Play interactive tour

Edit tour

Analysis Report Payment_Advice_pdf.exe

Overview

General Information

Sample Name:	Payment_Advice_pdf.exe
Analysis ID:	324331
MD5:	536cf4ed17eba1bf41ef70faaa2054a4
SHA1:	72e062dd7a10d8b9e66732d5037c5156a9741d30
SHA256:	c8ad1b5688fbbc359ee4256d3c7fbca2d09bdd4968000dc8ffb86bb9964ac213
Tags:	Agentteslaexe
Most interesting Screenshot:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Yara detected AgentTesla

.NET source code contains very large strings

Adds a directory exclusion to Windows Defender

Connects to a pastebin service (likely for C&C)

Creates an undocumented autostart registry key

Creates autostart registry keys with suspicious names

Creates multiple autostart registry keys

Drops PE files to the startup folder

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Antivirus or Machine Learning detection for unpacked file

Contains capabilities to detect virtual machines

Contains long sleeps (>= 3 min)

Creates a DirectInput object (often for capturing keystrokes)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE / OLE file has an invalid certificate

PE file contains strange resources

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Stores files to the Windows start menu directory

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Startup

System is w10x64

Payment_Advice_pdf.exe (PID: 4392 cmdline: 'C:\Users\user\Desktop\Payment_Advice_pdf.exe' MD5: 536CF4ED17EBA1BF41EF70FAAA2054A4)

timeout.exe (PID: 4488 cmdline: timeout 4 MD5: 121A4EDAE60A7AF6F5DFA82F7BB95659)

conhost.exe (PID: 4616 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

powershell.exe (PID: 6924 cmdline: 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payment_Advice_pdf.exe' -Force MD5: DBA3E6449E97D4E3DF64527EF7012A10)

conhost.exe (PID: 6932 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

powershell.exe (PID: 6948 cmdline: 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payment_Advice_pdf.exe' -Force MD5: DBA3E6449E97D4E3DF64527EF7012A10)

conhost.exe (PID: 7016 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

powershell.exe (PID: 7008 cmdline: 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payment_Advice_pdf.exe' -Force MD5: DBA3E6449E97D4E3DF64527EF7012A10)

conhost.exe (PID: 7056 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

powershell.exe (PID: 7104 cmdline: 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\Payment_Advice_pdf.exe' -Force MD5: DBA3E6449E97D4E3DF64527EF7012A10)

conhost.exe (PID: 5792 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

Payment_Advice_pdf.exe (PID: 6728 cmdline: C:\Users\user\Desktop\Payment_Advice_pdf.exe MD5: 536CF4ED17EBA1BF41EF70FAAA2054A4)

Payment_Advice_pdf.exe (PID: 5600 cmdline: 'C:\Users\user\Desktop\Payment_Advice_pdf.exe' MD5: 536CF4ED17EBA1BF41EF70FAAA2054A4)

Payment_Advice_pdf.exe (PID: 6944 cmdline: 'C:\Users\user\Desktop\Payment_Advice_pdf.exe' MD5: 536CF4ED17EBA1BF41EF70FAAA2054A4)

timeout.exe (PID: 4404 cmdline: timeout 4 MD5: 121A4EDAE60A7AF6F5DFA82F7BB95659)

conhost.exe (PID: 5772 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

Payment_Advice_pdf.exe (PID: 5360 cmdline: 'C:\Users\user\Desktop\Payment_Advice_pdf.exe' MD5: 536CF4ED17EBA1BF41EF70FAAA2054A4)

Payment_Advice_pdf.exe (PID: 5916 cmdline: 'C:\Users\user\Desktop\Payment_Advice_pdf.exe' MD5: 536CF4ED17EBA1BF41EF70FAAA2054A4)

Payment_Advice_pdf.exe (PID: 5536 cmdline: 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payment_Advice_pdf.exe' MD5: 536CF4ED17EBA1BF41EF70FAAA2054A4)

cleanup

Malware Configuration

No configs have been found

Yara Overview

Memory Dumps

Source	Rule	Description	Author
00000016.00000002.509306076.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000016.00000002.532140773.0000000002C41000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000016.00000002.532140773.0000000002C41000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Payment_Advice_pdf.exe PID: 6728	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: Payment_Advice_pdf.exe PID: 6728	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
22.2.Payment_Advice_pdf.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security

Sigma Overview

No Sigma rule has matched

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Multi AV Scanner detection for dropped file

Show sources

Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payment_Advice_pdf.exe	Metadefender: Detection: 18%			Perma Link
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payment_Advice_pdf.exe	ReversingLabs: Detection: 48%

Multi AV Scanner detection for submitted file

Show sources

Source: Payment_Advice_pdf.exe	Virustotal: Detection: 39%	Perma Link
Source: Payment_Advice_pdf.exe	Metadefender: Detection: 18%	Perma Link
Source: Payment_Advice_pdf.exe	ReversingLabs: Detection: 48%

Source: 22.2.Payment_Advice_pdf.exe.400000.0.unpack

Avira: Label: TR/Spy.Gen8

Networking:

Connects to a pastebin service (likely for C&C)

Show sources

Source: unknown	DNS query: name: hastebin.com
Source: unknown	DNS query: name: pastebin.com
Source: unknown	DNS query: name: hastebin.com
Source: unknown	DNS query: name: hastebin.com
Source: unknown	DNS query: name: hastebin.com
Source: unknown	DNS query: name: hastebin.com
Source: unknown	DNS query: name: pastebin.com
Source: unknown	DNS query: name: pastebin.com
Source: unknown	DNS query: name: pastebin.com
Source: unknown	DNS query: name: hastebin.com
Source: unknown	DNS query: name: hastebin.com
Source: unknown	DNS query: name: pastebin.com

Source: Joe Sandbox View	IP Address: 104.23.98.190 104.23.98.190
Source: Joe Sandbox View	IP Address: 104.23.98.190 104.23.98.190
Source: Joe Sandbox View	IP Address: 172.67.143.180 172.67.143.180

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown

DNS traffic detected: queries for: hastebin.com

Source: Payment_Advice_pdf.exe, 00000016.00000002.532140773.0000000002C41000.00000004.00000001.sdmp	String found in binary or memory: http://127.0.0.1:HTTP/1.1
Source: Payment_Advice_pdf.exe, 00000016.00000002.532140773.0000000002C41000.00000004.00000001.sdmp	String found in binary or memory: http://DynDns.comDynDNS
Source: Payment_Advice_pdf.exe, 00000000.00000003.309198205.00000000011E9000.00000004.00000001.sdmp, Payment_Advice_pdf.exe, 0000001B.00000002.533241996.000000000291C000.00000004.00000001.sdmp, Payment_Advice_pdf.exe, 0000001C.00000002.533472572.000000000349C000.00000004.00000001.sdmp, Payment_Advice_pdf.exe, 00000020.00000002.525801719.00000000012D0000.00000004.00000020.sdmp	String found in binary or memory: http://cacerts.digicert.com/CloudflareIncECCCA-3.crt0
Source: Payment_Advice_pdf.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: Payment_Advice_pdf.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: powershell.exe, 0000000D.00000002.517611780.0000000000A88000.00000004.00000001.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: Payment_Advice_pdf.exe, 00000000.00000003.309198205.00000000011E9000.00000004.00000001.sdmp, Payment_Advice_pdf.exe, 0000001B.00000002.533241996.000000000291C000.00000004.00000001.sdmp, Payment_Advice_pdf.exe, 0000001C.00000002.533472572.000000000349C000.00000004.00000001.sdmp, Payment_Advice_pdf.exe, 00000020.00000002.525801719.00000000012D0000.00000004.00000020.sdmp	String found in binary or memory: http://crl3.digicert.com/CloudflareIncECCCA-3.crl07
Source: Payment_Advice_pdf.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: Payment_Advice_pdf.exe, 0000001B.00000002.527256543.0000000000C44000.00000004.00000020.sdmp	String found in binary or memory: http://crl3.digicert.com/Omn
Source: Payment_Advice_pdf.exe, 00000000.00000003.309198205.00000000011E9000.00000004.00000001.sdmp, Payment_Advice_pdf.exe, 0000001B.00000002.527256543.0000000000C44000.00000004.00000020.sdmp, Payment_Advice_pdf.exe, 00000020.00000002.525801719.00000000012D0000.00000004.00000020.sdmp	String found in binary or memory: http://crl3.digicert.com/Omniroot2025.crl0m
Source: Payment_Advice_pdf.exe	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: Payment_Advice_pdf.exe, 0000001B.00000002.527256543.0000000000C44000.00000004.00000020.sdmp	String found in binary or memory: http://crl4.digicert.com/Cloudfl
Source: Payment_Advice_pdf.exe, 00000000.00000003.309198205.00000000011E9000.00000004.00000001.sdmp, Payment_Advice_pdf.exe, 0000001B.00000002.533241996.000000000291C000.00000004.00000001.sdmp, Payment_Advice_pdf.exe, 0000001C.00000002.533472572.000000000349C000.00000004.00000001.sdmp, Payment_Advice_pdf.exe, 00000020.00000002.525801719.00000000012D0000.00000004.00000020.sdmp	String found in binary or memory: http://crl4.digicert.com/CloudflareIncECCCA-3.crl0L
Source: Payment_Advice_pdf.exe	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: Payment_Advice_pdf.exe	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: powershell.exe, 00000013.00000002.601790285.0000000005BB5000.00000004.00000001.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: Payment_Advice_pdf.exe, 00000016.00000002.532140773.0000000002C41000.00000004.00000001.sdmp	String found in binary or memory: http://oTJwpq.com
Source: Payment_Advice_pdf.exe, 00000000.00000003.309198205.00000000011E9000.00000004.00000001.sdmp, Payment_Advice_pdf.exe, 0000001B.00000002.533241996.000000000291C000.00000004.00000001.sdmp, Payment_Advice_pdf.exe, 0000001C.00000002.533472572.000000000349C000.00000004.00000001.sdmp, Payment_Advice_pdf.exe, 00000020.00000002.525801719.00000000012D0000.00000004.00000020.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: Payment_Advice_pdf.exe, 00000000.00000003.309198205.00000000011E9000.00000004.00000001.sdmp, Payment_Advice_pdf.exe, 0000001B.00000002.527256543.0000000000C44000.00000004.00000020.sdmp, Payment_Advice_pdf.exe, 00000020.00000002.525801719.00000000012D0000.00000004.00000020.sdmp	String found in binary or memory: http://ocsp.digicert.com0:
Source: Payment_Advice_pdf.exe	String found in binary or memory: http://ocsp.digicert.com0C
Source: Payment_Advice_pdf.exe	String found in binary or memory: http://ocsp.digicert.com0O
Source: Payment_Advice_pdf.exe, 00000000.00000003.309198205.00000000011E9000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.digp
Source: powershell.exe, 00000013.00000002.537783198.0000000004C8E000.00000004.00000001.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 0000000F.00000002.535899338.0000000004BC1000.00000004.00000001.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.pngTG
Source: powershell.exe, 0000000D.00000002.535392577.000000000498D000.00000004.00000001.sdmp, powershell.exe, 0000000F.00000002.535899338.0000000004BC1000.00000004.00000001.sdmp, powershell.exe, 00000013.00000002.537783198.0000000004C8E000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: powershell.exe, 0000000D.00000002.532936323.0000000004761000.00000004.00000001.sdmp, powershell.exe, 0000000F.00000002.532691170.0000000004A81000.00000004.00000001.sdmp, powershell.exe, 00000010.00000002.585877442.0000000004761000.00000004.00000001.sdmp, powershell.exe, 00000013.00000002.535729267.0000000004B51000.00000004.00000001.sdmp, Payment_Advice_pdf.exe, 0000001B.00000002.532494643.00000000028C1000.00000004.00000001.sdmp, Payment_Advice_pdf.exe, 0000001C.00000002.532784461.0000000003441000.00000004.00000001.sdmp, Payment_Advice_pdf.exe, 00000020.00000002.532690166.0000000003051000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 0000000D.00000002.535392577.000000000498D000.00000004.00000001.sdmp, powershell.exe, 0000000F.00000002.535899338.0000000004BC1000.00000004.00000001.sdmp, powershell.exe, 00000013.00000002.537783198.0000000004C8E000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: powershell.exe, 00000013.00000002.537783198.0000000004C8E000.00000004.00000001.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 0000000F.00000002.535899338.0000000004BC1000.00000004.00000001.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.htmlTG
Source: Payment_Advice_pdf.exe, 00000016.00000002.532140773.0000000002C41000.00000004.00000001.sdmp	String found in binary or memory: https://api.ipify.orgGETMozilla/5.0
Source: Payment_Advice_pdf.exe, 00000016.00000002.509306076.0000000000402000.00000040.00000001.sdmp	String found in binary or memory: https://api.telegram.org/bot%telegramapi%/
Source: Payment_Advice_pdf.exe, 00000016.00000002.532140773.0000000002C41000.00000004.00000001.sdmp	String found in binary or memory: https://api.telegram.org/bot%telegramapi%/sendDocumentdocument---------------------------x
Source: powershell.exe, 00000013.00000002.601790285.0000000005BB5000.00000004.00000001.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000013.00000002.601790285.0000000005BB5000.00000004.00000001.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000013.00000002.601790285.0000000005BB5000.00000004.00000001.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000013.00000002.537783198.0000000004C8E000.00000004.00000001.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 0000000F.00000002.535899338.0000000004BC1000.00000004.00000001.sdmp	String found in binary or memory: https://github.com/Pester/PesterTG
Source: Payment_Advice_pdf.exe, 0000001B.00000002.532494643.00000000028C1000.00000004.00000001.sdmp, Payment_Advice_pdf.exe, 0000001C.00000002.532784461.0000000003441000.00000004.00000001.sdmp, Payment_Advice_pdf.exe, 00000020.00000002.532690166.0000000003051000.00000004.00000001.sdmp	String found in binary or memory: https://hastebin.com
Source: Payment_Advice_pdf.exe, 00000019.00000002.529670733.000000000324E000.00000004.00000001.sdmp, Payment_Advice_pdf.exe, 0000001B.00000002.532494643.00000000028C1000.00000004.00000001.sdmp, Payment_Advice_pdf.exe, 0000001C.00000002.532784461.0000000003441000.00000004.00000001.sdmp, Payment_Advice_pdf.exe, 00000020.00000002.532690166.0000000003051000.00000004.00000001.sdmp	String found in binary or memory: https://hastebin.com/raw/asixarufey
Source: Payment_Advice_pdf.exe, 00000019.00000002.529670733.000000000324E000.00000004.00000001.sdmp, Payment_Advice_pdf.exe, 0000001B.00000002.532494643.00000000028C1000.00000004.00000001.sdmp, Payment_Advice_pdf.exe, 0000001C.00000002.532784461.0000000003441000.00000004.00000001.sdmp, Payment_Advice_pdf.exe, 00000020.00000002.532690166.0000000003051000.00000004.00000001.sdmp	String found in binary or memory: https://hastebin.com/raw/caqubavere
Source: Payment_Advice_pdf.exe, 00000019.00000002.529670733.000000000324E000.00000004.00000001.sdmp, Payment_Advice_pdf.exe, 0000001B.00000002.532494643.00000000028C1000.00000004.00000001.sdmp, Payment_Advice_pdf.exe, 0000001C.00000002.532784461.0000000003441000.00000004.00000001.sdmp, Payment_Advice_pdf.exe, 00000020.00000002.532690166.0000000003051000.00000004.00000001.sdmp	String found in binary or memory: https://hastebin.com/raw/foqosepayu
Source: Payment_Advice_pdf.exe, 00000019.00000002.529670733.000000000324E000.00000004.00000001.sdmp, Payment_Advice_pdf.exe, 0000001B.00000002.532494643.00000000028C1000.00000004.00000001.sdmp, Payment_Advice_pdf.exe, 0000001C.00000002.532784461.0000000003441000.00000004.00000001.sdmp, Payment_Advice_pdf.exe, 00000020.00000002.532690166.0000000003051000.00000004.00000001.sdmp	String found in binary or memory: https://hastebin.com/raw/fufufevuxa
Source: Payment_Advice_pdf.exe, 00000019.00000002.529670733.000000000324E000.00000004.00000001.sdmp, Payment_Advice_pdf.exe, 0000001B.00000002.532494643.00000000028C1000.00000004.00000001.sdmp, Payment_Advice_pdf.exe, 0000001C.00000002.532784461.0000000003441000.00000004.00000001.sdmp, Payment_Advice_pdf.exe, 00000020.00000002.532690166.0000000003051000.00000004.00000001.sdmp	String found in binary or memory: https://hastebin.com/raw/noqadobanu
Source: Payment_Advice_pdf.exe, 00000019.00000002.529670733.000000000324E000.00000004.00000001.sdmp, Payment_Advice_pdf.exe, 0000001B.00000002.532494643.00000000028C1000.00000004.00000001.sdmp, Payment_Advice_pdf.exe, 0000001C.00000002.532784461.0000000003441000.00000004.00000001.sdmp, Payment_Advice_pdf.exe, 00000020.00000002.532690166.0000000003051000.00000004.00000001.sdmp	String found in binary or memory: https://hastebin.com/raw/onikuyajar
Source: Payment_Advice_pdf.exe, 00000019.00000002.529670733.000000000324E000.00000004.00000001.sdmp, Payment_Advice_pdf.exe, 0000001B.00000002.532494643.00000000028C1000.00000004.00000001.sdmp, Payment_Advice_pdf.exe, 0000001C.00000002.532784461.0000000003441000.00000004.00000001.sdmp, Payment_Advice_pdf.exe, 00000020.00000002.532690166.0000000003051000.00000004.00000001.sdmp	String found in binary or memory: https://hastebin.com/raw/oqigugirew
Source: Payment_Advice_pdf.exe, 00000019.00000002.529670733.000000000324E000.00000004.00000001.sdmp, Payment_Advice_pdf.exe, 0000001B.00000002.532494643.00000000028C1000.00000004.00000001.sdmp, Payment_Advice_pdf.exe, 0000001C.00000002.532784461.0000000003441000.00000004.00000001.sdmp, Payment_Advice_pdf.exe, 00000020.00000002.532690166.0000000003051000.00000004.00000001.sdmp	String found in binary or memory: https://hastebin.com/raw/saconikone
Source: Payment_Advice_pdf.exe, 00000019.00000002.529670733.000000000324E000.00000004.00000001.sdmp, Payment_Advice_pdf.exe, 0000001B.00000002.532494643.00000000028C1000.00000004.00000001.sdmp, Payment_Advice_pdf.exe, 0000001C.00000002.532784461.0000000003441000.00000004.00000001.sdmp, Payment_Advice_pdf.exe, 00000020.00000002.532690166.0000000003051000.00000004.00000001.sdmp	String found in binary or memory: https://hastebin.com/raw/userirulod
Source: Payment_Advice_pdf.exe, 00000019.00000002.529670733.000000000324E000.00000004.00000001.sdmp, Payment_Advice_pdf.exe, 0000001B.00000002.532494643.00000000028C1000.00000004.00000001.sdmp, Payment_Advice_pdf.exe, 0000001C.00000002.532784461.0000000003441000.00000004.00000001.sdmp, Payment_Advice_pdf.exe, 00000020.00000002.532690166.0000000003051000.00000004.00000001.sdmp	String found in binary or memory: https://hastebin.com/raw/walodekari
Source: Payment_Advice_pdf.exe, 00000019.00000002.529670733.000000000324E000.00000004.00000001.sdmp, Payment_Advice_pdf.exe, 0000001B.00000002.532494643.00000000028C1000.00000004.00000001.sdmp, Payment_Advice_pdf.exe, 0000001C.00000002.532784461.0000000003441000.00000004.00000001.sdmp, Payment_Advice_pdf.exe, 00000020.00000002.532690166.0000000003051000.00000004.00000001.sdmp	String found in binary or memory: https://hastebin.com/raw/yafimefexo
Source: Payment_Advice_pdf.exe, 00000019.00000002.529670733.000000000324E000.00000004.00000001.sdmp, Payment_Advice_pdf.exe, 0000001B.00000002.532494643.00000000028C1000.00000004.00000001.sdmp, Payment_Advice_pdf.exe, 0000001C.00000002.532784461.0000000003441000.00000004.00000001.sdmp, Payment_Advice_pdf.exe, 00000020.00000002.532690166.0000000003051000.00000004.00000001.sdmp	String found in binary or memory: https://hastebin.com/raw/yimijojino
Source: Payment_Advice_pdf.exe, 00000019.00000002.529670733.000000000324E000.00000004.00000001.sdmp, Payment_Advice_pdf.exe, 0000001B.00000002.532494643.00000000028C1000.00000004.00000001.sdmp, Payment_Advice_pdf.exe, 0000001C.00000002.532784461.0000000003441000.00000004.00000001.sdmp, Payment_Advice_pdf.exe, 00000020.00000002.532690166.0000000003051000.00000004.00000001.sdmp	String found in binary or memory: https://hastebin.com/raw/zegivutiko
Source: Payment_Advice_pdf.exe, 0000001B.00000002.536730759.0000000002A8C000.00000004.00000001.sdmp, Payment_Advice_pdf.exe, 0000001C.00000002.537590651.00000000036B9000.00000004.00000001.sdmp, Payment_Advice_pdf.exe, 00000020.00000002.533702642.00000000030C3000.00000004.00000001.sdmp	String found in binary or memory: https://hastebin.comD8
Source: powershell.exe, 00000013.00000002.601790285.0000000005BB5000.00000004.00000001.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: Payment_Advice_pdf.exe, 0000001B.00000002.533241996.000000000291C000.00000004.00000001.sdmp, Payment_Advice_pdf.exe, 0000001B.00000002.536730759.0000000002A8C000.00000004.00000001.sdmp, Payment_Advice_pdf.exe, 0000001C.00000002.537590651.00000000036B9000.00000004.00000001.sdmp, Payment_Advice_pdf.exe, 00000020.00000002.533702642.00000000030C3000.00000004.00000001.sdmp, Payment_Advice_pdf.exe, 00000020.00000002.533400666.00000000030AC000.00000004.00000001.sdmp	String found in binary or memory: https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct
Source: Payment_Advice_pdf.exe, 0000001B.00000002.527256543.0000000000C44000.00000004.00000020.sdmp	String found in binary or memory: https://www.digicert.co
Source: Payment_Advice_pdf.exe	String found in binary or memory: https://www.digicert.com/CPS0
Source: Payment_Advice_pdf.exe, 00000016.00000002.509306076.0000000000402000.00000040.00000001.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
Source: Payment_Advice_pdf.exe, 00000016.00000002.532140773.0000000002C41000.00000004.00000001.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725

Source: Payment_Advice_pdf.exe, 00000020.00000002.522672763.000000000122B000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

System Summary:

.NET source code contains very large strings

Show sources

Source: Payment_Advice_pdf.exe, Dfefcbbdbedeeeacebdceebcecee/Eaeecddaaefdcbdbfbefdeebb.cs	Long String: Length: 75040
Source: Payment_Advice_pdf.exe.0.dr, Dfefcbbdbedeeeacebdceebcecee/Eaeecddaaefdcbdbfbefdeebb.cs	Long String: Length: 75040
Source: 0.0.Payment_Advice_pdf.exe.a20000.0.unpack, Dfefcbbdbedeeeacebdceebcecee/Eaeecddaaefdcbdbfbefdeebb.cs	Long String: Length: 75040
Source: 22.0.Payment_Advice_pdf.exe.840000.0.unpack, Dfefcbbdbedeeeacebdceebcecee/Eaeecddaaefdcbdbfbefdeebb.cs	Long String: Length: 75040
Source: 22.2.Payment_Advice_pdf.exe.840000.1.unpack, Dfefcbbdbedeeeacebdceebcecee/Eaeecddaaefdcbdbfbefdeebb.cs	Long String: Length: 75040
Source: 23.2.Payment_Advice_pdf.exe.db0000.0.unpack, Dfefcbbdbedeeeacebdceebcecee/Eaeecddaaefdcbdbfbefdeebb.cs	Long String: Length: 75040

Initial sample is a PE file and has a suspicious name

Show sources

Source: initial sample	Static PE information: Filename: Payment_Advice_pdf.exe
Source: initial sample	Static PE information: Filename: Payment_Advice_pdf.exe

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 13_2_0080EDA8	13_2_0080EDA8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 13_2_0080A570	13_2_0080A570
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 13_2_0081A0C0	13_2_0081A0C0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 13_2_0081F890	13_2_0081F890
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 13_2_0081E028	13_2_0081E028
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 13_2_0081BCF8	13_2_0081BCF8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 15_2_00DE1088	15_2_00DE1088
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 15_2_00DEF528	15_2_00DEF528
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 15_2_01196848	15_2_01196848
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 15_2_01197CE0	15_2_01197CE0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 15_2_0487C9B0	15_2_0487C9B0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 15_2_0487EA10	15_2_0487EA10
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 16_2_00386ED0	16_2_00386ED0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 16_2_00387F60	16_2_00387F60
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 16_2_00398458	16_2_00398458
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 16_2_00390040	16_2_00390040
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 16_2_0039B448	16_2_0039B448
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 16_2_00391870	16_2_00391870
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 16_2_00396E70	16_2_00396E70
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 16_2_006E7F38	16_2_006E7F38
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 16_2_006EAFD0	16_2_006EAFD0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_0102B150	19_2_0102B150
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_010284B8	19_2_010284B8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_01066F88	19_2_01066F88
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_01068010	19_2_01068010
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_010643C0	19_2_010643C0
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Code function: 22_2_012B46A0	22_2_012B46A0
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Code function: 22_2_012B4630	22_2_012B4630
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Code function: 22_2_012B4690	22_2_012B4690
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Code function: 23_2_014C0468	23_2_014C0468
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Code function: 23_2_014C0457	23_2_014C0457
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Code function: 25_2_01850468	25_2_01850468
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Code function: 25_2_01850457	25_2_01850457
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Code function: 27_2_00B80468	27_2_00B80468
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Code function: 27_2_00B80457	27_2_00B80457
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Code function: 28_2_01660468	28_2_01660468
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Code function: 28_2_01660457	28_2_01660457
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payment_Advice_pdf.exe	Code function: 32_2_014B0468	32_2_014B0468
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payment_Advice_pdf.exe	Code function: 32_2_014B0457	32_2_014B0457

Source: Payment_Advice_pdf.exe

Static PE information: invalid certificate

Source: Payment_Advice_pdf.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: Payment_Advice_pdf.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: Payment_Advice_pdf.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: Payment_Advice_pdf.exe.0.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: Payment_Advice_pdf.exe.0.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: Payment_Advice_pdf.exe.0.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: Payment_Advice_pdf.exe, 00000000.00000003.316353924.0000000005E67000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenamewitadmin.exe~/ vs Payment_Advice_pdf.exe
Source: Payment_Advice_pdf.exe	Binary or memory string: OriginalFilename vs Payment_Advice_pdf.exe
Source: Payment_Advice_pdf.exe, 00000016.00000002.603196546.0000000005D10000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameKernelbase.dll.muij% vs Payment_Advice_pdf.exe
Source: Payment_Advice_pdf.exe, 00000016.00000000.333815367.0000000000842000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenamewitadmin.exe~/ vs Payment_Advice_pdf.exe
Source: Payment_Advice_pdf.exe	Binary or memory string: OriginalFilename vs Payment_Advice_pdf.exe
Source: Payment_Advice_pdf.exe, 00000017.00000002.357200362.00000000015FA000.00000004.00000020.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs Payment_Advice_pdf.exe
Source: Payment_Advice_pdf.exe, 00000017.00000000.343447880.0000000000DB2000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenamewitadmin.exe~/ vs Payment_Advice_pdf.exe
Source: Payment_Advice_pdf.exe	Binary or memory string: OriginalFilename vs Payment_Advice_pdf.exe
Source: Payment_Advice_pdf.exe, 00000019.00000002.509305247.0000000000E52000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenamewitadmin.exe~/ vs Payment_Advice_pdf.exe
Source: Payment_Advice_pdf.exe, 00000019.00000002.536243626.0000000005910000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameKernelbase.dll.muij% vs Payment_Advice_pdf.exe
Source: Payment_Advice_pdf.exe, 00000019.00000002.521307297.000000000161A000.00000004.00000020.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs Payment_Advice_pdf.exe
Source: Payment_Advice_pdf.exe	Binary or memory string: OriginalFilename vs Payment_Advice_pdf.exe
Source: Payment_Advice_pdf.exe, 0000001B.00000002.524460175.0000000000BA9000.00000004.00000020.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs Payment_Advice_pdf.exe
Source: Payment_Advice_pdf.exe, 0000001B.00000002.509293707.0000000000372000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenamewitadmin.exe~/ vs Payment_Advice_pdf.exe
Source: Payment_Advice_pdf.exe, 0000001B.00000002.529605225.0000000000E40000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameKernelbase.dll.muij% vs Payment_Advice_pdf.exe
Source: Payment_Advice_pdf.exe	Binary or memory string: OriginalFilename vs Payment_Advice_pdf.exe
Source: Payment_Advice_pdf.exe, 0000001C.00000002.509221914.0000000000E62000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenamewitadmin.exe~/ vs Payment_Advice_pdf.exe
Source: Payment_Advice_pdf.exe	Binary or memory string: OriginalFilename vs Payment_Advice_pdf.exe
Source: Payment_Advice_pdf.exe, 00000020.00000002.508979983.0000000000BB2000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenamewitadmin.exe~/ vs Payment_Advice_pdf.exe
Source: Payment_Advice_pdf.exe	Binary or memory string: OriginalFilenamewitadmin.exe~/ vs Payment_Advice_pdf.exe

Source: classification engine

Classification label: mal100.troj.adwa.evad.winEXE@26/15@13/2

Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payment_Advice_pdf.exe

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7016:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5772:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5792:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7056:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4616:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6932:120:WilError_01

Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe

File created: C:\Users\user\AppData\Local\Temp\642ea71a-359c-4338-a04f-1ead15fc1a7a

Jump to behavior

Source: Payment_Advice_pdf.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payment_Advice_pdf.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll

Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: Payment_Advice_pdf.exe	Virustotal: Detection: 39%
Source: Payment_Advice_pdf.exe	Metadefender: Detection: 18%
Source: Payment_Advice_pdf.exe	ReversingLabs: Detection: 48%

Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe

File read: C:\Users\user\Desktop\Payment_Advice_pdf.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Payment_Advice_pdf.exe 'C:\Users\user\Desktop\Payment_Advice_pdf.exe'
Source: unknown	Process created: C:\Windows\SysWOW64\timeout.exe timeout 4
Source: unknown	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payment_Advice_pdf.exe' -Force
Source: unknown	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payment_Advice_pdf.exe' -Force
Source: unknown	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payment_Advice_pdf.exe' -Force
Source: unknown	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\Payment_Advice_pdf.exe' -Force
Source: unknown	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\Desktop\Payment_Advice_pdf.exe C:\Users\user\Desktop\Payment_Advice_pdf.exe
Source: unknown	Process created: C:\Users\user\Desktop\Payment_Advice_pdf.exe 'C:\Users\user\Desktop\Payment_Advice_pdf.exe'
Source: unknown	Process created: C:\Users\user\Desktop\Payment_Advice_pdf.exe 'C:\Users\user\Desktop\Payment_Advice_pdf.exe'
Source: unknown	Process created: C:\Users\user\Desktop\Payment_Advice_pdf.exe 'C:\Users\user\Desktop\Payment_Advice_pdf.exe'
Source: unknown	Process created: C:\Users\user\Desktop\Payment_Advice_pdf.exe 'C:\Users\user\Desktop\Payment_Advice_pdf.exe'
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payment_Advice_pdf.exe 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payment_Advice_pdf.exe'
Source: unknown	Process created: C:\Windows\SysWOW64\timeout.exe timeout 4
Source: unknown	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout 4	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payment_Advice_pdf.exe' -Force	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payment_Advice_pdf.exe' -Force	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payment_Advice_pdf.exe' -Force	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\Payment_Advice_pdf.exe' -Force	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Process created: C:\Users\user\Desktop\Payment_Advice_pdf.exe C:\Users\user\Desktop\Payment_Advice_pdf.exe	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout 4

Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{172BDDF8-CEEA-11D1-8B05-00600806D9B6}\InProcServer32

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: Payment_Advice_pdf.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: Payment_Advice_pdf.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT, HIGH_ENTROPY_VA

Source:

Binary string: \??\C:\Windows\dll\System.Management.Automation.pdbs source: powershell.exe, 0000000D.00000002.517611780.0000000000A88000.00000004.00000001.sdmp

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 13_2_008131C0 push ebx; ret	13_2_008131CE
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 13_2_00815AF8 push eax; mov dword ptr [esp], edx	13_2_00815B0C
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 13_2_00818DC0 push es; ret	13_2_00818DD0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 13_2_00815EB0 push eax; mov dword ptr [esp], edx	13_2_00815EB4
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 13_2_00818FE1 push eax; mov dword ptr [esp], ecx	13_2_00818FF4
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 15_2_00DE0690 push es; ret	15_2_00DE06A0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 15_2_00DE0A81 push es; ret	15_2_00DE0A90
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 15_2_0119C891 push 3800B793h; retf	15_2_0119C89D
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 15_2_0119D241 push eax; retf	15_2_0119D24D
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 15_2_0487D5A0 push es; ret	15_2_0487D5B0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 16_2_00385D51 push eax; mov dword ptr [esp], edx	16_2_00385D64
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 16_2_00392160 push eax; mov dword ptr [esp], edx	16_2_00392174
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 16_2_00396260 push es; ret	16_2_00396270
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 16_2_00396450 push eax; mov dword ptr [esp], edx	16_2_00396464
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 16_2_003978D0 push es; ret	16_2_003978E0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 16_2_00399A98 push 0000C36Dh; ret	16_2_00399C3A
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 16_2_006ED027 push esp; retf	16_2_006ED035
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_00BB0810 pushad ; retf	19_2_00BB0811
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_00BB0C30 push eax; mov dword ptr [esp], edx	19_2_00BB0C44
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_0106A2D1 push FF580101h; retf	19_2_0106A2D6
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_01064E38 push FFFFFF8Bh; retf	19_2_01064E23

Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payment_Advice_pdf.exe

Jump to dropped file

Boot Survival:

Creates an undocumented autostart registry key

Show sources

Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe

Key value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon shell

Jump to behavior

Creates autostart registry keys with suspicious names

Show sources

Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe

Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run <Unknown>

Jump to behavior

Creates multiple autostart registry keys

Show sources

Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run <Unknown>			Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run Payment_Advice_pdf.exe			Jump to behavior

