571e29bf52e9e1e04ce2eefb0327f294942f0122daa1a867783
Opcode Fuzzy Hash: 76aa80c3c3ff8c8e822d7c9e74525c47f237189874d40c880819b26da564b36d
Instruction Fuzzy Hash: 94F074763505149F8754DB6ED888C1ABBEAEB8D66131581A9F609CB332CA61DC418B90

Function 062C54F8 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2348854653.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_62c0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8aeeb5bb4204ec62e39d6cf6c0a6a676e1ff27b3ac363f74fd406a2efa905c50
Instruction ID: cc802813697d3a834acd3517ae479f3f73eebdef22b5add38a68ea253bde4294
Opcode Fuzzy Hash: 8aeeb5bb4204ec62e39d6cf6c0a6a676e1ff27b3ac363f74fd406a2efa905c50
Instruction Fuzzy Hash: 64F05931520742CFDBA8CE21D9407777BF2BF80364F488A6CD84646A15CBB5F444CB40

Function 062CFB3F Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2348854653.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_62c0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1424e902f16f05a0a14bd4669bfe1ca3c73ac60b41b71e7eb75b90307b5cb7d0
Instruction ID: 679d0d72cf79aaece45d2b3d8d2ac4e5e3ee140ba6081a1cabb795f280aa1617
Opcode Fuzzy Hash: 1424e902f16f05a0a14bd4669bfe1ca3c73ac60b41b71e7eb75b90307b5cb7d0
Instruction Fuzzy Hash: 5FE02201B082501BC756227C64293AD2BA3DFC5602F15009FD94BCF3C3CE544C054BC2

Function 065756B2 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2349358688.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64e51a95d8d911fc75316c0ae3255cbb7a2183caf951ffec047cf4a7bf1efbe1
Instruction ID: 9f53a106f8230413bc09a1f3471613b3159ad154353ea6b8fac18292b5109aa0
Opcode Fuzzy Hash: 64e51a95d8d911fc75316c0ae3255cbb7a2183caf951ffec047cf4a7bf1efbe1
Instruction Fuzzy Hash: 67F05875D05259DECB40EFBCE9045EEBFB4AF05310F20866AD948EB210E2308A66CFD1

Function 06573F72 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2349358688.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7206cc6a7f7c74f4f59acae29007c67dda9fdfdda9da8e5bc4aad040a4657e7
Instruction ID: 4023fb420caca7ed4435f71d296029787db460b80d656942b7d9c02f5ac6b2c6
Opcode Fuzzy Hash: b7206cc6a7f7c74f4f59acae29007c67dda9fdfdda9da8e5bc4aad040a4657e7
Instruction Fuzzy Hash: 22F074763504109F8754DB6DE888C5A7BAAABCD62131581A9F109CB331CA61DC418B50

Function 06571D87 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2349358688.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6d22d679fb07e50bb5dcea41e223d2372ef4c4dece3491c9992bf3438e715d0
Instruction ID: 65bad906ae0cbcfe6304340fbde6c3e2fcf236ece5d38b94fff863fc142e3529
Opcode Fuzzy Hash: a6d22d679fb07e50bb5dcea41e223d2372ef4c4dece3491c9992bf3438e715d0
Instruction Fuzzy Hash: 75F027323047408FC3996BA8E8585597B56DFC5211F19457AE61A8B782DE31C809CFE4

Function 062C9237 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2348854653.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_62c0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f32c671b6eb7640ae82c780813ea0868765bc9635c8815207297042184b00d3
Instruction ID: df44fa0d682de0258de6a708cf54fd7f437e948c5c8d7b805f9de0803b3feb68
Opcode Fuzzy Hash: 7f32c671b6eb7640ae82c780813ea0868765bc9635c8815207297042184b00d3
Instruction Fuzzy Hash: 1EF0BE34E08348AFC745EFA4E891BAD7BB0AB04300F1081A9D8589F3A1DA708E49CB81

Function 062C9294 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2348854653.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_62c0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34cba414709f4902cadfb00e1ef0ef91c63d9610adeca121c122e020c76dd8c2
Instruction ID: 7ca88640205903cb69aa3a6c8ae0c1942e52f8ed9de13801722b1f1e6ad94319
Opcode Fuzzy Hash: 34cba414709f4902cadfb00e1ef0ef91c63d9610adeca121c122e020c76dd8c2
Instruction Fuzzy Hash: 7BF0B475D09244DFD745DB60D8617AD7B70EB41310F0042DED9548F3A4DB749A41DB81

Function 062CB4C8 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2348854653.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_62c0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a75182209f83e825aa0c30534bf0ad501d672cddacb4f58c089d9373dd51000
Instruction ID: 8eb710381337bc759453ee5a533077791953006a0270c028494ac873cb3e7582
Opcode Fuzzy Hash: 0a75182209f83e825aa0c30534bf0ad501d672cddacb4f58c089d9373dd51000
Instruction Fuzzy Hash: 77E0D831304100ABD7142B6AE849A9F7BDAEBC9351B40443DF20EC3342CE65280587F6

Function 062CAF40 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2348854653.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_62c0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db04e47c3a6443bbb76d0d30241d73e1e0ec3eba4c3ba0b551a2877e3de0df0e
Instruction ID: 21b810ebc13200f0099452a1d7174182928d744b82fe347719d7a453a72d2ed0
Opcode Fuzzy Hash: db04e47c3a6443bbb76d0d30241d73e1e0ec3eba4c3ba0b551a2877e3de0df0e
Instruction Fuzzy Hash: 78E0D8313192955FDB272735A8244AD7FBADAC366130C80AFE786C724ACE642D0587E6

Function 062CC450 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2348854653.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_62c0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9de9b26724b5a8e5f9d2191b06c7e3286a1c5a977d8aae206e2f5c9ce5c830cb
Instruction ID: ef5fa2a099097a93955049c2aa8d644e4ec212717653e44142368a1688148a92
Opcode Fuzzy Hash: 9de9b26724b5a8e5f9d2191b06c7e3286a1c5a977d8aae206e2f5c9ce5c830cb
Instruction Fuzzy Hash: 9BF06770500B018FD725EF26E448566BBF2FF88300700862EE84A82A15DB70A949CFC8

Function 062CB7D0 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2348854653.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_62c0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a254737086277b80ed4e88e0a72760871ccaa2d951200759f640b0c4bb1efc1
Instruction ID: e213e9f1cfbb6ee91ab52556c5a3059e27a762e15e2ab5ef22152af0b2fddb26
Opcode Fuzzy Hash: 4a254737086277b80ed4e88e0a72760871ccaa2d951200759f640b0c4bb1efc1
Instruction Fuzzy Hash: B8F01575D0120CAFCF02DFB4DA448CEBFB4EB09200F1082AAE846E3241EA310B45DF80

Function 062CC3F0 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2348854653.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_62c0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f400225737ee7f8bc8e5b2b640fd3329b3ed3a3a4c13b17fbcf83e423392ddf
Instruction ID: cc8377bfe3d1bff999c3c902cdec19a1ee5eba38948fbe9fe00afc34c857842b
Opcode Fuzzy Hash: 1f400225737ee7f8bc8e5b2b640fd3329b3ed3a3a4c13b17fbcf83e423392ddf
Instruction Fuzzy Hash: 01E0A0302047508FC314A76DE40879F7FE6DBC2304F04042DE2468B742CAA569018B95