Drops PE files to the startup folder

Show sources

Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payment_Advice_pdf.exe

Jump to dropped file

Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payment_Advice_pdf.exe

Jump to behavior

Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payment_Advice_pdf.exe			Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payment_Advice_pdf.exe\:Zone.Identifier:$DATA			Jump to behavior

Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run <Unknown>	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run <Unknown>	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run Payment_Advice_pdf.exe	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run Payment_Advice_pdf.exe	Jump to behavior

Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payment_Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payment_Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payment_Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payment_Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payment_Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payment_Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion:

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Show sources

Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Show sources

Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe

File opened / queried: SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}

Jump to behavior

Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 374	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 612	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Window / User API: threadDelayed 2280

Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe TID: 6212	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe TID: 4696	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2144	Thread sleep time: -6456360425798339s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5348	Thread sleep count: 236 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5348	Thread sleep count: 59 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6336	Thread sleep count: 64 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5908	Thread sleep count: 331 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5928	Thread sleep count: 286 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6328	Thread sleep count: 88 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4568	Thread sleep count: 220 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 644	Thread sleep count: 115 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1112	Thread sleep count: 62 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe TID: 360	Thread sleep time: -9223372036854770s >= -30000s
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe TID: 6816	Thread sleep count: 95 > 30
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe TID: 6816	Thread sleep count: 2280 > 30

Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Last function: Thread delayed
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: Payment_Advice_pdf.exe, 00000016.00000002.603196546.0000000005D10000.00000002.00000001.sdmp, Payment_Advice_pdf.exe, 00000019.00000002.536243626.0000000005910000.00000002.00000001.sdmp, Payment_Advice_pdf.exe, 0000001B.00000002.529605225.0000000000E40000.00000002.00000001.sdmp	Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: Payment_Advice_pdf.exe, 00000000.00000003.308077244.0000000001196000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll1
Source: Payment_Advice_pdf.exe, 00000016.00000002.603196546.0000000005D10000.00000002.00000001.sdmp, Payment_Advice_pdf.exe, 00000019.00000002.536243626.0000000005910000.00000002.00000001.sdmp, Payment_Advice_pdf.exe, 0000001B.00000002.529605225.0000000000E40000.00000002.00000001.sdmp	Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: Payment_Advice_pdf.exe, 00000016.00000002.603196546.0000000005D10000.00000002.00000001.sdmp, Payment_Advice_pdf.exe, 00000019.00000002.536243626.0000000005910000.00000002.00000001.sdmp, Payment_Advice_pdf.exe, 0000001B.00000002.529605225.0000000000E40000.00000002.00000001.sdmp	Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: Payment_Advice_pdf.exe, 0000001B.00000002.525708728.0000000000BF9000.00000004.00000020.sdmp, Payment_Advice_pdf.exe, 00000020.00000002.524461670.0000000001281000.00000004.00000020.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: powershell.exe, 0000000D.00000002.534697532.00000000048A2000.00000004.00000001.sdmp, powershell.exe, 0000000F.00000002.587753653.0000000004F55000.00000004.00000001.sdmp, powershell.exe, 00000010.00000002.614459908.00000000048A3000.00000004.00000001.sdmp	Binary or memory string: l:C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Hyper-V
Source: Payment_Advice_pdf.exe, 00000016.00000002.603196546.0000000005D10000.00000002.00000001.sdmp, Payment_Advice_pdf.exe, 00000019.00000002.536243626.0000000005910000.00000002.00000001.sdmp, Payment_Advice_pdf.exe, 0000001B.00000002.529605225.0000000000E40000.00000002.00000001.sdmp	Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

Adds a directory exclusion to Windows Defender

Show sources

Source: unknown	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payment_Advice_pdf.exe' -Force
Source: unknown	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payment_Advice_pdf.exe' -Force
Source: unknown	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payment_Advice_pdf.exe' -Force
Source: unknown	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\Payment_Advice_pdf.exe' -Force
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payment_Advice_pdf.exe' -Force	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payment_Advice_pdf.exe' -Force	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payment_Advice_pdf.exe' -Force	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\Payment_Advice_pdf.exe' -Force	Jump to behavior

Injects a PE file into a foreign processes

Show sources

Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe

Memory written: C:\Users\user\Desktop\Payment_Advice_pdf.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payment_Advice_pdf.exe' -Force	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payment_Advice_pdf.exe' -Force	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payment_Advice_pdf.exe' -Force	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\Payment_Advice_pdf.exe' -Force	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Process created: C:\Users\user\Desktop\Payment_Advice_pdf.exe C:\Users\user\Desktop\Payment_Advice_pdf.exe	Jump to behavior

Source: Payment_Advice_pdf.exe, 00000016.00000002.530003686.0000000001670000.00000002.00000001.sdmp, Payment_Advice_pdf.exe, 00000019.00000002.525926020.0000000001DA0000.00000002.00000001.sdmp, Payment_Advice_pdf.exe, 0000001B.00000002.531190840.00000000012D0000.00000002.00000001.sdmp, Payment_Advice_pdf.exe, 0000001C.00000002.530154769.0000000001D50000.00000002.00000001.sdmp, Payment_Advice_pdf.exe, 00000020.00000002.530081844.00000000019A0000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: Payment_Advice_pdf.exe, 00000016.00000002.530003686.0000000001670000.00000002.00000001.sdmp, Payment_Advice_pdf.exe, 00000019.00000002.525926020.0000000001DA0000.00000002.00000001.sdmp, Payment_Advice_pdf.exe, 0000001B.00000002.531190840.00000000012D0000.00000002.00000001.sdmp, Payment_Advice_pdf.exe, 0000001C.00000002.530154769.0000000001D50000.00000002.00000001.sdmp, Payment_Advice_pdf.exe, 00000020.00000002.530081844.00000000019A0000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: Payment_Advice_pdf.exe, 00000016.00000002.530003686.0000000001670000.00000002.00000001.sdmp, Payment_Advice_pdf.exe, 00000019.00000002.525926020.0000000001DA0000.00000002.00000001.sdmp, Payment_Advice_pdf.exe, 0000001B.00000002.531190840.00000000012D0000.00000002.00000001.sdmp, Payment_Advice_pdf.exe, 0000001C.00000002.530154769.0000000001D50000.00000002.00000001.sdmp, Payment_Advice_pdf.exe, 00000020.00000002.530081844.00000000019A0000.00000002.00000001.sdmp	Binary or memory string: SProgram Managerl
Source: Payment_Advice_pdf.exe, 00000016.00000002.530003686.0000000001670000.00000002.00000001.sdmp, Payment_Advice_pdf.exe, 00000019.00000002.525926020.0000000001DA0000.00000002.00000001.sdmp, Payment_Advice_pdf.exe, 0000001B.00000002.531190840.00000000012D0000.00000002.00000001.sdmp, Payment_Advice_pdf.exe, 0000001C.00000002.530154769.0000000001D50000.00000002.00000001.sdmp, Payment_Advice_pdf.exe, 00000020.00000002.530081844.00000000019A0000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd,
Source: Payment_Advice_pdf.exe, 00000016.00000002.530003686.0000000001670000.00000002.00000001.sdmp, Payment_Advice_pdf.exe, 00000019.00000002.525926020.0000000001DA0000.00000002.00000001.sdmp, Payment_Advice_pdf.exe, 0000001B.00000002.531190840.00000000012D0000.00000002.00000001.sdmp, Payment_Advice_pdf.exe, 0000001C.00000002.530154769.0000000001D50000.00000002.00000001.sdmp, Payment_Advice_pdf.exe, 00000020.00000002.530081844.00000000019A0000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Queries volume information: C:\Users\user\Desktop\Payment_Advice_pdf.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Queries volume information: C:\Users\user\Desktop\Payment_Advice_pdf.exe VolumeInformation
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Queries volume information: C:\Users\user\Desktop\Payment_Advice_pdf.exe VolumeInformation
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Queries volume information: C:\Users\user\Desktop\Payment_Advice_pdf.exe VolumeInformation
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Queries volume information: C:\Users\user\Desktop\Payment_Advice_pdf.exe VolumeInformation
Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe	Queries volume information: C:\Users\user\Desktop\Payment_Advice_pdf.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payment_Advice_pdf.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payment_Advice_pdf.exe VolumeInformation

Source: C:\Users\user\Desktop\Payment_Advice_pdf.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information:

Yara detected AgentTesla

Show sources

Source: Yara match	File source: 00000016.00000002.509306076.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.532140773.0000000002C41000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Payment_Advice_pdf.exe PID: 6728, type: MEMORY
Source: Yara match	File source: 22.2.Payment_Advice_pdf.exe.400000.0.unpack, type: UNPACKEDPE

Source: Yara match	File source: 00000016.00000002.532140773.0000000002C41000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Payment_Advice_pdf.exe PID: 6728, type: MEMORY

Remote Access Functionality:

Yara detected AgentTesla

Show sources

Source: Yara match	File source: 00000016.00000002.509306076.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.532140773.0000000002C41000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Payment_Advice_pdf.exe PID: 6728, type: MEMORY
Source: Yara match	File source: 22.2.Payment_Advice_pdf.exe.400000.0.unpack, type: UNPACKEDPE

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation211	Startup Items1	Startup Items1	Masquerading1	Input Capture1	Query Registry1	Remote Services	Input Capture1	Exfiltration Over Other Network Medium	Web Service1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Registry Run Keys / Startup Folder421	Process Injection112	Virtualization/Sandbox Evasion14	LSASS Memory	Security Software Discovery221	Remote Desktop Protocol	Archive Collected Data1	Exfiltration Over Bluetooth	Encrypted Channel12	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Registry Run Keys / Startup Folder421	Disable or Modify Tools11	Security Account Manager	Virtualization/Sandbox Evasion14	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Non-Application Layer Protocol1	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Process Injection112	NTDS	Process Discovery2	Distributed Component Object Model	Input Capture	Scheduled Transfer	Application Layer Protocol2	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Obfuscated Files or Information1	LSA Secrets	Application Window Discovery1	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Software Packing1	Cached Domain Credentials	Remote System Discovery1	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Compile After Delivery	DCSync	File and Directory Discovery1	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	System Information Discovery113	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Payment_Advice_pdf.exe	39%	Virustotal		Browse
Payment_Advice_pdf.exe	19%	Metadefender		Browse
Payment_Advice_pdf.exe	48%	ReversingLabs	ByteCode-MSIL.Trojan.Generic

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payment_Advice_pdf.exe	19%	Metadefender		Browse
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payment_Advice_pdf.exe	48%	ReversingLabs	ByteCode-MSIL.Trojan.Generic

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
22.2.Payment_Advice_pdf.exe.400000.0.unpack	100%	Avira	TR/Spy.Gen8		Download File

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
http://127.0.0.1:HTTP/1.1	0%	Avira URL Cloud	safe
http://ocsp.digp	0%	Avira URL Cloud	safe
http://DynDns.comDynDNS	0%	URL Reputation	safe
http://DynDns.comDynDNS	0%	URL Reputation	safe
http://DynDns.comDynDNS	0%	URL Reputation	safe
http://DynDns.comDynDNS	0%	URL Reputation	safe
http://pesterbdd.com/images/Pester.png	0%	URL Reputation	safe
http://pesterbdd.com/images/Pester.png	0%	URL Reputation	safe
http://pesterbdd.com/images/Pester.png	0%	URL Reputation	safe
http://pesterbdd.com/images/Pester.png	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	0%	URL Reputation	safe
https://contoso.com/License	0%	URL Reputation	safe
https://contoso.com/License	0%	URL Reputation	safe
https://contoso.com/License	0%	URL Reputation	safe
https://contoso.com/License	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
https://hastebin.comD8	0%	Avira URL Cloud	safe
https://api.ipify.orgGETMozilla/5.0	0%	URL Reputation	safe
https://api.ipify.orgGETMozilla/5.0	0%	URL Reputation	safe
https://api.ipify.orgGETMozilla/5.0	0%	URL Reputation	safe
https://api.ipify.orgGETMozilla/5.0	0%	URL Reputation	safe
https://www.digicert.co	0%	Virustotal		Browse
https://www.digicert.co	0%	Avira URL Cloud	safe
https://contoso.com/	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
http://pesterbdd.com/images/Pester.pngTG	0%	Avira URL Cloud	safe
http://oTJwpq.com	0%	Avira URL Cloud	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
hastebin.com	172.67.143.180	true	false	high
pastebin.com	104.23.98.190	true	false	high
g.msn.com	unknown	unknown	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://hastebin.com	Payment_Advice_pdf.exe, 0000001B.00000002.532494643.00000000028C1000.00000004.00000001.sdmp, Payment_Advice_pdf.exe, 0000001C.00000002.532784461.0000000003441000.00000004.00000001.sdmp, Payment_Advice_pdf.exe, 00000020.00000002.532690166.0000000003051000.00000004.00000001.sdmp	false		high
http://127.0.0.1:HTTP/1.1	Payment_Advice_pdf.exe, 00000016.00000002.532140773.0000000002C41000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
http://nuget.org/NuGet.exe	powershell.exe, 00000013.00000002.601790285.0000000005BB5000.00000004.00000001.sdmp	false		high
http://ocsp.digp	Payment_Advice_pdf.exe, 00000000.00000003.309198205.00000000011E9000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://DynDns.comDynDNS	Payment_Advice_pdf.exe, 00000016.00000002.532140773.0000000002C41000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://hastebin.com/raw/foqosepayu	Payment_Advice_pdf.exe, 00000019.00000002.529670733.000000000324E000.00000004.00000001.sdmp, Payment_Advice_pdf.exe, 0000001B.00000002.532494643.00000000028C1000.00000004.00000001.sdmp, Payment_Advice_pdf.exe, 0000001C.00000002.532784461.0000000003441000.00000004.00000001.sdmp, Payment_Advice_pdf.exe, 00000020.00000002.532690166.0000000003051000.00000004.00000001.sdmp	false		high
https://hastebin.com/raw/noqadobanu	Payment_Advice_pdf.exe, 00000019.00000002.529670733.000000000324E000.00000004.00000001.sdmp, Payment_Advice_pdf.exe, 0000001B.00000002.532494643.00000000028C1000.00000004.00000001.sdmp, Payment_Advice_pdf.exe, 0000001C.00000002.532784461.0000000003441000.00000004.00000001.sdmp, Payment_Advice_pdf.exe, 00000020.00000002.532690166.0000000003051000.00000004.00000001.sdmp	false		high
https://hastebin.com/raw/zegivutiko	Payment_Advice_pdf.exe, 00000019.00000002.529670733.000000000324E000.00000004.00000001.sdmp, Payment_Advice_pdf.exe, 0000001B.00000002.532494643.00000000028C1000.00000004.00000001.sdmp, Payment_Advice_pdf.exe, 0000001C.00000002.532784461.0000000003441000.00000004.00000001.sdmp, Payment_Advice_pdf.exe, 00000020.00000002.532690166.0000000003051000.00000004.00000001.sdmp	false		high
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000013.00000002.537783198.0000000004C8E000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 0000000D.00000002.535392577.000000000498D000.00000004.00000001.sdmp, powershell.exe, 0000000F.00000002.535899338.0000000004BC1000.00000004.00000001.sdmp, powershell.exe, 00000013.00000002.537783198.0000000004C8E000.00000004.00000001.sdmp	false		high
https://hastebin.com/raw/walodekari	Payment_Advice_pdf.exe, 00000019.00000002.529670733.000000000324E000.00000004.00000001.sdmp, Payment_Advice_pdf.exe, 0000001B.00000002.532494643.00000000028C1000.00000004.00000001.sdmp, Payment_Advice_pdf.exe, 0000001C.00000002.532784461.0000000003441000.00000004.00000001.sdmp, Payment_Advice_pdf.exe, 00000020.00000002.532690166.0000000003051000.00000004.00000001.sdmp	false		high
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	Payment_Advice_pdf.exe, 00000016.00000002.532140773.0000000002C41000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000013.00000002.537783198.0000000004C8E000.00000004.00000001.sdmp	false		high
https://hastebin.com/raw/yafimefexo	Payment_Advice_pdf.exe, 00000019.00000002.529670733.000000000324E000.00000004.00000001.sdmp, Payment_Advice_pdf.exe, 0000001B.00000002.532494643.00000000028C1000.00000004.00000001.sdmp, Payment_Advice_pdf.exe, 0000001C.00000002.532784461.0000000003441000.00000004.00000001.sdmp, Payment_Advice_pdf.exe, 00000020.00000002.532690166.0000000003051000.00000004.00000001.sdmp	false		high
https://contoso.com/License	powershell.exe, 00000013.00000002.601790285.0000000005BB5000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://contoso.com/Icon	powershell.exe, 00000013.00000002.601790285.0000000005BB5000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://hastebin.com/raw/onikuyajar	Payment_Advice_pdf.exe, 00000019.00000002.529670733.000000000324E000.00000004.00000001.sdmp, Payment_Advice_pdf.exe, 0000001B.00000002.532494643.00000000028C1000.00000004.00000001.sdmp, Payment_Advice_pdf.exe, 0000001C.00000002.532784461.0000000003441000.00000004.00000001.sdmp, Payment_Advice_pdf.exe, 00000020.00000002.532690166.0000000003051000.00000004.00000001.sdmp	false		high
https://hastebin.comD8	Payment_Advice_pdf.exe, 0000001B.00000002.536730759.0000000002A8C000.00000004.00000001.sdmp, Payment_Advice_pdf.exe, 0000001C.00000002.537590651.00000000036B9000.00000004.00000001.sdmp, Payment_Advice_pdf.exe, 00000020.00000002.533702642.00000000030C3000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://hastebin.com/raw/caqubavere	Payment_Advice_pdf.exe, 00000019.00000002.529670733.000000000324E000.00000004.00000001.sdmp, Payment_Advice_pdf.exe, 0000001B.00000002.532494643.00000000028C1000.00000004.00000001.sdmp, Payment_Advice_pdf.exe, 0000001C.00000002.532784461.0000000003441000.00000004.00000001.sdmp, Payment_Advice_pdf.exe, 00000020.00000002.532690166.0000000003051000.00000004.00000001.sdmp	false		high
https://github.com/Pester/Pester	powershell.exe, 00000013.00000002.537783198.0000000004C8E000.00000004.00000001.sdmp	false		high
https://hastebin.com/raw/fufufevuxa	Payment_Advice_pdf.exe, 00000019.00000002.529670733.000000000324E000.00000004.00000001.sdmp, Payment_Advice_pdf.exe, 0000001B.00000002.532494643.00000000028C1000.00000004.00000001.sdmp, Payment_Advice_pdf.exe, 0000001C.00000002.532784461.0000000003441000.00000004.00000001.sdmp, Payment_Advice_pdf.exe, 00000020.00000002.532690166.0000000003051000.00000004.00000001.sdmp	false		high
https://hastebin.com/raw/saconikone	Payment_Advice_pdf.exe, 00000019.00000002.529670733.000000000324E000.00000004.00000001.sdmp, Payment_Advice_pdf.exe, 0000001B.00000002.532494643.00000000028C1000.00000004.00000001.sdmp, Payment_Advice_pdf.exe, 0000001C.00000002.532784461.0000000003441000.00000004.00000001.sdmp, Payment_Advice_pdf.exe, 00000020.00000002.532690166.0000000003051000.00000004.00000001.sdmp	false		high
https://api.ipify.orgGETMozilla/5.0	Payment_Advice_pdf.exe, 00000016.00000002.532140773.0000000002C41000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://hastebin.com/raw/asixarufey	Payment_Advice_pdf.exe, 00000019.00000002.529670733.000000000324E000.00000004.00000001.sdmp, Payment_Advice_pdf.exe, 0000001B.00000002.532494643.00000000028C1000.00000004.00000001.sdmp, Payment_Advice_pdf.exe, 0000001C.00000002.532784461.0000000003441000.00000004.00000001.sdmp, Payment_Advice_pdf.exe, 00000020.00000002.532690166.0000000003051000.00000004.00000001.sdmp	false		high
https://www.digicert.co	Payment_Advice_pdf.exe, 0000001B.00000002.527256543.0000000000C44000.00000004.00000020.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://api.telegram.org/bot%telegramapi%/	Payment_Advice_pdf.exe, 00000016.00000002.509306076.0000000000402000.00000040.00000001.sdmp	false		high
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 0000000D.00000002.535392577.000000000498D000.00000004.00000001.sdmp, powershell.exe, 0000000F.00000002.535899338.0000000004BC1000.00000004.00000001.sdmp, powershell.exe, 00000013.00000002.537783198.0000000004C8E000.00000004.00000001.sdmp	false		high
https://contoso.com/	powershell.exe, 00000013.00000002.601790285.0000000005BB5000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://github.com/Pester/PesterTG	powershell.exe, 0000000F.00000002.535899338.0000000004BC1000.00000004.00000001.sdmp	false		high
https://nuget.org/nuget.exe	powershell.exe, 00000013.00000002.601790285.0000000005BB5000.00000004.00000001.sdmp	false		high
http://pesterbdd.com/images/Pester.pngTG	powershell.exe, 0000000F.00000002.535899338.0000000004BC1000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0.htmlTG	powershell.exe, 0000000F.00000002.535899338.0000000004BC1000.00000004.00000001.sdmp	false		high
http://oTJwpq.com	Payment_Advice_pdf.exe, 00000016.00000002.532140773.0000000002C41000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 0000000D.00000002.532936323.0000000004761000.00000004.00000001.sdmp, powershell.exe, 0000000F.00000002.532691170.0000000004A81000.00000004.00000001.sdmp, powershell.exe, 00000010.00000002.585877442.0000000004761000.00000004.00000001.sdmp, powershell.exe, 00000013.00000002.535729267.0000000004B51000.00000004.00000001.sdmp, Payment_Advice_pdf.exe, 0000001B.00000002.532494643.00000000028C1000.00000004.00000001.sdmp, Payment_Advice_pdf.exe, 0000001C.00000002.532784461.0000000003441000.00000004.00000001.sdmp, Payment_Advice_pdf.exe, 00000020.00000002.532690166.0000000003051000.00000004.00000001.sdmp	false		high
https://api.telegram.org/bot%telegramapi%/sendDocumentdocument---------------------------x	Payment_Advice_pdf.exe, 00000016.00000002.532140773.0000000002C41000.00000004.00000001.sdmp	false		high
https://hastebin.com/raw/oqigugirew	Payment_Advice_pdf.exe, 00000019.00000002.529670733.000000000324E000.00000004.00000001.sdmp, Payment_Advice_pdf.exe, 0000001B.00000002.532494643.00000000028C1000.00000004.00000001.sdmp, Payment_Advice_pdf.exe, 0000001C.00000002.532784461.0000000003441000.00000004.00000001.sdmp, Payment_Advice_pdf.exe, 00000020.00000002.532690166.0000000003051000.00000004.00000001.sdmp	false		high
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	Payment_Advice_pdf.exe, 00000016.00000002.509306076.0000000000402000.00000040.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://hastebin.com/raw/yimijojino	Payment_Advice_pdf.exe, 00000019.00000002.529670733.000000000324E000.00000004.00000001.sdmp, Payment_Advice_pdf.exe, 0000001B.00000002.532494643.00000000028C1000.00000004.00000001.sdmp, Payment_Advice_pdf.exe, 0000001C.00000002.532784461.0000000003441000.00000004.00000001.sdmp, Payment_Advice_pdf.exe, 00000020.00000002.532690166.0000000003051000.00000004.00000001.sdmp	false		high
https://hastebin.com/raw/userirulod	Payment_Advice_pdf.exe, 00000019.00000002.529670733.000000000324E000.00000004.00000001.sdmp, Payment_Advice_pdf.exe, 0000001B.00000002.532494643.00000000028C1000.00000004.00000001.sdmp, Payment_Advice_pdf.exe, 0000001C.00000002.532784461.0000000003441000.00000004.00000001.sdmp, Payment_Advice_pdf.exe, 00000020.00000002.532690166.0000000003051000.00000004.00000001.sdmp	false		high

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.23.98.190	unknown	United States		13335	CLOUDFLARENETUS	false
172.67.143.180	unknown	United States		13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox Version:	31.0.0 Red Diamond
Analysis ID:	324331
Start date:	29.11.2020
Start time:	06:47:57
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 14m 17s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	Payment_Advice_pdf.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	37
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.adwa.evad.winEXE@26/15@13/2
EGA Information:	Failed
HDC Information:	Successful, ratio: 0.6% (good quality ratio 0.6%) Quality average: 93.8% Quality standard deviation: 7.8%
HCA Information:	Successful, ratio: 96% Number of executed functions: 352 Number of non-executed functions: 8
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Exclude process from analysis (whitelisted): MpCmdRun.exe, BackgroundTransferHost.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, WmiPrvSE.exe, svchost.exe Excluded IPs from analysis (whitelisted): 168.61.161.212, 104.43.193.48, 2.20.84.85, 51.11.168.160, 20.54.26.129, 51.103.5.159, 52.142.114.176, 92.122.213.194, 92.122.213.247, 51.104.144.132, 52.155.217.156 Excluded domains from analysis (whitelisted): displaycatalog-europeeap.md.mp.microsoft.com.akadns.net, client.wns.windows.com, fs.microsoft.com, arc.msn.com.nsatc.net, ris-prod.trafficmanager.net, displaycatalog.md.mp.microsoft.com.akadns.net, skypedataprdcolcus17.cloudapp.net, e1723.g.akamaiedge.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, wns.notify.windows.com.akadns.net, a1449.dscg2.akamai.net, arc.msn.com, g-msn-com-nsatc.trafficmanager.net, skypedataprdcolcus15.cloudapp.net, ris.api.iris.microsoft.com, db5eap.displaycatalog.md.mp.microsoft.com.akadns.net, par02p.wns.notify.windows.com.akadns.net, emea1.notify.windows.com.akadns.net, blobcollector.events.data.trafficmanager.net, displaycatalog.mp.microsoft.com, watson.telemetry.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net Report size exceeded maximum capacity and may have missing behavior information. Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
06:49:35	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run <Unknown> C:\Users\user\Desktop\Payment_Advice_pdf.exe
06:49:40	API Interceptor	17x Sleep call for process: Payment_Advice_pdf.exe modified
06:49:44	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Payment_Advice_pdf.exe C:\Users\user\Desktop\Payment_Advice_pdf.exe
06:49:53	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run <Unknown> C:\Users\user\Desktop\Payment_Advice_pdf.exe
06:50:02	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Payment_Advice_pdf.exe C:\Users\user\Desktop\Payment_Advice_pdf.exe
06:50:11	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payment_Advice_pdf.exe
06:50:51	API Interceptor	25x Sleep call for process: powershell.exe modified
06:51:10	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run newapp C:\Users\user\AppData\Roaming\newapp\newapp.exe
06:51:19	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run newapp C:\Users\user\AppData\Roaming\newapp\newapp.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
104.23.98.190	b095b966805abb7df4ffddf183def880.exe	Get hash	malicious	Browse	pastebin.com/raw/XMKKNkb0
	E1Q0TjeN32.exe	Get hash	malicious	Browse	pastebin.com/raw/XMKKNkb0
	6YCl3ATKJw.exe	Get hash	malicious	Browse	pastebin.com/raw/XMKKNkb0
	Hjnb15Nuc3.exe	Get hash	malicious	Browse	pastebin.com/raw/XMKKNkb0
	JDgYMW0LHW.exe	Get hash	malicious	Browse	pastebin.com/raw/XMKKNkb0
	4av8Sn32by.exe	Get hash	malicious	Browse	pastebin.com/raw/XMKKNkb0
	5T4Ykc0VSK.exe	Get hash	malicious	Browse	pastebin.com/raw/XMKKNkb0
	afvhKak0Ir.exe	Get hash	malicious	Browse	pastebin.com/raw/XMKKNkb0
	T6OcyQsUsY.exe	Get hash	malicious	Browse	pastebin.com/raw/XMKKNkb0
	1KITgJnGbI.exe	Get hash	malicious	Browse	pastebin.com/raw/XMKKNkb0
	PxwWcmbMC5.exe	Get hash	malicious	Browse	pastebin.com/raw/XMKKNkb0
	XnAJZR4NcN.exe	Get hash	malicious	Browse	pastebin.com/raw/XMKKNkb0
	PbTwrajNMX.exe	Get hash	malicious	Browse	pastebin.com/raw/XMKKNkb0
	22NO7gVJ7r.exe	Get hash	malicious	Browse	pastebin.com/raw/XMKKNkb0
	rE7DwszvrX.exe	Get hash	malicious	Browse	pastebin.com/raw/XMKKNkb0
	VjPHSJkwr6.exe	Get hash	malicious	Browse	pastebin.com/raw/XMKKNkb0
	wf86K0dpOP.exe	Get hash	malicious	Browse	pastebin.com/raw/XMKKNkb0
	VrR9J0FnSG.exe	Get hash	malicious	Browse	pastebin.com/raw/XMKKNkb0
	6C1MYmrVl1.exe	Get hash	malicious	Browse	pastebin.com/raw/XMKKNkb0
	aTZQZVVriQ.exe	Get hash	malicious	Browse	pastebin.com/raw/XMKKNkb0
172.67.143.180	OVERDUE INVOICE.xls	Get hash	malicious	Browse
	Purchase Order.exe	Get hash	malicious	Browse
	SecuriteInfo.com.Mal.Generic-S.26042.exe	Get hash	malicious	Browse
	SecuriteInfo.com.Trojan.Siggen11.48004.19433.exe	Get hash	malicious	Browse
	CSq58hA6nO.exe	Get hash	malicious	Browse
	Order Catalogue Specifications.xlsx	Get hash	malicious	Browse
	IFEvMPuK1t.exe	Get hash	malicious	Browse
	PO91666. pdf.exe	Get hash	malicious	Browse
	8DHgG635TK.exe	Get hash	malicious	Browse
	NdAonNMuzm.exe	Get hash	malicious	Browse
	9fv6IffZmA.exe	Get hash	malicious	Browse
	plvSd6AoLp.exe	Get hash	malicious	Browse
	w6r8DJTtvF.exe	Get hash	malicious	Browse
	B67aSzPX6F.exe	Get hash	malicious	Browse
	3230_pdf.exe	Get hash	malicious	Browse
	P.O pdf pdf pdf pdf pdf ori40 ony.exe	Get hash	malicious	Browse
	Shipping Details_PDF.exe	Get hash	malicious	Browse
	#INVBEBON095834.pdf.exe	Get hash	malicious	Browse
	#INVBEBON095835.pdf.exe	Get hash	malicious	Browse
	xE08uG0aqO.exe	Get hash	malicious	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
pastebin.com	BWPh61ydQN.exe	Get hash	malicious	Browse	104.23.99.190
	fAhW3JEGaZ.exe	Get hash	malicious	Browse	104.23.99.190
	HIp08HPg20.exe	Get hash	malicious	Browse	104.23.98.190
	OVERDUE INVOICE.xls	Get hash	malicious	Browse	104.23.98.190
	Venom.exe	Get hash	malicious	Browse	104.23.99.190
	PO348578.jar	Get hash	malicious	Browse	104.23.99.190
	Purchase Order.exe	Get hash	malicious	Browse	104.23.98.190
	SecuriteInfo.com.Trojan.Siggen11.49316.15393.exe	Get hash	malicious	Browse	104.23.98.190
	SecuriteInfo.com.Trojan.Nanocore.23.20965.exe	Get hash	malicious	Browse	104.23.98.190
	SecuriteInfo.com.Mal.Generic-S.26042.exe	Get hash	malicious	Browse	104.23.98.190
	SecuriteInfo.com.BehavesLike.Win32.VirRansom.rm.exe	Get hash	malicious	Browse	104.23.99.190
	SecuriteInfo.com.Trojan.KillProc2.14740.25300.exe	Get hash	malicious	Browse	104.23.99.190
	due-invoice.xlsm	Get hash	malicious	Browse	104.23.98.190
	Order 51897.exe	Get hash	malicious	Browse	104.23.99.190
	Statement Of Account.exe	Get hash	malicious	Browse	104.23.98.190
	http://ancien-site-joomla.fr/build2.exe	Get hash	malicious	Browse	104.23.98.190
	BTNCRKWd.exe	Get hash	malicious	Browse	104.23.98.190
	Shipment Details.exe	Get hash	malicious	Browse	104.23.98.190
	7iZX0KCH4C.exe	Get hash	malicious	Browse	104.23.98.190
	IFEvMPuK1t.exe	Get hash	malicious	Browse	104.23.98.190
hastebin.com	OVERDUE INVOICE.xls	Get hash	malicious	Browse	172.67.143.180
	Venom.exe	Get hash	malicious	Browse	104.24.127.89
	Purchase Order.exe	Get hash	malicious	Browse	172.67.143.180
	SecuriteInfo.com.Mal.Generic-S.26042.exe	Get hash	malicious	Browse	104.24.126.89
	due-invoice.xlsm	Get hash	malicious	Browse	104.24.127.89
	SecuriteInfo.com.Gen.NN.ZemsilF.34658.m0@a8V1yrei.exe	Get hash	malicious	Browse	104.24.126.89
	Order 51897.exe	Get hash	malicious	Browse	104.24.127.89
	AsyncClient.exe	Get hash	malicious	Browse	104.24.126.89
	Statement Of Account.exe	Get hash	malicious	Browse	104.24.127.89
	http://ancien-site-joomla.fr/build2.exe	Get hash	malicious	Browse	104.24.126.89
	SecuriteInfo.com.ArtemisTrojan.exe	Get hash	malicious	Browse	104.24.126.89
	SecuriteInfo.com.BackDoor.SpyBotNET.25.30157.exe	Get hash	malicious	Browse	104.24.127.89
	C03N224Hbu.exe	Get hash	malicious	Browse	104.24.126.89
	P.O_ 39134.xlsx	Get hash	malicious	Browse	104.24.127.89
	EME.39134.xlsx	Get hash	malicious	Browse	104.24.127.89
	SecuriteInfo.com.Trojan.Siggen11.48004.19433.exe	Get hash	malicious	Browse	172.67.143.180
	Order List.xlsx	Get hash	malicious	Browse	104.24.127.89
	CSq58hA6nO.exe	Get hash	malicious	Browse	172.67.143.180
	Order Catalogue Specifications.xlsx	Get hash	malicious	Browse	172.67.143.180
	Shipping Details_PDF.exe	Get hash	malicious	Browse	104.24.127.89

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
CLOUDFLARENETUS	case4092.xls	Get hash	malicious	Browse	104.31.86.113
	case4092.xls	Get hash	malicious	Browse	104.31.86.113
	SecuriteInfo.com.Exploit.Siggen3.2597.23127.xls	Get hash	malicious	Browse	172.67.212.16
	SecuriteInfo.com.Exploit.Siggen3.2597.23127.xls	Get hash	malicious	Browse	172.67.212.16
	Quote.exe	Get hash	malicious	Browse	172.67.188.154
	DWG AND PO SPECIFICATION.xls	Get hash	malicious	Browse	104.20.138.65
	DWG AND PO SPECIFICATION.xls	Get hash	malicious	Browse	104.20.139.65
	egGgMixHNS.exe	Get hash	malicious	Browse	172.67.219.32
	BWPh61ydQN.exe	Get hash	malicious	Browse	162.159.135.233
	DWG AND PO SPECIFICATION.xls	Get hash	malicious	Browse	104.20.138.65
	egGgMixHNS.exe	Get hash	malicious	Browse	104.24.123.22
	5KYnVcv9cf.exe	Get hash	malicious	Browse	104.24.123.22
	5KYnVcv9cf.exe	Get hash	malicious	Browse	104.24.122.22
	DHL invoice VNYI564714692.exe	Get hash	malicious	Browse	162.159.135.232
	Order-Poland.exe	Get hash	malicious	Browse	162.159.134.233
	Novi poredak.exe	Get hash	malicious	Browse	162.159.135.233
	Customer Remittance Advice 9876627262822662.exe	Get hash	malicious	Browse	162.159.134.233
	94039330.exe	Get hash	malicious	Browse	162.159.134.233
	P1001094.EXE	Get hash	malicious	Browse	162.159.134.233
	ompbSaRiK0.exe	Get hash	malicious	Browse	104.18.53.239
CLOUDFLARENETUS	case4092.xls	Get hash	malicious	Browse	104.31.86.113
	case4092.xls	Get hash	malicious	Browse	104.31.86.113
	SecuriteInfo.com.Exploit.Siggen3.2597.23127.xls	Get hash	malicious	Browse	172.67.212.16
	SecuriteInfo.com.Exploit.Siggen3.2597.23127.xls	Get hash	malicious	Browse	172.67.212.16
	Quote.exe	Get hash	malicious	Browse	172.67.188.154
	DWG AND PO SPECIFICATION.xls	Get hash	malicious	Browse	104.20.138.65
	DWG AND PO SPECIFICATION.xls	Get hash	malicious	Browse	104.20.139.65
	egGgMixHNS.exe	Get hash	malicious	Browse	172.67.219.32
	BWPh61ydQN.exe	Get hash	malicious	Browse	162.159.135.233
	DWG AND PO SPECIFICATION.xls	Get hash	malicious	Browse	104.20.138.65
	egGgMixHNS.exe	Get hash	malicious	Browse	104.24.123.22
	5KYnVcv9cf.exe	Get hash	malicious	Browse	104.24.123.22
	5KYnVcv9cf.exe	Get hash	malicious	Browse	104.24.122.22
	DHL invoice VNYI564714692.exe	Get hash	malicious	Browse	162.159.135.232
	Order-Poland.exe	Get hash	malicious	Browse	162.159.134.233
	Novi poredak.exe	Get hash	malicious	Browse	162.159.135.233
	Customer Remittance Advice 9876627262822662.exe	Get hash	malicious	Browse	162.159.134.233
	94039330.exe	Get hash	malicious	Browse	162.159.134.233
	P1001094.EXE	Get hash	malicious	Browse	162.159.134.233
	ompbSaRiK0.exe	Get hash	malicious	Browse	104.18.53.239

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	ompbSaRiK0.exe	Get hash	malicious	Browse	104.23.98.190 172.67.143.180
	XcOxlmOz4D.exe	Get hash	malicious	Browse	104.23.98.190 172.67.143.180
	Venom.exe	Get hash	malicious	Browse	104.23.98.190 172.67.143.180
	module.exe	Get hash	malicious	Browse	104.23.98.190 172.67.143.180
	SecuriteInfo.com.Trojan.MulDrop15.61980.13868.exe	Get hash	malicious	Browse	104.23.98.190 172.67.143.180
	SecuriteInfo.com.Trojan.PWS.Stealer.29618.24275.exe	Get hash	malicious	Browse	104.23.98.190 172.67.143.180
	Purchase Order.exe	Get hash	malicious	Browse	104.23.98.190 172.67.143.180
	SecuriteInfo.com.Trojan.MulDrop15.61981.23282.exe	Get hash	malicious	Browse	104.23.98.190 172.67.143.180
	ORDER.exe	Get hash	malicious	Browse	104.23.98.190 172.67.143.180
	Mixtec New Order And Price List Requsting Form_pdf.exe	Get hash	malicious	Browse	104.23.98.190 172.67.143.180
	swift copy.exe	Get hash	malicious	Browse	104.23.98.190 172.67.143.180
	26-11-20_Dhl_Signed_document-pdf.exe	Get hash	malicious	Browse	104.23.98.190 172.67.143.180
	Arrivalnotice2020pdf.exe	Get hash	malicious	Browse	104.23.98.190 172.67.143.180
	SecuriteInfo.com.Mal.Generic-S.26042.exe	Get hash	malicious	Browse	104.23.98.190 172.67.143.180
	guy1.exe	Get hash	malicious	Browse	104.23.98.190 172.67.143.180
	guy2.exe	Get hash	malicious	Browse	104.23.98.190 172.67.143.180
	Exodus.exe	Get hash	malicious	Browse	104.23.98.190 172.67.143.180
	INV-6367-20_pdf.exe	Get hash	malicious	Browse	104.23.98.190 172.67.143.180
	#A06578987.xlsm	Get hash	malicious	Browse	104.23.98.190 172.67.143.180
	Order 51897.exe	Get hash	malicious	Browse	104.23.98.190 172.67.143.180

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Payment_Advice_pdf.exe.log Download File
Process:	C:\Users\user\Desktop\Payment_Advice_pdf.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	1216
Entropy (8bit):	5.355304211458859
Encrypted:	false
SSDEEP:	24:MLU84qpE4Ks2wKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7GE4Kx1qE4KE4j:Mgv2HKXwYHKhQnoPtHoxHhAHKzvGHKxx
MD5:	6601BE2C4834904CD917BA61AE5C10E2
SHA1:	2AB6A81BFA9DC031F5D2538AB94FC99074AD5241
SHA-256:	85212C0C71D214CD899B0E3FDD41A1D149E44FEFA5DD42B419B2299BC6FCC34F
SHA-512:	2F825EC08F2A34A6540F862EDD948E5674D66C94E371C9EF3CDA0AA657E0A8EB8F6260A9EE7A582A1EC30C16CC8094ECC60F3406D2904A9AA0B38918205C5EA6
Malicious:	true
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\b219d4630d26b88041b59c21e8e2b95c\System.Xml.ni.dll",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutra

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_24fphy4r.0gs.ps1 Download File
Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_52egkfrp.jkl.psm1 Download File
Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bppwvxmq.v5t.ps1 Download File
Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_clsntrj5.a1a.ps1 Download File
Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fwsc2twm.abg.ps1 Download File
Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lv3izpro.emd.psm1 Download File
Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mmdcdr4n.tid.psm1 Download File
Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vxulzjog.0pn.psm1 Download File
Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payment_Advice_pdf.exe Download File
Process:	C:\Users\user\Desktop\Payment_Advice_pdf.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	631776
Entropy (8bit):	5.351954264003962
Encrypted:	false
SSDEEP:	6144:9ktH7smB3jEe4PPDRQLv6DPc/cYeYUzz/OBOf7242COfS:mson4PL4vezOBOD242C0S
MD5:	536CF4ED17EBA1BF41EF70FAAA2054A4
SHA1:	72E062DD7A10D8B9E66732D5037C5156A9741D30
SHA-256:	C8AD1B5688FBBC359EE4256D3C7FBCA2D09BDD4968000DC8FFB86BB9964AC213
SHA-512:	67BF10D1EA495B97EF8DB595BE0A1E363E2FF4B1E2EB6B55048C8AFDAF95CCC6AF443AE55070EDF22E1B0964B08099ABBE20E52301061B48C041240FD47471EE
Malicious:	true
Antivirus:	Antivirus: Metadefender, Detection: 19%, Browse Antivirus: ReversingLabs, Detection: 48%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....N.^.........."...0.................. ........@.. ...............................K....`.....................................O.................................................................................... ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......(...d...................P ........................................................................................................................................................................ .........90...(....9........r...p....(....(............(..........(.....0......D....U.... ....(.....#................(....& ....(.....#................(....& ....(.....#................(....& ....(..... ....(.....#................(....& ....(.....#................(....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payment_Advice_pdf.exe:Zone.Identifier Download File
Process:	C:\Users\user\Desktop\Payment_Advice_pdf.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\Documents\20201129\PowerShell_transcript.103386.JJDrYbN8.20201129064938.txt Download File
Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	690
Entropy (8bit):	5.374884313341398
Encrypted:	false
SSDEEP:	12:57DtSA6N4xYiTH3fBTj5oy/x2DOzzUjjIneSuVReTA64WoVPw6jewGxMKjX4CIyv:BxSAMiDvBBt/x2DOXUWeSuVReM64W8Hy
MD5:	EF7B79CA905D042D66413FBDCF5DCDBF
SHA1:	66857605BB4F8B535CD14C9EF58356B7A64B40BA
SHA-256:	EA4E25DF8980DECDD46A1F43C64433A52C9F28ECFF87491622F9446F5B788600
SHA-512:	7BC7AA96989DB17BF3255F72BBE074F552FCD6082892C6BD18B87A197353671A88261936716FEA777E1F9FF7D40684102B40609C26016995BEB8301B627FC0A5
Malicious:	false
Preview:	.********************..Windows PowerShell transcript start..Start time: 20201129065027..Username: computer\user..RunAs User: computer\user..Configuration Name: ..Machine: 103386 (Microsoft Windows NT 10.0.17134.0)..Host Application: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath C:\Users\user\Desktop\Payment_Advice_pdf.exe -Force..Process ID: 7104..PSVersion: 5.1.17134.1..PSEdition: Desktop..PSCompatibleVersions: 1.0, 2.0, 3.0, 4.0, 5.0, 5.1.17134.1..BuildVersion: 10.0.17134.1..CLRVersion: 4.0.30319.42000..WSManStackVersion: 3.0..PSRemotingProtocolVersion: 2.3..SerializationVersion: 1.1.0.1..********************..

C:\Users\user\Documents\20201129\PowerShell_transcript.103386.VthBuP45.20201129064936.txt Download File
Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	744
Entropy (8bit):	5.386572842518841
Encrypted:	false
SSDEEP:	12:57DtSA6N4xXTH3fBTj5oy/x2DOzzUjjIneSuSHSuVM1t2X9TA64WoEPw6jewGxMy:BxSADDvBBt/x2DOXUWeSuvuVMyM64WNS
MD5:	B61E1B38F5A52C9C70308B3313727171
SHA1:	70CEA769F553FD5D183CC384D8BA35DBC02CFE2A
SHA-256:	3B342B75D223229FD4C12ED07611CC69C177CFD7452BAE9C28E860052EBB42BD
SHA-512:	985CA19BA3318E267D0F5CC823195A836B0FC60053345EDCB5C89DB3B293EA17874D88438A119D732B3692300DDC346D2B144FFD8D800ED2104DF1B0F1A73D07
Malicious:	false
Preview:	.********************..Windows PowerShell transcript start..Start time: 20201129065032..Username: computer\user..RunAs User: computer\user..Configuration Name: ..Machine: 103386 (Microsoft Windows NT 10.0.17134.0)..Host Application: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payment_Advice_pdf.exe -Force..Process ID: 7008..PSVersion: 5.1.17134.1..PSEdition: Desktop..PSCompatibleVersions: 1.0, 2.0, 3.0, 4.0, 5.0, 5.1.17134.1..BuildVersion: 10.0.17134.1..CLRVersion: 4.0.30319.42000..WSManStackVersion: 3.0..PSRemotingProtocolVersion: 2.3..SerializationVersion: 1.1.0.1..********************..

C:\Users\user\Documents\20201129\PowerShell_transcript.103386.loZpncW0.20201129064934.txt Download File
Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	972
Entropy (8bit):	5.340417633985651
Encrypted:	false
SSDEEP:	24:BxSAO1DvBBt/x2DOXUWeSuvuVMyM64WEUHjeTKKjX4CIym1ZJXPuvuVMyM6k:BZCv/toO+SsuJblqDYB1ZNsuJk
MD5:	F15BE5A6925D17D92F9A119AA38CA51F
SHA1:	2608202B911882C6088D93169D4F1FA10E037FB1
SHA-256:	ADAC5C16AF66849262785A58D4A99C9EA9FEAADE4091A489CCCA041A1D2128BD
SHA-512:	90536976CCFC4E2B27F2FA1F60C44CA07007050F7273FC0F7DF73991A72245D909E89923482E876584EACA92B243BD4C397A5186FDA23404A9234131B97ACCD8
Malicious:	false
Preview:	.********************..Windows PowerShell transcript start..Start time: 20201129065013..Username: computer\user..RunAs User: computer\user..Configuration Name: ..Machine: 103386 (Microsoft Windows NT 10.0.17134.0)..Host Application: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payment_Advice_pdf.exe -Force..Process ID: 6924..PSVersion: 5.1.17134.1..PSEdition: Desktop..PSCompatibleVersions: 1.0, 2.0, 3.0, 4.0, 5.0, 5.1.17134.1..BuildVersion: 10.0.17134.1..CLRVersion: 4.0.30319.42000..WSManStackVersion: 3.0..PSRemotingProtocolVersion: 2.3..SerializationVersion: 1.1.0.1..******************..******************..Command start time: 20201129065014..********************..PS>Add-MpPreference -ExclusionPath C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payment_Advice_pdf.exe -Force..

C:\Users\user\Documents\20201129\PowerShell_transcript.103386.z_ziTDYA.20201129064937.txt Download File
Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	744
Entropy (8bit):	5.3922837398219405
Encrypted:	false
SSDEEP:	12:57DtSA6N4xiTH3fBTj5oy/x2DOzzUjjIneSuSHSuVM1t2X9TA64WofyPw6jewGx9:BxSAODvBBt/x2DOXUWeSuvuVMyM64WaD
MD5:	FDFA077639A382123DC963D7DB1589C0
SHA1:	D98CDEAA8B6FC7243E40D80D52F53C995BF0B413
SHA-256:	2FE16B41DBFEBD40DF624B046CBBFEB051F98EF96998FDBF7F8797F31FB55CD3
SHA-512:	DBE91F7DA2DF097E0B5CF6F5192C7A1A4B5A1AF2FC0DE357F47A16F64A197DB8703D43EE0A567B863E0554DE6090D722F2B59F5CE339063711A2E29BA50F5A35
Malicious:	false
Preview:	.********************..Windows PowerShell transcript start..Start time: 20201129065031..Username: computer\user..RunAs User: computer\user..Configuration Name: ..Machine: 103386 (Microsoft Windows NT 10.0.17134.0)..Host Application: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payment_Advice_pdf.exe -Force..Process ID: 6948..PSVersion: 5.1.17134.1..PSEdition: Desktop..PSCompatibleVersions: 1.0, 2.0, 3.0, 4.0, 5.0, 5.1.17134.1..BuildVersion: 10.0.17134.1..CLRVersion: 4.0.30319.42000..WSManStackVersion: 3.0..PSRemotingProtocolVersion: 2.3..SerializationVersion: 1.1.0.1..********************..

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.351954264003962
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.98% Win32 Executable (generic) a (10002005/4) 49.93% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	Payment_Advice_pdf.exe
File size:	631776
MD5:	536cf4ed17eba1bf41ef70faaa2054a4
SHA1:	72e062dd7a10d8b9e66732d5037c5156a9741d30
SHA256:	c8ad1b5688fbbc359ee4256d3c7fbca2d09bdd4968000dc8ffb86bb9964ac213
SHA512:	67bf10d1ea495b97ef8db595be0a1e363e2ff4b1e2eb6b55048c8afdaf95ccc6af443ae55070edf22e1b0964b08099abbe20e52301061b48c041240fd47471ee
SSDEEP:	6144:9ktH7smB3jEe4PPDRQLv6DPc/cYeYUzz/OBOf7242COfS:mson4PL4vezOBOD242C0S
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....N.^.........."...0.................. ........@.. ...............................K....`................................

File Icon


Icon Hash:	5414746b4a511de8

Static PE Info

General
Entrypoint:	0x48d2de
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT, HIGH_ENTROPY_VA
Time Stamp:	0x5EA34EB2 [Fri Apr 24 20:40:18 2020 UTC]
TLS Callbacks:
CLR (.Net) Version:	v4.0.30319
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Authenticode Signature

Signature Valid:	false
Signature Issuer:	C=US, L=New York, OU=Beebbecbbffabffdbbffedcdeecdb, O=Fadddee, CN=Eddcbdabcadbaebb
Signature Validation Error:	A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider
Error Number:	-2146762487
Not Before, Not After	11/26/2020 2:31:29 PM 11/26/2021 2:31:29 PM
Subject Chain	C=US, L=New York, OU=Beebbecbbffabffdbbffedcdeecdb, O=Fadddee, CN=Eddcbdabcadbaebb
Version:	3
Thumbprint MD5:	DEFA3690708D3682B3E4D95E30B1BDE9
Thumbprint SHA-1:	78B16D9ABE3F03A2D7907298352F0447D308BA24
Thumbprint SHA-256:	1CF24A216D49C60783F64E313500C987149D11738D40B8EC45F2E3E20914B0EF
Serial:	009CB9CAA3873FF2621FE2496AE8C17F7F

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8d28c	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x8e000	0xd7d8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x99000	0x13e0	.rsrc
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x9c000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x8b2e4	0x8b400	False	0.177788725875	data	5.16846171058	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rsrc	0x8e000	0xd7d8	0xd800	False	0.240993923611	data	4.46718133319	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x9c000	0xc	0x200	False	0.044921875	data	0.101910425663	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_ICON	0x8e370	0x9a4	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States
RT_ICON	0x8ed14	0x668	data	English	United States
RT_ICON	0x8f37c	0x2e8	dBase IV DBT of @.DBF, block length 512, next free block index 40, next free block 2004318071, next used block 4286054399	English	United States
RT_ICON	0x8f664	0x128	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0x8f78c	0xed9	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States
RT_ICON	0x90668	0xea8	data	English	United States
RT_ICON	0x91510	0x8a8	dBase IV DBT of @.DBF, block length 1024, next free block index 40, next free block 0, next used block 0	English	United States
RT_ICON	0x91db8	0x568	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0x92320	0xee9	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States
RT_ICON	0x9320c	0x4228	dBase IV DBT of \200.DBF, blocks size 0, block length 16896, next free block index 40, next free block 64767, next used block 0	English	United States
RT_ICON	0x97434	0x25a8	data	English	United States
RT_ICON	0x999dc	0x10a8	data	English	United States
RT_ICON	0x9aa84	0x468	GLS_BINARY_LSB_FIRST	English	United States
RT_GROUP_ICON	0x9aeec	0xbc	data	English	United States
RT_VERSION	0x9afa8	0x440	data	English	United States
RT_MANIFEST	0x9b3e8	0x3ea	XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators	English	United States

Imports

DLL	Import
mscoree.dll	_CorExeMain

Version Infos

Description	Data
Assembly Version	16.0.0.0
LegalCopyright	Microsoft Corporation. All rights reserved.
InternalName	witadmin.exe
FileVersion	16.166.30024.1 built by: releases/dev16/16.6-preview5 (77caed4305)
CompanyName	Microsoft Corporation
Comments	6b2f20d4
ProductName	Microsoft Visual Studio Azure DevOps Server
ProductVersion	16.166.30024.1
FileDescription	witadmin.exe
OriginalFilename	witadmin.exe
Translation	0x0409 0x04b0