Function 06574620 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2349358688.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24df316e1e21758112bc81d934abea9bda1dce2c7357372c3fde2002779fb52b
Instruction ID: d481df1ac32328f1c821e88992167e56e25622fc1c008c4ad27b773e93790fc6
Opcode Fuzzy Hash: 24df316e1e21758112bc81d934abea9bda1dce2c7357372c3fde2002779fb52b
Instruction Fuzzy Hash: EDE0DF323052A09FC3054F28D4048A6BFBAEFCA62032900DBE189CB223CA20CC43C7A1

Function 062C5698 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2348854653.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_62c0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef29d31d5b20bbdd76c6b2719552429c16213026c68562d68396832e549b38c5
Instruction ID: 67f2ccb3c76646ae066916ec3a005a69373ea07c3c0c62377be0cc57d2e40a3e
Opcode Fuzzy Hash: ef29d31d5b20bbdd76c6b2719552429c16213026c68562d68396832e549b38c5
Instruction Fuzzy Hash: CDE0D8B210C3119FD304DB60E8458D6BBA4EF95320F16CC6EE881CB181E772D841C795

Function 062C91DA Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2348854653.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_62c0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c5216be06cacbb793992809e156bcc1906f9e62ff5b376bdbee5f6185c064d9
Instruction ID: 946ecde67520253d3adab2cea36941781d4b49a2094e7a4586f4d22700933161
Opcode Fuzzy Hash: 3c5216be06cacbb793992809e156bcc1906f9e62ff5b376bdbee5f6185c064d9
Instruction Fuzzy Hash: E1E02631A096044FD362DBA8E560681BFE4CB8E320B0A89FECD5CC7B42E921DC03C380

Function 065756C0 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2349358688.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a29f92feb7fea514a0c9216e686754cf617358d236dc99569db0ce2723f38aa9
Instruction ID: c8dc95ca0d5866bc801ba6cae1b23f94cd6a1f00a135ec1e4f128e238af34648
Opcode Fuzzy Hash: a29f92feb7fea514a0c9216e686754cf617358d236dc99569db0ce2723f38aa9
Instruction Fuzzy Hash: FBF0A571D00219DFCB40EFA8E9055DEBBF4AB05250F508266DA59E7210F6309A558BD1

Function 0657DEFE Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2349358688.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb7bf2e673677af989905a2c38df33fa9fdc327b07d2d2029f4c2117e52abee3
Instruction ID: 2aa22cc2d8d7ec517aea16752d5637a482266bb1707d74c2de2b1cf1e6964d85
Opcode Fuzzy Hash: bb7bf2e673677af989905a2c38df33fa9fdc327b07d2d2029f4c2117e52abee3
Instruction Fuzzy Hash: EDF09270E01209CBDF58CFA6A4486AEBBF1BF88655F04456DD50AAB250EA369940CF91

Function 06571D48 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2349358688.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92f754d8a9bd17629c74dad49060cac0fe70e75d79945a3b296467bfc5d638e8
Instruction ID: b0f2b2d9d6b3a3b1b7ad1253bb77f65fa79d05b1498c93fc5ad7feb932e94a68
Opcode Fuzzy Hash: 92f754d8a9bd17629c74dad49060cac0fe70e75d79945a3b296467bfc5d638e8
Instruction Fuzzy Hash: 2EE0263362092207E7311298F0283F532D9AB80360F080033D10CCBA44C994C8514FE4

Function 062C9248 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2348854653.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_62c0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b866b4ddeea49806af980be354c6652ee8e1040a5bd9baf27cad627b3ea6a247
Instruction ID: 1015852859398f10aab3843245b02adb3ee88516fd98e8e54ed81f4ac9caeb11
Opcode Fuzzy Hash: b866b4ddeea49806af980be354c6652ee8e1040a5bd9baf27cad627b3ea6a247
Instruction Fuzzy Hash: 58F06D74E04308EFCB44EFA4E881BAEB7B4AB44300F1082A8D9549F3A4DB745D40CF80

Function 062CE4BF Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2348854653.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_62c0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa6fe6cc4037717a368cdfe1be62d1f045a5349e6707d35bcf44778cef5d1210
Instruction ID: 9352ab4f7e991fd202ce26e1f9a057310fff26740743ffc96418ca05cb22d846
Opcode Fuzzy Hash: aa6fe6cc4037717a368cdfe1be62d1f045a5349e6707d35bcf44778cef5d1210
Instruction Fuzzy Hash: 3CE09270909388AFC706CB78E94199D7FB0DB82215B1101DED005EB392D5B11F04AB52

Function 062CFBA2 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2348854653.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_62c0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f00ee7b7d8cc1129557d6fd35fd8fa06e5b21543561be6978f3d91f2c1a749b
Instruction ID: 3d8372bfc6d0c1cb70870169d3b4ad19bc009d5d50bc7ad2da57bef1ebf52303
Opcode Fuzzy Hash: 3f00ee7b7d8cc1129557d6fd35fd8fa06e5b21543561be6978f3d91f2c1a749b
Instruction Fuzzy Hash: 99E0C225B082E12B8316136C28184DB7F76DDCB6F230A01DFF90AD7343C9500C0987B6

Function 065759D3 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2349358688.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22ffed79aac6b42f992b92957cfea708b5b112e33821ab9a8b3d2208f71ee38c
Instruction ID: e98383d5875b87639c799aa82e3d469056b97228646f7d830b73031ff754d4f5
Opcode Fuzzy Hash: 22ffed79aac6b42f992b92957cfea708b5b112e33821ab9a8b3d2208f71ee38c
Instruction Fuzzy Hash: 5DF0ED30804649CFDB40EF74E0046ADBBB0BF46340F200A1AD002AB290EF304A85CB91

Function 062CCF10 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2348854653.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_62c0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa584881bdc9df9a7d0d64333ddf41e3ee8c77398b333b376aa28d945b40db08
Instruction ID: 4e0150b632ad3feb1550a503d34c311e720d1a7e04eb61b6b871f204167fcc04
Opcode Fuzzy Hash: aa584881bdc9df9a7d0d64333ddf41e3ee8c77398b333b376aa28d945b40db08
Instruction Fuzzy Hash: 5DE09A2260D2C04BD303EA28B8504C87FA0DA82222307458FD189CF357E6A0580887A6

Function 062CE540 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2348854653.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_62c0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c80ed05d48cda52c8553d20217449aa128b23c76a00a137e2e152aa9387f6e52
Instruction ID: 75d942bd40eb434e4e0f99bba22e6ba0c7acf7e4e73deabdcf0f0061598fbecd
Opcode Fuzzy Hash: c80ed05d48cda52c8553d20217449aa128b23c76a00a137e2e152aa9387f6e52
Instruction Fuzzy Hash: D9E0D83100C3C05FE707EB38F8954893FA0DE86704703844FD9469F2A7DBA059058799

Function 062CAF50 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2348854653.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_62c0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a02bc44bd19b37612ebd1632b580d7e68e4871d8b3fe773515766fed6a4695f8
Instruction ID: 8fcab6d92821781f87c14ac8b9e9b5bf28c2e798227554a1e13d918a58ae9607
Opcode Fuzzy Hash: a02bc44bd19b37612ebd1632b580d7e68e4871d8b3fe773515766fed6a4695f8
Instruction Fuzzy Hash: 88D05E31300128979A092769B4188BE7BABEBC5672300813EE70BC3344DE652E0287D6

Function 062CB7E0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2348854653.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_62c0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28a3b214002509638c439d8a36e1ece1a564f55013f91deccc70f81a8009a5c5
Instruction ID: b86794640412eeffba17609e63da4548d8c9f674b2c1885b6c1fcacefe3bbd10
Opcode Fuzzy Hash: 28a3b214002509638c439d8a36e1ece1a564f55013f91deccc70f81a8009a5c5
Instruction Fuzzy Hash: 8EE09A75D0020CEFCB41DFE4D9448DEBBB9EB48300F1082AAD805A3200EB305B55DF80