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 29, 2020 06:49:06.858720064 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:06.885519028 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:06.885683060 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:06.922310114 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:06.948971033 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:06.951082945 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:06.951127052 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:06.951248884 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:06.963032961 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:06.989978075 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:06.990125895 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.036216974 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:07.066555977 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:07.093046904 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.265099049 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.265120983 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.265131950 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.265144110 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.265152931 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.265167952 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.265183926 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.265196085 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.265211105 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.265225887 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.265237093 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.265252113 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.265270948 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.265286922 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.265297890 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.265310049 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.265345097 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:07.265405893 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:07.338573933 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.338589907 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.338603020 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.338627100 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.338630915 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.338634968 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.338650942 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.338661909 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.338670969 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.338748932 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.338773966 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.338777065 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:07.338792086 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.338809013 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.338824034 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.338866949 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:07.338916063 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.338936090 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:07.338963985 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.338979959 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.338996887 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.339011908 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.339031935 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.339032888 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:07.339046001 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.339092970 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:07.339143991 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.339160919 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.339175940 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.339191914 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.339211941 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.339212894 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:07.339270115 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:07.339318037 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.339370966 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.339386940 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.339421988 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:07.380106926 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:07.412678003 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.412694931 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.412707090 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.412719011 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.412727118 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.412739038 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.412746906 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.412758112 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.412775993 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.412791014 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.412802935 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.412863016 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.412879944 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.412894964 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.412905931 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.412951946 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:07.413042068 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.413073063 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.413105965 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:07.413110971 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.413155079 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.413162947 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.413165092 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.413172007 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.413180113 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.413197041 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.413197041 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:07.413213968 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.413275957 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:07.413336039 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.413364887 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.413377047 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.413428068 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:07.413520098 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:07.413595915 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.413666964 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.413718939 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.413750887 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:07.413769960 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.413820982 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.413847923 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:07.413871050 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.413922071 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.413979053 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.414009094 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:07.414030075 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.414079905 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.414109945 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:07.414132118 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.414172888 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:07.414186001 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.414237976 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.414278030 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:07.414283037 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.414333105 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.414376020 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:07.414391041 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.414446115 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.414499998 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.414520979 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:07.414545059 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.414596081 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.414622068 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:07.414650917 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.414684057 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:07.414715052 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.414766073 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.414778948 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:07.414804935 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.414880037 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:07.486943007 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.486994028 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.487025976 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.487054110 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.487082958 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.487112045 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.487144947 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.487166882 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.487190962 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:07.487194061 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.487225056 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.487256050 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.487270117 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:07.487292051 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.487310886 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:07.487322092 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.487345934 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:07.487351894 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.487381935 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.487404108 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:07.487406015 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.487437963 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.487468004 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:07.487472057 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.487505913 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.487540960 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.487551928 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:07.487569094 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.487598896 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:07.487600088 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.487632036 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.487662077 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.487690926 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.487723112 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:07.487725019 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.487757921 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.487777948 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:07.487788916 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.487821102 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.487853050 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.487875938 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:07.487885952 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.487916946 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:07.487917900 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.487946033 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.487974882 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:07.487977982 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.488008976 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.488039970 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.488050938 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:07.488071918 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.488101006 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.488114119 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:07.488133907 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.488148928 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:07.488159895 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.488193989 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.488214016 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:07.488225937 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.488255978 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.488287926 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.488298893 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:07.488320112 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.488336086 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:07.488351107 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.488382101 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.488413095 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.488435030 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:07.488447905 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.488492966 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.488501072 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:07.488527060 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.488554001 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.488559008 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:07.488619089 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:07.488636971 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.488668919 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.488697052 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.488739967 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:07.515110970 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.515144110 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.515316963 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:07.515661955 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.515700102 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.515729904 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.515757084 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:07.515759945 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.515790939 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.515815973 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:07.515820980 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.515851021 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.515876055 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:07.515881062 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.515908003 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:07.515913963 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.515945911 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.515974998 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.515978098 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:07.516005039 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.516033888 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:07.516036034 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.516066074 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.516093969 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:07.516098976 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.516129017 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.516156912 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:07.516164064 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.516196012 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.516218901 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:07.516227007 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.516258001 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.516284943 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:07.516288042 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.516319036 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.516343117 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.516347885 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:07.516371965 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.516403913 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.516406059 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:07.516433954 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.516463995 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.516465902 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:07.516494989 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.516520977 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:07.516525030 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.516556978 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.516581059 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:07.516587973 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.516618013 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.516639948 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:07.516652107 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.516685009 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.516707897 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:07.516714096 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.516743898 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.516766071 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:07.516773939 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.516803026 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.516824961 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.516830921 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:07.516889095 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:07.563819885 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.563886881 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.563936949 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.563992023 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.564044952 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.564064026 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:07.564091921 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.564142942 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.564194918 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.564222097 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:07.564249992 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.564287901 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:07.564301968 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.564353943 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.564412117 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.564426899 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:07.564455986 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.564506054 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.564524889 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:07.564560890 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.564596891 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:07.564611912 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.564662933 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.564685106 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:07.564714909 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.564764977 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.564821959 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.564841032 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:07.564876080 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.564928055 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.564929008 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:07.564980030 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.565017939 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:07.565032005 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.565083027 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.565104008 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:07.565121889 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.565172911 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.565243006 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:07.565243959 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.565301895 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.565330982 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:07.565355062 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.565447092 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.565484047 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:07.565505981 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.565565109 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.565607071 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:07.565617085 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.565671921 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.565701008 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:07.565723896 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.565776110 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.565813065 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:07.565829039 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.565865993 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.565916061 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:07.565927029 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.565982103 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.565995932 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:07.566032887 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.566086054 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.566139936 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.566155910 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:07.566190958 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.566239119 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:07.566246033 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.566298962 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.566334009 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:07.566351891 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.566406012 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.566438913 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:07.566459894 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.566514969 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.566554070 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.566591978 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:07.566749096 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:07.593170881 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.593204021 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.593264103 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.593281031 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.593297958 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.593314886 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.593331099 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.593347073 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.593359947 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.593377113 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.593399048 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:07.593409061 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.593441963 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.593445063 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:07.593462944 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.593480110 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.593485117 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:07.593497992 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.593514919 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.593516111 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:07.593532085 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.593547106 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.593563080 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.593575954 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.593583107 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:07.593626976 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:07.593765974 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.593782902 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.593805075 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.593822002 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.593837023 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.593849897 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:07.593895912 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:07.593961000 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.593977928 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.593996048 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.594006062 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:07.594012976 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.594033003 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.594050884 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.594058037 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:07.594064951 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:07.594101906 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:07.594126940 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:08.006048918 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:08.032656908 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.202377081 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.202405930 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.202433109 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.202459097 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.202482939 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.202481985 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:08.202506065 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.202510118 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:08.202531099 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.202563047 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.202565908 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:08.202578068 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.202604055 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.202622890 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:08.202625036 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.202645063 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:08.255103111 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:08.274672031 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.274714947 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.274735928 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.274836063 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:08.274867058 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.274894953 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.274912119 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.274940014 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:08.274972916 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:08.274976015 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.274998903 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.275022984 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.275046110 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.275052071 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:08.275063992 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.275089979 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:08.276103020 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.276143074 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.276165009 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.276180029 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:08.276211977 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:08.276247978 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.276273012 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.276297092 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.276310921 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:08.276323080 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.276349068 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.276370049 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:08.276374102 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.276396990 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.276417971 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:08.276439905 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.276462078 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.276479959 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:08.276484966 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.276508093 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.276525021 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:08.276530027 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.276568890 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:08.349114895 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.349155903 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.349179983 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.349203110 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.349229097 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.349253893 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.349276066 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.349277973 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:08.349296093 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.349344969 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:08.349380016 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:08.351435900 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.351481915 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.351504087 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.351526976 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.351553917 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.351571083 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:08.351582050 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.351605892 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.351629019 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.351650000 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.351653099 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:08.351674080 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.351681948 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:08.351696968 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.351722002 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.351743937 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.351752996 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:08.351768970 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.351794004 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.351819038 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.351840973 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:08.351841927 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.351866007 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.351870060 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:08.351886034 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:08.351890087 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.351911068 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:08.351916075 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.351942062 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.351959944 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:08.351964951 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.351984978 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.352004051 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.352026939 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.352044106 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:08.352045059 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.352082014 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:08.352111101 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.352112055 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:08.353480101 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.353519917 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.353543043 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.353568077 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.353590012 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:08.353591919 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.353615999 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.353637934 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.353648901 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:08.353662968 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.353684902 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.353693962 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:08.353708982 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.353733063 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:08.353734016 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.353792906 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:08.424431086 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.424482107 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.424500942 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.424523115 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.424544096 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.424566031 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.424588919 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.424613953 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.424635887 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.424658060 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.424679995 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.424700975 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.424711943 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:08.424719095 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.424737930 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.424758911 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.424783945 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:08.424783945 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.424807072 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.424812078 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:08.424829006 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.424835920 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:08.424849987 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.424871922 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.424876928 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:08.424894094 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.424916029 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:08.424916983 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.424937963 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.424964905 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.424968958 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:08.424992085 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.425010920 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.425010920 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:08.425034046 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.425056934 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.425059080 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:08.425079107 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.425102949 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.425107002 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:08.425126076 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.425149918 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:08.425151110 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.425178051 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.425192118 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:08.425200939 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.425225973 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.425240993 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:08.425249100 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.425266981 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.425291061 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:08.425465107 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.425491095 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.425513983 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.425513983 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:08.425538063 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.425555944 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:08.425563097 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.425585985 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.425600052 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:08.425606966 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.425631046 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.425645113 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:08.425653934 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.425800085 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.425827026 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.425827026 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:08.425852060 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.425863028 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:08.425878048 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.425903082 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.425915956 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:08.425924063 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.425950050 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.425975084 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.425976038 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:08.425997972 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.426019907 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.426028967 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:08.426045895 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.426067114 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:08.426069021 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.426088095 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.426109076 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:08.426310062 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.426338911 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.426357031 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:08.426362991 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.426388025 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.426399946 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:08.426410913 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.426438093 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.426461935 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:08.426462889 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.426491022 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.426507950 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:08.426517963 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.426543951 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.426570892 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.426572084 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:08.426595926 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.426618099 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:08.426620007 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.426646948 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.426661015 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:08.426672935 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.426696062 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.426713943 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.426722050 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:08.426759005 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:08.426840067 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:08.426969051 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.427021980 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.427042961 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.427062035 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.427093983 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:08.427129984 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:08.451800108 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.451843977 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.451869965 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.451896906 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.451972961 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:08.452023029 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:08.452033997 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.452060938 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.452088118 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.452111959 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.452114105 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:08.452135086 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.452158928 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.452162027 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:08.452182055 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.452203035 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.452204943 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:08.452248096 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:08.497574091 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.497617006 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.497638941 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.497664928 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.497689009 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.497711897 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.497740030 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.497756958 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:08.497765064 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.497790098 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.497803926 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:08.497812986 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.497837067 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.497850895 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:08.497859001 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.497879982 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:08.497881889 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.497905016 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.497906923 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:08.497930050 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.497944117 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:08.497951031 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.497976065 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.497999907 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.498008013 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:08.498024940 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.498043060 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.498053074 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:08.498094082 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:08.498141050 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.498167038 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.498193026 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.498209000 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:08.498218060 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.498246908 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.498260021 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:08.498274088 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.498298883 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.498322964 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:08.498323917 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.498347998 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.498359919 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:08.498372078 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.498398066 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.498420954 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.498423100 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:08.498442888 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.498469114 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:08.498601913 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.498631001 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.498650074 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:08.498660088 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.498687029 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.498709917 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:08.498711109 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.498735905 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.498748064 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:08.498759031 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.498781919 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.498806953 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.498810053 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:08.498831987 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.498857021 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:08.498861074 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.498886108 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.498905897 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:08.499073982 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.499099970 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.499120951 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:08.499125957 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.499150991 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.499171972 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:08.499176025 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.499201059 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.499217987 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:08.499224901 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.499250889 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.499264002 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:08.499274969 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.499300003 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.499313116 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:08.499324083 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.499373913 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:08.499507904 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.499538898 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.499567986 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.499581099 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:08.499593973 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.499619007 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.499635935 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:08.499644041 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.499669075 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.499696970 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.499697924 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:08.499721050 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.499739885 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:08.499748945 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.499774933 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.499799013 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.499806881 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:08.499824047 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.499835014 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:08.499850035 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.499874115 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.499896049 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:08.499897957 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.499922991 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.499938965 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:08.499948978 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.499974012 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.499993086 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:08.499995947 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.500036955 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:08.500269890 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:08.500336885 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.500366926 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.500387907 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.500406981 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:08.500408888 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.500449896 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:08.500616074 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:08.524506092 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.524558067 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.524583101 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.524667978 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:08.525451899 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.525480986 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:08.525528908 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:08.567614079 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:08.943289042 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:08.969892025 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.077250004 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.077291965 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.077315092 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.077336073 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.077358007 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.077379942 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.077393055 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:09.077415943 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:09.077419996 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.077439070 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:09.077442884 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.077465057 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.077481031 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.077491999 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:09.077502012 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.077519894 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:09.077527046 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.077549934 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.077573061 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.077584028 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:09.077630997 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:09.081929922 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.081969976 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.081996918 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.082025051 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.082042933 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:09.082047939 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.082072020 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.082087994 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.082110882 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.082138062 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:09.082138062 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.082159996 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.082163095 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:09.082202911 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:09.082231045 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.082252979 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.082269907 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.082292080 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.082313061 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:09.082334042 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.082344055 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:09.082654953 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.082675934 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.082705975 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:09.088584900 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.088635921 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.088660955 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.088671923 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:09.088685989 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.088716030 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:09.088716984 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.088740110 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.088766098 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.088790894 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.088794947 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:09.088819981 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.088831902 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:09.088848114 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.088874102 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.088891029 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:09.088896990 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.088917017 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.088926077 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:09.088943005 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.088967085 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.088967085 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:09.088992119 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.089015007 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.089032888 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:09.089044094 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.089071035 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.089091063 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.089095116 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:09.089113951 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.089118004 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:09.089140892 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.089159012 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:09.089167118 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.089194059 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.089215994 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:09.089221001 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.089241982 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.089266062 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:09.089267015 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.089293957 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.089313984 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:09.089319944 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.089345932 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.089368105 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:09.089373112 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.089420080 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:09.089431047 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.089457035 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.089482069 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.089507103 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.089530945 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:09.089531898 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.089557886 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.089570045 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:09.089586973 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.089591980 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.089608908 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:09.089734077 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.089759111 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.089767933 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:09.089785099 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.089808941 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.089809895 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:09.089833975 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.089854002 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.089855909 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:09.089875937 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.089896917 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.089900017 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:09.089936972 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:09.090040922 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.090059042 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.090120077 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:09.095599890 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.095648050 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.095670938 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.095696926 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.095721960 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.095742941 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.095777035 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:09.095804930 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:09.104166031 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.104207993 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.104237080 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.104258060 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.104262114 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:09.104311943 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:09.105228901 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.105268002 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.105297089 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.105323076 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.105331898 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:09.105346918 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.105370998 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.105380058 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:09.105413914 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.105424881 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:09.105437994 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.105460882 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.105488062 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:09.108633041 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.108666897 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.108688116 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:09.116156101 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.116199017 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.116223097 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:09.116225958 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.116250038 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.116271019 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:09.116275072 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.116301060 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.116321087 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:09.116328001 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.116353989 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.116372108 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:09.116379976 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.116405964 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.116419077 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:09.116430998 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.116455078 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.116475105 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.116477966 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:09.116498947 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.116517067 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:09.116523027 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.116545916 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.116569996 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.116596937 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.116622925 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.116624117 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:09.116641045 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:09.116647959 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.116672993 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:09.116677999 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.116693020 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.116720915 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.116749048 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.116775036 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.116791010 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.116795063 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:09.116817951 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.116847038 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.116857052 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:09.116872072 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.116883039 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:09.116919994 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:09.116940022 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.116966009 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.116991043 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.117010117 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.117017031 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:09.117027998 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.117049932 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.117074013 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.117094994 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:09.117099047 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.117124081 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.117149115 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.117158890 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:09.117173910 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.117201090 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.117202997 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:09.117223024 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.117244005 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.117266893 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.117292881 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.117295980 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:09.117316008 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.117320061 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:09.117341042 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.117350101 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:09.117398977 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:09.122328043 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.122364998 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.122399092 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.122421980 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.122450113 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.122467995 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:09.122473001 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.122495890 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.122507095 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:09.122517109 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.122540951 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.122553110 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:09.122560978 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.122581005 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:09.122581959 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.122601986 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.122622013 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:09.122628927 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.122648001 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.122658968 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:09.122668028 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.122694016 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:09.130824089 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.130861044 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.130886078 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.130886078 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:09.130920887 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.130944967 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:09.131969929 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.131993055 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.132028103 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.132047892 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.132056952 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:09.132102966 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:09.135148048 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.135189056 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.135207891 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.135210037 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:09.135231972 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.135255098 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.135279894 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.135303974 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.135307074 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:09.135329962 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:09.135339022 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.135360003 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:09.143464088 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.143512011 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.143543959 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:09.143932104 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.143955946 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.143979073 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.143985987 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:09.144000053 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.144025087 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.144027948 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:09.144053936 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.144072056 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:09.144078970 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.144118071 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.144131899 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.144133091 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:09.144151926 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.144177914 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.144201994 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.144224882 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.144226074 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:09.144248962 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.144279003 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:09.144279957 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.144304037 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.144326925 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:09.144328117 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.144351006 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.144370079 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:09.144373894 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.144397974 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.144414902 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.144419909 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:09.144443035 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.144462109 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:09.144465923 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.144490957 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.144512892 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:09.144515038 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.144540071 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.144557953 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:09.144563913 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.144588947 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.144608021 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.144610882 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:09.144634008 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.144659996 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.144685030 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.144711018 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.144718885 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:09.144736052 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.144762039 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.144774914 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:09.144787073 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.144812107 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:09.144813061 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.144839048 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.144862890 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.144866943 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:09.144912958 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:09.151890039 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.151935101 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.151958942 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.151983023 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.152005911 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.152026892 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.152045965 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.152056932 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:09.152070999 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.152095079 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.152102947 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:09.152118921 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.152128935 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:09.152143955 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.152164936 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:09.152168989 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.152190924 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.152228117 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:09.157473087 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.157516956 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.157543898 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.157552958 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:09.157568932 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.157593966 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.157594919 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:09.157619953 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.157634974 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:09.157644033 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.157669067 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.157682896 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:09.157696962 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.157723904 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.157742023 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.157766104 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:09.157787085 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:09.161890984 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.161927938 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.161955118 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.161977053 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:09.161979914 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.162004948 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.162028074 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:09.162029982 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.162055016 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.162082911 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.162094116 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:09.162110090 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.162134886 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.162137032 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:09.162154913 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.162175894 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.162178040 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:09.162195921 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.162216902 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.162224054 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:09.162237883 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.162261009 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.162262917 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:09.162285089 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.162297964 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.162333965 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:09.162374973 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:09.802915096 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:09.829636097 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.999560118 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.999655008 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.999675035 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.999694109 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.999723911 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.999727964 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.999732018 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.999747992 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.999759912 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.999805927 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.999825001 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.999838114 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.999875069 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:09.999900103 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.999916077 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:09.999933958 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:09.999978065 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:10.072936058 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.072984934 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.073000908 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.073282003 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:10.074120045 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.074172020 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.074197054 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.074220896 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.074245930 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.074270010 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.074290991 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.074318886 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:10.074373007 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:10.074568987 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.074595928 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.074620962 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.074640036 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.074662924 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.074688911 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.074717045 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.074717045 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:10.074740887 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.074764967 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.074790001 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.074794054 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:10.074811935 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.074836016 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.074848890 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:10.074858904 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.074884892 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.074896097 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:10.074903011 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.074954987 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:10.147291899 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.147341967 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.147362947 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.147382975 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.147408009 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.147608995 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:10.148979902 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.149019003 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.149288893 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:10.149302959 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.149337053 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.149360895 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.149408102 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.149436951 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.149473906 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.149497986 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.149521112 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.149538040 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:10.149544954 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.149545908 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:10.149549007 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:10.149569035 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.149590015 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.149610996 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:10.149615049 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.149645090 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.149671078 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.149693012 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:10.149698019 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.149725914 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.149745941 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:10.149749994 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.149795055 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.149815083 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:10.149816036 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.149842024 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.149866104 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.149871111 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:10.149888992 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.149910927 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.149912119 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:10.149929047 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.149954081 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.149972916 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:10.149981022 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.150007010 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.150022030 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:10.150032043 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.150055885 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.150079966 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.150083065 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:10.150103092 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.150129080 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.150130033 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:10.150156021 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.150185108 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.150208950 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.150233984 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.150235891 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:10.150258064 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.150275946 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:10.150280952 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.150305033 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.150306940 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:10.150324106 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.150356054 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:10.150449038 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:10.221600056 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.221652031 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.221668959 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.221687078 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.221712112 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.221739054 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.221764088 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.221785069 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.221807957 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.221899986 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:10.221962929 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:10.223846912 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.223875999 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.223893881 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.223911047 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.223932981 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.223953962 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.223974943 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.223998070 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.224019051 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.224045038 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.224069118 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.224091053 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.224107027 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:10.224109888 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.224133968 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.224148989 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:10.224155903 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:10.224162102 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.224179983 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:10.224185944 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.224209070 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.224217892 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:10.224236012 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.224260092 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.224271059 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:10.224282026 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.224303961 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.224308968 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:10.224327087 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.224348068 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.224365950 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:10.224370003 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.224390984 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.224410057 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:10.224412918 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.224457026 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:10.224466085 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.224488020 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.224513054 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.224538088 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.224546909 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:10.224560022 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.224581957 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.224587917 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:10.224602938 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.224618912 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:10.224625111 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.224646091 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.224661112 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:10.224667072 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.224694014 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.224695921 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:10.224720001 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.224736929 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.224751949 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:10.224798918 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:10.225039959 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.225066900 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.225089073 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.225112915 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.225135088 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.225143909 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:10.225164890 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.225189924 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.225192070 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:10.225214005 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.225238085 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.225241899 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:10.225260973 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.225277901 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:10.225282907 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.225305080 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.225318909 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:10.225327015 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.225353003 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.225362062 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:10.225375891 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.225414991 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:10.225431919 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.225456953 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.225478888 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.225486040 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:10.225500107 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.225521088 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.225543976 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.225549936 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:10.225565910 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.225589037 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.225599051 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:10.225617886 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:10.225919962 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.225985050 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.226006985 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.226020098 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:10.226027966 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.226051092 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.226073027 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.226083994 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:10.226095915 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.226118088 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.226125002 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:10.226144075 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.226157904 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:10.226166964 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.226190090 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.226207972 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:10.226211071 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.226233006 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.226248980 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:10.226253986 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.226274967 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.226289034 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:10.226295948 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.226321936 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.226334095 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:10.226345062 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.226380110 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:10.226639986 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.226665974 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.226684093 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.226710081 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:10.226743937 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:10.296077013 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.296144009 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.296164036 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.296183109 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.296207905 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.296231985 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.296253920 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.296278000 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.296302080 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.296299934 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:10.296323061 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.296344995 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.296363115 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:10.296367884 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.296389103 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.296397924 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:10.296411991 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.296426058 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:10.296433926 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.296456099 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.296466112 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:10.296478987 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.296502113 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.296504021 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:10.296521902 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.296557903 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:10.296761036 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.296787977 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.296807051 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.296830893 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.296837091 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:10.296858072 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.296881914 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.296881914 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:10.296899080 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.296907902 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:10.296921968 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.296941042 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.296951056 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:10.296962976 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.296986103 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.296988964 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:10.297003984 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.297029972 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.297054052 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.297055006 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:10.297070026 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.297092915 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:10.297111034 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.297132969 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:10.297136068 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.297153950 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.297194004 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:10.297241926 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.297267914 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.297288895 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.297314882 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.297317028 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:10.297338963 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:10.297339916 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.297365904 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.297399998 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:10.297447920 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.297472954 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.297497988 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.297521114 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.297523975 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:10.297544956 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.297564030 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:10.297569990 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.297590017 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:10.297595978 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.297624111 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.297646999 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:10.297677994 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.297698975 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.297722101 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.297744036 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.297808886 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:10.297810078 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.297837019 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.297857046 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:10.297862053 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.297863007 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:10.297887087 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.297904968 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.297936916 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:10.297981024 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:10.298048019 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.298072100 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.298099041 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.298122883 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.298145056 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:10.298146009 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.298186064 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.298213005 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:10.298213959 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.298238039 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.298240900 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:10.298260927 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.298289061 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:10.298290014 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.298316002 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.298337936 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.298361063 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:10.298363924 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.298388004 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.298389912 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:10.298409939 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.298461914 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:10.298621893 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.298650980 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.298677921 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.298708916 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.298712969 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:10.298736095 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.298759937 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.298763990 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:10.298782110 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:10.298782110 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.298809052 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.298830986 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.298851013 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:10.298904896 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:10.298955917 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.298985004 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.299009085 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.299031973 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.299036026 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:10.299053907 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.299078941 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.299108982 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:10.299128056 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:10.299166918 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:10.349042892 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:10.603965044 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:11.053400993 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:11.080074072 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.254806995 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.254844904 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.254858971 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.254889011 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.254968882 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:11.255026102 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:11.257953882 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.257985115 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.258002043 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.258018970 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.258035898 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.258055925 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.258075953 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.258090019 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.258094072 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:11.258152008 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:11.328692913 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.328716993 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.328726053 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.328854084 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:11.328891039 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.328912973 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.328926086 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.328938007 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:11.328943968 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.328962088 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.328977108 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.328990936 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:11.329041958 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:11.329830885 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.329850912 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.329869986 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.329885006 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.329905033 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.329917908 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.329921007 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:11.329956055 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:11.329965115 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.329977989 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.329998970 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.330007076 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:11.330018044 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.330033064 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.330045938 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.330058098 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:11.330091000 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:11.330101013 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.330152035 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:11.330153942 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.330172062 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.330188990 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.330204964 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.330212116 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:11.330245972 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:11.330305099 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.330322027 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.330333948 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.330364943 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:11.380359888 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:11.404488087 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.404517889 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.404537916 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.404556990 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.404573917 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.404591084 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.404608011 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.404624939 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.404644012 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.404654026 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:11.404660940 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.404680967 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.404701948 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.404707909 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:11.404721022 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.404736042 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.404748917 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:11.404756069 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.404772043 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:11.404776096 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.404788971 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:11.404793978 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.404814005 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.404827118 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:11.404833078 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.404851913 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.404859066 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:11.404870033 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.404886961 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.404901981 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.404910088 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:11.404917955 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.404953003 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:11.404974937 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:11.404977083 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.404994965 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.405011892 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.405029058 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.405044079 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:11.405046940 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.405064106 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.405073881 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:11.405086994 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.405106068 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.405117035 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:11.405123949 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.405141115 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.405153990 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:11.405159950 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.405178070 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.405191898 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.405191898 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:11.405231953 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:11.405482054 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.405503988 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.405520916 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.405544043 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.405561924 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.405565977 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:11.405579090 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.405597925 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.405615091 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.405618906 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:11.405632019 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.405646086 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:11.405647039 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.405669928 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:11.458470106 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:11.479341030 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.479387045 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.479423046 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.479449034 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.479477882 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.479504108 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.479506969 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:11.479533911 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.479562998 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:11.479562998 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.479589939 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.479609013 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:11.479617119 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.479641914 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.479661942 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:11.479665995 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.479686975 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.479707956 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:11.479712009 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.479739904 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.479759932 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:11.479764938 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.479787111 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.479809999 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:11.479810953 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.479835987 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.479857922 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.479859114 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:11.479882002 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.479904890 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.479914904 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:11.479932070 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.479958057 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.479960918 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:11.479979992 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.480001926 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.480005026 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:11.480025053 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.480040073 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:11.480046034 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.480068922 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.480091095 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.480091095 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:11.480117083 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.480139971 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:11.480144978 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.480170965 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.480190039 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:11.480197906 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.480225086 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.480235100 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:11.480251074 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.480278015 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.480290890 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:11.480297089 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.480328083 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.480355978 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:11.480356932 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.480382919 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.480407000 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:11.480412006 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.480437994 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.480460882 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:11.480464935 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.480488062 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.480509996 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:11.480511904 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.480539083 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.480564117 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.480567932 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:11.480587006 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.480601072 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:11.480609894 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.480633974 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.480654955 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:11.480659962 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.480684996 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.480700016 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:11.480707884 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.480734110 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.480751038 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:11.480757952 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.480779886 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.480797052 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:11.480804920 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.480832100 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.480851889 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:11.480856895 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.480884075 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.480897903 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:11.481281042 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.481307983 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.481331110 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.481353998 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.481367111 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:11.481379986 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.481415033 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:11.481435061 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.481456995 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:11.481458902 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.481482029 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.481503963 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.481523991 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.481528997 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:11.481547117 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:11.481553078 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.481580019 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.481601954 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:11.481605053 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.481631994 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.481647015 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:11.481657982 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.481683969 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.481704950 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:11.481709957 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.481735945 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.481750011 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:11.481765032 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.481790066 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.481812000 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.481813908 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:11.481834888 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.481852055 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:11.482223988 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.482254982 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.482281923 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.482300043 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:11.482307911 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.482330084 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.482353926 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:11.482356071 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.482378006 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.482383013 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:11.482426882 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:11.552299976 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.552346945 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.552371025 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.552393913 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.552416086 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.552438974 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.552460909 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.552484035 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.552501917 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:11.552509069 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.552532911 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.552553892 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.552557945 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:11.552580118 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.552583933 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:11.552601099 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.552627087 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.552651882 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:11.552653074 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.552690029 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:11.552700043 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.552715063 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.552731991 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.552762032 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.552769899 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:11.552789927 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.552795887 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:11.552815914 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.552845001 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:11.552846909 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.552875042 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.552901030 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.552916050 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:11.552926064 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.552946091 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.552958012 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:11.552968025 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.552990913 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.552999973 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:11.553014994 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.553041935 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.553050041 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:11.553069115 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.553102016 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:11.553106070 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.553136110 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.553158045 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:11.553160906 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.553184986 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.553210974 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.553212881 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:11.553235054 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.553257942 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.553257942 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:11.553282976 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.553307056 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.553312063 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:11.553333998 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.553365946 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:11.553448915 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.553482056 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.553513050 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.553527117 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:11.553540945 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.553567886 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.553579092 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:11.553595066 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.553618908 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.553648949 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:11.553673029 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.553698063 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.553719044 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:11.553723097 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.553750038 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.553761005 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:11.553774118 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.553797007 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.553805113 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:11.553818941 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.553843975 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.553853989 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:11.553868055 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.553891897 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.553917885 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.553926945 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:11.553935051 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.553946972 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:11.553992987 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:11.554124117 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.554156065 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.554182053 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.554208994 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.554233074 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.554236889 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:11.554263115 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.554263115 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:11.554291010 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.554316044 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.554341078 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.554343939 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:11.554372072 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:11.554378033 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.554405928 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.554435968 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.554442883 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:11.554461956 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.554490089 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:11.554491043 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.554517984 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.554542065 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:11.554543018 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.554569006 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.554589987 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:11.554600000 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.554625988 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.554650068 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:11.554651976 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.554678917 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.554707050 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:11.554708004 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.554759026 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:11.555010080 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:11.599096060 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:12.094410896 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:12.099647999 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:12.615128994 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:12.641731977 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:12.812928915 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:12.812949896 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:12.812966108 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:12.812983990 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:12.813000917 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:12.813018084 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:12.813030958 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:12.813035011 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:12.813056946 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:12.813075066 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:12.813079119 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:12.813092947 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:12.813106060 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:12.813107014 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:12.813139915 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:12.864859104 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:12.885194063 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:12.885225058 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:12.885238886 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:12.885339975 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:12.885344982 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:12.885365963 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:12.885380030 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:12.885406017 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:12.885417938 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:12.885435104 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:12.885447979 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:12.885458946 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:12.885494947 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:12.886027098 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:12.886048079 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:12.886060953 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:12.886070967 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:12.886106014 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:12.886121035 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:12.886138916 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:12.886152029 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:12.886156082 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:12.886173010 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:12.886189938 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:12.886198997 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:12.886204958 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:12.886233091 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:12.886301041 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:12.886316061 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:12.886333942 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:12.886353016 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:12.886357069 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:12.886368990 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:12.886379004 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:12.886383057 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:12.886424065 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:12.886440992 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:12.886459112 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:12.886475086 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:12.886491060 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:12.886527061 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:12.959541082 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:12.959569931 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:12.959587097 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:12.959604025 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:12.959621906 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:12.959640026 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:12.959641933 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:12.959656000 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:12.959669113 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:12.959673882 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:12.959686041 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:12.959695101 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:12.959702015 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:12.959716082 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:12.959728956 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:12.959733963 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:12.959754944 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:12.959763050 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:12.959769964 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:12.959784031 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:12.959785938 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:12.959803104 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:12.959816933 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:12.959816933 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:12.959856033 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:12.960201025 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:12.960222960 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:12.960238934 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:12.960252047 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:12.960259914 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:12.960274935 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:12.960283995 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:12.960293055 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:12.960309982 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:12.960315943 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:12.960323095 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:12.960362911 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:12.960386992 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:12.960406065 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:12.960419893 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:12.960433006 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:12.960439920 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:12.960458040 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:12.960464954 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:12.960472107 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:12.960510015 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:12.960516930 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:12.960526943 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:12.960540056 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:12.960550070 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:12.960583925 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:12.960637093 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:12.960655928 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:12.960674047 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:12.960690022 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:12.960704088 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:12.960716963 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:12.960732937 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:12.960798025 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:12.960818052 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:12.960830927 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:12.960844994 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:12.960886955 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:12.961289883 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:12.961312056 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:12.961332083 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:12.961353064 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:12.961370945 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:12.961389065 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:12.961405993 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:12.961407900 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:12.961427927 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:12.961440086 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:12.961450100 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:12.961467981 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:12.961478949 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:12.961487055 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:12.961513996 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:13.005498886 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:13.033631086 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.033663034 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.033679008 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.033696890 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.033713102 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.033734083 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.033746004 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:13.033752918 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.033770084 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.033782959 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:13.033785105 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.033806086 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:13.035604954 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.035639048 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.035656929 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.035675049 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.035691023 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.035695076 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:13.035706997 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.035722971 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.035722971 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:13.035738945 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.035756111 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.035768986 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:13.035775900 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.035794020 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.035794020 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:13.035809040 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.035824060 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.035841942 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.035845995 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:13.035859108 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.035876036 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.035880089 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:13.035892963 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.035906076 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:13.035912991 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.035931110 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.035948992 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:13.035952091 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.035964966 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.035980940 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.035990953 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:13.036000967 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.036019087 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.036024094 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:13.036036015 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.036043882 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:13.036048889 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.036183119 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:13.036308050 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.036326885 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.036341906 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.036362886 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:13.036364079 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.036380053 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:13.036382914 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.036400080 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.036417961 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.036434889 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.036437988 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:13.036452055 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.036469936 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.036470890 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:13.036485910 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.036494970 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:13.036505938 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.036520004 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.036528111 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:13.036566973 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:13.036806107 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.036823988 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.036840916 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.036858082 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.036874056 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.036890984 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.036900043 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:13.036911964 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.036923885 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:13.036928892 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.036948919 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:13.036950111 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.036968946 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.036977053 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:13.036987066 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.037005901 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.037023067 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.037034988 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:13.037039042 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.037056923 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.037062883 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:13.037074089 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.037085056 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:13.037094116 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.037111998 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.037122011 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:13.037127972 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.037144899 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.037157059 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:13.037163019 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.037177086 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.037193060 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.037205935 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:13.037230015 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:13.037765980 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.037787914 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.037806034 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.037823915 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.037834883 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:13.037846088 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.037857056 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:13.037866116 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.037883043 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.037899971 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.037900925 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:13.037916899 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.037916899 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:13.037935019 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.037952900 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.037969112 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.037976980 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:13.037988901 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.037997961 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:13.038007021 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.038023949 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.038033009 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:13.038041115 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.038067102 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.038079977 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:13.038083076 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.038100004 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.038114071 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:13.038145065 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:13.107893944 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.107928038 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.107947111 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.107964993 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.107980967 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.107996941 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.108014107 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.108041048 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.108046055 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:13.108058929 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.108076096 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:13.108076096 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.108086109 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:13.108093977 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.108113050 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.108129025 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.108139038 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:13.108144999 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.108160973 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.108180046 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:13.108180046 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.108198881 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.108211994 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:13.108215094 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.108231068 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.108239889 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:13.108248949 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.108263969 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.108277082 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:13.108325005 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:13.108367920 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.108386040 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.108402014 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.108422995 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.108439922 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.108455896 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.108460903 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:13.108468056 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.108485937 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:13.108519077 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:13.108613014 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.108630896 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.108648062 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.108695984 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:13.108746052 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.108763933 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.108783960 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.108792067 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:13.108800888 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.108814955 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.108834028 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:13.108870029 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:13.108956099 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.108978987 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.108997107 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.109014034 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.109030008 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.109045029 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:13.109046936 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.109064102 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.109081984 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.109086037 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:13.109096050 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.109136105 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:13.109252930 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.109272003 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.109283924 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.109307051 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:13.109349012 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:13.109405041 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.109426975 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.109445095 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.109462976 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.109481096 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.109492064 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:13.109498978 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.109509945 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:13.109515905 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.109532118 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.109555960 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:13.109580994 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:13.109688044 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.109708071 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.109730005 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.109747887 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.109764099 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.109783888 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.109788895 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:13.109802961 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.109822989 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.109827042 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:13.109839916 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.109852076 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:13.109857082 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.109873056 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.109882116 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:13.109890938 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.109906912 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.109913111 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:13.109922886 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.109950066 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:13.109985113 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:13.110234022 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.110253096 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.110271931 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.110289097 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.110308886 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.110327959 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.110344887 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.110354900 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:13.110363960 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.110380888 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.110398054 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.110402107 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:13.110418081 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.110424995 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:13.110434055 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.110450029 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:13.110454082 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.110472918 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.110488892 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.110496998 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:13.110502005 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.110526085 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:13.110553026 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:13.110869884 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:13.161725998 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:13.881063938 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:14.241480112 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:14.740077019 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:15.349419117 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:16.552711010 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:16.579289913 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.752446890 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.752494097 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.752521992 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.752552032 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.752579927 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.752612114 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.752615929 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:16.752641916 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.752650023 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:16.752670050 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.752680063 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:16.752693892 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.752722025 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:16.752741098 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.752777100 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.752804041 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.752824068 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:16.752856016 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:16.825987101 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.826031923 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.826051950 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.826076984 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.826105118 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.826123953 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.826138020 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:16.826148987 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.826175928 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.826189041 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:16.826195002 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.826219082 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:16.826219082 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.826245070 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.826261997 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.826265097 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:16.826303959 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:16.826560974 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.826590061 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.826606989 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.826630116 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.826653004 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:16.826658010 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.826680899 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.826699972 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:16.826704025 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.826728106 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:16.826729059 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.826749086 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.826776028 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:16.826782942 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.826793909 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.826813936 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.826859951 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.826865911 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:16.826885939 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.826910973 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.826931953 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:16.826935053 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.826958895 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.826997995 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:16.906745911 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.906784058 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.906805992 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.906827927 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.906851053 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.906872034 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.906869888 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:16.906891108 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.906914949 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:16.906914949 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.906940937 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.906963110 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.906968117 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:16.906985044 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.907006979 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.907008886 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:16.907025099 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.907047033 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.907068968 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.907075882 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:16.907093048 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.907111883 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:16.907119036 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.907140970 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:16.907144070 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.907166004 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.907186985 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.907188892 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:16.907210112 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.907231092 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:16.907232046 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.907253027 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.907274008 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.907288074 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:16.907300949 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.907320023 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.907325029 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:16.907341957 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.907365084 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.907366991 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:16.907387018 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.907402039 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:16.907408953 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.907432079 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.907455921 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.907459021 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:16.907480001 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.907502890 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:16.907504082 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.907526016 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.907546997 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:16.907547951 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.907569885 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.907589912 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.907596111 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:16.907607079 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.907636881 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:16.907833099 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.907860994 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.907886028 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.907901049 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:16.907907009 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.907929897 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.907932043 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:16.907952070 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.907973051 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.907977104 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:16.908035040 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:16.975696087 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.975740910 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.975766897 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.975791931 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.975817919 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.975841045 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.975864887 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.975889921 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.975903988 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:16.975918055 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.975944042 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.975965023 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:16.975971937 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.975996017 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.976001978 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:16.976016998 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.976042032 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.976066113 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.976069927 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:16.976089954 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.976109982 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:16.976116896 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.976133108 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:16.976142883 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.976166010 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.976187944 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:16.976188898 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.976214886 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.976227999 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:16.976242065 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.976267099 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.976291895 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.976311922 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:16.976319075 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.976336956 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.976346016 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:16.976358891 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.976382017 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.976385117 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:16.976407051 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.976423979 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:16.976428032 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.976450920 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.976475000 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.976479053 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:16.976500988 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.976525068 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:16.976526976 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.976552010 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.976567030 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:16.976577044 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.976600885 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.976624966 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.976628065 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:16.976648092 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.976660967 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:16.976671934 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.976694107 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.976722956 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:16.976819992 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.976850033 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.976871967 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:16.976875067 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.976898909 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.976914883 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:16.976923943 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.976950884 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.976977110 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.976993084 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:16.976999998 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.977024078 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.977029085 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:16.977047920 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.977063894 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:16.977072001 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.977092981 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.977117062 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.977128029 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:16.977144003 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.977154970 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:16.977169991 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.977193117 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.977211952 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.977221966 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:16.977262020 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:16.977531910 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.977559090 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.977581978 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.977607965 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.977628946 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:16.977634907 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.977642059 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:16.977659941 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.977684021 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.977711916 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.977715015 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:16.977737904 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.977760077 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.977781057 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:16.977782965 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.977808952 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.977813959 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:16.977833986 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.977854967 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:16.977859020 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.977884054 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.977906942 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.977915049 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:16.977962971 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:16.978127956 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.978157997 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.978184938 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.978208065 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.978209972 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:16.978233099 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.978256941 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.978274107 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.978282928 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:16.978307962 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:16.978440046 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.978467941 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.978487968 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:16.978493929 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.978518963 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.978543997 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.978549957 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:16.978569984 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.978586912 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:16.978594065 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.978617907 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.978640079 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.978650093 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:16.978667021 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.978676081 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:16.978691101 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.978709936 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:16.978739023 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.021529913 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.049602032 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.049657106 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.049684048 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.049709082 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.049735069 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.049767017 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.049786091 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.049796104 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.049823046 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.049848080 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.049870968 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.049874067 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.049897909 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.049910069 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.049922943 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.049942970 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.049948931 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.049973011 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.049973965 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.049994946 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.050014019 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.050019979 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.050050974 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.050076008 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.050076962 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.050100088 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.050126076 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.050127983 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.050168037 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.050172091 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.050203085 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.050231934 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.050257921 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.050280094 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.050285101 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.050303936 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.050324917 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.050327063 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.050350904 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.050373077 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.050378084 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.050395966 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.050405025 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.050425053 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.050453901 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.050458908 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.050484896 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.050499916 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.050510883 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.050535917 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.050564051 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.050564051 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.050594091 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.050616026 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.050618887 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.050647020 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.050662994 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.050663948 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.050786018 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.050816059 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.050834894 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.050841093 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.050867081 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.050867081 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.050892115 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.050904989 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.050914049 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.050939083 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.050967932 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.050976038 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.050995111 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.051011086 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.051019907 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.051043034 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.051060915 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.051068068 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.051091909 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.051116943 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.051131010 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.051141024 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.051167011 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.051182032 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.051208973 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.051234007 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.051234961 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.051254988 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.051280975 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.051430941 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.051460028 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.051484108 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.051507950 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.051513910 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.051548004 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.051557064 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.051574945 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.051601887 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.051620960 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.051629066 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.051644087 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.051666021 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.051692963 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.051712990 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.051716089 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.051734924 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.051758051 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.051762104 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.051790953 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.051800966 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.051817894 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.051842928 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.051857948 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.051868916 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.051896095 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.051909924 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.051922083 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.051948071 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.051956892 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.051974058 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.052002907 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.052026033 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.052030087 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.052071095 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.052299976 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.052373886 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.052402973 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.052424908 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.052448988 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.052952051 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.474909067 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.501559973 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.595068932 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.595103979 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.595119953 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.595139027 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.595153093 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.595223904 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.595267057 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.595499039 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.595520020 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.595535994 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.595552921 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.595557928 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.595570087 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.595587969 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.595596075 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.595603943 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.595621109 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.595626116 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.595649004 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.596649885 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.596674919 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.596690893 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.596708059 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.596719027 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.596724987 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.596743107 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.596744061 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.596759081 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.596776009 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.596790075 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.596796036 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.596812963 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.596812963 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.596828938 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.596843958 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.596844912 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.596875906 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.596919060 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.596935034 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.596950054 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.596962929 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.596983910 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.596985102 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.597001076 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.597021103 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.597038984 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.597045898 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.597052097 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.597091913 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.597918034 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.597939014 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.597980022 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.598047018 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.598066092 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.598081112 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.598093987 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.598098993 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.598115921 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.598129988 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.598131895 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.598148108 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.598150969 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.598164082 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.598182917 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.598187923 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.598201036 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.598215103 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.598234892 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.598259926 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.599493027 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.599514008 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.599528074 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.599545002 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.599561930 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.599577904 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.599587917 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.599596024 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.599611998 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.599615097 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.599632978 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.599641085 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.599649906 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.599662066 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.599667072 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.599684000 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.599695921 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.599699974 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.599715948 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.599730968 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.599731922 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.599751949 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.599760056 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.599769115 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.599783897 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.599806070 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.599834919 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.599879026 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.600130081 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.601519108 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.601545095 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.601556063 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.601573944 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.601592064 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.601603985 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.601609945 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.601625919 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.601638079 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.601640940 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.601656914 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.601671934 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.601675987 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.601691961 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.601699114 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.601706028 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.601721048 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.601752996 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.601766109 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.601783037 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.601799011 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.601814985 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.601830959 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.601836920 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.601849079 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.601856947 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.601891041 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.602132082 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.602150917 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.602165937 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.602181911 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.602200031 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.602215052 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.602216005 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.602232933 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.602245092 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.602247953 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.602272987 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.602294922 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.603483915 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.603503942 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.603584051 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.603693008 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.603709936 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.603725910 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.603739023 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.603755951 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.603765965 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.603775978 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.603779078 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.603794098 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.603806019 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.603822947 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.603847980 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.603897095 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.603915930 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.603933096 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.603950977 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.603969097 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.603974104 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.603985071 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.603996992 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.603998899 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.604031086 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.604155064 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.604172945 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.604187965 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.604202986 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.604207993 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.604226112 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.604237080 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.604242086 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.604258060 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.604271889 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.604279995 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.604312897 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.604468107 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.604485035 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.604505062 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.604520082 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.604522943 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.604540110 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.604552984 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.604557991 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.604573965 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.604587078 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.604590893 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.604607105 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.604612112 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.604620934 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.604660034 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.604816914 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.604875088 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.606621027 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.606653929 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.606677055 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.606699944 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.606723070 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.606735945 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.606745005 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.606772900 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.606775045 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.606797934 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.606797934 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.606821060 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.606843948 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.606843948 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.606868982 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.606892109 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.606894016 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.606910944 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.606933117 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.606934071 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.606960058 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.606976032 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.606987000 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.607009888 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.607024908 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.607033014 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.607057095 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.607076883 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.607078075 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.607103109 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.607125998 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.607126951 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.607152939 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.607167959 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.607177973 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.607201099 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.607214928 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.607219934 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.607270002 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.607276917 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.607301950 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.607326031 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.607340097 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.607352018 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.607376099 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.607398033 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.607398033 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.607422113 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.607436895 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.607444048 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.607467890 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.607491016 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.607491970 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.607515097 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.607536077 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.607543945 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.607563019 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.607585907 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.607748032 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.607765913 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.607798100 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.608587027 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.608616114 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.608638048 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.608654976 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.608656883 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.608679056 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.608680964 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.608700037 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.608725071 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.608875990 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.608901024 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.608927965 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.608928919 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.608953953 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.608973026 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.608978033 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.609000921 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.609016895 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.609025002 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.609047890 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.609070063 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.609071016 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.609093904 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.609112978 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.609118938 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.609143972 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.609160900 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.609162092 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.609184980 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.609206915 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.609220028 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.609242916 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.609261990 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.609267950 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.609291077 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.609312057 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.609313011 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.609344006 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.609359980 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.609366894 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.609409094 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.609414101 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.609502077 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.609528065 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.609548092 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.609551907 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.609575033 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.609597921 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.611011028 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.611042023 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.611068964 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.611087084 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.611094952 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.611109972 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.611119986 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.611144066 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.611170053 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.611171007 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.611195087 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.611211061 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.611218929 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.611242056 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.611264944 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.611267090 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.611291885 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.611310959 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.611319065 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.611332893 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.611356020 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.611357927 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.611382008 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.611397028 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.611403942 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.611426115 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.611450911 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.611452103 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.611474037 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.611495972 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.662126064 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.669115067 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.669158936 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.669172049 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.669296026 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.670363903 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.670399904 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.670423031 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.670444012 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.670466900 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.670481920 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.670486927 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.670512915 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.670535088 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.670536041 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.670558929 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.670583010 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.670584917 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.670607090 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.670623064 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.670630932 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.670659065 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.670666933 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.670681953 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.670703888 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.670708895 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.670732975 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.670754910 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.670761108 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.670778036 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.670800924 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.670809031 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.670824051 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.670850039 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.670855999 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.670875072 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.670900106 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.670901060 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.670944929 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.671294928 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.671319962 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.671344042 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.671369076 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.671380043 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.671391964 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.671417952 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.671418905 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.671443939 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.671468019 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.671469927 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.671492100 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.671513081 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.671516895 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.671540976 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.671564102 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.671565056 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.671582937 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.671606064 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.671607971 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.671632051 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.671653032 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.671654940 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.671679020 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.671700954 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.671704054 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.671726942 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.671749115 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.671750069 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.671772957 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.671793938 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.671797991 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.671822071 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.671843052 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.671844959 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.671896935 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:17.671911955 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:17.724644899 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:18.084413052 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:18.111068010 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.200666904 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.200757980 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.200798988 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.200834990 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.200838089 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:18.200864077 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.200886011 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:18.202775955 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.202822924 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.202858925 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.202897072 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.202941895 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.202944040 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:18.202984095 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.203021049 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.203058004 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.203075886 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:18.203094959 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.203130007 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.203166962 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.203186035 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:18.203203917 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.203248024 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.203263044 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:18.203288078 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.203325033 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.203336000 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:18.203351974 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.203387976 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.203424931 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.203461885 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.203465939 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:18.203489065 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.203531981 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.203547955 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:18.203567982 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.203627110 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:18.203665972 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.203706980 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.203722000 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:18.203749895 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.203779936 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.203819990 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.203825951 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:18.203867912 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.203910112 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:18.203912020 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.203950882 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.203988075 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:18.203993082 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.204034090 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.204071045 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.204111099 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.204112053 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:18.204149961 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.204164982 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:18.204200029 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.204245090 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.204274893 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:18.204284906 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.204315901 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.204343081 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:18.204355001 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.204386950 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:18.204392910 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.204440117 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:18.204894066 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.204936028 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.204977989 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.205010891 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:18.205018044 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.205050945 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.205068111 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:18.205090046 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.205131054 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.205137014 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:18.205179930 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.205214977 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.205229044 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:18.205254078 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.205292940 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.205301046 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:18.205333948 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.205372095 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.205414057 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:18.205437899 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.205480099 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.205487013 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:18.205518961 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.205558062 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.205559015 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:18.205599070 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.205638885 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.205646038 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:18.205678940 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.205715895 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.205720901 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:18.205755949 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.205797911 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.205799103 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:18.205838919 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.205878973 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.205883980 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:18.205919027 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.205957890 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.205962896 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:18.205987930 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.206027985 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.206031084 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:18.206067085 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.206110001 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.206114054 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:18.206151009 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.206191063 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.206202984 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:18.206229925 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.206269026 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.206274986 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:18.206309080 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.206347942 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.206351995 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:18.206396103 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.206440926 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.206478119 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.206584930 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:18.209584951 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:18.209839106 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:18.211651087 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.211677074 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.211716890 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.211741924 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.211785078 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.211807966 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:18.211826086 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.211863995 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.211911917 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.211946964 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:18.211955070 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.211992979 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.212012053 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:18.212033033 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.212070942 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.212071896 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:18.212100983 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.212138891 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.212158918 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:18.212177038 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.212229967 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.212256908 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:18.212274075 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.212291956 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:18.212315083 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.212353945 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.212368011 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:18.212392092 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.212430954 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.212460995 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.212460995 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:18.212524891 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:18.223366022 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.223429918 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.223479986 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.223522902 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.223562002 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.223565102 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:18.223602057 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.223612070 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:18.223640919 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.223655939 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:18.223683119 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.223722935 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.223727942 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:18.223761082 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.223802090 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:18.223810911 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.223854065 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.223885059 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.223891973 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:18.223926067 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.223965883 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.223967075 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:18.224004030 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.224040985 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:18.224044085 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.224083900 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.224123001 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:18.224132061 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.224174976 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.224214077 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.224215984 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:18.224255085 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.224292994 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:18.224293947 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.224332094 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.224369049 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:18.224370003 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.224400997 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.224436998 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:18.224448919 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.224493027 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.224530935 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:18.224533081 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.224570990 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.224611044 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.224616051 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:18.224647999 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.224689007 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.224693060 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:18.224726915 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.224765062 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:18.224776030 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.224822044 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.224859953 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.224862099 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:18.224900961 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.224937916 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:18.224941015 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.224980116 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.225018978 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:18.225018978 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.225059032 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.225100994 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:18.225106955 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.225148916 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.225188017 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:18.225189924 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.225229979 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.225270987 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:18.225275993 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.225298882 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.225339890 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.225346088 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:18.225379944 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.225442886 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:18.225467920 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.225526094 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.225555897 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.225579977 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:18.225595951 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.225640059 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:18.225642920 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.225666046 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.225704908 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.225708008 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:18.225748062 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.225775003 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.225811005 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:18.225815058 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.225857973 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.225862026 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:18.225903988 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.225927114 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.225972891 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.225976944 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:18.226003885 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.226032019 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:18.226052999 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.226068974 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.226098061 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:18.226100922 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.226139069 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.226140976 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:18.226187944 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.226231098 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:18.226232052 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.226269960 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.226332903 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:18.226334095 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.226376057 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.226417065 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.226419926 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:18.226458073 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.226496935 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.226497889 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:18.226535082 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.226577044 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.226599932 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:18.226615906 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.226655006 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:18.226663113 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.226706982 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.226746082 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.226748943 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:18.226788998 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.226828098 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:18.226829052 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.226867914 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.226907015 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.226910114 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:18.226948977 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.226986885 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:18.226995945 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.227039099 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.227077961 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.227077961 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:18.227118015 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.227155924 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.227157116 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:18.227194071 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.227233887 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:18.227233887 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.227272987 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.227312088 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:18.227327108 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.227351904 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.227392912 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.227394104 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:18.227433920 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.227473021 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:18.227473021 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.227519989 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.227557898 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:18.227564096 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.227602959 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.227643013 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.227646112 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:18.227682114 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.227720976 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.227721930 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:18.227758884 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.227797031 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.227799892 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:18.227844000 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.227885008 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:18.227886915 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.227926016 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.227966070 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.227967978 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:18.228005886 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.228043079 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.228075027 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:18.228080988 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.228118896 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.228121996 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:18.228167057 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.228207111 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:18.230092049 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.230137110 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.230178118 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.230199099 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:18.230216980 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.230261087 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:18.230264902 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.230308056 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.230345011 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.230350971 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:18.230385065 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.230426073 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:18.230427027 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.230464935 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.230504036 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.230504036 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:18.230544090 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.230582952 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:18.230592012 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.230633020 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.230674028 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:18.230880022 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.230922937 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.230961084 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.230963945 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:18.231000900 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.231035948 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:18.231039047 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.231086016 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.231128931 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.231129885 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:18.231167078 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.231205940 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.231209040 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:18.231244087 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.231281042 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.231282949 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:18.231309891 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.231347084 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.231348991 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:18.231393099 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.231435061 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:18.231437922 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.231477976 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.231508970 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:18.231517076 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:18.287198067 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:19.366000891 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:19.392647982 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.490061045 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.490104914 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.490125895 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.490144014 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.490159988 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.490283012 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:19.490751028 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.490777969 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.490806103 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.490823984 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.490847111 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.490847111 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:19.490868092 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.490894079 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.490897894 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:19.490912914 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.490922928 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:19.490936995 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.490951061 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:19.490956068 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.490976095 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.490982056 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:19.490995884 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.491024971 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:19.493340969 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.493371964 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.493424892 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.493446112 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.493469954 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.493491888 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.493505001 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:19.493514061 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.493531942 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.493563890 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:19.493588924 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:19.494151115 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.494175911 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.494204998 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.494219065 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.494235039 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:19.494282007 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:19.494313002 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.494333029 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.494360924 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.494381905 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.494384050 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:19.494400978 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.494421959 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.494429111 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:19.494446039 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.494466066 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.494467020 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:19.494487047 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.494499922 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:19.494508028 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.494529963 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.494539022 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:19.494556904 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.494571924 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.494573116 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:19.494613886 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:19.494674921 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.494692087 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.494716883 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.494735956 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.494746923 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:19.494761944 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.494779110 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.494788885 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:19.494801044 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.494820118 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.494823933 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:19.494839907 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.494859934 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.494867086 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:19.494879961 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.494904041 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:19.501568079 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.501596928 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.501631975 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.501656055 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.501683950 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.501693964 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:19.501704931 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.501727104 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.501739979 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:19.501750946 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.501770020 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.501774073 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:19.501791000 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.501811028 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.501815081 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:19.501830101 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.501849890 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.501851082 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:19.501869917 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.501888990 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.501889944 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:19.501909018 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.501924992 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:19.501929998 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.501950979 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.501959085 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:19.501971006 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.501991034 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.502017021 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.502032042 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:19.502032995 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.502072096 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:19.502181053 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.502203941 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.502227068 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.502248049 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.502255917 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:19.502275944 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.502290010 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.502294064 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:19.502327919 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:19.502388000 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.502410889 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.502434015 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.502446890 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.502460003 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:19.502492905 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:19.502546072 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.502568007 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.502593040 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.502614975 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.502615929 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:19.502636909 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.502651930 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:19.502660036 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.502681971 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.502687931 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:19.502707005 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.502727985 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.502732992 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:19.502752066 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.502769947 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:19.502772093 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.502791882 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.502805948 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.502826929 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:19.502854109 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:19.503027916 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.503051996 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.503077030 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.503096104 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.503103971 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:19.503123045 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.503143072 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.503159046 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:19.503166914 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.503185987 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:19.503187895 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.503209114 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.503225088 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:19.503230095 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.503248930 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.503273010 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.503292084 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.503300905 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:19.503313065 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.503334045 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.503340006 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:19.503359079 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.503367901 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:19.503381014 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.503400087 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.503406048 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:19.503423929 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.503443003 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.503443003 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:19.503463030 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.503480911 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.503484011 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:19.503498077 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.503521919 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:19.504021883 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.504044056 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.504070044 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.504092932 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.504101992 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:19.504120111 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.504139900 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.504147053 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:19.504169941 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.504184961 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:19.504193068 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.504214048 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.504215002 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:19.504234076 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.504255056 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:19.504256964 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.504276991 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.504295111 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:19.504297018 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.504317045 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.504331112 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:19.504338026 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.504357100 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.504380941 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.504400969 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.504409075 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:19.504425049 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.504446030 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.504446030 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:19.504467010 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.504491091 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.504493952 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:19.504507065 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.504523993 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:19.504563093 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:19.504928112 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.504951000 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.504976034 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.504997015 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.505007982 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:19.505022049 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.505038977 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:19.505040884 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.505059958 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.505074024 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:19.506934881 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:19.508744001 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.508769035 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.508804083 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.508822918 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.508840084 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.508877039 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:19.508925915 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:19.512449026 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.512484074 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.512506008 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.512531042 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.512550116 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.512557030 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:19.512566090 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.512583971 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.512604952 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:19.512605906 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.512624979 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.512646914 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.512653112 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:19.512665987 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.512676954 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:19.512684107 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.512696981 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.512700081 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:19.512716055 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.512736082 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.512743950 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:19.512758017 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.512775898 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.512785912 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:19.512798071 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.512814045 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:19.512815952 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.512835026 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.512846947 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:19.512856960 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.512876034 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.512883902 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:19.512897968 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.512914896 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.512928963 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:19.512937069 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.512949944 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.512959003 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:19.512996912 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:19.513189077 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.513212919 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.513237953 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.513257027 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.513263941 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:19.513281107 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.513293028 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:19.513300896 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.513319969 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.513343096 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.513360023 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:19.513361931 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.513396025 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.513410091 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:19.513418913 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.513452053 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.513465881 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.513477087 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:19.513533115 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:19.513654947 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.513676882 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.513701916 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.513720989 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.513745070 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.513763905 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.513771057 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:19.513787031 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.513803005 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.513803959 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:19.513827085 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.513828993 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:19.513850927 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.513879061 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.513897896 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.513905048 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:19.513925076 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.513945103 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:19.513945103 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.513966084 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.513979912 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:19.513986111 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.514007092 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.514017105 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:19.514025927 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.514045954 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.514065027 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.514069080 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:19.514086008 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.514110088 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:19.514111042 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.514130116 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.514158010 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:19.514302015 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:19.516746044 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.516772985 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.516792059 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.516812086 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.516819954 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:19.516829967 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.516850948 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.516858101 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:19.516868114 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.516896963 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.516900063 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:19.516916037 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.516938925 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.516956091 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.516966105 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:19.516983986 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.517000914 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.517000914 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:19.517023087 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.517040968 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.517045975 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:19.517066002 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.517081976 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:19.517083883 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.517101049 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.517111063 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:19.517119884 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.517165899 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:19.519972086 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.519999027 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.520028114 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.520056009 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.520059109 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:19.520073891 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.520097971 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.520102978 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:19.520117998 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.520138025 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.520154953 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:19.520159960 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.520179033 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.520181894 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:19.520199060 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.520217896 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.520220041 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:19.520239115 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.520257950 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.520260096 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:19.520278931 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.520299911 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:19.520299911 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.520318031 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:19.520339012 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:19.520375013 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:20.737325907 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.178476095 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.205133915 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.300013065 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.300044060 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.300156116 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.303929090 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.303965092 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.303987980 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.304017067 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.304042101 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.304066896 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.304085970 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.304090023 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.304111004 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.304131985 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.304156065 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.304177046 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.304183006 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.304202080 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.304220915 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.304230928 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.304243088 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.304265976 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.304296017 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.304357052 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.309899092 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.309935093 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.309958935 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.309982061 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.310007095 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.310034990 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.310065031 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.310065985 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.310094118 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.310117960 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.310134888 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.310147047 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.310158014 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.310182095 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.310184956 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.310204983 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.310225964 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.310228109 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.310250044 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.310266018 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.310275078 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.310298920 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.310316086 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.310322046 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.310345888 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.310364008 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.310372114 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.310398102 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.310409069 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.310422897 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.310448885 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.310460091 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.310476065 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.310499907 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.310518980 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.310544014 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.310569048 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.310571909 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.310595989 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.310621977 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.310643911 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.310646057 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.310667038 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.310683966 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.310734034 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.313628912 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.313674927 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.313700914 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.313724995 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.313750029 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.313775063 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.313792944 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.313801050 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.313826084 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.313847065 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.313849926 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.313877106 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.313886881 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.313904047 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.313929081 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.313935995 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.313946962 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.313971043 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.313978910 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.313994884 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.314016104 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.314023018 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.314071894 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.317647934 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.317684889 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.317707062 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.317730904 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.317754030 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.317758083 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.317776918 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.317778111 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.317801952 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.317804098 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.317823887 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.317847967 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.317852020 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.317874908 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.317898989 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.317914963 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.317923069 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.317939043 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.317958117 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.317981958 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.317992926 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.318003893 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.318027020 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.318027973 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.318053961 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.318078041 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.318093061 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.318104982 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.318125010 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.318130016 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.319152117 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.319185019 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.319209099 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.319233894 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.319247961 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.319256067 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.319284916 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.319286108 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.319310904 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.319336891 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.319339037 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.319364071 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.319386959 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.319394112 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.319411039 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.319436073 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.319436073 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.319461107 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.319478035 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.319489002 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.319508076 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.319535971 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.319562912 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.319587946 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.319612980 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.319636106 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.319645882 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.319668055 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.319674015 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.319693089 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.319716930 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.319720984 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.319742918 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.319767952 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.319864988 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.319884062 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.319911003 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.319926023 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.319943905 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.319998980 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.320694923 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.320723057 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.320741892 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.320766926 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.320780039 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.320795059 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.320810080 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.320827007 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.320842981 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.320852041 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.320878029 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.320894957 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.320904016 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.320929050 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.320954084 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.320980072 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.320981979 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.320997953 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.321006060 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.321144104 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.321168900 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.321192026 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.321201086 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.321212053 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.321227074 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.321233988 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.321253061 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.321264982 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.321300983 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.330478907 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.330518007 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.330544949 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.330569983 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.330595016 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.330621958 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.330630064 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.330646992 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.330651999 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.330673933 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.330677032 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.330703020 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.330733061 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.330734015 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.330758095 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.330781937 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.330786943 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.330801010 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.330823898 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.330843925 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.330864906 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.330867052 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.330890894 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.330899954 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.330915928 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.330936909 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.330944061 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.330955982 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.330971956 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.330997944 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.331022978 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.331023932 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.331048012 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.331072092 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.331090927 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.331096888 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.331115007 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.331125021 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.331142902 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.331171989 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.331172943 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.331195116 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.331219912 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.331224918 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.331243992 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.331267118 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.331269026 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.331290960 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.331321001 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.331327915 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.331353903 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.331368923 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.331379890 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.331404924 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.331430912 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.331446886 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.331451893 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.331479073 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.331619024 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.331641912 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.331665039 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.331688881 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.331690073 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.331712961 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.331722975 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.331737041 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.331758022 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.331767082 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.331784010 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.331808090 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.331826925 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.331829071 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.331851959 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.331871986 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.331873894 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.331902027 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.331904888 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.331927061 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.331948996 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.331954956 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.331965923 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.331988096 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.332000017 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.332009077 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.332030058 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.332037926 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.332051992 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.332075119 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.332098007 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.332101107 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.332122087 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.332130909 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.332149982 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.332175016 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.332606077 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.332634926 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.332659960 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.332684994 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.332695961 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.332706928 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.332729101 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.332731962 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.332747936 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.332756042 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.332782030 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.332796097 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.332807064 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.332830906 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.332879066 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.373527050 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.373569965 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.373589993 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.373608112 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.373624086 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.373645067 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.373673916 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.373697042 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.373713970 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.373739004 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.373742104 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.373763084 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.373776913 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.373789072 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.373812914 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.373831034 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.373837948 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.373859882 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.373877048 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.373886108 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.373902082 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.373905897 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.373927116 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.373949051 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.373964071 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.373970985 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.373994112 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.374001026 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.374012947 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.374051094 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.374275923 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.374305010 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.374325991 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.374344110 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.374366999 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.374367952 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.374404907 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.374417067 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.374439955 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.374465942 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.374465942 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.374490023 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.374509096 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.374515057 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.374538898 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.374550104 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.374562025 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.374586105 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.374602079 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.374608994 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.374631882 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.374634027 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.374658108 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.374679089 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.374691963 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.374779940 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.374805927 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.374829054 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.374844074 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.374851942 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.374871969 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.374872923 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.374897957 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.375022888 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.375047922 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.375065088 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.375077963 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.375111103 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.375854015 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.375884056 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.375905037 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.375930071 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.375951052 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.375953913 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.375977993 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.375993013 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.375998020 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.376025915 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.384103060 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.384143114 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.384162903 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.384179115 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.384207964 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.384232044 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.384249926 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.384252071 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.384267092 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.384315014 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.384340048 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.819041014 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.845752954 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.939699888 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.939749956 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.939786911 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.939816952 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.939856052 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.939899921 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.939902067 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.939940929 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.939960957 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.939980984 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.940026045 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.940056086 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.940064907 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.940107107 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.940143108 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.940157890 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.940201998 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.941080093 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.941124916 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.941163063 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.941189051 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.941227913 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.941236019 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.941257000 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.941301107 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.941438913 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.942423105 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.942459106 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.942517042 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.942527056 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.942534924 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.942553043 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.942574024 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.942616940 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.942640066 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.942656040 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.942692041 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.942693949 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.942734957 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.942771912 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.942778111 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.942810059 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.942830086 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.942851067 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.942876101 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.943061113 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.943094015 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.943175077 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.943341017 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.943383932 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.943423033 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.943463087 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.943464041 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.943494081 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.943528891 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.943533897 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.943567991 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.943574905 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.943610907 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.943648100 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.943685055 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.943711996 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.943722963 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.943767071 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.943794966 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.943806887 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.943844080 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.943870068 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.943895102 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.943908930 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.943938017 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.943969965 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.944020987 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.945079088 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.945128918 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.945169926 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.945207119 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.945252895 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.945266962 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.945292950 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.945312977 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.945324898 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.945353031 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.953974962 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.954008102 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.954026937 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.954050064 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.954202890 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.954242945 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.954354048 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.954385042 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.954411030 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.954426050 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.954444885 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.954457998 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.954474926 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.954493046 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.954503059 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.954530954 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.954541922 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.954559088 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.954574108 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.954586029 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.954602957 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.954617977 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.954647064 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.954668045 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.954679966 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.954694033 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.954722881 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.954725981 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.954750061 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.954777002 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.954782963 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.954804897 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.954833984 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.954834938 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.954863071 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.954889059 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.954891920 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.954916954 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.954941034 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.954942942 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.954971075 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.954991102 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.954998016 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.955018044 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.955075026 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.955075979 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.955104113 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.955131054 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.955141068 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.955161095 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.955188036 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.955198050 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.955213070 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.955239058 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.955249071 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.955274105 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.955296993 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.955302954 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.955327988 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.955353975 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.955380917 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.955380917 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.955401897 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.955435038 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.955466032 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.955590963 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.955622911 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.955651045 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.955678940 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.955682039 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.955704927 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.955739975 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.955753088 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.955756903 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.955782890 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.955811024 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.955820084 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.955842972 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.955842972 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.955864906 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.955885887 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.955893040 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.955919981 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.955945969 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.955966949 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.955971003 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.956001043 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.956022024 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.956027985 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.956049919 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.956054926 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.956082106 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.956094980 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.956108093 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.956132889 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.956173897 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.957634926 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.957672119 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.957710981 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.957722902 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.957783937 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.957808018 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.958014011 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.958045959 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.958056927 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.958086014 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.958127022 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.958127022 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.958153963 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.958180904 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.958190918 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.958208084 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.958249092 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.958262920 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.958275080 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.958304882 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.958316088 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.958333969 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.958354950 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.958381891 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.958381891 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.958409071 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.958412886 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.958434105 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.958460093 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.958481073 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.958486080 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.958512068 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.958515882 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.958544016 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.958569050 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.958578110 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.958596945 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.958606958 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.958622932 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.958647013 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.958672047 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.958690882 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.958707094 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.958733082 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.958755970 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.958760023 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.958781004 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.958786964 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.958812952 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.958837032 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.958844900 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.958865881 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.958889008 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.958911896 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.958913088 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.958939075 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.958961964 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.958964109 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.958986998 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.958988905 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.959011078 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.959031105 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.959031105 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.959074020 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.959259033 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.959274054 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.959301949 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.959320068 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.959337950 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.959357023 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.959381104 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.959407091 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.959408045 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.959429979 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.959440947 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.959454060 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.959476948 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.959480047 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.959501028 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.959505081 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.959527969 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.959546089 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.959554911 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.959578991 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.959603071 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.959616899 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.959636927 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.959661961 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.960324049 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.960356951 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.960380077 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.960407019 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.960417986 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.960442066 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.960454941 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.960467100 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.960469007 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.960488081 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.960511923 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.960522890 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.960537910 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.960561991 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.960565090 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.960589886 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.960609913 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.960618973 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.960634947 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.960659981 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.960660934 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.960685015 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.960707903 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.960711002 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.960736990 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.960757971 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.960763931 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.960788965 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.960803032 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.960813999 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.960835934 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.960853100 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.960860014 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.960879087 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.960917950 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.960927010 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.960954905 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.960980892 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.960982084 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.961007118 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.961030960 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.961035013 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.961055994 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.961078882 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.961078882 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.961102009 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.961126089 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.961208105 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.961227894 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.961280107 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.963452101 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.963481903 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.963499069 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.963515997 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.963543892 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.963568926 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.963591099 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.963603973 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.963614941 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.963639021 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.963646889 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.963663101 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.963685036 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.963687897 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.963711977 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.963737965 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.963758945 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.963762999 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.963788986 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.963799000 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.963814020 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.963839054 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.963840008 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.963864088 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.963876963 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.963888884 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.963912964 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.963943005 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.963948965 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.963973999 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.963998079 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.964020014 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.964045048 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.964065075 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.966677904 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.966717958 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.966816902 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.967797041 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.967832088 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.967854977 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.967880011 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.967904091 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.967911005 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.967935085 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.967958927 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.967959881 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.967987061 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.967989922 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.968009949 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.968020916 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.968034029 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.968058109 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.968066931 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.968085051 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.968108892 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.968110085 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.968169928 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.969348907 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.969396114 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.969424009 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.969444990 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.969517946 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.969546080 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:21.970397949 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.970422029 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.970441103 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:21.970475912 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:22.021821976 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:22.397627115 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:22.424402952 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.515467882 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.515681982 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.515710115 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.515734911 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.515752077 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.515767097 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:22.515775919 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.515799999 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.515808105 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:22.515821934 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.515830994 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:22.515842915 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.515867949 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.515876055 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:22.515892029 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.515913963 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.515917063 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:22.515933990 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.515964985 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:22.516077995 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.516103029 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.516124010 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:22.516124010 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.516146898 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.516169071 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.516190052 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:22.516190052 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.516213894 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.516223907 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:22.516236067 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.516292095 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:22.517591000 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.517622948 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.517640114 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.517663002 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.517683983 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.517709017 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.517709970 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:22.517728090 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.517741919 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:22.517750978 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.517772913 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:22.517776966 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.517801046 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.517824888 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.517824888 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:22.517848969 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.517872095 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.517893076 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:22.517895937 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.517918110 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.517925978 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:22.517965078 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:22.519622087 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.519651890 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.519669056 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.519686937 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.519710064 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.519737005 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.519753933 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:22.519766092 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.519777060 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:22.519783974 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.519814014 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:22.519831896 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.519850969 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:22.519856930 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.519881010 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.519901991 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:22.519906998 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.519932985 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.519958973 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.519983053 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.519984007 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:22.520009041 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.520011902 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:22.520032883 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.520054102 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.520056009 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:22.520077944 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.520100117 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.520116091 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:22.520116091 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.520152092 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:22.520240068 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.521897078 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:22.522165060 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:22.529288054 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.529326916 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.529349089 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.529365063 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.529409885 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.529433012 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.529433012 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:22.529460907 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.529472113 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:22.529489040 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.529514074 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.529539108 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:22.529540062 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.529572964 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.529597998 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.529613018 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:22.529624939 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.529648066 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:22.529650927 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.529679060 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.529702902 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:22.529705048 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.529730082 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.529762030 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.529763937 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:22.529781103 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.529803038 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.529815912 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:22.529829025 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.529849052 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:22.529854059 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.529898882 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:22.538492918 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.538538933 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.538566113 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.538590908 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.538616896 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.538640976 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.538665056 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.538685083 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.538697958 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:22.538711071 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.538724899 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:22.538738012 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.538741112 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:22.538764954 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.538788080 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.538789988 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:22.538808107 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.538831949 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.538846970 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:22.538856983 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.538880110 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.538885117 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:22.538904905 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.538918018 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:22.538928986 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.538953066 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.538975954 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.538979053 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:22.539001942 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.539015055 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:22.539026976 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.539052963 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.539077997 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.539077997 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:22.539102077 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.539124966 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.539125919 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:22.539151907 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.539175987 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.539195061 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:22.539200068 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.539225101 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.539227962 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:22.539251089 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.539263010 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:22.539278984 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.539304972 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.539319992 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:22.539334059 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.539360046 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.539386034 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.539402008 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:22.539408922 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.539432049 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.539438009 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:22.539450884 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.539473057 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:22.539561987 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.539591074 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.539613962 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:22.539614916 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.539644003 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.539668083 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.539685965 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:22.539693117 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.539720058 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.539721966 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:22.539752960 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.539762020 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:22.539779902 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.539808989 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.539834023 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.539858103 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.539859056 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:22.539896011 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.539896965 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:22.539904118 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.539928913 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.539952040 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:22.539952993 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.539974928 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:22.539978027 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.540002108 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.540021896 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:22.540026903 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.540055037 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.540081024 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.540096045 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:22.540102959 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.540127993 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.540137053 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:22.540153027 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.540167093 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:22.540549040 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.540581942 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.540607929 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.540632010 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.540653944 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:22.540656090 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.540682077 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.540695906 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:22.540704012 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.540734053 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.540745974 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.540749073 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:22.540766954 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.540792942 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.540812969 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:22.540817976 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.540843010 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.540847063 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:22.540868044 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.540880919 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:22.540890932 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.540914059 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.540936947 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.540939093 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:22.540961027 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.540975094 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:22.540983915 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.541013002 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.541037083 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.541053057 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:22.541060925 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.541085005 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:22.541085958 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.541110992 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.541136026 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:22.541481018 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.541511059 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.541536093 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.541559935 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.541568995 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:22.541590929 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.541594028 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:22.541615009 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.541629076 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:22.541640043 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.541665077 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.541685104 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:22.541688919 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.541712999 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.541737080 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.541752100 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:22.541764021 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.541789055 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.541790009 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:22.541846991 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.541872978 CET	443	49720	172.67.143.180	192.168.2.5
Nov 29, 2020 06:49:22.541886091 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:22.541918993 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:49:36.862401962 CET	49725	443	192.168.2.5	104.23.98.190
Nov 29, 2020 06:49:36.878961086 CET	443	49725	104.23.98.190	192.168.2.5
Nov 29, 2020 06:49:36.879306078 CET	49725	443	192.168.2.5	104.23.98.190
Nov 29, 2020 06:49:36.880620003 CET	49725	443	192.168.2.5	104.23.98.190
Nov 29, 2020 06:49:36.897111893 CET	443	49725	104.23.98.190	192.168.2.5
Nov 29, 2020 06:49:36.902586937 CET	443	49725	104.23.98.190	192.168.2.5
Nov 29, 2020 06:49:36.902630091 CET	443	49725	104.23.98.190	192.168.2.5
Nov 29, 2020 06:49:36.902843952 CET	49725	443	192.168.2.5	104.23.98.190
Nov 29, 2020 06:49:36.912168980 CET	49725	443	192.168.2.5	104.23.98.190
Nov 29, 2020 06:49:36.928710938 CET	443	49725	104.23.98.190	192.168.2.5
Nov 29, 2020 06:49:36.929131031 CET	443	49725	104.23.98.190	192.168.2.5
Nov 29, 2020 06:49:36.939893007 CET	49725	443	192.168.2.5	104.23.98.190
Nov 29, 2020 06:49:36.956551075 CET	443	49725	104.23.98.190	192.168.2.5
Nov 29, 2020 06:49:37.250885010 CET	443	49725	104.23.98.190	192.168.2.5
Nov 29, 2020 06:49:37.250930071 CET	443	49725	104.23.98.190	192.168.2.5
Nov 29, 2020 06:49:37.251189947 CET	49725	443	192.168.2.5	104.23.98.190
Nov 29, 2020 06:49:40.915954113 CET	49725	443	192.168.2.5	104.23.98.190
Nov 29, 2020 06:49:40.916193962 CET	49720	443	192.168.2.5	172.67.143.180
Nov 29, 2020 06:51:22.764256001 CET	49743	443	192.168.2.5	104.23.98.190
Nov 29, 2020 06:51:22.780699015 CET	443	49743	104.23.98.190	192.168.2.5
Nov 29, 2020 06:51:22.787697077 CET	49743	443	192.168.2.5	104.23.98.190
Nov 29, 2020 06:51:22.788621902 CET	49743	443	192.168.2.5	104.23.98.190
Nov 29, 2020 06:51:22.804939032 CET	443	49743	104.23.98.190	192.168.2.5
Nov 29, 2020 06:51:22.807193041 CET	443	49743	104.23.98.190	192.168.2.5
Nov 29, 2020 06:51:22.807216883 CET	443	49743	104.23.98.190	192.168.2.5
Nov 29, 2020 06:51:22.807342052 CET	49743	443	192.168.2.5	104.23.98.190
Nov 29, 2020 06:51:22.810411930 CET	49743	443	192.168.2.5	104.23.98.190
Nov 29, 2020 06:51:22.826796055 CET	443	49743	104.23.98.190	192.168.2.5
Nov 29, 2020 06:51:22.826915026 CET	443	49743	104.23.98.190	192.168.2.5
Nov 29, 2020 06:51:22.835551977 CET	49743	443	192.168.2.5	104.23.98.190
Nov 29, 2020 06:51:22.851993084 CET	443	49743	104.23.98.190	192.168.2.5
Nov 29, 2020 06:51:22.859528065 CET	443	49743	104.23.98.190	192.168.2.5
Nov 29, 2020 06:51:22.859563112 CET	443	49743	104.23.98.190	192.168.2.5
Nov 29, 2020 06:51:22.862159014 CET	49743	443	192.168.2.5	104.23.98.190

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 29, 2020 06:48:49.592431068 CET	54757	53	192.168.2.5	8.8.8.8
Nov 29, 2020 06:48:49.619355917 CET	53	54757	8.8.8.8	192.168.2.5
Nov 29, 2020 06:48:50.452881098 CET	49992	53	192.168.2.5	8.8.8.8
Nov 29, 2020 06:48:50.479872942 CET	53	49992	8.8.8.8	192.168.2.5
Nov 29, 2020 06:48:52.347913980 CET	60075	53	192.168.2.5	8.8.8.8
Nov 29, 2020 06:48:52.383404016 CET	53	60075	8.8.8.8	192.168.2.5
Nov 29, 2020 06:49:06.794851065 CET	55016	53	192.168.2.5	8.8.8.8
Nov 29, 2020 06:49:06.833525896 CET	53	55016	8.8.8.8	192.168.2.5
Nov 29, 2020 06:49:07.933543921 CET	64345	53	192.168.2.5	8.8.8.8
Nov 29, 2020 06:49:07.972069979 CET	53	64345	8.8.8.8	192.168.2.5
Nov 29, 2020 06:49:14.015892982 CET	57128	53	192.168.2.5	8.8.8.8
Nov 29, 2020 06:49:15.006133080 CET	57128	53	192.168.2.5	8.8.8.8
Nov 29, 2020 06:49:16.072524071 CET	57128	53	192.168.2.5	8.8.8.8
Nov 29, 2020 06:49:16.099591017 CET	53	57128	8.8.8.8	192.168.2.5
Nov 29, 2020 06:49:31.701009989 CET	54791	53	192.168.2.5	8.8.8.8
Nov 29, 2020 06:49:31.744827032 CET	53	54791	8.8.8.8	192.168.2.5
Nov 29, 2020 06:49:36.824596882 CET	50463	53	192.168.2.5	8.8.8.8
Nov 29, 2020 06:49:36.860050917 CET	53	50463	8.8.8.8	192.168.2.5
Nov 29, 2020 06:49:38.577140093 CET	50394	53	192.168.2.5	8.8.8.8
Nov 29, 2020 06:49:38.615976095 CET	53	50394	8.8.8.8	192.168.2.5
Nov 29, 2020 06:49:42.247489929 CET	58530	53	192.168.2.5	8.8.8.8
Nov 29, 2020 06:49:42.274691105 CET	53	58530	8.8.8.8	192.168.2.5
Nov 29, 2020 06:49:50.300962925 CET	53813	53	192.168.2.5	8.8.8.8
Nov 29, 2020 06:49:50.351768017 CET	53	53813	8.8.8.8	192.168.2.5
Nov 29, 2020 06:50:01.251828909 CET	63732	53	192.168.2.5	8.8.8.8
Nov 29, 2020 06:50:01.289098024 CET	53	63732	8.8.8.8	192.168.2.5
Nov 29, 2020 06:50:25.678795099 CET	57344	53	192.168.2.5	8.8.8.8
Nov 29, 2020 06:50:25.705877066 CET	53	57344	8.8.8.8	192.168.2.5
Nov 29, 2020 06:51:06.451838017 CET	54450	53	192.168.2.5	8.8.8.8
Nov 29, 2020 06:51:06.452275991 CET	59261	53	192.168.2.5	8.8.8.8
Nov 29, 2020 06:51:06.460237026 CET	57151	53	192.168.2.5	8.8.8.8
Nov 29, 2020 06:51:06.489944935 CET	53	59261	8.8.8.8	192.168.2.5
Nov 29, 2020 06:51:06.492084026 CET	53	54450	8.8.8.8	192.168.2.5
Nov 29, 2020 06:51:06.495630026 CET	53	57151	8.8.8.8	192.168.2.5
Nov 29, 2020 06:51:14.662991047 CET	59413	53	192.168.2.5	8.8.8.8
Nov 29, 2020 06:51:14.701637983 CET	53	59413	8.8.8.8	192.168.2.5
Nov 29, 2020 06:51:21.824026108 CET	60516	53	192.168.2.5	8.8.8.8
Nov 29, 2020 06:51:21.826122999 CET	51649	53	192.168.2.5	8.8.8.8
Nov 29, 2020 06:51:21.859415054 CET	53	60516	8.8.8.8	192.168.2.5
Nov 29, 2020 06:51:21.863610029 CET	53	51649	8.8.8.8	192.168.2.5
Nov 29, 2020 06:51:22.658529997 CET	65086	53	192.168.2.5	8.8.8.8
Nov 29, 2020 06:51:22.693871975 CET	53	65086	8.8.8.8	192.168.2.5
Nov 29, 2020 06:51:30.456788063 CET	56432	53	192.168.2.5	8.8.8.8
Nov 29, 2020 06:51:30.492680073 CET	53	56432	8.8.8.8	192.168.2.5
Nov 29, 2020 06:51:31.626458883 CET	52929	53	192.168.2.5	8.8.8.8
Nov 29, 2020 06:51:31.662272930 CET	53	52929	8.8.8.8	192.168.2.5
Nov 29, 2020 06:51:34.100285053 CET	64317	53	192.168.2.5	8.8.8.8
Nov 29, 2020 06:51:34.135688066 CET	53	64317	8.8.8.8	192.168.2.5
Nov 29, 2020 06:51:38.658795118 CET	61004	53	192.168.2.5	8.8.8.8
Nov 29, 2020 06:51:38.694324970 CET	53	61004	8.8.8.8	192.168.2.5
Nov 29, 2020 06:51:40.229526997 CET	56895	53	192.168.2.5	8.8.8.8
Nov 29, 2020 06:51:40.265198946 CET	53	56895	8.8.8.8	192.168.2.5
Nov 29, 2020 06:51:40.482561111 CET	62372	53	192.168.2.5	8.8.8.8
Nov 29, 2020 06:51:40.518327951 CET	53	62372	8.8.8.8	192.168.2.5
Nov 29, 2020 06:51:41.393907070 CET	61515	53	192.168.2.5	8.8.8.8
Nov 29, 2020 06:51:41.429419041 CET	53	61515	8.8.8.8	192.168.2.5
Nov 29, 2020 06:51:42.054263115 CET	56675	53	192.168.2.5	8.8.8.8
Nov 29, 2020 06:51:42.090038061 CET	53	56675	8.8.8.8	192.168.2.5
Nov 29, 2020 06:51:48.654684067 CET	57172	53	192.168.2.5	8.8.8.8
Nov 29, 2020 06:51:48.690429926 CET	53	57172	8.8.8.8	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Nov 29, 2020 06:49:06.794851065 CET	192.168.2.5	8.8.8.8	0xfc83	Standard query (0)	hastebin.com	A (IP address)	IN (0x0001)
Nov 29, 2020 06:49:36.824596882 CET	192.168.2.5	8.8.8.8	0x3952	Standard query (0)	pastebin.com	A (IP address)	IN (0x0001)
Nov 29, 2020 06:49:50.300962925 CET	192.168.2.5	8.8.8.8	0xc052	Standard query (0)	g.msn.com	A (IP address)	IN (0x0001)
Nov 29, 2020 06:51:06.451838017 CET	192.168.2.5	8.8.8.8	0x7226	Standard query (0)	hastebin.com	A (IP address)	IN (0x0001)
Nov 29, 2020 06:51:06.452275991 CET	192.168.2.5	8.8.8.8	0x71be	Standard query (0)	hastebin.com	A (IP address)	IN (0x0001)
Nov 29, 2020 06:51:06.460237026 CET	192.168.2.5	8.8.8.8	0xb643	Standard query (0)	hastebin.com	A (IP address)	IN (0x0001)
Nov 29, 2020 06:51:14.662991047 CET	192.168.2.5	8.8.8.8	0x8d0d	Standard query (0)	hastebin.com	A (IP address)	IN (0x0001)
Nov 29, 2020 06:51:21.824026108 CET	192.168.2.5	8.8.8.8	0x727	Standard query (0)	pastebin.com	A (IP address)	IN (0x0001)
Nov 29, 2020 06:51:21.826122999 CET	192.168.2.5	8.8.8.8	0xbb93	Standard query (0)	pastebin.com	A (IP address)	IN (0x0001)
Nov 29, 2020 06:51:22.658529997 CET	192.168.2.5	8.8.8.8	0xc7e8	Standard query (0)	pastebin.com	A (IP address)	IN (0x0001)
Nov 29, 2020 06:51:31.626458883 CET	192.168.2.5	8.8.8.8	0xb638	Standard query (0)	hastebin.com	A (IP address)	IN (0x0001)
Nov 29, 2020 06:51:40.229526997 CET	192.168.2.5	8.8.8.8	0x5ccc	Standard query (0)	hastebin.com	A (IP address)	IN (0x0001)
Nov 29, 2020 06:51:41.393907070 CET	192.168.2.5	8.8.8.8	0x4c60	Standard query (0)	pastebin.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Nov 29, 2020 06:49:06.833525896 CET	8.8.8.8	192.168.2.5	0xfc83	No error (0)	hastebin.com		172.67.143.180	A (IP address)	IN (0x0001)
Nov 29, 2020 06:49:06.833525896 CET	8.8.8.8	192.168.2.5	0xfc83	No error (0)	hastebin.com		104.24.127.89	A (IP address)	IN (0x0001)
Nov 29, 2020 06:49:06.833525896 CET	8.8.8.8	192.168.2.5	0xfc83	No error (0)	hastebin.com		104.24.126.89	A (IP address)	IN (0x0001)
Nov 29, 2020 06:49:36.860050917 CET	8.8.8.8	192.168.2.5	0x3952	No error (0)	pastebin.com		104.23.98.190	A (IP address)	IN (0x0001)
Nov 29, 2020 06:49:36.860050917 CET	8.8.8.8	192.168.2.5	0x3952	No error (0)	pastebin.com		104.23.99.190	A (IP address)	IN (0x0001)
Nov 29, 2020 06:49:50.351768017 CET	8.8.8.8	192.168.2.5	0xc052	No error (0)	g.msn.com	g-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)
Nov 29, 2020 06:51:06.489944935 CET	8.8.8.8	192.168.2.5	0x71be	No error (0)	hastebin.com		104.24.126.89	A (IP address)	IN (0x0001)
Nov 29, 2020 06:51:06.489944935 CET	8.8.8.8	192.168.2.5	0x71be	No error (0)	hastebin.com		104.24.127.89	A (IP address)	IN (0x0001)
Nov 29, 2020 06:51:06.489944935 CET	8.8.8.8	192.168.2.5	0x71be	No error (0)	hastebin.com		172.67.143.180	A (IP address)	IN (0x0001)
Nov 29, 2020 06:51:06.492084026 CET	8.8.8.8	192.168.2.5	0x7226	No error (0)	hastebin.com		104.24.126.89	A (IP address)	IN (0x0001)
Nov 29, 2020 06:51:06.492084026 CET	8.8.8.8	192.168.2.5	0x7226	No error (0)	hastebin.com		104.24.127.89	A (IP address)	IN (0x0001)
Nov 29, 2020 06:51:06.492084026 CET	8.8.8.8	192.168.2.5	0x7226	No error (0)	hastebin.com		172.67.143.180	A (IP address)	IN (0x0001)
Nov 29, 2020 06:51:06.495630026 CET	8.8.8.8	192.168.2.5	0xb643	No error (0)	hastebin.com		104.24.126.89	A (IP address)	IN (0x0001)
Nov 29, 2020 06:51:06.495630026 CET	8.8.8.8	192.168.2.5	0xb643	No error (0)	hastebin.com		104.24.127.89	A (IP address)	IN (0x0001)
Nov 29, 2020 06:51:06.495630026 CET	8.8.8.8	192.168.2.5	0xb643	No error (0)	hastebin.com		172.67.143.180	A (IP address)	IN (0x0001)
Nov 29, 2020 06:51:14.701637983 CET	8.8.8.8	192.168.2.5	0x8d0d	No error (0)	hastebin.com		104.24.126.89	A (IP address)	IN (0x0001)
Nov 29, 2020 06:51:14.701637983 CET	8.8.8.8	192.168.2.5	0x8d0d	No error (0)	hastebin.com		104.24.127.89	A (IP address)	IN (0x0001)
Nov 29, 2020 06:51:14.701637983 CET	8.8.8.8	192.168.2.5	0x8d0d	No error (0)	hastebin.com		172.67.143.180	A (IP address)	IN (0x0001)
Nov 29, 2020 06:51:21.859415054 CET	8.8.8.8	192.168.2.5	0x727	No error (0)	pastebin.com		104.23.99.190	A (IP address)	IN (0x0001)
Nov 29, 2020 06:51:21.859415054 CET	8.8.8.8	192.168.2.5	0x727	No error (0)	pastebin.com		104.23.98.190	A (IP address)	IN (0x0001)
Nov 29, 2020 06:51:21.863610029 CET	8.8.8.8	192.168.2.5	0xbb93	No error (0)	pastebin.com		104.23.99.190	A (IP address)	IN (0x0001)
Nov 29, 2020 06:51:21.863610029 CET	8.8.8.8	192.168.2.5	0xbb93	No error (0)	pastebin.com		104.23.98.190	A (IP address)	IN (0x0001)
Nov 29, 2020 06:51:22.693871975 CET	8.8.8.8	192.168.2.5	0xc7e8	No error (0)	pastebin.com		104.23.98.190	A (IP address)	IN (0x0001)
Nov 29, 2020 06:51:22.693871975 CET	8.8.8.8	192.168.2.5	0xc7e8	No error (0)	pastebin.com		104.23.99.190	A (IP address)	IN (0x0001)
Nov 29, 2020 06:51:31.662272930 CET	8.8.8.8	192.168.2.5	0xb638	No error (0)	hastebin.com		104.24.126.89	A (IP address)	IN (0x0001)
Nov 29, 2020 06:51:31.662272930 CET	8.8.8.8	192.168.2.5	0xb638	No error (0)	hastebin.com		104.24.127.89	A (IP address)	IN (0x0001)
Nov 29, 2020 06:51:31.662272930 CET	8.8.8.8	192.168.2.5	0xb638	No error (0)	hastebin.com		172.67.143.180	A (IP address)	IN (0x0001)
Nov 29, 2020 06:51:40.265198946 CET	8.8.8.8	192.168.2.5	0x5ccc	No error (0)	hastebin.com		104.24.126.89	A (IP address)	IN (0x0001)
Nov 29, 2020 06:51:40.265198946 CET	8.8.8.8	192.168.2.5	0x5ccc	No error (0)	hastebin.com		104.24.127.89	A (IP address)	IN (0x0001)
Nov 29, 2020 06:51:40.265198946 CET	8.8.8.8	192.168.2.5	0x5ccc	No error (0)	hastebin.com		172.67.143.180	A (IP address)	IN (0x0001)
Nov 29, 2020 06:51:41.429419041 CET	8.8.8.8	192.168.2.5	0x4c60	No error (0)	pastebin.com		104.23.99.190	A (IP address)	IN (0x0001)
Nov 29, 2020 06:51:41.429419041 CET	8.8.8.8	192.168.2.5	0x4c60	No error (0)	pastebin.com		104.23.98.190	A (IP address)	IN (0x0001)