Function 06574630 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2349358688.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75c168d14b6d3a4c24cb9fd9174fed06ff48dccabf438aa6cd380bec75ad8717
Instruction ID: e11db32cf8ca493bdbddc2ed82c872b98aabf08063c269ef0616228b96029b6c
Opcode Fuzzy Hash: 75c168d14b6d3a4c24cb9fd9174fed06ff48dccabf438aa6cd380bec75ad8717
Instruction Fuzzy Hash: 14D05B327101205F87045F5DD40485ABBFFDFC9561325409BE145C7326CA71DC03C790

Function 062CE4D0 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2348854653.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_62c0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35a22e4a600542468e8408f64fe9c9d77533efbc05aa6594015b4b201becd8df
Instruction ID: 37b9f68a5e185acb4942ec163e59012030d895411226e9db1ecaa3c73f9c63e7
Opcode Fuzzy Hash: 35a22e4a600542468e8408f64fe9c9d77533efbc05aa6594015b4b201becd8df
Instruction Fuzzy Hash: BBD05B71A0010CFFCB04DFA8E90155E77B5DB84305B11419ED509E7341EE712F009F95

Function 062CEBB8 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2348854653.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_62c0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2b68997693121035675864a0f509faf0281886dc065bc1da77f66994ae814a0
Instruction ID: 0cef7b165342eabbc67b68562f70d4b595035ae5f669a96a7c127575b23352b7
Opcode Fuzzy Hash: d2b68997693121035675864a0f509faf0281886dc065bc1da77f66994ae814a0
Instruction Fuzzy Hash: 77E05B352583889FC7429B58D401C967F75FF4662074540DAF5C58F532C2329815DB51

Function 06574A00 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2349358688.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77aee4faa58421279c858dc07be19aa9909e2a652ae36700fbfe6843877471d8
Instruction ID: d6b619292dee80c8acb9543844ff39bd4dbce406d6d6be52060d32fb37c9036e
Opcode Fuzzy Hash: 77aee4faa58421279c858dc07be19aa9909e2a652ae36700fbfe6843877471d8
Instruction Fuzzy Hash: C0C0123500E3813FC2421E60EC10CA77FB5AA56120B054A47F0E4D50B2C22549589376

Function 06571B99 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2349358688.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 430a3a0b0296a3d7155f9228c53fc0fd27d9e98ca5c337078b1ffaa8b9bf6bc6
Instruction ID: 7cd0019f140008fadfb72916f6be709f31cd7fd3bf01dd6b0b9bb97bc0081db1
Opcode Fuzzy Hash: 430a3a0b0296a3d7155f9228c53fc0fd27d9e98ca5c337078b1ffaa8b9bf6bc6
Instruction Fuzzy Hash: DAD05E7090F3C18FDB16AB20FEA87513F62DB02301F1A64DAD084CE077D6781814CB52

Function 0657ACD0 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2349358688.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 409ff21ea4b9270945d246132ad3596ef751ded4893bfd8437723f9263182012
Instruction ID: 79c970298b394a38bb16f0cebc3c221d27a4873e70eb7c31592b4849658858e3
Opcode Fuzzy Hash: 409ff21ea4b9270945d246132ad3596ef751ded4893bfd8437723f9263182012
Instruction Fuzzy Hash: D4C08C31590108CFC740ABA4F00889837ADFF8822A3114090F60C8F631EB22EC408A80

Function 0657041E Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2349358688.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8f67bb881e616a15d1ff4af379ff8f81264180e724fb69999abcc02fe5c49b9
Instruction ID: 9082a113a9ab272fb0dfdb8ceb68aa51e7398adee1733eaff5e23520ed24ed73
Opcode Fuzzy Hash: f8f67bb881e616a15d1ff4af379ff8f81264180e724fb69999abcc02fe5c49b9
Instruction Fuzzy Hash: 33D0C77054120ACFD714DF50D16577E7BB1FF14308F600418D101BA691C7B54945DBD1

Function 062C3721 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2348854653.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_62c0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f1a3da1586ab67a200e4679933dbfa9737a0365778eb882c6a2b2d417a00046
Instruction ID: 9e1b3f3711be54c10d077da03777c3801ebe907ae65ca6ea2bdb8a36854658be
Opcode Fuzzy Hash: 9f1a3da1586ab67a200e4679933dbfa9737a0365778eb882c6a2b2d417a00046
Instruction Fuzzy Hash: 76B0927225010257F70092909D07FE13954D3A0711F2595106BA2AA285CAAA90438AE5

Function 06573D40 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2349358688.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d36cb798322b211e9311ad08044f0e779a8749fc49e875db322451f82932cd5b
Instruction ID: 3a81e3a0086a9dbf1037df6199b246fc66ce179e9a0719505d4d6e4561e6e98e
Opcode Fuzzy Hash: d36cb798322b211e9311ad08044f0e779a8749fc49e875db322451f82932cd5b
Instruction Fuzzy Hash: 3EC04C353405048FC344DB5DD445C55F7E9EF9C615315C0A5E509CB332D632FC52DA54

Non-executed Functions

Function 065B2E88 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2349584262.00000000065B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_65b0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89434d9049f204ce6b64a8d25918514d2ac3626e23a6be516bc48157461246b4
Instruction ID: 16dcef47510f5e5d73a0d5543c18f1d0e2fb8fc0ef24f5f7ed44f032b725c768
Opcode Fuzzy Hash: 89434d9049f204ce6b64a8d25918514d2ac3626e23a6be516bc48157461246b4
Instruction Fuzzy Hash: 8661AD74E00208DFDB44DFA9D880ADDBBB2BF89300F24912AE515BB365DB35A946CF54

Function 065B3158 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2349584262.00000000065B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_65b0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e129fea8fd9c8903a0784766b9a75b02092a25438ec6fd142d16eb285ea2fe9d
Instruction ID: 40efb4d96a527ca8cfcfad6549fc63501c39d079cd9302245093aa0580e3e883
Opcode Fuzzy Hash: e129fea8fd9c8903a0784766b9a75b02092a25438ec6fd142d16eb285ea2fe9d
Instruction Fuzzy Hash: 20011A34E05308DFCB00CF94D841AEDFBB5FB4A311F155196E919AB262C6359D41CF90

Function 065E89EC Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2350106853.00000000065E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_65e0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7270b496fa1885d75579be043904ac752b6068bc5dbee24cf17ade2b9301d74e
Instruction ID: 005c039778e648b98623281fb7ab676acaf98a5481103be2e7bbe8258f5628ef
Opcode Fuzzy Hash: 7270b496fa1885d75579be043904ac752b6068bc5dbee24cf17ade2b9301d74e
Instruction Fuzzy Hash: 94F0C270C84259CFEF688F50D8597BDBBB0BB06315F20A999C006B3590CBB44A88DF85

Function 065BEE89 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2349584262.00000000065B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_65b0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5939579e570cfa28275fbf775efad52ea59fd21167dca8c50386d102ad93862
Instruction ID: b7d0f340b2276f5ab65a69c01cf52757f74b3b47814b19beed81a16cc5bbcd26
Opcode Fuzzy Hash: b5939579e570cfa28275fbf775efad52ea59fd21167dca8c50386d102ad93862
Instruction Fuzzy Hash: FAE09A30C5A10ECEEB508F91C816BFEF630BB41344F20B849D80277240CB7086448FA5

Function 062CE587 Relevance: 46.6, Strings: 37, Instructions: 390COMMON

Download Yara Rule

Strings

Dj, xrefs: 062CEAD9
Dj, xrefs: 062CE65D
Dj, xrefs: 062CEA58
Dj, xrefs: 062CE682
Dj, xrefs: 062CE5EE
Dj, xrefs: 062CE78B
Dj, xrefs: 062CE7DB
Dj, xrefs: 062CE716
Dj, xrefs: 062CE5A4
Dj, xrefs: 062CEB04
Dj, xrefs: 062CE613
Dj, xrefs: 062CE803
Dj, xrefs: 062CE82B
Dj, xrefs: 062CE940
Dj, xrefs: 062CE968
Dj, xrefs: 062CEAAE
Dj, xrefs: 062CEA83
Dj, xrefs: 062CE8C8
Dj, xrefs: 062CE73B
Dj, xrefs: 062CE638
Dj, xrefs: 062CE8A3
Dj, xrefs: 062CE918
Dj, xrefs: 062CE8F0
Dj, xrefs: 062CE87B
Dj, xrefs: 062CE9E0
Dj, xrefs: 062CEA08
Dj, xrefs: 062CE853
Dj, xrefs: 062CEB2F
Dj, xrefs: 062CEA30
Dj, xrefs: 062CE990
Dj, xrefs: 062CE6CC
Dj, xrefs: 062CE6A7
Dj, xrefs: 062CE9B8
Dj, xrefs: 062CE7B3
Dj, xrefs: 062CE6F1
Dj, xrefs: 062CE5C9
Dj, xrefs: 062CE763

Memory Dump Source

Source File: 00000003.00000002.2348854653.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_62c0000_MSBuild.jbxd

Similarity

API ID:
String ID: Dj$Dj$Dj$Dj$Dj$Dj$Dj$Dj$Dj$Dj$Dj$Dj$Dj$Dj$Dj$Dj$Dj$Dj$Dj$Dj$Dj$Dj$Dj$Dj$Dj$Dj$Dj$Dj$Dj$Dj$Dj$Dj$Dj$Dj$Dj$Dj$Dj
API String ID: 0-3026329000
Opcode ID: 151d82049b87f7ce033e2f3b04b9e2c60fcde72ef00d7f64873b16cab6b37db9
Instruction ID: d6f701cef8138235f3229f8a529d7b0d36d1ce3d3cbfeee9e66333aff19fd5b7
Opcode Fuzzy Hash: 151d82049b87f7ce033e2f3b04b9e2c60fcde72ef00d7f64873b16cab6b37db9
Instruction Fuzzy Hash: E2D17D30300611EBE70A6BE49895B6DBA93FBC6300B40482CD7155F7AADFB17D1A539B

Function 062CE598 Relevance: 46.6, Strings: 37, Instructions: 383COMMON

Download Yara Rule

Strings

Dj, xrefs: 062CEAD9
Dj, xrefs: 062CE65D
Dj, xrefs: 062CEA58
Dj, xrefs: 062CE682
Dj, xrefs: 062CE5EE
Dj, xrefs: 062CE78B
Dj, xrefs: 062CE7DB
Dj, xrefs: 062CE716
Dj, xrefs: 062CE5A4
Dj, xrefs: 062CEB04
Dj, xrefs: 062CE613
Dj, xrefs: 062CE803
Dj, xrefs: 062CE82B
Dj, xrefs: 062CE940
Dj, xrefs: 062CE968
Dj, xrefs: 062CEAAE
Dj, xrefs: 062CEA83
Dj, xrefs: 062CE8C8
Dj, xrefs: 062CE73B
Dj, xrefs: 062CE638
Dj, xrefs: 062CE8A3
Dj, xrefs: 062CE918
Dj, xrefs: 062CE8F0
Dj, xrefs: 062CE87B
Dj, xrefs: 062CE9E0
Dj, xrefs: 062CEA08
Dj, xrefs: 062CE853
Dj, xrefs: 062CEB2F
Dj, xrefs: 062CEA30
Dj, xrefs: 062CE990
Dj, xrefs: 062CE6CC
Dj, xrefs: 062CE6A7
Dj, xrefs: 062CE9B8
Dj, xrefs: 062CE7B3
Dj, xrefs: 062CE6F1
Dj, xrefs: 062CE5C9
Dj, xrefs: 062CE763

Memory Dump Source

Source File: 00000003.00000002.2348854653.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_62c0000_MSBuild.jbxd

Similarity

API ID:
String ID: Dj$Dj$Dj$Dj$Dj$Dj$Dj$Dj$Dj$Dj$Dj$Dj$Dj$Dj$Dj$Dj$Dj$Dj$Dj$Dj$Dj$Dj$Dj$Dj$Dj$Dj$Dj$Dj$Dj$Dj$Dj$Dj$Dj$Dj$Dj$Dj$Dj
API String ID: 0-3026329000
Opcode ID: 035a733ab230574672e498a8ec666c481c17b993f661eceb51c32abe6545301c
Instruction ID: a4219067d42c645dbf9c6f95f165bb1bf2e2404dff9cc496c4ae95d1d92ad0a6
Opcode Fuzzy Hash: 035a733ab230574672e498a8ec666c481c17b993f661eceb51c32abe6545301c
Instruction Fuzzy Hash: 81D17D30300611EBE70A6AE09855B6DB693FBCA700B80482CD7155F7AADFB17D1653DB

Function 06573097 Relevance: 32.8, Strings: 26, Instructions: 281COMMON

Download Yara Rule

Strings

Dj, xrefs: 06573373
Dj, xrefs: 06573226
Dj, xrefs: 065730D9
Dj, xrefs: 0657324B
Dj, xrefs: 06573398
Dj, xrefs: 065730B4
Dj, xrefs: 065733BD
Dj, xrefs: 06573295
Dj, xrefs: 06573148
Dj, xrefs: 06573270
Dj, xrefs: 0657316D
Dj, xrefs: 06573329
Dj, xrefs: 06573192
Dj, xrefs: 06573451
Dj, xrefs: 065731B7
Dj, xrefs: 0657334E
Dj, xrefs: 06573123
Dj, xrefs: 065732DF
Dj, xrefs: 065731DC
Dj, xrefs: 0657342C
Dj, xrefs: 065733E2
Dj, xrefs: 06573304
Dj, xrefs: 06573201
Dj, xrefs: 065730FE
Dj, xrefs: 065732BA
Dj, xrefs: 06573407

Memory Dump Source

Source File: 00000003.00000002.2349358688.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID: Dj$Dj$Dj$Dj$Dj$Dj$Dj$Dj$Dj$Dj$Dj$Dj$Dj$Dj$Dj$Dj$Dj$Dj$Dj$Dj$Dj$Dj$Dj$Dj$Dj$Dj
API String ID: 0-1952648061
Opcode ID: 5bfe40257926b6fd9602b800af407b849c9c729f09593377d6f85265d94b9bd0
Instruction ID: 22acaf45bce0506d65892705a6c978cd854906e8077901404afdbeb262da8035
Opcode Fuzzy Hash: 5bfe40257926b6fd9602b800af407b849c9c729f09593377d6f85265d94b9bd0
Instruction Fuzzy Hash: 93918D30300611ABE70A6AE4985572EBA53FBCA700B40482CE7094F796DFF27E1A5797