HTTPS Packets

Timestamp	Source IP	Source Port	Dest IP	Dest Port	Subject	Issuer	Not Before	Not After	JA3 SSL Client Fingerprint	JA3 SSL Client Digest
Nov 29, 2020 06:49:06.951127052 CET	172.67.143.180	443	192.168.2.5	49720	CN=sni.cloudflaressl.com, O="Cloudflare, Inc.", L=San Francisco, ST=CA, C=US CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Sat Jul 25 02:00:00 CEST 2020 Mon Jan 27 13:48:08 CET 2020	Sun Jul 25 14:00:00 CEST 2021 Wed Jan 01 00:59:59 CET 2025	771,49196-49195-49200-49199-159-158-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-23-65281,29-23-24,0	3b5074b1b5d032e5620f69f9f700ff0e
Nov 29, 2020 06:49:06.951127052 CET	172.67.143.180	443	192.168.2.5	49720	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Mon Jan 27 13:48:08 CET 2020	Wed Jan 01 00:59:59 CET 2025		3b5074b1b5d032e5620f69f9f700ff0e
Nov 29, 2020 06:49:36.902630091 CET	104.23.98.190	443	192.168.2.5	49725	CN=sni.cloudflaressl.com, O="Cloudflare, Inc.", L=San Francisco, ST=CA, C=US CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Mon Aug 17 02:00:00 CEST 2020 Mon Jan 27 13:48:08 CET 2020	Tue Aug 17 14:00:00 CEST 2021 Wed Jan 01 00:59:59 CET 2025	771,49196-49195-49200-49199-159-158-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-23-65281,29-23-24,0	3b5074b1b5d032e5620f69f9f700ff0e
Nov 29, 2020 06:49:36.902630091 CET	104.23.98.190	443	192.168.2.5	49725	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Mon Jan 27 13:48:08 CET 2020	Wed Jan 01 00:59:59 CET 2025		3b5074b1b5d032e5620f69f9f700ff0e
Nov 29, 2020 06:51:22.807216883 CET	104.23.98.190	443	192.168.2.5	49743	CN=sni.cloudflaressl.com, O="Cloudflare, Inc.", L=San Francisco, ST=CA, C=US CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Mon Aug 17 02:00:00 CEST 2020 Mon Jan 27 13:48:08 CET 2020	Tue Aug 17 14:00:00 CEST 2021 Wed Jan 01 00:59:59 CET 2025	771,49196-49195-49200-49199-159-158-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-23-65281,29-23-24,0	3b5074b1b5d032e5620f69f9f700ff0e
Nov 29, 2020 06:51:22.807216883 CET	104.23.98.190	443	192.168.2.5	49743	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Mon Jan 27 13:48:08 CET 2020	Wed Jan 01 00:59:59 CET 2025		3b5074b1b5d032e5620f69f9f700ff0e

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: Payment_Advice_pdf.exe PID: 4392 Parent PID: 5724

General

Start time:	06:48:54
Start date:	29/11/2020
Path:	C:\Users\user\Desktop\Payment_Advice_pdf.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\Payment_Advice_pdf.exe'
Imagebase:	0xa20000
File size:	631776 bytes
MD5 hash:	536CF4ED17EBA1BF41EF70FAAA2054A4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	low

Chronological Activities

Analysis Process: timeout.exe PID: 4488 Parent PID: 4392

General

Start time:	06:48:59
Start date:	29/11/2020
Path:	C:\Windows\SysWOW64\timeout.exe
Wow64 process (32bit):	true
Commandline:	timeout 4
Imagebase:	0x350000
File size:	26112 bytes
MD5 hash:	121A4EDAE60A7AF6F5DFA82F7BB95659
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: conhost.exe PID: 4616 Parent PID: 4488

General

Start time:	06:49:00
Start date:	29/11/2020
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7ecfc0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: powershell.exe PID: 6924 Parent PID: 4392

General

Start time:	06:49:32
Start date:	29/11/2020
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payment_Advice_pdf.exe' -Force
Imagebase:	0x12e0000
File size:	430592 bytes
MD5 hash:	DBA3E6449E97D4E3DF64527EF7012A10
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	high

Chronological Activities

Analysis Process: conhost.exe PID: 6932 Parent PID: 6924

General

Start time:	06:49:32
Start date:	29/11/2020
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7ecfc0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: powershell.exe PID: 6948 Parent PID: 4392

General

Start time:	06:49:32
Start date:	29/11/2020
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payment_Advice_pdf.exe' -Force
Imagebase:	0x12e0000
File size:	430592 bytes
MD5 hash:	DBA3E6449E97D4E3DF64527EF7012A10
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET

Chronological Activities

Analysis Process: powershell.exe PID: 7008 Parent PID: 4392

General

Start time:	06:49:33
Start date:	29/11/2020
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payment_Advice_pdf.exe' -Force
Imagebase:	0x12e0000
File size:	430592 bytes
MD5 hash:	DBA3E6449E97D4E3DF64527EF7012A10
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET

Chronological Activities

Analysis Process: conhost.exe PID: 7016 Parent PID: 6948

General

Start time:	06:49:33
Start date:	29/11/2020
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7ecfc0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: conhost.exe PID: 7056 Parent PID: 7008

General

Start time:	06:49:33
Start date:	29/11/2020
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7ecfc0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: powershell.exe PID: 7104 Parent PID: 4392

General

Start time:	06:49:33
Start date:	29/11/2020
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\Payment_Advice_pdf.exe' -Force
Imagebase:	0x12e0000
File size:	430592 bytes
MD5 hash:	DBA3E6449E97D4E3DF64527EF7012A10
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET

Chronological Activities

Analysis Process: conhost.exe PID: 5792 Parent PID: 7104

General

Start time:	06:49:34
Start date:	29/11/2020
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7ecfc0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: Payment_Advice_pdf.exe PID: 6728 Parent PID: 4392

General

Start time:	06:49:39
Start date:	29/11/2020
Path:	C:\Users\user\Desktop\Payment_Advice_pdf.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\Payment_Advice_pdf.exe
Imagebase:	0x840000
File size:	631776 bytes
MD5 hash:	536CF4ED17EBA1BF41EF70FAAA2054A4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000016.00000002.509306076.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000016.00000002.532140773.0000000002C41000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000016.00000002.532140773.0000000002C41000.00000004.00000001.sdmp, Author: Joe Security

Chronological Activities

Analysis Process: Payment_Advice_pdf.exe PID: 5600 Parent PID: 3472

General

Start time:	06:49:44
Start date:	29/11/2020
Path:	C:\Users\user\Desktop\Payment_Advice_pdf.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\Payment_Advice_pdf.exe'
Imagebase:	0xdb0000
File size:	631776 bytes
MD5 hash:	536CF4ED17EBA1BF41EF70FAAA2054A4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET

Chronological Activities

Analysis Process: Payment_Advice_pdf.exe PID: 6944 Parent PID: 3472

General

Start time:	06:49:53
Start date:	29/11/2020
Path:	C:\Users\user\Desktop\Payment_Advice_pdf.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\Payment_Advice_pdf.exe'
Imagebase:	0xe50000
File size:	631776 bytes
MD5 hash:	536CF4ED17EBA1BF41EF70FAAA2054A4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET

Chronological Activities

Analysis Process: Payment_Advice_pdf.exe PID: 5360 Parent PID: 3472

General

Start time:	06:50:02
Start date:	29/11/2020
Path:	C:\Users\user\Desktop\Payment_Advice_pdf.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\Payment_Advice_pdf.exe'
Imagebase:	0x370000
File size:	631776 bytes
MD5 hash:	536CF4ED17EBA1BF41EF70FAAA2054A4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET

Chronological Activities

Analysis Process: Payment_Advice_pdf.exe PID: 5916 Parent PID: 3472

General

Start time:	06:50:11
Start date:	29/11/2020
Path:	C:\Users\user\Desktop\Payment_Advice_pdf.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\Payment_Advice_pdf.exe'
Imagebase:	0xe60000
File size:	631776 bytes
MD5 hash:	536CF4ED17EBA1BF41EF70FAAA2054A4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET

Chronological Activities

Analysis Process: Payment_Advice_pdf.exe PID: 5536 Parent PID: 3472

General

Start time:	06:50:20
Start date:	29/11/2020
Path:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payment_Advice_pdf.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payment_Advice_pdf.exe'
Imagebase:	0xbb0000
File size:	631776 bytes
MD5 hash:	536CF4ED17EBA1BF41EF70FAAA2054A4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Antivirus matches:	Detection: 19%, Metadefender, Browse Detection: 48%, ReversingLabs

Chronological Activities

Analysis Process: timeout.exe PID: 4404 Parent PID: 6944

General

Start time:	06:50:53
Start date:	29/11/2020
Path:	C:\Windows\SysWOW64\timeout.exe
Wow64 process (32bit):	true
Commandline:	timeout 4
Imagebase:	0x350000
File size:	26112 bytes
MD5 hash:	121A4EDAE60A7AF6F5DFA82F7BB95659
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: conhost.exe PID: 5772 Parent PID: 4404

General

Start time:	06:50:54
Start date:	29/11/2020
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7ecfc0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: powershell.exe PID: 6924 Parent PID: 4392 powershell.exeCOMMON

Executed Functions

Function 0081A0C0, Relevance: 7.5, Strings: 5, Instructions: 1236COMMON

Download Yara Rule

Strings

lo], xrefs: 0081AB90
lo], xrefs: 0081B41E
ln^, xrefs: 0081B5B7
$o^, xrefs: 0081B587
XP], xrefs: 0081A9A3

Memory Dump Source

Source File: 0000000D.00000002.512840359.0000000000810000.00000040.00000001.sdmp, Offset: 00810000, based on PE: false

Similarity

API ID:
String ID: $o^$XP]$ln^$lo]$lo]
API String ID: 0-1103020024
Opcode ID: d35a3096e049f7d9dcf7e36f8c4d8cb5b0da570aa3cfde2dfbc24440d30a6cbe
Instruction ID: c088ff572092ef88eef0a985255acac679c375aa804b90ced4ecba350339e911
Opcode Fuzzy Hash: d35a3096e049f7d9dcf7e36f8c4d8cb5b0da570aa3cfde2dfbc24440d30a6cbe
Instruction Fuzzy Hash: 73C23874A04218CFCB29DF64C894AEDBBB6FF89304F1485A9E506AB391CB359D81CF51

Uniqueness

Uniqueness Score: -1.00%

Function 0080EDA8, Relevance: 2.1, Strings: 1, Instructions: 893COMMON

Download Yara Rule

Strings

#, xrefs: 0080EDF7

Memory Dump Source

Source File: 0000000D.00000002.512790112.0000000000800000.00000040.00000001.sdmp, Offset: 00800000, based on PE: false

Similarity

API ID:
String ID: #
API String ID: 0-1885708031
Opcode ID: a6550479f90e712ae2adf37e70536db3895dfd39130404b4e9f3c2e4b1044a53
Instruction ID: 5c6d100927752971c0e6f6249731989bf644f5c37a4e141ade5f15db5eb4a73f
Opcode Fuzzy Hash: a6550479f90e712ae2adf37e70536db3895dfd39130404b4e9f3c2e4b1044a53
Instruction Fuzzy Hash: 40923574A01218CFDB65CF64C894BADBBB2FF89304F1184A9E909AB391DB759D81CF50

Uniqueness

Uniqueness Score: -1.00%

Function 0080A570, Relevance: .7, Instructions: 675COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.512790112.0000000000800000.00000040.00000001.sdmp, Offset: 00800000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ccd4763242b79c732282c02ce5f94b8718df969fdc5d8dacb7152e913074ad44
Instruction ID: 674eb74f4c625c1ae82642432e4db3a1903c5ff2a31c69a2e10fdb43e272cf46
Opcode Fuzzy Hash: ccd4763242b79c732282c02ce5f94b8718df969fdc5d8dacb7152e913074ad44
Instruction Fuzzy Hash: BF428D34A002089FCB64DF68C854AAEBBF6FF89314F258569E905AB391DB34ED41CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00806919, Relevance: 2.8, Strings: 2, Instructions: 264COMMON

Download Yara Rule

Strings

lo], xrefs: 00806AEE
lo], xrefs: 00806C46

Memory Dump Source

Source File: 0000000D.00000002.512790112.0000000000800000.00000040.00000001.sdmp, Offset: 00800000, based on PE: false

Similarity

API ID:
String ID: lo]$lo]
API String ID: 0-1903763222
Opcode ID: 35a849859b1d06e2eb7895b3608be0594109e642e47ba306de9fbacf177d3b53
Instruction ID: 5726dfa298b5bc872371d2a0e62666e1f7ef42552c831b84b0d05994089bbdd7
Opcode Fuzzy Hash: 35a849859b1d06e2eb7895b3608be0594109e642e47ba306de9fbacf177d3b53
Instruction Fuzzy Hash: 6EB14834A002049FDB54DFA4D894BADBBF2FF88314F188469E906AB7A1DB31AC51CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00808121, Relevance: 2.6, Strings: 2, Instructions: 111COMMON

Download Yara Rule

Strings

tN], xrefs: 00808156
@ Xl, xrefs: 0080821B

Memory Dump Source

Source File: 0000000D.00000002.512790112.0000000000800000.00000040.00000001.sdmp, Offset: 00800000, based on PE: false

Similarity

API ID:
String ID: @ Xl$tN]
API String ID: 0-949322729
Opcode ID: 0495839cbcdc3a9c417be164bda422bf127727b308d2ae0854a59a345e82c388
Instruction ID: 16617e0f501b437be4e2833bc9c00bf37ed96e227dfb5d2ca2df4edeea7ebdaa
Opcode Fuzzy Hash: 0495839cbcdc3a9c417be164bda422bf127727b308d2ae0854a59a345e82c388
Instruction Fuzzy Hash: FE41D230604204DFCB44DF64E89469DBBF6FF89314F14896AC505DB392DB74AD46CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00808138, Relevance: 2.6, Strings: 2, Instructions: 98COMMON

Download Yara Rule

Strings

tN], xrefs: 00808156
@ Xl, xrefs: 0080821B

Memory Dump Source

Source File: 0000000D.00000002.512790112.0000000000800000.00000040.00000001.sdmp, Offset: 00800000, based on PE: false

Similarity

API ID:
String ID: @ Xl$tN]
API String ID: 0-949322729
Opcode ID: 1b47f26bc3d78c3980df857cc88a386b5f07a57f3e6ba2cd1f7d0e28f656b624
Instruction ID: 2cdf2dc90ac07dffdc4234cb2b6036441473e24ff2c225a4bb205f335eac817f
Opcode Fuzzy Hash: 1b47f26bc3d78c3980df857cc88a386b5f07a57f3e6ba2cd1f7d0e28f656b624
Instruction Fuzzy Hash: 9731AD30600605DFCB84EB64D894AADB7E6FF88314F14C96AC505AB391DB70AD85CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00804338, Relevance: 2.5, Strings: 1, Instructions: 1298COMMON

Download Yara Rule

Strings

|~], xrefs: 00804361

Memory Dump Source

Source File: 0000000D.00000002.512790112.0000000000800000.00000040.00000001.sdmp, Offset: 00800000, based on PE: false

Similarity

API ID:
String ID: |~]
API String ID: 0-114045207
Opcode ID: 2e6d71234f2767bb4c0b487528f6709064eafb66cf357d5c58c1f306939c148b
Instruction ID: c2976db8189c6f21f507e326206b20c610114c72173b92c45efc6cc131335143
Opcode Fuzzy Hash: 2e6d71234f2767bb4c0b487528f6709064eafb66cf357d5c58c1f306939c148b
Instruction Fuzzy Hash: 82D23670A042199FDB65EF64C894BEEB7F6EB89300F1081E9D509AB791DB319E85CF40

Uniqueness

Uniqueness Score: -1.00%

Function 00804348, Relevance: 2.5, Strings: 1, Instructions: 1294COMMON

Download Yara Rule

Strings

|~], xrefs: 00804361

Memory Dump Source

Source File: 0000000D.00000002.512790112.0000000000800000.00000040.00000001.sdmp, Offset: 00800000, based on PE: false

Similarity

API ID:
String ID: |~]
API String ID: 0-114045207
Opcode ID: a3e5ef122f581c63e21e51af8246c07208d4037fbeb9855a37c0cc1f184721eb
Instruction ID: 70cb0d480b8186a5cda00d289433ca1e8dd2a55040144090db498dbdaaa79391
Opcode Fuzzy Hash: a3e5ef122f581c63e21e51af8246c07208d4037fbeb9855a37c0cc1f184721eb
Instruction Fuzzy Hash: F7D23670A042199FDB65EF64C894BEEB7F6EB89300F1081E9D509AB791DB319E85CF40

Uniqueness

Uniqueness Score: -1.00%

Function 008037A0, Relevance: 1.7, Strings: 1, Instructions: 442COMMON

Download Yara Rule

Strings

~], xrefs: 00803BDF

Memory Dump Source

Source File: 0000000D.00000002.512790112.0000000000800000.00000040.00000001.sdmp, Offset: 00800000, based on PE: false

Similarity

API ID:
String ID: ~]
API String ID: 0-1667950275
Opcode ID: 12fa6b0b6a22428632ae763bbc31f0f09e8b92e6706ddcf6a6e3e91ca52a9ff7
Instruction ID: 1a619c9e6073adb336db219d98302e26b20a1a321f988b451b705c68b7b865e4
Opcode Fuzzy Hash: 12fa6b0b6a22428632ae763bbc31f0f09e8b92e6706ddcf6a6e3e91ca52a9ff7
Instruction Fuzzy Hash: F9026030A14209DFCB54DFA4D894AAEBBF6FF88304F108569D506EB3A1DB35AD45CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00807291, Relevance: 1.6, Strings: 1, Instructions: 351COMMON

Download Yara Rule

Strings

@ Xl, xrefs: 00807576

Memory Dump Source

Source File: 0000000D.00000002.512790112.0000000000800000.00000040.00000001.sdmp, Offset: 00800000, based on PE: false

Similarity

API ID:
String ID: @ Xl
API String ID: 0-3027975150
Opcode ID: 74002b8c8eb1be9d1481b674e894cd2e1d2974248c1b46b07e96f19b76b8b186
Instruction ID: e5accaac40c030752a0ec016be330ae1933059b03773d8eb7504a1bd5579a8b0
Opcode Fuzzy Hash: 74002b8c8eb1be9d1481b674e894cd2e1d2974248c1b46b07e96f19b76b8b186
Instruction Fuzzy Hash: 14E17E30A042149FDB64DF64DC94BAEBBB2FF84304F0584A9D90A9B7A1DB31AD45CF91

Uniqueness

Uniqueness Score: -1.00%

Function 00802BC0, Relevance: 1.6, Strings: 1, Instructions: 307COMMON

Download Yara Rule

Strings

lo], xrefs: 00802DEC

Memory Dump Source

Source File: 0000000D.00000002.512790112.0000000000800000.00000040.00000001.sdmp, Offset: 00800000, based on PE: false

Similarity

API ID:
String ID: lo]
API String ID: 0-1228124535
Opcode ID: 19a5dc338b4e08eaa2a21c956879bfa5e508821cefe383072c701f26e393dc39
Instruction ID: 2678020f3b368ebf693a9302d5a12aa00590e0166ecf05c928b0d6293815b9f7
Opcode Fuzzy Hash: 19a5dc338b4e08eaa2a21c956879bfa5e508821cefe383072c701f26e393dc39
Instruction Fuzzy Hash: 74C1BF74A042598FDB14DFA4C854BAEBBF2FF89300F1484A9E945EB391DB749C46CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00817A40, Relevance: 1.6, APIs: 1, Instructions: 51COMMON

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000,?,?,?,?,?,?,?,?,?,0081CDC2), ref: 0081D04F

Memory Dump Source

Source File: 0000000D.00000002.512840359.0000000000810000.00000040.00000001.sdmp, Offset: 00810000, based on PE: false

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: 6c32b1b82731bc0908638630e0a07e1fba10b9c4f204ea1abb1ebeb8355d96b0
Instruction ID: 17caaffd497a30e8c6d15298d8af4185c847e190de13158487a832d4b70cb999
Opcode Fuzzy Hash: 6c32b1b82731bc0908638630e0a07e1fba10b9c4f204ea1abb1ebeb8355d96b0
Instruction Fuzzy Hash: A61158B18083488FCB10CF99D888BDEBBF8FF49328F10845AD559A7200D774A985CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00817A4C, Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000,?,?,?,?,?,?,?,?,?,0081CDC2), ref: 0081D04F

Memory Dump Source

Source File: 0000000D.00000002.512840359.0000000000810000.00000040.00000001.sdmp, Offset: 00810000, based on PE: false

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: 58c3490ae13b442b6fdca9a215228df7073258c091e9dad05c842b0befc3bf4d
Instruction ID: 95e214a733568b83b001567f60d5eb4a860fb5216d37782a3f6f4a04ee1a6ac7
Opcode Fuzzy Hash: 58c3490ae13b442b6fdca9a215228df7073258c091e9dad05c842b0befc3bf4d
Instruction Fuzzy Hash: 0E11F2B18047498FCB10CF99D848BDEBBF8FF49328F10841AD919A7600C7B5A985CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0081CFE9, Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000,?,?,?,?,?,?,?,?,?,0081CDC2), ref: 0081D04F