Function 065730A8 Relevance: 32.8, Strings: 26, Instructions: 273COMMON

Download Yara Rule

Strings

Dj, xrefs: 06573373
Dj, xrefs: 06573226
Dj, xrefs: 065730D9
Dj, xrefs: 0657324B
Dj, xrefs: 06573398
Dj, xrefs: 065730B4
Dj, xrefs: 065733BD
Dj, xrefs: 06573295
Dj, xrefs: 06573148
Dj, xrefs: 06573270
Dj, xrefs: 0657316D
Dj, xrefs: 06573329
Dj, xrefs: 06573192
Dj, xrefs: 06573451
Dj, xrefs: 065731B7
Dj, xrefs: 0657334E
Dj, xrefs: 06573123
Dj, xrefs: 065732DF
Dj, xrefs: 065731DC
Dj, xrefs: 0657342C
Dj, xrefs: 065733E2
Dj, xrefs: 06573304
Dj, xrefs: 06573201
Dj, xrefs: 065730FE
Dj, xrefs: 065732BA
Dj, xrefs: 06573407

Memory Dump Source

Source File: 00000003.00000002.2349358688.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6570000_MSBuild.jbxd

Similarity

API ID:
String ID: Dj$Dj$Dj$Dj$Dj$Dj$Dj$Dj$Dj$Dj$Dj$Dj$Dj$Dj$Dj$Dj$Dj$Dj$Dj$Dj$Dj$Dj$Dj$Dj$Dj$Dj
API String ID: 0-1952648061
Opcode ID: a957d187f766ca855d0b815da01f81c396b590142f703ee429317e47f54d76a4
Instruction ID: 955e922c87239409f21df0fbbcf116ab3e10ce32fe7dbe1251ddfe4b94678876
Opcode Fuzzy Hash: a957d187f766ca855d0b815da01f81c396b590142f703ee429317e47f54d76a4
Instruction Fuzzy Hash: 11918F30300611ABE6097AE4985572E7653FBCA700B80483CE7095F796DFF27E165797

Function 062CCF57 Relevance: 16.4, Strings: 13, Instructions: 150COMMON

Download Yara Rule

Strings

Dj, xrefs: 062CD09C
Dj, xrefs: 062CD0E6
Dj, xrefs: 062CD0C1
Dj, xrefs: 062CCF74
Dj, xrefs: 062CD02D
Dj, xrefs: 062CD10B
Dj, xrefs: 062CD008
Dj, xrefs: 062CCF99
Dj, xrefs: 062CCFBE
Dj, xrefs: 062CD130
Dj, xrefs: 062CD077
Dj, xrefs: 062CD052
Dj, xrefs: 062CCFE3

Memory Dump Source

Source File: 00000003.00000002.2348854653.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_62c0000_MSBuild.jbxd

Similarity

API ID:
String ID: Dj$Dj$Dj$Dj$Dj$Dj$Dj$Dj$Dj$Dj$Dj$Dj$Dj
API String ID: 0-1755392669
Opcode ID: 59b123602d55565941a01a99ce987e9b79d66ee2e367be7985d4d62874ad4b5d
Instruction ID: 8deeb82328b8e98493b5bb3d14ded723c2b0d47bf907934ab0d69f089b891e76
Opcode Fuzzy Hash: 59b123602d55565941a01a99ce987e9b79d66ee2e367be7985d4d62874ad4b5d
Instruction Fuzzy Hash: 4941B130300600AFE7066BA49856B6DBA53FBC6300B40493DE3095F796CFB67D56479B

Function 062CCF68 Relevance: 16.4, Strings: 13, Instructions: 143COMMON

Download Yara Rule

Strings

Dj, xrefs: 062CD09C
Dj, xrefs: 062CD0E6
Dj, xrefs: 062CD0C1
Dj, xrefs: 062CCF74
Dj, xrefs: 062CD02D
Dj, xrefs: 062CD10B
Dj, xrefs: 062CD008
Dj, xrefs: 062CCF99
Dj, xrefs: 062CCFBE
Dj, xrefs: 062CD130
Dj, xrefs: 062CD077
Dj, xrefs: 062CD052
Dj, xrefs: 062CCFE3

Memory Dump Source

Source File: 00000003.00000002.2348854653.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_62c0000_MSBuild.jbxd

Similarity

API ID:
String ID: Dj$Dj$Dj$Dj$Dj$Dj$Dj$Dj$Dj$Dj$Dj$Dj$Dj
API String ID: 0-1755392669
Opcode ID: df727209f327f871a9c3f2eb5a8c714e570cac8e5f78b119ada224f2d9e5731e
Instruction ID: aa39bbf8cd45ebf3f267084d261e66c652beee4ca6a85d1b832a4ffaba456527
Opcode Fuzzy Hash: df727209f327f871a9c3f2eb5a8c714e570cac8e5f78b119ada224f2d9e5731e
Instruction Fuzzy Hash: BA418030300611ABE7057AA49845B2DBA53FBCA700B80493CE3095F796DFB67E16479B

Function 062CD1A9 Relevance: 10.1, Strings: 8, Instructions: 99COMMON

Download Yara Rule

Strings

Dj, xrefs: 062CD2C7
Dj, xrefs: 062CD27D
Dj, xrefs: 062CD20E
Dj, xrefs: 062CD1C4
Dj, xrefs: 062CD1E9
Dj, xrefs: 062CD2A2
Dj, xrefs: 062CD258
Dj, xrefs: 062CD233

Memory Dump Source

Source File: 00000003.00000002.2348854653.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_62c0000_MSBuild.jbxd

Similarity

API ID:
String ID: Dj$Dj$Dj$Dj$Dj$Dj$Dj$Dj
API String ID: 0-3343961145
Opcode ID: 665f48f0d189bba4005d4344cc97322a3943b215341c5418eaea1831e2bf3234
Instruction ID: 9451d0c09f97183942aeac5223cded51f85852044dcc5f4e7f5e1b7cea500fc8
Opcode Fuzzy Hash: 665f48f0d189bba4005d4344cc97322a3943b215341c5418eaea1831e2bf3234
Instruction Fuzzy Hash: CD318131304251AFE7066AA49851B6DBA53FBC6300B804A3DE3094F796CFB57D5983DB

Function 062CD1B8 Relevance: 10.1, Strings: 8, Instructions: 93COMMON

Download Yara Rule

Strings

Dj, xrefs: 062CD2C7
Dj, xrefs: 062CD27D
Dj, xrefs: 062CD20E
Dj, xrefs: 062CD1C4
Dj, xrefs: 062CD1E9
Dj, xrefs: 062CD2A2
Dj, xrefs: 062CD258
Dj, xrefs: 062CD233

Memory Dump Source

Source File: 00000003.00000002.2348854653.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_62c0000_MSBuild.jbxd

Similarity

API ID:
String ID: Dj$Dj$Dj$Dj$Dj$Dj$Dj$Dj
API String ID: 0-3343961145
Opcode ID: fbbeb20b15ab5a2726083cf0e47bcc258a2477fd59f59b8f2cc596988eeaa785
Instruction ID: aa5a667a459b55a0453463b45274cd5a92b6c5d0cb0dfda3024a2a1b09c0a9df
Opcode Fuzzy Hash: fbbeb20b15ab5a2726083cf0e47bcc258a2477fd59f59b8f2cc596988eeaa785
Instruction Fuzzy Hash: B0218C30300211AFE7096AA49841B2DBA93FBC6700B80493CE7095F796CFB67D5683DB

Function 062CCC40 Relevance: 8.8, Strings: 7, Instructions: 89COMMON

Download Yara Rule

Strings

Dj, xrefs: 062CCD00
Dj, xrefs: 062CCC85
Dj, xrefs: 062CCC5C
Dj, xrefs: 062CCD29
Dj, xrefs: 062CCCAE
Dj, xrefs: 062CCCD7
Dj, xrefs: 062CCD52

Memory Dump Source

Source File: 00000003.00000002.2348854653.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_62c0000_MSBuild.jbxd

Similarity

API ID:
String ID: Dj$Dj$Dj$Dj$Dj$Dj$Dj
API String ID: 0-1644632172
Opcode ID: 01e59b2144964d382de174f18adfdafb54a6a7a63f7965c7e6deb16ed081d156
Instruction ID: 7c2b62407746b118610fecd05d5f14719479ebd306ee9e3ab558917912c7e3f8
Opcode Fuzzy Hash: 01e59b2144964d382de174f18adfdafb54a6a7a63f7965c7e6deb16ed081d156
Instruction Fuzzy Hash: 52318830305591AFEB052BA5E84196D7B63FBDA300704453DE70A8F7A6CEB16E5A8783

Function 062CCC50 Relevance: 8.8, Strings: 7, Instructions: 83COMMON

Download Yara Rule

Strings

Dj, xrefs: 062CCD00
Dj, xrefs: 062CCC85
Dj, xrefs: 062CCC5C
Dj, xrefs: 062CCD29
Dj, xrefs: 062CCCAE
Dj, xrefs: 062CCCD7
Dj, xrefs: 062CCD52

Memory Dump Source

Source File: 00000003.00000002.2348854653.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_62c0000_MSBuild.jbxd

Similarity

API ID:
String ID: Dj$Dj$Dj$Dj$Dj$Dj$Dj
API String ID: 0-1644632172
Opcode ID: 5c787ba46152a6cb11823b4c1e79d3c43659a5516ea5c972be90ce5e48083f3d
Instruction ID: 0da3371d5e667313e174d4fdb302a313d1a7b91ae095e369054553bd244fbcbf
Opcode Fuzzy Hash: 5c787ba46152a6cb11823b4c1e79d3c43659a5516ea5c972be90ce5e48083f3d
Instruction Fuzzy Hash: 6D218530300551AFEB052BA5E84596D7B53FBDA300B044538E30A8F7A6CEB16E4A8B83

Function 062CD7F8 Relevance: 7.6, Strings: 6, Instructions: 81COMMON

Download Yara Rule

Strings

Dj, xrefs: 062CD8A8
Dj, xrefs: 062CD883
Dj, xrefs: 062CD839
Dj, xrefs: 062CD85E
Dj, xrefs: 062CD814
Dj, xrefs: 062CD8CD

Memory Dump Source

Source File: 00000003.00000002.2348854653.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_62c0000_MSBuild.jbxd

Similarity

API ID:
String ID: Dj$Dj$Dj$Dj$Dj$Dj
API String ID: 0-504410534
Opcode ID: 15f708e80d11215cf2e865f10ec5611ab71cdd0cfd8b1df507a5e770320a9d3c
Instruction ID: 43a5163a769d35a96e2be019a9736d59ef41a7146a0b0eb2a7bd5c3125ed005a
Opcode Fuzzy Hash: 15f708e80d11215cf2e865f10ec5611ab71cdd0cfd8b1df507a5e770320a9d3c
Instruction Fuzzy Hash: B021A131304290AFE3066AA59851B6DBA53EBC6700B444A2DD3054F796CFF26D5983D7

Function 062CD808 Relevance: 7.6, Strings: 6, Instructions: 73COMMON

Download Yara Rule

Strings

Dj, xrefs: 062CD8A8
Dj, xrefs: 062CD883
Dj, xrefs: 062CD839
Dj, xrefs: 062CD85E
Dj, xrefs: 062CD814
Dj, xrefs: 062CD8CD

Memory Dump Source

Source File: 00000003.00000002.2348854653.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_62c0000_MSBuild.jbxd

Similarity

API ID:
String ID: Dj$Dj$Dj$Dj$Dj$Dj
API String ID: 0-504410534
Opcode ID: db8859ba9a694cb408514828bf7f2172a318718c238e5d9354a4e156bb1788f7
Instruction ID: a853bc853c2e6f918ded3560f9fdaf1db781c281d93b6467ea495a5426ebfcda
Opcode Fuzzy Hash: db8859ba9a694cb408514828bf7f2172a318718c238e5d9354a4e156bb1788f7
Instruction Fuzzy Hash: A7119D31300250AFE3056AA59851B2DBA97FBC6700B804A3CE3095F796CFB27E5643E7

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
89.105.223.196	jYDYjpSbvf.exe	Get hash	malicious	LummaC, Amadey, Clipboard Hijacker, LummaC Stealer, RedLine, SmokeLoader, Stealc	Browse
	vsYkceYJOX.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, RedLine, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, CryptOne, LummaC Stealer, PureLog Stealer, RedLine, Stealc	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, CryptOne, LummaC Stealer, PureLog Stealer, RedLine, Socks5Systemz	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Clipboard Hijacker, CryptOne, Cryptbot, LummaC Stealer, PureLog Stealer	Browse
	file.exe	Get hash	malicious	Amadey, CryptOne, PureLog Stealer, RedLine, Stealc, Vidar, Zhark RAT	Browse
	jD6b7MZOhT.exe	Get hash	malicious	Amadey, Clipboard Hijacker, CryptOne, Cryptbot, LummaC Stealer, PureLog Stealer, RedLine	Browse
	SecuriteInfo.com.Win32.TrojanX-gen.1325.25139.exe	Get hash	malicious	Amadey, CryptOne, LummaC Stealer, PureLog Stealer, RedLine, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	RedLine	Browse