Memory Dump Source

Source File: 0000000D.00000002.512840359.0000000000810000.00000040.00000001.sdmp, Offset: 00810000, based on PE: false

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: d43f92bdbf4044f5c29db7eeea944279a83ba3bed87ea5839810fc479d89b1bf
Instruction ID: d5cc2cec1cdd548253e455a35982d3ae2ff68c67f7244658bf15cc5dd6c0551d
Opcode Fuzzy Hash: d43f92bdbf4044f5c29db7eeea944279a83ba3bed87ea5839810fc479d89b1bf
Instruction Fuzzy Hash: CC1103B08047498FCB20CF99D488BDEBBF8FF49324F10845AD559A7650C375A984CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0080FC38, Relevance: 1.4, Strings: 1, Instructions: 186COMMON

Download Yara Rule

Strings

@ Xl, xrefs: 0080FDA9

Memory Dump Source

Source File: 0000000D.00000002.512790112.0000000000800000.00000040.00000001.sdmp, Offset: 00800000, based on PE: false

Similarity

API ID:
String ID: @ Xl
API String ID: 0-3027975150
Opcode ID: fb419c4fcce1dd0441a3536f3c20984ef622c5dd82317a504eaffb4386d3a50f
Instruction ID: 954faf01bd62c6bc9efc7091b30ffa01967b5d5fb4e4a3bf75b0cef1e15a03d1
Opcode Fuzzy Hash: fb419c4fcce1dd0441a3536f3c20984ef622c5dd82317a504eaffb4386d3a50f
Instruction Fuzzy Hash: 8F814930A05208DFDB54DF68D984A9DB7F2FF88304F158469E905EB6A2DB34ED42CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0080FC37, Relevance: 1.4, Strings: 1, Instructions: 168COMMON

Download Yara Rule

Strings

@ Xl, xrefs: 0080FDA9

Memory Dump Source

Source File: 0000000D.00000002.512790112.0000000000800000.00000040.00000001.sdmp, Offset: 00800000, based on PE: false

Similarity

API ID:
String ID: @ Xl
API String ID: 0-3027975150
Opcode ID: 1d2fd50959d79b97ab60ba5ff820c6f7d6f7810c7ad43040df900bb3484707a1
Instruction ID: a8f13035fa8c6ac392dce4e8e471b86bb36a1b60fa0e824c05924e6294600f3b
Opcode Fuzzy Hash: 1d2fd50959d79b97ab60ba5ff820c6f7d6f7810c7ad43040df900bb3484707a1
Instruction Fuzzy Hash: C9613A30A05218DFCB64DF64D984A9DB7F2FF88304F158469E905EB6A2DB70ED42CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0080C960, Relevance: 1.3, Strings: 1, Instructions: 50COMMON

Download Yara Rule

Strings

tN], xrefs: 0080C993

Memory Dump Source

Source File: 0000000D.00000002.512790112.0000000000800000.00000040.00000001.sdmp, Offset: 00800000, based on PE: false

Similarity

API ID:
String ID: tN]
API String ID: 0-3617150556
Opcode ID: 3837294be3e68356830a193fbb445cc5a5337dda751e99a96fca2afb033d0fe6
Instruction ID: 8fd9824880642e92c4b23dc394b922af4de26cc982360d337f242b6e7e7ad6c5
Opcode Fuzzy Hash: 3837294be3e68356830a193fbb445cc5a5337dda751e99a96fca2afb033d0fe6
Instruction Fuzzy Hash: D9115A31A002089FDB14DB98D849BDEBBF6FB4D324F1442AAD401B7381CB726D44CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0080C94F, Relevance: 1.3, Strings: 1, Instructions: 49COMMON

Download Yara Rule

Strings

tN], xrefs: 0080C993

Memory Dump Source

Source File: 0000000D.00000002.512790112.0000000000800000.00000040.00000001.sdmp, Offset: 00800000, based on PE: false

Similarity

API ID:
String ID: tN]
API String ID: 0-3617150556
Opcode ID: 49086207a88bb58db0b26e2b92d711334b8bc2e161737f731394f2ab2aa2dd8c
Instruction ID: af0591ff6714d9fff67b03645fe96b3178f0bcc501cdb563a002a09cbbf9da16
Opcode Fuzzy Hash: 49086207a88bb58db0b26e2b92d711334b8bc2e161737f731394f2ab2aa2dd8c
Instruction Fuzzy Hash: 64116D31600209DFCB24DF68C88979DBBF5FB49320F148299D801AB3D1CB729C45CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00809FC0, Relevance: .3, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.512790112.0000000000800000.00000040.00000001.sdmp, Offset: 00800000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd5c41766b6abefd9610a25da92285ad104a9883becb247fda64b60f8cd4cf7c
Instruction ID: 1bcc1809a1818faecb1078421d5520342cfff2233efa78dffb822e18494c8a21
Opcode Fuzzy Hash: dd5c41766b6abefd9610a25da92285ad104a9883becb247fda64b60f8cd4cf7c
Instruction Fuzzy Hash: 1DD14C34A00204DFDB59DF64E854BAEBBB6FF88304F248468E506AB3A1CB75AD45CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00808D20, Relevance: .3, Instructions: 269COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.512790112.0000000000800000.00000040.00000001.sdmp, Offset: 00800000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df8f84323273ed7fa4890652ad147ea689f34483aeca6836328a2f1465e7576e
Instruction ID: 3886909c3a57be998f076f8bdeb18c8c52a0e315978062dea58ddab117929b02
Opcode Fuzzy Hash: df8f84323273ed7fa4890652ad147ea689f34483aeca6836328a2f1465e7576e
Instruction Fuzzy Hash: 37B12F74A02605DFC744CF68DA8099DB7F2FF98314B2186A5E4059F3A6DB71ED41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0080B2D0, Relevance: .2, Instructions: 214COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.512790112.0000000000800000.00000040.00000001.sdmp, Offset: 00800000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3299bbf3f3564892ba795aebda03a70c291acfcf2afb52cc0e448333b58ac65
Instruction ID: 495a36241e5f18e9fbf722eb8d75e6f64517702d46dc593b21c7df238578fd2e
Opcode Fuzzy Hash: e3299bbf3f3564892ba795aebda03a70c291acfcf2afb52cc0e448333b58ac65
Instruction Fuzzy Hash: 7B81BA316006018FDB259F65EC587AEBBBAFB88301F14842CE50A9B7A5DF74AD41DB90

Uniqueness

Uniqueness Score: -1.00%

Function 00809A10, Relevance: .2, Instructions: 194COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.512790112.0000000000800000.00000040.00000001.sdmp, Offset: 00800000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b9b62921e558d625d75343a7e36c9fa4483542810cadd9413ed58c894d3643f
Instruction ID: c137c95718a737972378c4f5ff5821338313e353ef3b1d92d950ced65d061240
Opcode Fuzzy Hash: 9b9b62921e558d625d75343a7e36c9fa4483542810cadd9413ed58c894d3643f
Instruction Fuzzy Hash: 87810674A002048FDB54DF69DA84A9DBBF2FF48314B2186A8E455EB3A2DB31DD41CF60

Uniqueness

Uniqueness Score: -1.00%

Function 0080BF00, Relevance: .2, Instructions: 191COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.512790112.0000000000800000.00000040.00000001.sdmp, Offset: 00800000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7d64c3c787f40f8fa9508fa5c09683ff5671f0c34ab013491304d10e1429781
Instruction ID: c4f3a6f1e4ee423c883eac78829fa4f7669d1bd2380ca65629c99ac84b36810c
Opcode Fuzzy Hash: e7d64c3c787f40f8fa9508fa5c09683ff5671f0c34ab013491304d10e1429781
Instruction Fuzzy Hash: DC815674E1439ACFCB10CFA8C880AEDBBB1FF05314F154695E850AB391E775A989CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0080BAE8, Relevance: .2, Instructions: 181COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.512790112.0000000000800000.00000040.00000001.sdmp, Offset: 00800000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5e610bfca3adf0a6d6bd480396aa623a24f5ef10eb7b774e976e8a15851e5f6
Instruction ID: 1cc227979cbfae2023165a5d66bc0bbf97158c94dae97fcfbf9706423d43d615
Opcode Fuzzy Hash: b5e610bfca3adf0a6d6bd480396aa623a24f5ef10eb7b774e976e8a15851e5f6
Instruction Fuzzy Hash: 93814A34A11209DFCB54DF68D994AADBBF2FF44314F2189A8E505AB3A2DB34ED45CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00809490, Relevance: .2, Instructions: 165COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.512790112.0000000000800000.00000040.00000001.sdmp, Offset: 00800000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: add3b9721e704eff5661db7235b540106844b8ef7ee371bd38f5b39b05f949ab
Instruction ID: ea0ac24b1a50bbbbb9ba1fb5bea919c8de506fe9ff1feaa691c2f00d98009b41
Opcode Fuzzy Hash: add3b9721e704eff5661db7235b540106844b8ef7ee371bd38f5b39b05f949ab
Instruction Fuzzy Hash: B7518871B002149FCB58DB69D844AAEB7E2FF88310F14817AD915EB391EB36DC06CB90

Uniqueness

Uniqueness Score: -1.00%

Function 008087B9, Relevance: .2, Instructions: 159COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.512790112.0000000000800000.00000040.00000001.sdmp, Offset: 00800000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1307724d3dc0b27c2943656a85da8223d467027e6ead5c8fd98dbd619ae84139
Instruction ID: e9d7aab0b1f2faaba6a42118ed22bec29eb4deac15f78ca5573f1c20b289e171
Opcode Fuzzy Hash: 1307724d3dc0b27c2943656a85da8223d467027e6ead5c8fd98dbd619ae84139
Instruction Fuzzy Hash: E5516B34A11204CFD754DF68D894BADBBF2FF88310F54846AE941AB3A1DB35AC85CB60

Uniqueness

Uniqueness Score: -1.00%

Function 0080C16B, Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.512790112.0000000000800000.00000040.00000001.sdmp, Offset: 00800000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d07c6bf374c0dbf66db30a49cfd669499cf18236f9564afffac9e839c38fb830
Instruction ID: 66bf36a82bd87cdb3917ea45a54beaad3140ed1d54bcb3ec6838ce0290dba4a1
Opcode Fuzzy Hash: d07c6bf374c0dbf66db30a49cfd669499cf18236f9564afffac9e839c38fb830
Instruction Fuzzy Hash: 7D613530604208CFCB54DFA4D484AADBBB2FF89318F1189A8E5069F3A5DB35ED85CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0080BF80, Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.512790112.0000000000800000.00000040.00000001.sdmp, Offset: 00800000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c58afb8b6f802bf923dff3938d235193455e27108162e8ece171971c9552385
Instruction ID: afcc72a4aa65808bbf881305fad4027b7ef6f95ad1b3af2695e2f36ce58b7802
Opcode Fuzzy Hash: 2c58afb8b6f802bf923dff3938d235193455e27108162e8ece171971c9552385
Instruction Fuzzy Hash: 9161113491079ACFDB51CFA8C880ADDBBB1FF09314F154695E850BB392D771A989CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0080AE60, Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.512790112.0000000000800000.00000040.00000001.sdmp, Offset: 00800000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31769a43049514494c43a084a53314e28c418f111eecbac24b416e70dcbcb7ad
Instruction ID: 53fa734f0fa13074ef04844679d057b1537cc250907287f5b9d33b08eecfd6e5
Opcode Fuzzy Hash: 31769a43049514494c43a084a53314e28c418f111eecbac24b416e70dcbcb7ad
Instruction Fuzzy Hash: 47512574A042098FCB54DF68D584A9EB7F2FF48318F118999E905AB361DB31EE41CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 00802E50, Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.512790112.0000000000800000.00000040.00000001.sdmp, Offset: 00800000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76bb77474d3fda479b6469754659fc081fd01ecf81241123319ee8fb3efc6ac5
Instruction ID: 388a73b282e7cafaa379138035af84460410f47163f35905b67b06ab15a5142b
Opcode Fuzzy Hash: 76bb77474d3fda479b6469754659fc081fd01ecf81241123319ee8fb3efc6ac5
Instruction Fuzzy Hash: 3D519F34A0829A8FCB65CB78C454BAEBFB2BF49314F184498E455E7392DB749841CB60

Uniqueness

Uniqueness Score: -1.00%

Function 0080AEC0, Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.512790112.0000000000800000.00000040.00000001.sdmp, Offset: 00800000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2708d7d12de48dddeede52fa3aab47f46c1fc9a057bc86517b1d803fa6cbbcab
Instruction ID: 4b09f9ef857cf44afeab514f1725e95232f8861ca4e6d774e192034fb81881e7
Opcode Fuzzy Hash: 2708d7d12de48dddeede52fa3aab47f46c1fc9a057bc86517b1d803fa6cbbcab
Instruction Fuzzy Hash: 3C41E474A04209CFCB54DF68D684A99B7F1FF48318F118998E905AB761DB31EE45CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 00803792, Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.512790112.0000000000800000.00000040.00000001.sdmp, Offset: 00800000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5b5116b0085c2f0aaaf5b8a8620194a7dbfd6efc91a0467eeed1ee65d09628e
Instruction ID: a2e4e39913d0c3366cbeda47f446368f018ec6ccbc87aed18d5635192fe705f2
Opcode Fuzzy Hash: b5b5116b0085c2f0aaaf5b8a8620194a7dbfd6efc91a0467eeed1ee65d09628e
Instruction Fuzzy Hash: F531C470B042159FCB40DF68D8849AEBBF6FF89314B11896AD605DB3A1DB34AD45CBE0

Uniqueness

Uniqueness Score: -1.00%

Function 0080B1B8, Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.512790112.0000000000800000.00000040.00000001.sdmp, Offset: 00800000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca7f14ae3fe6325e0758f64aa6fed03bc1f7ff9183b27d56f22ca90790b0a547
Instruction ID: 38cb4deb2f084aeb1dc445586ed0362f07eeb9fa16f8be44e99aef7921905de4
Opcode Fuzzy Hash: ca7f14ae3fe6325e0758f64aa6fed03bc1f7ff9183b27d56f22ca90790b0a547
Instruction Fuzzy Hash: 3E313830A00218CFCB54DFA9D940A9EB7F6FF89318F158469D509EB3A4DB35AD418BA1

Uniqueness

Uniqueness Score: -1.00%

Function 00809826, Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.512790112.0000000000800000.00000040.00000001.sdmp, Offset: 00800000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be7986d8e5d33264c8e724902534dd5ce2e644f4dce99d1033f86abbed294a6c
Instruction ID: 32352ab3703827fd23c331e902e69359f004f0990e44c126547cfe9a985d1b08
Opcode Fuzzy Hash: be7986d8e5d33264c8e724902534dd5ce2e644f4dce99d1033f86abbed294a6c
Instruction Fuzzy Hash: D4214A303047008FD720DF25E984A6AB7E2FF85304F55CA79D18A8B6A6DB71F9498B91

Uniqueness

Uniqueness Score: -1.00%

Function 00800810, Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.512790112.0000000000800000.00000040.00000001.sdmp, Offset: 00800000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ed9552b5dbc667e6b6d2023660aa1b8fce577f15ee20843b9e0013f3fe91059
Instruction ID: a3900f632ec353d6574c22a317e545dfbdd15e6cb8a80fdcb57ae9aaababde0c
Opcode Fuzzy Hash: 4ed9552b5dbc667e6b6d2023660aa1b8fce577f15ee20843b9e0013f3fe91059
Instruction Fuzzy Hash: E611CE32F4C5108BE76956599C50B7EA29AFBC4724F158039DA4D9F3D0CFA6AC828BD0

Uniqueness

Uniqueness Score: -1.00%

Function 0080EB49, Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.512790112.0000000000800000.00000040.00000001.sdmp, Offset: 00800000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51d8b61c0a7fe935a1bb240437a13bcc6de6c01edafb6165bca756a138b9dfc4
Instruction ID: 15175da711a6e634c89622f9c4ed4063b120139fb3b818e028fad558c564dcb9
Opcode Fuzzy Hash: 51d8b61c0a7fe935a1bb240437a13bcc6de6c01edafb6165bca756a138b9dfc4
Instruction Fuzzy Hash: 2E014E317093604FC3218B24D95096BBBD5DF81364B09885BE845CB3D2C775DC49C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 008083C2, Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.512790112.0000000000800000.00000040.00000001.sdmp, Offset: 00800000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62ef8f0dd48b758dd99ad50f7fe8c3eb79e27655449381fa65a6fd4275d1349d
Instruction ID: 226ae3f155dce003cd680b7596672fb96effe5b230e9345d37cb664b99ab35bd
Opcode Fuzzy Hash: 62ef8f0dd48b758dd99ad50f7fe8c3eb79e27655449381fa65a6fd4275d1349d
Instruction Fuzzy Hash: 7C212634A10205CFCB05DF64E498E9DBBB2FF88315F1595A9E501AB3A1DB35E886CF50

Uniqueness

Uniqueness Score: -1.00%

Function 00B0D006, Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.519637547.0000000000B0D000.00000040.00000001.sdmp, Offset: 00B0D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a244f5f6d3ee887462dfdc1c07a53c6bb83ca16fefc1523692af6d9626ef3b1
Instruction ID: 3bfcf1f103b7a266578d2174896e2cf765e3049b7f19f9adf55456d12f5a4ed2
Opcode Fuzzy Hash: 7a244f5f6d3ee887462dfdc1c07a53c6bb83ca16fefc1523692af6d9626ef3b1
Instruction Fuzzy Hash: D0019E7140D3C05FD7124B258C94752BFA8EF53224F0980DBE9888F2E7D2685C49CB72

Uniqueness

Uniqueness Score: -1.00%

Function 00809B94, Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.512790112.0000000000800000.00000040.00000001.sdmp, Offset: 00800000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b31fea93039184d3d9003d34199e2bc95292c99bc07fc677676f2777ae16f5d
Instruction ID: 0a09e28315ac4c3c7c9550c4d8ebda0836c495e6da2c72ec75f208c07719a3d6
Opcode Fuzzy Hash: 8b31fea93039184d3d9003d34199e2bc95292c99bc07fc677676f2777ae16f5d
Instruction Fuzzy Hash: 14112870A042058FC710DF68EA4498CB7F1FF48328B218A94D455AB3E2CB31EE428F50

Uniqueness

Uniqueness Score: -1.00%

Function 0080EB58, Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.512790112.0000000000800000.00000040.00000001.sdmp, Offset: 00800000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0997d20b7f0d7b5673641d7f92bf9e46307da960e094c2950a726a4aaf66187
Instruction ID: 66d2c87facac87fa231622551486ebb96359db7c132fefe5cb64fcb85e0e3f87
Opcode Fuzzy Hash: e0997d20b7f0d7b5673641d7f92bf9e46307da960e094c2950a726a4aaf66187
Instruction Fuzzy Hash: 5C012B716093205FC320DB29D950A6BBBD9EFC0364F05896AE945CB391CBB0EC44C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 00B0D01D, Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.519637547.0000000000B0D000.00000040.00000001.sdmp, Offset: 00B0D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 602ddc726d6b45aed883fdc560f5897bd2ebd5369249703e7cca7adc9e442c19
Instruction ID: af77cae2cb539ddb220be743210d2cecc4ca0e83097e06e3984aca476a48f111
Opcode Fuzzy Hash: 602ddc726d6b45aed883fdc560f5897bd2ebd5369249703e7cca7adc9e442c19
Instruction Fuzzy Hash: 7801F77050C340AEE7104A66DCC4767BFC8EF42368F18849AFE485B2C6D3799945C6B1

Uniqueness

Uniqueness Score: -1.00%

Function 0080D8B8, Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.512790112.0000000000800000.00000040.00000001.sdmp, Offset: 00800000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a13caf1f9f69ef3367ec5525a71b1e4e90e2b356657ad01b437406a9937c404
Instruction ID: ff34ba55807f89e3e52b5053a711892b112695080141452c9984170afd3dc2e2
Opcode Fuzzy Hash: 4a13caf1f9f69ef3367ec5525a71b1e4e90e2b356657ad01b437406a9937c404
Instruction Fuzzy Hash: EE11C5756041098FCB44DFA8CA94E9DBBF1BB4C314F214698E445EB3A6DB31EE418FA0

Uniqueness

Uniqueness Score: -1.00%

Function 0080EA21, Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.512790112.0000000000800000.00000040.00000001.sdmp, Offset: 00800000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 683dd3405644b7dfd9f78da551c9a4dd161532a3d95e0500f982644bb54fba15
Instruction ID: f85afe693f96897f5f497f1bc4daa26a2f57442e184b81913df9c8a5750859e3
Opcode Fuzzy Hash: 683dd3405644b7dfd9f78da551c9a4dd161532a3d95e0500f982644bb54fba15
Instruction Fuzzy Hash: 08010070E05229CFDF54CFA9D8446AEBBB0FF18314F14446AD415E72D1D3385945CB51

Uniqueness

Uniqueness Score: -1.00%

Function 0080EA30, Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.512790112.0000000000800000.00000040.00000001.sdmp, Offset: 00800000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3499629669cf364ae1dbecf41a9b11ab75dbe022e48f060243a58f8109841323
Instruction ID: 2f2ea2edc24fed81176d8651851ad97f9be1ac8e2208dcc6ff68902df1ae58c9
Opcode Fuzzy Hash: 3499629669cf364ae1dbecf41a9b11ab75dbe022e48f060243a58f8109841323
Instruction Fuzzy Hash: 8D01A970E05229CFCF94DFA9D8446AEBBF5FF58305F108569D41AE7291E7389901CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0080EA53, Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.512790112.0000000000800000.00000040.00000001.sdmp, Offset: 00800000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9c3f033cc77e3e6f53bbd36bf974ed15de19844e6d7e5e1d3108d6f0ee786c0
Instruction ID: 76afa0bfe56e4eb0d8ccf88c0b08586878cfdae80c1491c65c7e23f0a2256d76
Opcode Fuzzy Hash: f9c3f033cc77e3e6f53bbd36bf974ed15de19844e6d7e5e1d3108d6f0ee786c0
Instruction Fuzzy Hash: ACF0F470A01219CFDF60CFA5C9447AEBBB1FF18308F055499D415A7291C7389805CB51

Uniqueness

Uniqueness Score: -1.00%

Function 0080E6EC, Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.512790112.0000000000800000.00000040.00000001.sdmp, Offset: 00800000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe414c8a15ba951661a2f7f2b45dcc888699fed69953f18be9c93875e6a99677
Instruction ID: 692622b0ab9f275443da04655e4d3418ec3c2a723d48d2842c455af039e310bf
Opcode Fuzzy Hash: fe414c8a15ba951661a2f7f2b45dcc888699fed69953f18be9c93875e6a99677
Instruction Fuzzy Hash: B5E0C23A6011149FC704CB99D484DCEB7B5EF9D228B654198E509ABB61CB32ED46CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 00803770, Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.512790112.0000000000800000.00000040.00000001.sdmp, Offset: 00800000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: edb4731bfa15d60843e010ee03badfd7a5fc491b4b6df81fee7de90f150a2e38
Instruction ID: cc4aff19ca509ab48b71e0df5b7519e648a4c74f13f79449d3ba34f462936352
Opcode Fuzzy Hash: edb4731bfa15d60843e010ee03badfd7a5fc491b4b6df81fee7de90f150a2e38
Instruction Fuzzy Hash: 62C00279610A308BCB659A24E44469AB3E5BF88725F05456DE58283684C7B9ED818A80

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0081E028, Relevance: 3.4, Strings: 2, Instructions: 947COMMON

Download Yara Rule

Strings

lo], xrefs: 0081F6D0
lo], xrefs: 0081E708

Memory Dump Source

Source File: 0000000D.00000002.512840359.0000000000810000.00000040.00000001.sdmp, Offset: 00810000, based on PE: false

Similarity

API ID:
String ID: lo]$lo]
API String ID: 0-1903763222
Opcode ID: 8ebb090c6c20a21dcff89185e6bb3b880efd2709403094378661f00b848aa4f0
Instruction ID: ab22825e6b7941066fd6280a383f8dcda4a59340ce4cd60ffe8b4f17d559cfd2
Opcode Fuzzy Hash: 8ebb090c6c20a21dcff89185e6bb3b880efd2709403094378661f00b848aa4f0
Instruction Fuzzy Hash: 2AA29474A012198FDB64DF68C994B9DBBF6BF48304F1085EAE909A7361DB319E81CF50

Uniqueness

Uniqueness Score: -1.00%

Function 0081F890, Relevance: .4, Instructions: 352COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.512840359.0000000000810000.00000040.00000001.sdmp, Offset: 00810000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7fa0e04460df0a644d1c4d33f2a03295bcb803ea020a62002fbf7f413fef744
Instruction ID: 490a39d3a659ed9421bc10dfe5bb8beb8b090cce11af6d8a413501d31cbdbcef
Opcode Fuzzy Hash: b7fa0e04460df0a644d1c4d33f2a03295bcb803ea020a62002fbf7f413fef744
Instruction Fuzzy Hash: 36C1E170B047008BCB24AB3598552AF7AEAEFC4708B09893DD606D7795EF38DD46CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0081BCF8, Relevance: .3, Instructions: 306COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.512840359.0000000000810000.00000040.00000001.sdmp, Offset: 00810000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db818364fbc5f56f619b344dd30a6e38a778624afa8bda4c2614d8e5bd407c3e
Instruction ID: 737cd4dd7448cee62fe2def308344af703b6f2b4e505936603a8cf2dc9b4d1f3
Opcode Fuzzy Hash: db818364fbc5f56f619b344dd30a6e38a778624afa8bda4c2614d8e5bd407c3e
Instruction Fuzzy Hash: 11C18E30A002049FCB15DFA5D859AAEBBF6FF88314F14846AE50AE7390DB35AD41DF51

Uniqueness

Uniqueness Score: -1.00%

Function 00801D13, Relevance: 10.3, Strings: 8, Instructions: 265COMMON

Download Yara Rule

Strings

$`], xrefs: 00801FFF
$`], xrefs: 00801E0E
$`], xrefs: 00801DB5
$`], xrefs: 00802057
$`], xrefs: 00802355
$`], xrefs: 008023C8
$`], xrefs: 00801EFA
$`], xrefs: 00801F80

Memory Dump Source

Source File: 0000000D.00000002.512790112.0000000000800000.00000040.00000001.sdmp, Offset: 00800000, based on PE: false

Similarity

API ID:
String ID: $`]$$`]$$`]$$`]$$`]$$`]$$`]$$`]
API String ID: 0-2268728624
Opcode ID: cd3b374d09e27ed0b4345473369727bfd45d598ad5a084a932ef7f82a835777d
Instruction ID: db42488ff9576d01b51ab39a5109a0adeb74752dba9732615a7acf51ca7f579c
Opcode Fuzzy Hash: cd3b374d09e27ed0b4345473369727bfd45d598ad5a084a932ef7f82a835777d
Instruction Fuzzy Hash: 95C12B30A00609CFDF64CFA4C948BAEBBB1FF54314F20856AC915EB794DB75A985CB60

Uniqueness

Uniqueness Score: -1.00%

Function 008024B1, Relevance: 5.1, Strings: 4, Instructions: 139COMMON

Download Yara Rule

Strings

$`], xrefs: 00802594
$`], xrefs: 008026D1
$`], xrefs: 00802642
$`], xrefs: 0080271A

Memory Dump Source

Source File: 0000000D.00000002.512790112.0000000000800000.00000040.00000001.sdmp, Offset: 00800000, based on PE: false

Similarity

API ID:
String ID: $`]$$`]$$`]$$`]
API String ID: 0-2249448199
Opcode ID: b8e8ee897c3de6589aca3202e0510a4842a66a43da286001e9203f56c7cc9102
Instruction ID: bb0a85df87d01528da7dab8ca13288018e2ef64f4cb66ee0704dd239bcd9cc1e
Opcode Fuzzy Hash: b8e8ee897c3de6589aca3202e0510a4842a66a43da286001e9203f56c7cc9102
Instruction Fuzzy Hash: E3510430A007188FDB64CF64C84479AB7B1FF55318F1086AAC459EB694EB71AE89CF51

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: powershell.exe PID: 6948 Parent PID: 4392 powershell.exeCOMMON

Executed Functions

Function 00DE1088, Relevance: 9.6, Strings: 7, Instructions: 864COMMON

Download Yara Rule

Strings

Xl, xrefs: 00DE1267
p\0k, xrefs: 00DE1441
p\0k, xrefs: 00DE11F9
p\0k, xrefs: 00DE10FE
p\0k, xrefs: 00DE1563
p\0k, xrefs: 00DE19B1
p\0k, xrefs: 00DE1768

Memory Dump Source

Source File: 0000000F.00000002.515970420.0000000000DE0000.00000040.00000001.sdmp, Offset: 00DE0000, based on PE: false

Similarity

API ID:
String ID: p\0k$p\0k$p\0k$p\0k$p\0k$p\0k$ Xl
API String ID: 0-3437126010
Opcode ID: 91b82426ab129a300712b9ab1cd884ddd68d2dae5b844ae008a5f80c0ac582c1
Instruction ID: e9be60f4d2f90adaaeacc809b12be809c4b7750a016d74ab88728331545f46da
Opcode Fuzzy Hash: 91b82426ab129a300712b9ab1cd884ddd68d2dae5b844ae008a5f80c0ac582c1
Instruction Fuzzy Hash: 3A822874B002148FCB54DF64D894BAEB7B2BF98304F1085A9D50AAB755DF34AD86CF90

Uniqueness

Uniqueness Score: -1.00%

Function 00DEAE70, Relevance: 3.9, Strings: 3, Instructions: 154COMMON

Download Yara Rule

Strings

(Rk, xrefs: 00DEAE99
(Rk, xrefs: 00DEAE8F
##, xrefs: 00DEAF19

Memory Dump Source

Source File: 0000000F.00000002.515970420.0000000000DE0000.00000040.00000001.sdmp, Offset: 00DE0000, based on PE: false

Similarity

API ID:
String ID: (Rk$(Rk$##
API String ID: 0-1843958456
Opcode ID: 61cfa14156be10edc2ee848ddee854ed76c1356c5173afe1e76ce678e79e2b76
Instruction ID: b5de238105aac9938ede7c1a4c2ec0ad1f84ddc649ab72df8989e5419fe2316e
Opcode Fuzzy Hash: 61cfa14156be10edc2ee848ddee854ed76c1356c5173afe1e76ce678e79e2b76
Instruction Fuzzy Hash: B3516C74710646CFCB04EF69C5989AAB7F2FF89714B1584A9E40ADB362DB30ED01CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00DE0CB0, Relevance: 2.8, Strings: 2, Instructions: 273COMMON

Download Yara Rule

Strings

p\0k, xrefs: 00DE0CE6
p\0k, xrefs: 00DE0D4F

Memory Dump Source

Source File: 0000000F.00000002.515970420.0000000000DE0000.00000040.00000001.sdmp, Offset: 00DE0000, based on PE: false

Similarity

API ID:
String ID: p\0k$p\0k
API String ID: 0-3784121238
Opcode ID: f120d0f021cee10f1a6ff7aa74f57878864672198dafec13db8d80827a192b99
Instruction ID: b308ab7125de6c05f3a3cf5c852eb0c74cdd35bad3e75f098e41623ff4180788
Opcode Fuzzy Hash: f120d0f021cee10f1a6ff7aa74f57878864672198dafec13db8d80827a192b99
Instruction Fuzzy Hash: 9FA16C74B042059FDB14EF74D890BAEB7A3BFC8304F148528E505AB395DF78AD468BA1

Uniqueness

Uniqueness Score: -1.00%

Function 00DE0CA1, Relevance: 2.7, Strings: 2, Instructions: 230COMMON

Download Yara Rule

Strings

p\0k, xrefs: 00DE0CE6
p\0k, xrefs: 00DE0D4F

Memory Dump Source

Source File: 0000000F.00000002.515970420.0000000000DE0000.00000040.00000001.sdmp, Offset: 00DE0000, based on PE: false

Similarity

API ID:
String ID: p\0k$p\0k
API String ID: 0-3784121238
Opcode ID: 053446a80bac45aabcefff70437d10af24d800718ca477bc178da8e38556f4fd
Instruction ID: ce8d1095b363d396787c78af920a9305eb6e3412de80d3977ae2eb7501a8fb5f
Opcode Fuzzy Hash: 053446a80bac45aabcefff70437d10af24d800718ca477bc178da8e38556f4fd
Instruction Fuzzy Hash: E1818C74B042059FDB14EF64D890BAEB7A3BFC8304F148528E505AB3A5DF74AD468BA1

Uniqueness

Uniqueness Score: -1.00%

Function 04875778, Relevance: 1.6, APIs: 1, Instructions: 90COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(00000000), ref: 04875740

Memory Dump Source

Source File: 0000000F.00000002.527064273.0000000004870000.00000040.00000001.sdmp, Offset: 04870000, based on PE: false

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: c2d14e922d1060e8eee63e3b7edd4fb6c5bb864877dfb3cfd4be013fda332b8c
Instruction ID: ac8384540ae46b42b310e01cd3f2debd46271026cfaf5a759494b6efb6d18015
Opcode Fuzzy Hash: c2d14e922d1060e8eee63e3b7edd4fb6c5bb864877dfb3cfd4be013fda332b8c
Instruction Fuzzy Hash: E831D170904219EFDB20DFA4D9547EFBBF0AF48308F008A58D145F7680D779AA45CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 048756C8, Relevance: 1.6, APIs: 1, Instructions: 59COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(00000000), ref: 04875740

Memory Dump Source

Source File: 0000000F.00000002.527064273.0000000004870000.00000040.00000001.sdmp, Offset: 04870000, based on PE: false

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 2b7957f58568980dabfcaea5d971d0abe9442bb605288abc1896ed73f601e790
Instruction ID: 577316f7b593b3e561317c3f9497f339732e75cff2d4a796a30d6e18d2454730
Opcode Fuzzy Hash: 2b7957f58568980dabfcaea5d971d0abe9442bb605288abc1896ed73f601e790
Instruction Fuzzy Hash: D52167B0D042199FCB10CF99D844ADEFBB4FB48314F00821AD818B7640C338A945CFE5

Uniqueness

Uniqueness Score: -1.00%

Function 04874004, Relevance: 1.6, APIs: 1, Instructions: 56COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(00000000), ref: 04875740

Memory Dump Source

Source File: 0000000F.00000002.527064273.0000000004870000.00000040.00000001.sdmp, Offset: 04870000, based on PE: false

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 4c9bd805f013d524af7db81c054689a21d20fb70e3a6e73976b4c74bd5424195
Instruction ID: 69f3da91bb6a0b48270cfa16182037679ee2ed8a7e32981675385b242ac60593
Opcode Fuzzy Hash: 4c9bd805f013d524af7db81c054689a21d20fb70e3a6e73976b4c74bd5424195
Instruction Fuzzy Hash: B12147B1D086599BCB10CF9AD44479EFBF4FB48354F10862AD918B3600D774A944CFE5

Uniqueness

Uniqueness Score: -1.00%

Function 0119ACB0, Relevance: 1.4, Instructions: 1370COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.516124975.0000000001190000.00000040.00000001.sdmp, Offset: 01190000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 897201055b3db96347b368afac7f4a8c40f0db7906c7dfa3a56c7d0f4306931d
Instruction ID: 36ba5aeae2b0e2c46e898335a403b649d9e04190614216a96ef97165fc514a38
Opcode Fuzzy Hash: 897201055b3db96347b368afac7f4a8c40f0db7906c7dfa3a56c7d0f4306931d
Instruction Fuzzy Hash: ADE23474A042199FCB65EB64C894BEEB7B2FF99300F1041E9D509AB7A0DB319E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 0119CC21, Relevance: 1.4, Strings: 1, Instructions: 111COMMON

Download Yara Rule

Strings

@ Xl, xrefs: 0119CD1B

Memory Dump Source

Source File: 0000000F.00000002.516124975.0000000001190000.00000040.00000001.sdmp, Offset: 01190000, based on PE: false

Similarity

API ID:
String ID: @ Xl
API String ID: 0-3027975150
Opcode ID: 7558270f7e8cdb00bfc9cf59fa8ea0d39b41e3de16d9db3502ab27d9c3f2af3c
Instruction ID: b4dda6d8872a757d98c22fc0a1ca61c411dfde69ca1cb299ddd60cd2fe8e1b5c
Opcode Fuzzy Hash: 7558270f7e8cdb00bfc9cf59fa8ea0d39b41e3de16d9db3502ab27d9c3f2af3c
Instruction Fuzzy Hash: 4D41BF706042059FCB08EF68D494BADBBF2FF89314F548929C5059B392CB70AD49CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 0119ACE5, Relevance: 1.4, Instructions: 1360COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.516124975.0000000001190000.00000040.00000001.sdmp, Offset: 01190000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40212befa2039026362bd5b7074d2d9552d45ec99d3dc781fdb08953786c970c
Instruction ID: ab02ff2b7d2e0a4062c033c4f3112b5b26beeebe8965cea4a42098f568743f29
Opcode Fuzzy Hash: 40212befa2039026362bd5b7074d2d9552d45ec99d3dc781fdb08953786c970c
Instruction Fuzzy Hash: CAE23474A042199FCB65EB64C894BEEB7B2FF99300F1041E9D509AB7A0DB319E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 0119CC38, Relevance: 1.3, Strings: 1, Instructions: 98COMMON

Download Yara Rule

Strings

@ Xl, xrefs: 0119CD1B

Memory Dump Source

Source File: 0000000F.00000002.516124975.0000000001190000.00000040.00000001.sdmp, Offset: 01190000, based on PE: false

Similarity

API ID:
String ID: @ Xl
API String ID: 0-3027975150
Opcode ID: 078973f34595432b88207516016a4d75af4c70e8b6a590d82d2434ff9b6f6a3f
Instruction ID: c07ac64104631d057598b0b04dede2f8fb74128d1cd94fb42bd3df17c99f2c72
Opcode Fuzzy Hash: 078973f34595432b88207516016a4d75af4c70e8b6a590d82d2434ff9b6f6a3f
Instruction Fuzzy Hash: 82319F706046059FCB08EF68E494BADBBF2FF88314F508929C515AB351CB70AD49CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 00DEBF21, Relevance: 1.3, Strings: 1, Instructions: 98COMMON

Download Yara Rule

Strings

Xl, xrefs: 00DEBF3C

Memory Dump Source

Source File: 0000000F.00000002.515970420.0000000000DE0000.00000040.00000001.sdmp, Offset: 00DE0000, based on PE: false

Similarity

API ID:
String ID: Xl
API String ID: 0-628407737
Opcode ID: 03f30813a782d028b8030c56e5723e89120401da5c366ea128b2103634fcb090
Instruction ID: 6504ecd266106fbebf2b02d5c72cfc64b843168da8ece305e8aaa60ccd28cd5f
Opcode Fuzzy Hash: 03f30813a782d028b8030c56e5723e89120401da5c366ea128b2103634fcb090
Instruction Fuzzy Hash: D5318B747086158FC704DB69C8A4AAE77B2FF89314B1544A9E206CB3A1CF31EC41CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0119AD88, Relevance: 1.3, Instructions: 1294COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.516124975.0000000001190000.00000040.00000001.sdmp, Offset: 01190000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72f692f1b71af7273d1d12822963017bd46fc32f7c5079b066e212347265a00d
Instruction ID: 0b197cf3b5e5ce7aa28abf573dd220da8dc73b0aa79bf3c855820cfe004f69be
Opcode Fuzzy Hash: 72f692f1b71af7273d1d12822963017bd46fc32f7c5079b066e212347265a00d
Instruction Fuzzy Hash: 6DD23374A042199FDB65EB64C894BEEB7B2FB99300F1081E9D509BB790CB319E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 00DE5710, Relevance: .5, Instructions: 528COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.515970420.0000000000DE0000.00000040.00000001.sdmp, Offset: 00DE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b80446e7759832044861e06aa2e86f6fb96b1716a460ed8b6e0f625cfaa9512f
Instruction ID: 79b4b9f94c150adc7f7ae25e6da1d33c89875e2d4b30817b69663ee09d53e221
Opcode Fuzzy Hash: b80446e7759832044861e06aa2e86f6fb96b1716a460ed8b6e0f625cfaa9512f
Instruction Fuzzy Hash: D4323834A00706CFCB15EFA5D9849AEB7B2FF89319B148969D4069B764CB31EC46CF60

Uniqueness

Uniqueness Score: -1.00%

Function 00DEB1F0, Relevance: .4, Instructions: 411COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.515970420.0000000000DE0000.00000040.00000001.sdmp, Offset: 00DE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 928f805448c1eec640093041acecad3ed95905a9433b5e0393bbdaccf7a8fdbe
Instruction ID: 32a025cdd0e4948c74214ae4f2e9309061a71dd507c02ef7e96637d02313b607
Opcode Fuzzy Hash: 928f805448c1eec640093041acecad3ed95905a9433b5e0393bbdaccf7a8fdbe
Instruction Fuzzy Hash: 5AF13974A042498FCB04EFA9D595AAEBBF2AF88314F158469D505EB361DB30EC41CB60

Uniqueness

Uniqueness Score: -1.00%

Function 01198E9D, Relevance: .4, Instructions: 378COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.516124975.0000000001190000.00000040.00000001.sdmp, Offset: 01190000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f50bb7ad02a4c460cb9f3989cb9ac850eb8da858494ee77ecef7dae798bcaa22
Instruction ID: 8690e74b5f96302cb84dbf71e983cc33cee844eee5746a402fab6bf429bd61ac
Opcode Fuzzy Hash: f50bb7ad02a4c460cb9f3989cb9ac850eb8da858494ee77ecef7dae798bcaa22
Instruction Fuzzy Hash: D0F19E30A0470ACFCB15DF68C980A99F7B2FF85314F15C699D559AB252DB30FA85CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00DE3EB8, Relevance: .3, Instructions: 313COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.515970420.0000000000DE0000.00000040.00000001.sdmp, Offset: 00DE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e4f2e83292b3aaa40e9527d13ec36bae054f1ebb1d8fe3af32cab311080a71e
Instruction ID: 822ca0139c453a7f9bda1ae613eb8a7a66f401cbc1afaec4822caa3d68553a33
Opcode Fuzzy Hash: 1e4f2e83292b3aaa40e9527d13ec36bae054f1ebb1d8fe3af32cab311080a71e
Instruction Fuzzy Hash: 04A14D34748662CB87892F6A982883DF6EB9FDA7063244005E093CB7E5CF74CD5257E6

Uniqueness

Uniqueness Score: -1.00%

Function 01198808, Relevance: .3, Instructions: 259COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.516124975.0000000001190000.00000040.00000001.sdmp, Offset: 01190000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0c20d2534f8f5759935028e7e14f0c3ba778e7eec8f9f5568941144be7b0699
Instruction ID: 07ec33b4467a27e90a7cf68c9f742a866775dfe6914ff7a371824819240034fa
Opcode Fuzzy Hash: a0c20d2534f8f5759935028e7e14f0c3ba778e7eec8f9f5568941144be7b0699
Instruction Fuzzy Hash: 7AA18A30A04248CFDB08DFA8D494AADBBF2FF89304F158469D511AB395DB74AD86CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00DE5701, Relevance: .2, Instructions: 234COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.515970420.0000000000DE0000.00000040.00000001.sdmp, Offset: 00DE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 785b23d39c86ebd4097b76bf76ace98191aed7392f60129513571a76a11ff2ea
Instruction ID: c8f217a4249edf0c6414247b77996cb6a4ecb64c55a66311c96b6de84faa6e2b
Opcode Fuzzy Hash: 785b23d39c86ebd4097b76bf76ace98191aed7392f60129513571a76a11ff2ea
Instruction Fuzzy Hash: DCA12534A00706CFCB14DFA5D58496EB7B2FF89305B148969D40A9B365DB31ED85CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 01196100, Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.516124975.0000000001190000.00000040.00000001.sdmp, Offset: 01190000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35377275457dce5bfc80c05ca13ec3e65207211acc659105dfa53d548d78207f
Instruction ID: b94c8fd9935390c1c4a410593f6fac602ae9523cb9beb308c84fd0bd5396a280
Opcode Fuzzy Hash: 35377275457dce5bfc80c05ca13ec3e65207211acc659105dfa53d548d78207f
Instruction Fuzzy Hash: 2A71AA306082459FCB04DF74E954AAE7BF2FF85309F1148B9D506CB7A1EB35AA45CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 011957A0, Relevance: .2, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.516124975.0000000001190000.00000040.00000001.sdmp, Offset: 01190000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6de87d87a3733c6fd1b35988bdd51978cf9a67030ec4fdb1ccfb1981ba325c1f
Instruction ID: 1ab65584d07d460ceeaf5f897105f5ef102f77df2515d5fedbd4771dd847f11f
Opcode Fuzzy Hash: 6de87d87a3733c6fd1b35988bdd51978cf9a67030ec4fdb1ccfb1981ba325c1f
Instruction Fuzzy Hash: 45612874E002199FCB05DFA9D884AEEBBF2FF88304F15846AE915AB351DB359D41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00DEBB97, Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.515970420.0000000000DE0000.00000040.00000001.sdmp, Offset: 00DE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e5e4f03920d83c79f7520930631b7596fedd063a329fb97f6b8520807318254
Instruction ID: 4d072c94d8e00a1ad65a98683cb3716d56538643cc83ecfa8acd28cc62384944
Opcode Fuzzy Hash: 9e5e4f03920d83c79f7520930631b7596fedd063a329fb97f6b8520807318254
Instruction Fuzzy Hash: 11516330708A96DFC7096B2A981897EBAA7EFD0759728405AD043C73B4CF74DD029772

Uniqueness

Uniqueness Score: -1.00%

Function 00DE511F, Relevance: .2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.515970420.0000000000DE0000.00000040.00000001.sdmp, Offset: 00DE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07abfbe1c85d76cc1d37b6a6a71c62dbebe01f8c52f0484f09f9f1f8f2262ce7
Instruction ID: 63c9f45767f18da5cdea75decc5fc10e360495ef2709ff648076a245480f30f2
Opcode Fuzzy Hash: 07abfbe1c85d76cc1d37b6a6a71c62dbebe01f8c52f0484f09f9f1f8f2262ce7
Instruction Fuzzy Hash: DE514E75A046458FCB15DF65D9988AEBBF1FF88304B1580A9E905EB365DB30EC01CF60

Uniqueness

Uniqueness Score: -1.00%

Function 00DE0AE8, Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.515970420.0000000000DE0000.00000040.00000001.sdmp, Offset: 00DE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9cdb37ff75f8e564e907433d823acff733cbdb4fc1de9937e65e06a177c1239
Instruction ID: 4ddbaf762030e02e39791c340cf644212730053c3160d3de72879391082a28ae
Opcode Fuzzy Hash: b9cdb37ff75f8e564e907433d823acff733cbdb4fc1de9937e65e06a177c1239
Instruction Fuzzy Hash: 21518B75B042458FCB14EF69D480AAABBF2EB89314B18C46DD519DB341D771DD82CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0119CF87, Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.516124975.0000000001190000.00000040.00000001.sdmp, Offset: 01190000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6b083c4e6992ea7c9b96f1cdb6d3b390eae2e2819afe89bb897ce5805934789
Instruction ID: 6aeacea1c9cc8390c0bd8564b23eb5729e788264fa9d6cc33444b5bb7b5144d7
Opcode Fuzzy Hash: f6b083c4e6992ea7c9b96f1cdb6d3b390eae2e2819afe89bb897ce5805934789
Instruction Fuzzy Hash: 81518D74A102049FDB14DFA8E894BADB7B2EF88301F158169E915AB3A1CB75AC45CB60

Uniqueness

Uniqueness Score: -1.00%

Function 01197AC8, Relevance: .1, Instructions: 141COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.516124975.0000000001190000.00000040.00000001.sdmp, Offset: 01190000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1bd4d3b150d6a306daf6eb35fd924c8b5536a2e4d5f33f71fc44897e9f035a0
Instruction ID: 43731a6cb681de239ae3b024d7566bd3dbace7f6d13ab066c7342c567348584f
Opcode Fuzzy Hash: f1bd4d3b150d6a306daf6eb35fd924c8b5536a2e4d5f33f71fc44897e9f035a0
Instruction Fuzzy Hash: 43418E6170E3841FD70727745C682AA3FB29F83640F1A80D7D682CF2E3EA184D49D7A2

Uniqueness

Uniqueness Score: -1.00%

Function 00DE0878, Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.515970420.0000000000DE0000.00000040.00000001.sdmp, Offset: 00DE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37ef359d6f201e9b4f010c5939d4c4b974c4d2573cf89710cb669a3d35a44bc1
Instruction ID: fd65dc03791ac83b4629509f264fe5115123b0d530ca4f3393bd01190774440f
Opcode Fuzzy Hash: 37ef359d6f201e9b4f010c5939d4c4b974c4d2573cf89710cb669a3d35a44bc1
Instruction Fuzzy Hash: 86517F30B002458FDB14DF66D984AAEBBF2FF88308F188629D445A7751DB74AD85CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 00DE0888, Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.515970420.0000000000DE0000.00000040.00000001.sdmp, Offset: 00DE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3ec57a9b9424f45628a3e3e1104f2b025ac9730f23b792da10be0493fa88341
Instruction ID: d32845de9e011a2450c963bcc8eba15c090ab131324a9ee4ee4c13002c82effe
Opcode Fuzzy Hash: d3ec57a9b9424f45628a3e3e1104f2b025ac9730f23b792da10be0493fa88341
Instruction Fuzzy Hash: 72513D70A002498FDB14DF66D984AAEBBF2FF88304F188629D545A7751DB74ED81CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 00DE5558, Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.515970420.0000000000DE0000.00000040.00000001.sdmp, Offset: 00DE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a477c647d025b43527858af6671ec34cf0fba80f8180f03a99585b45641b13d9
Instruction ID: 84fec807f20f076f40b16f5f177fb472986bcf5862b767f424b4b2c9b3b91867
Opcode Fuzzy Hash: a477c647d025b43527858af6671ec34cf0fba80f8180f03a99585b45641b13d9
Instruction Fuzzy Hash: 954126717096808FC724AB29E49496BBBA2EFC6345B1945BED105CB366CB30DC45CB71

Uniqueness

Uniqueness Score: -1.00%

Function 0119A5E0, Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.516124975.0000000001190000.00000040.00000001.sdmp, Offset: 01190000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f25fdc0fd512861a5a5bf2fe4d7d8c886d9dde679df25810526d7c22a183b6a
Instruction ID: bec6439c00a00d2cf27fad0c6bb778ccbf43ab5564fa2eb1413d81cb63661c44
Opcode Fuzzy Hash: 4f25fdc0fd512861a5a5bf2fe4d7d8c886d9dde679df25810526d7c22a183b6a
Instruction Fuzzy Hash: D351F434A083999FCF19CF78E050BBEBFB2AF45204F084499E4A2A7392D735D845CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0119A5F0, Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.516124975.0000000001190000.00000040.00000001.sdmp, Offset: 01190000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52919f169b440e61e07dedddcafe036b5111c928077f1c12af8bd526bef0bd4e
Instruction ID: 35f1c1a5408ea438746641f5f750879204c5d0525fc4e879151ba535edadf60f
Opcode Fuzzy Hash: 52919f169b440e61e07dedddcafe036b5111c928077f1c12af8bd526bef0bd4e
Instruction Fuzzy Hash: AB51D5349083999FDF19CF79E050BBEBFB2AF45204F084499E4A1A7392D735D845CB60

Uniqueness

Uniqueness Score: -1.00%

Function 0119A7F0, Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.516124975.0000000001190000.00000040.00000001.sdmp, Offset: 01190000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 556fbc8fff3a112bab575c5627cfea8adc425365d30898a23d7a020ab52a6fa2
Instruction ID: 595d112aa782509d40666703cf0dc4c467084ea61ec68cb47b7b8dcd3731f3e6
Opcode Fuzzy Hash: 556fbc8fff3a112bab575c5627cfea8adc425365d30898a23d7a020ab52a6fa2
Instruction Fuzzy Hash: 3741B1B0B042069FCB04EF78E49096EB7F2FF89204B114929D615DB351DB34AE05CB91

Uniqueness

Uniqueness Score: -1.00%

Function 01195B88, Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.516124975.0000000001190000.00000040.00000001.sdmp, Offset: 01190000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63d6ea1d970b3d2ef2c81f5aaebe26b2975b1a8a9dc0433e344e49faec07226b
Instruction ID: c1c61d64bbb61a25829d8c60d431b622ced4a86dd23cdbbb78ae5c3caaa21735
Opcode Fuzzy Hash: 63d6ea1d970b3d2ef2c81f5aaebe26b2975b1a8a9dc0433e344e49faec07226b
Instruction Fuzzy Hash: 9D41CE70B042559FDB09DBB8C8546BE7BA6FF84209F1044BED619AB790DB358E41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00DE06C0, Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.515970420.0000000000DE0000.00000040.00000001.sdmp, Offset: 00DE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72c8e10e9f6ea9ba850fd1bf276ce1a838fd35b6c26f2b32f888efb396fc78e3
Instruction ID: 3c1acbe260179f126078be1985eb4ef4cbead4a91fa61a18cf210ab1b6afe373
Opcode Fuzzy Hash: 72c8e10e9f6ea9ba850fd1bf276ce1a838fd35b6c26f2b32f888efb396fc78e3
Instruction Fuzzy Hash: A231B3343082414B9304BB3ADA5462B3BE6EFDD394B194129D606CB355DF70EC82CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00DE2930, Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.515970420.0000000000DE0000.00000040.00000001.sdmp, Offset: 00DE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 247ffa4ba134bf82424b09f33f621ae43822aaad207f8ff1ea993b7d3b097bb7
Instruction ID: ae37584c586a93b4ea91c7f4d24d9fa4ff975e5167f97f352a6f482ba80b2819
Opcode Fuzzy Hash: 247ffa4ba134bf82424b09f33f621ae43822aaad207f8ff1ea993b7d3b097bb7
Instruction Fuzzy Hash: F2416B78B042068FC714EF64D9989AEBBF2FF89305B108529D546DB761DB30ED85CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 01191E60, Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.516124975.0000000001190000.00000040.00000001.sdmp, Offset: 01190000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a68063fca0a87c986c458ea200c6069570b32cea0943506ddd86f6838338bfa3
Instruction ID: 89038d8e3d0f4d81c77b4509f7bad20c7a26eab1dc72b0a69e553142dd5847b6
Opcode Fuzzy Hash: a68063fca0a87c986c458ea200c6069570b32cea0943506ddd86f6838338bfa3
Instruction Fuzzy Hash: BC31C475A04209DFCF44DFA8E5809DDBBF1FF88308B158965E908AB325D771AE46CB90

Uniqueness

Uniqueness Score: -1.00%

Function 011996E8, Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.516124975.0000000001190000.00000040.00000001.sdmp, Offset: 01190000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7845b46222d4128bff00431045d65f00a030db4095dde6fa90c31c1ed55b6c61
Instruction ID: 0d3a28e31bf406e7bd81549629c6680ec32f683f5061aa2644fcfef4f33d28a8
Opcode Fuzzy Hash: 7845b46222d4128bff00431045d65f00a030db4095dde6fa90c31c1ed55b6c61
Instruction Fuzzy Hash: 2D315E76A08219DFCF09DF58C95499DBBB2FF49318F1140A9E505AB361DB359D01CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 011960F1, Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.516124975.0000000001190000.00000040.00000001.sdmp, Offset: 01190000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ef580a63696a83eda1de9f55449e5ecb63343ceabdfc3b564d360b2bacc8558
Instruction ID: 08aa3f8da2c6223020fc63e558619e6f1bb948d86809edabd0187882a5fb6157
Opcode Fuzzy Hash: 1ef580a63696a83eda1de9f55449e5ecb63343ceabdfc3b564d360b2bacc8558
Instruction Fuzzy Hash: 30316130208705DFC714DF24E985AAABBE1FF84308F408D29E5568B661DB71BA45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0119A7E0, Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.516124975.0000000001190000.00000040.00000001.sdmp, Offset: 01190000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 026b47145f1ce96cf03b2672aa8ca87965dffd8353e8a6396c1d614a1a82f902
Instruction ID: 1f99f4b6f0e9f160038d1052fd4d263b540a462cdd5b399c9cf831cfe4d009fc
Opcode Fuzzy Hash: 026b47145f1ce96cf03b2672aa8ca87965dffd8353e8a6396c1d614a1a82f902
Instruction Fuzzy Hash: 5431C7B5B042169FCB04DF68E4909AEB7B2FF89304B014969D619DB351DF30AD45CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 00DE5608, Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.515970420.0000000000DE0000.00000040.00000001.sdmp, Offset: 00DE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0dab6b738192370702e995b30953cdbe1ab001a1b78528e27d31ff000d110378
Instruction ID: 321f2d2943be3018ba2d8b61a172a29b3f9f0529363d95dec134597721721093
Opcode Fuzzy Hash: 0dab6b738192370702e995b30953cdbe1ab001a1b78528e27d31ff000d110378
Instruction Fuzzy Hash: E321B7307046818FC724BB1AE48497E77B7AB85748B68486EE006CB7A6DB70DC81CB71

Uniqueness

Uniqueness Score: -1.00%

Function 01195B78, Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.516124975.0000000001190000.00000040.00000001.sdmp, Offset: 01190000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 932b63794cbec9660b065e2dc7a3b802acfac2a93f906f4baa98de9b1a298bf3
Instruction ID: 7ebd9e89b663949277b083abc01efe6e35ad921a89126b7fe708c52f54fc973c
Opcode Fuzzy Hash: 932b63794cbec9660b065e2dc7a3b802acfac2a93f906f4baa98de9b1a298bf3
Instruction Fuzzy Hash: E8219E317002159FDB19CE79C8847BA7AAAFF84249F05847AE616DB360CB358942CB90

Uniqueness

Uniqueness Score: -1.00%

Function 01197B58, Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.516124975.0000000001190000.00000040.00000001.sdmp, Offset: 01190000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc93308ef6fae33cc4c3a3838118f956125bd1408de76982f431754319524283
Instruction ID: 597c8cf8071dff523344d2199da6d5bd97fa33b91747e16a4d52120dbbd84681
Opcode Fuzzy Hash: cc93308ef6fae33cc4c3a3838118f956125bd1408de76982f431754319524283
Instruction Fuzzy Hash: F5117C213482442BEB1927699CA873F2A969BC5B00F5480AAEA16CF3D4DF658D4287A1

Uniqueness

Uniqueness Score: -1.00%

Function 01192298, Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.516124975.0000000001190000.00000040.00000001.sdmp, Offset: 01190000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8562597e8fdf0b4615a749bb34be09cfb69cc87adac3f75cf9b773e8fefc372d
Instruction ID: fd0a0dbf34c0544cce4569372f5bc06ef7d31c7c2d6989e2f44499dd3b7ede04
Opcode Fuzzy Hash: 8562597e8fdf0b4615a749bb34be09cfb69cc87adac3f75cf9b773e8fefc372d
Instruction Fuzzy Hash: F421E272D057199FCB14DFA9D8805DEBBF1FF9D204B20856AE519B3610E730A980CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 011928A8, Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.516124975.0000000001190000.00000040.00000001.sdmp, Offset: 01190000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8610ca617fa020b93bb775b5db3d0169598e4bd634c2da6c708a31650f8b7716
Instruction ID: de63812874f62b9d331ab275a3ba036aeb140a60fc4583e9a88668791b313e87
Opcode Fuzzy Hash: 8610ca617fa020b93bb775b5db3d0169598e4bd634c2da6c708a31650f8b7716
Instruction Fuzzy Hash: 7E11C2353042269FC714AB28F8449AAF7E7FBC9229700893AE51AC7751DF30ED598B90

Uniqueness

Uniqueness Score: -1.00%

Function 00DE06B1, Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.515970420.0000000000DE0000.00000040.00000001.sdmp, Offset: 00DE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b04d5ef2ea12adfd42ab35dadedfa52ed9f324a9d0d46da0162f785a108d0e8a
Instruction ID: bab709fe578d5c35c7a97e4e0eb5164160da4d57a178dfb4f88e1f92385faefe
Opcode Fuzzy Hash: b04d5ef2ea12adfd42ab35dadedfa52ed9f324a9d0d46da0162f785a108d0e8a
Instruction Fuzzy Hash: 821125353083404FC314AB3AD95496A3FB6AFDA350719416EE106CB392CF70EC81CB61

Uniqueness

Uniqueness Score: -1.00%

Function 01195790, Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.516124975.0000000001190000.00000040.00000001.sdmp, Offset: 01190000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c76db1d99c62d12517927d314abad8f3314e35b1542a074281aa5c6f0a126cc5
Instruction ID: 0204af56a7e6161bf04c81914d5565f8a9123c4497cb7f6e18f0288b52299103
Opcode Fuzzy Hash: c76db1d99c62d12517927d314abad8f3314e35b1542a074281aa5c6f0a126cc5
Instruction Fuzzy Hash: A7212C74D002198FCF59DFA9D5554EDBBF2FF48240B01806AD815BB321EB349901CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 011929D8, Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.516124975.0000000001190000.00000040.00000001.sdmp, Offset: 01190000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80b05a88f576d7f2e84ef4b13163ee636f248837404c0aa69fe2011e58b2f34b
Instruction ID: b8c7f549354f5ff0b5ac542473106c556b570da8a60617ed23a1ef61c1f31031
Opcode Fuzzy Hash: 80b05a88f576d7f2e84ef4b13163ee636f248837404c0aa69fe2011e58b2f34b
Instruction Fuzzy Hash: 82115B71E04219ABEF28CBA5C854BEEBBF5AF48300F148029D511F7680DB799A41CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00DE2368, Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.515970420.0000000000DE0000.00000040.00000001.sdmp, Offset: 00DE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e401c3a4f7d1d34efc1535898173d8bcd2d4dadff1ed6258c1b0654f238d19a4
Instruction ID: 9c98e83359a42f3ee7afeb2b8e47e174a56c215a3e182beb856622c0fed5e6a6
Opcode Fuzzy Hash: e401c3a4f7d1d34efc1535898173d8bcd2d4dadff1ed6258c1b0654f238d19a4
Instruction Fuzzy Hash: 1701ADB7B082251B1314B67B784097EA78FDBE6371318823BE616CB391CE358C029774

Uniqueness

Uniqueness Score: -1.00%

Function 011996F8, Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.516124975.0000000001190000.00000040.00000001.sdmp, Offset: 01190000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6876ec255fcbf5ed693c7fb4dbc8c1f26761f9774d8606c18cf55425af5c6f34
Instruction ID: b7aeb5dfeab93bf1c2f8c795a3c746ce78fdc505ec8a7f8f478c82712a9f7188
Opcode Fuzzy Hash: 6876ec255fcbf5ed693c7fb4dbc8c1f26761f9774d8606c18cf55425af5c6f34
Instruction Fuzzy Hash: C721B475A04219CFCB08DF68DA9499DB7B2FF4C704B1104A8E502AB361DB39AD01CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 00DE45F0, Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.515970420.0000000000DE0000.00000040.00000001.sdmp, Offset: 00DE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ccd9e5e28d469addc566baf4c206767b2b220dcc60940b69d9b6178a92c7253b
Instruction ID: 9e78a7f8524698685193d6187151ea12e8a01a7f302167f16f824431fbfe5b12
Opcode Fuzzy Hash: ccd9e5e28d469addc566baf4c206767b2b220dcc60940b69d9b6178a92c7253b
Instruction Fuzzy Hash: DE016D357046518F9754AB2AE958D6EBBE6FFCA7513144079E40AC73A1CF30DC018B60

Uniqueness

Uniqueness Score: -1.00%

Function 00DE45E0, Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.515970420.0000000000DE0000.00000040.00000001.sdmp, Offset: 00DE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 703a4e7c2141b63ef8bb6ed3c0169ec09394528db58c68c50daf4e9549deecec
Instruction ID: ecdd6722c561d21e1e446430ed7dbf3cfa04866540b1f45136541154de99659a
Opcode Fuzzy Hash: 703a4e7c2141b63ef8bb6ed3c0169ec09394528db58c68c50daf4e9549deecec
Instruction Fuzzy Hash: BF116D75704651CFD7149B2AE958E6ABBE6FF8A35171440BDE90AC73A5CB30DC01CB60

Uniqueness

Uniqueness Score: -1.00%

Function 0119D369, Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.516124975.0000000001190000.00000040.00000001.sdmp, Offset: 01190000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc8a1a26410fb8135dabc6bf79fc28048648296bf5daabcd68daeb539003b3ad
Instruction ID: 26f4fbdbcffe7c6b8c38bcaa85fe86cb66aae5edc2a1ee271642f68f6fb77b1a
Opcode Fuzzy Hash: dc8a1a26410fb8135dabc6bf79fc28048648296bf5daabcd68daeb539003b3ad
Instruction Fuzzy Hash: 1C210A34A11205CFCB08DFA4E494E9DBBB2FF48315F159469D511AB3A1DB35E881CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 0123D006, Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.519347366.000000000123D000.00000040.00000001.sdmp, Offset: 0123D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7e5906b93eaaeb9595a670674bad06456130182add011fa67e56c7938ba81fa
Instruction ID: 104c7184c65ee525a1c193b0f876b033390d3157abff5d32f5f5e3bde545eb01
Opcode Fuzzy Hash: c7e5906b93eaaeb9595a670674bad06456130182add011fa67e56c7938ba81fa
Instruction Fuzzy Hash: 97016DA140D3C45FD7124B25CC94752BFA4EF43664F1980DBE9948F197C2695845CB72

Uniqueness

Uniqueness Score: -1.00%

Function 0123D01D, Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.519347366.000000000123D000.00000040.00000001.sdmp, Offset: 0123D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f87eb7879fdbb7f365e1c243b2e99196c0ce2f18396eebde7e3b7e7cb5ed97aa
Instruction ID: 0eafa21fb3951c7219852a2b13a6761169f897a4f990a0165e03b9dbeb52392e
Opcode Fuzzy Hash: f87eb7879fdbb7f365e1c243b2e99196c0ce2f18396eebde7e3b7e7cb5ed97aa
Instruction Fuzzy Hash: 5B01F7B141C3489EE7104E65DC84767FF98EF81BA8F08845AFF145B287C3B99545CAB1

Uniqueness

Uniqueness Score: -1.00%

Function 00DE3A80, Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.515970420.0000000000DE0000.00000040.00000001.sdmp, Offset: 00DE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4281e1df91466ff1096d7dbd4ca4cc1c0320fa3aec8f3e2c578240f03d335238
Instruction ID: 49c9ca92b57ffe8a1ff9718da8139e28b963be69a48423d2084eceb665456c3d
Opcode Fuzzy Hash: 4281e1df91466ff1096d7dbd4ca4cc1c0320fa3aec8f3e2c578240f03d335238
Instruction Fuzzy Hash: C7F08B7B70C2810FE3258B1AB494BE57BE78FE2256F09416EC00AC33D3C9108C0AC791

Uniqueness

Uniqueness Score: -1.00%

Function 01195814, Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.516124975.0000000001190000.00000040.00000001.sdmp, Offset: 01190000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe4e769694db015f586c10bcc476925e88c36b18ef09411dbc6911ec8c2d99af
Instruction ID: 4a7c62fd5ce3059ece34ee13fdda800d62ad0ffe5123f7ed95f9e44c0dfeb62a
Opcode Fuzzy Hash: fe4e769694db015f586c10bcc476925e88c36b18ef09411dbc6911ec8c2d99af
Instruction Fuzzy Hash: 2401FB35F002158FCB45EFA4E5959BDB7B2EF88705F014455EA12AB3A0DB75AD02CB90

Uniqueness

Uniqueness Score: -1.00%

Function 01192981, Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.516124975.0000000001190000.00000040.00000001.sdmp, Offset: 01190000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e4bd1b9ccd6a54a92f05156d00dc70024272c9182541d23b5b50b344aaca270
Instruction ID: 2b0400640ae8a15688acc80bdd3645ae9fdb38d6eb68048203d2fc631be38b3f
Opcode Fuzzy Hash: 9e4bd1b9ccd6a54a92f05156d00dc70024272c9182541d23b5b50b344aaca270
Instruction Fuzzy Hash: 35E092323051505B97058B6EA8106AEBBAADFC526132880BFD50EC3361DF628D078BA1

Uniqueness

Uniqueness Score: -1.00%

Function 0119D4A7, Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.516124975.0000000001190000.00000040.00000001.sdmp, Offset: 01190000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45ef6bd5a511383a4fc738d907a8f6db6601b93a86d58bba890