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s-part-0017.t-0009.t-msedge.net	https://1drv.ms/o/c/76471f3776916fd0/EomjtsItbi9Ag0bnzrJDx08BhxVWepFoAXrJFoYeR9IZ0A?e=5%3aEFCh5b&sharingv2=true&fromShare=true&at=9	Get hash	malicious	Unknown	Browse	13.107.246.45
	https://www.canva.com/design/DAGUUU-VdiI/DdL4Z-_loK4X7NMMbGGnJg/view?utm_content=DAGUUU-VdiI&utm_campaign=designshare&utm_medium=link&utm_source=editor	Get hash	malicious	Unknown	Browse	13.107.246.45
	https://egift.activationshub.com/gift-card/view/8lPFUrjq1LGzg7JHwS8hJJRdL/	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	https://chiquitzinbb.com/o/?c3Y9bzM2NV8xX25vbSZyYW5kPWQxbDZOVGc9JnVpZD1VU0VSMTYxMDIwMjRVMTExMDE2NDc=N0123N	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	13.107.246.45
	https://app.writesonic.com/share/writing-assistant/d140c48b-3642-43bf-a085-e258c1fb4f03	Get hash	malicious	Unknown	Browse	13.107.246.45
	https://1drv.ms/o/c/3e563d3fb2a98d1c/Emlo5KUbYYNEvKtIF-7SS0EBYSeT3hOOGuv_MbeT-n2y4g?e=HPjqUn	Get hash	malicious	HtmlDropper	Browse	13.107.246.45
	https://railrent-railrent.powerappsportals.com/	Get hash	malicious	Unknown	Browse	13.107.246.45
	https://2007.filemail.com/api/file/get?filekey=58mKUrTMdlmzqkRvo0UdVa2TMjJTCQiSNv5rUBtsDQTNU0dM4JzppUJaOrP_mWxCym0k9l5xEDeaXunPsHq6frY8XZH_gnclw86MefA3bpAlGuDkr77-xSqrMOQIlMdW5cRjwoOSCWIlTwpC48cNKMMHhMKp&track=P8fpm4ry&pk_vid=8a8b18f03738ae4f17297703684d559d	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	https://is.gd/6NgVrQ	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	https://tarah.com.sa/reee	Get hash	malicious	Unknown	Browse	13.107.246.45
fp2e7a.wpc.phicdn.net	https://na2.docusign.net/Signing/EmailStart.aspx?a=c6104538-ac3b-4407-b24b-a0b641ee4589&etti=24&acct=7853161b-6814-4528-85bc-ffe96cfca42f&er=09ab18a7-8de5-4c92-931d-cb9cd9f7b00d	Get hash	malicious	Unknown	Browse	192.229.221.95
	https://egift.activationshub.com/gift-card/view/8lPFUrjq1LGzg7JHwS8hJJRdL	Get hash	malicious	Unknown	Browse	192.229.221.95
	http://hybrid-web.global.blackspider.com/urlwrap/?q=AXicLU67UsMwEFQBX0Gf0pbtkywxowHLiZgUDEXoGVmRjbFlJX4wk4bPgT-kJgpp9u72dnb35hZ9_SB0943Q2J8S1kTT-Bk53fbGD_Po-8h4h4C_yGb70WGgwAjaOz_q4TFAY41fhvk0mSXyY4Pe5_kw3cdxP3RRa-M8k0-72IqHZXZvRruDbptBrMLl7L5dnLAh60JMfhmNFbb3x0VfmFDBDrPYPO9Wtj--jtp0271IeaVxWlvNawq24rrmlPAKkyw3hGoetMLaNOFnloGugFFS1QmrM3IGAKg1DSLdBrM0veyzSMIsryXPOUnO_1-dYIUisgSKsdoknOWcZiBlmSvMVaZwLouSpIqRslBScsxYCkWZQUkobEByul4riRAivwj9ATUqckw&Z	Get hash	malicious	Unknown	Browse	192.229.221.95
	https://click.smb-hub-amer.com/CL0/https:%2F%2Faws-experience.com%2Famer%2Fsmb%2Fe%2F6585d%2Ftech201-generative-ai-activation---prompt-usering-with-amazon-bedrock/1/010f019292a0535d-76bbe2fd-5051-4597-a0cb-70909e66221c-000000/EuaOeAUnoTjz0zRaIJDPPYf78GxHTGM9U_JpcCxZuA8=180	Get hash	malicious	Unknown	Browse	192.229.221.95
	https://www.canva.com/design/DAGUUU-VdiI/DdL4Z-_loK4X7NMMbGGnJg/view?utm_content=DAGUUU-VdiI&utm_campaign=designshare&utm_medium=link&utm_source=editor	Get hash	malicious	Unknown	Browse	192.229.221.95
	https://www.canva.com/design/DAGUUU-VdiI/DdL4Z-_loK4X7NMMbGGnJg/view?utm_content=DAGUUU-VdiI&utm_campaign=designshare&utm_medium=link&utm_source=editor	Get hash	malicious	Unknown	Browse	192.229.221.95
	https://click.smb-hub-amer.com/CL0/https:%2F%2Faws-experience.com%2Famer%2Fsmb%2Ffaq/1/010f0192953347ae-3c905125-2a17-4574-9bc8-91e7b29508e2-000000/yNxMb5L-NyQC__8b2PYbvEt2zZ-h7CoRCEU0OPMd7LQ=181	Get hash	malicious	Unknown	Browse	192.229.221.95
	https://www.cognitoforms.com/f/dPw6PjKRNEiTBIouwlWxQQ/1	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	192.229.221.95
	Windows-StandardCollector-x64.exe	Get hash	malicious	Codoso Ghost	Browse	192.229.221.95
	http://url960.aceeduconsult.com/ls/click?upn=u001.LUpianUM71xe7PV7wDA6i1kcuy38W249FfPzE-2Fn4iGArrL0MQBCUZHFEzmfBrwW7hf5h8aNQUml0OSIHqpXf0LMpnaTL-2BzYU1WV-2BSTu4-2FYE-3DnWBx_C2kZwAnfGwUSqF5D87NbxLVpuF-2FUu77KiRgkAhE5NE4LxNdD8Vk-2BBXjUuKxXLIa0fIDZmJqQTdTMUWaKg74qY7H1042trEdUOL1Ty-2B4ikz6aamPgX0YPKifSgbmdnoJ9QNdI7-2Fj5HU9YtlUVfM2hhaIRlcN5LDyRrfABDYCmE6HCezIFJke-2Bw8MgqKR8oZe3x0bNQ5ip4gqKVt9OZvtTXtI2W19VoVZDzbdeDK4WD-2F3HaEv25gNxrltbLRhf8V-2BO7eWR3mjaJT30K-2BcVCwIlJZO7lziFom1TeAFneOePh2rvH67eyoHyRuDs7uhJ58UvSbL-2F5WGOZFqHf1Uoqm5u1BuusL-2F4yIoUS3Zge-2Bhwb2SPTTZrQp-2B3YQW62QJEBscu8XAGBtmCTNO-2FGrj9S-2BwtsmLluvkoUx0cXtIZxgyjwWcDifMxEpsoupBhIu0vHgSwbA5Jlj-2FdPy-2B0yhvKMBxhOgsBuXNzAVSfF8HuZvD5iWXinRKWqhNg1QpvfMK5Why8PnI5FwIsgrY7RxMkEbcDdf0VL1a7dM3RDh9LkpekDjtHu-2F4c-2FsI73UIfVUG4-2BbcH5VEOHzkCenTbIl-2BeYnL2jw9k-2Bt-2BAEZMQZavCq5q7Io2kchrzK3tu9Vj43TTv0K790k8tA4okR0vSuH0WvhSIZBs2e3uKgx9FK2SAr5JJzheB6cW2OXdbGgfDGPwGYkvJqNCBixLi9dWacb8fBed5RjA3p1JUsS79RbxF-2FaSjDqEr3OTeFx3WgBthSzcSYPpiE9ha00gB-2FAVdpFU8eOGGhrdGc6OgU4OZhDsRkN5FNMpRj3pgHOHQ6dkJW4RJx1-2B1Om8bljV3ruWQytV5mwg68-2FvnkkpkZM63omm27kalKxw-3D	Get hash	malicious	HTMLPhisher	Browse	192.229.221.95

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	https://email.sg.on24event.com/ls/click?upn=u001.7kf5QUY4LGF7Fzt7LGE4bbPPsSPtBC4KXSPVJqWhtiGKYA8h-2Fs2ZE4k4Mw5OTNkG7MXiFSxnNtW0j6ofSHAXW1HldotIiuSczAWXKMwqPC9SEFfmHbhfPeJSnLL1byLqHFtV-2B5-2Bzlu3aEmkvEsjdF4pfPyN0cCie5qLdpyqXEVc-3DdW75_nptsQERiP2bxDplO0Yopma5-2B3-2BHXjIBfjCSriTnBL6bDAIVjKAbvVGNCWdU9DqIsFlkV1hwq0qq8QFfBJ4Jw83lxfQiag11eNjful-2F5DZNB0MfOdNL9CUK7i3u0XSRn3tgRxnTXYhlIImrFKtd24RJvAaDi0YLYq-2F-2Bnuc9osPPDAYREdTeCb9pcHCOzNWNquq3heowckATHcFvqXT76Jk2gcbZFXWlQRsFjG8eDMpM-2FLXpgzBvYnGXnUOibU2YR8sPRE-2FoPHFza-2Fw01eQ45phCwYix9qckBwiXG0HXQmAbfGqimPLouUL92q8izxx4IU5EnAunMVPc46qKMPXhEF7g-3D-3D	Get hash	malicious	Unknown	Browse	13.107.246.45
	_Play__New__VM__01min 04sec____ATT2006587654 (Randiwestbrook) .htm	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	https://na2.docusign.net/Signing/EmailStart.aspx?a=c6104538-ac3b-4407-b24b-a0b641ee4589&etti=24&acct=7853161b-6814-4528-85bc-ffe96cfca42f&er=09ab18a7-8de5-4c92-931d-cb9cd9f7b00d	Get hash	malicious	Unknown	Browse	13.107.246.45
	https://egift.activationshub.com/gift-card/view/8lPFUrjq1LGzg7JHwS8hJJRdL	Get hash	malicious	Unknown	Browse	13.107.246.45
	http://hybrid-web.global.blackspider.com/urlwrap/?q=AXicLU67UsMwEFQBX0Gf0pbtkywxowHLiZgUDEXoGVmRjbFlJX4wk4bPgT-kJgpp9u72dnb35hZ9_SB0943Q2J8S1kTT-Bk53fbGD_Po-8h4h4C_yGb70WGgwAjaOz_q4TFAY41fhvk0mSXyY4Pe5_kw3cdxP3RRa-M8k0-72IqHZXZvRruDbptBrMLl7L5dnLAh60JMfhmNFbb3x0VfmFDBDrPYPO9Wtj--jtp0271IeaVxWlvNawq24rrmlPAKkyw3hGoetMLaNOFnloGugFFS1QmrM3IGAKg1DSLdBrM0veyzSMIsryXPOUnO_1-dYIUisgSKsdoknOWcZiBlmSvMVaZwLouSpIqRslBScsxYCkWZQUkobEByul4riRAivwj9ATUqckw&Z	Get hash	malicious	Unknown	Browse	13.107.246.45
	https://1drv.ms/o/c/76471f3776916fd0/EomjtsItbi9Ag0bnzrJDx08BhxVWepFoAXrJFoYeR9IZ0A?e=5%3aEFCh5b&sharingv2=true&fromShare=true&at=9	Get hash	malicious	Unknown	Browse	13.107.246.45
	https://click.smb-hub-amer.com/CL0/https:%2F%2Faws-experience.com%2Famer%2Fsmb%2Fe%2F6585d%2Ftech201-generative-ai-activation---prompt-usering-with-amazon-bedrock/1/010f019292a0535d-76bbe2fd-5051-4597-a0cb-70909e66221c-000000/EuaOeAUnoTjz0zRaIJDPPYf78GxHTGM9U_JpcCxZuA8=180	Get hash	malicious	Unknown	Browse	13.107.246.45
	https://www.canva.com/design/DAGUUU-VdiI/DdL4Z-_loK4X7NMMbGGnJg/view?utm_content=DAGUUU-VdiI&utm_campaign=designshare&utm_medium=link&utm_source=editor	Get hash	malicious	Unknown	Browse	13.107.246.45
	https://www.canva.com/design/DAGUUU-VdiI/DdL4Z-_loK4X7NMMbGGnJg/view?utm_content=DAGUUU-VdiI&utm_campaign=designshare&utm_medium=link&utm_source=editor	Get hash	malicious	Unknown	Browse	13.107.246.45
	https://click.smb-hub-amer.com/CL0/https:%2F%2Faws-experience.com%2Famer%2Fsmb%2Ffaq/1/010f0192953347ae-3c905125-2a17-4574-9bc8-91e7b29508e2-000000/yNxMb5L-NyQC__8b2PYbvEt2zZ-h7CoRCEU0OPMd7LQ=181	Get hash	malicious	Unknown	Browse	13.107.246.45

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.479171546100309
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	SecuriteInfo.com.Trojan.Siggen29.57841.15930.23271.exe
File size:	527'360 bytes
MD5:	a904ae8b26c7d421140be930266ed425
SHA1:	c2e246b9197c18d6d40d9477a8e9a2d74a83b0e2
SHA256:	9d3380ee1ccaae63ca9f39e86630ffe877d0e3ecb711d87dc02350922595dc84
SHA512:	2dbd601a564f7ffc1609bfb05ed55d57afb9bdd9bec1e9091deb53fcfa9fa02a7ba59825f2b9c3777d2016d724a8263808331356f569a1ecae585422e040f3be
SSDEEP:	12288:GWFI4Hnedq5EL4739r+Xpph6s2V/m2CB9EKS:w4+d747NOChVnCBF
TLSH:	E9B4F106B5C08072C977253109E5DBB49F7DB8314F565E9FA3A80FBF4F35680D221AAA
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A......A...A...A...@...A...@...A...@...A...@...A...A]..A.#.@...A.#.@...A.#.@H..AM".@...AM".@...AM"zA...AM".@...ARich...A.......

Entrypoint:	0x406448
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x67162DA4 [Mon Oct 21 10:32:04 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	de48de5d6e0f4635b5910437a0f3a073

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x2b770	0x58	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2b7c8	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x7b000	0x1e0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x7c000	0x1a7c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x29cb8	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x29bf8	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x22000	0x12c	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x20f93	0x21000	8d00e75b6aabcecb0204ad6568e22c10	False	0.5813654119318182	data	6.655652521018225	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x22000	0x9e7c	0xa000	2424dfd68e38c52d3169699cdce77e1d	False	0.4315673828125	data	4.933141731127229	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x2c000	0x4e2e4	0x4d600	7fa509a82ee568ef0df8a3739a7d60a6	False	0.9898304977786753	data	7.991049833472621	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x7b000	0x1e0	0x200	d87d2d1418f12908b25a23b8f1593395	False	0.53125	data	4.7176788329467545	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x7c000	0x1a7c	0x1c00	89af7e56a21ed42b0aec0c8f923b9f5b	False	0.7254464285714286	data	6.382490014490992	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.bsp	0x7e000	0x3000	0x3000	b659eeb106761b57d34d4a9a0f026b5b	False	0.032958984375	data	0.35694093368121704	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.bsp	0x81000	0x3000	0x3000	b659eeb106761b57d34d4a9a0f026b5b	False	0.032958984375	data	0.35694093368121704	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers. Root certificates are used in public key cryptography to identify a root certificate authority (CA). When a root certificate is installed, the system or application will trust certificates in the root's chain of trust that have been signed by the root certificate.Certificates are commonly used for establishing secure TLS/SSL communications within a web browser. When a user attempts to browse a website that presents a certificate that is not trusted an error message will be displayed to warn the user of the security risk. Depending on the security settings, the browser may not allow the user to establish a connection to the website.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SecuriteInfo.com.Trojan.Siggen29.57841.15930.23271.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: RedLine

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_SecuriteInfo.com_d3361eebbf430e036b4a51b6ef5b69d794b9ba_78258953_0519d225-d812-4cba-ad6d-22db454bf1fb\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC620.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC67E.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC6BE.tmp.xml

C:\Users\Public\Desktop\Google Chrome.lnk

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\MSBuild.exe.log

C:\Users\user\AppData\Local\Temp\TmpC5D1.tmp

C:\Users\user\AppData\Local\Temp\TmpC5E2.tmp

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1003\76b53b3ec448f7ccdda2063b15d2bfc3_9e146be9-c76a-4720-bcdb-53011b87bd06

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

General

File Icon

Windows Analysis Report
SecuriteInfo.com.Trojan.Siggen29.57841.15930.23271.exe

Function 00183EE0 Relevance: 1.5, APIs: 1, Instructions: 34
memoryCOMMON

Function 00196E42 Relevance: 4.7, APIs: 3, Instructions: 202
COMMON

Function 0019AA85 Relevance: 3.2, APIs: 2, Instructions: 177
COMMON

Function 00194EE3 Relevance: 3.0, APIs: 2, Instructions: 34
COMMONLIBRARYCODE

Function 0019A689 Relevance: 1.6, APIs: 1, Instructions: 147
COMMON

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre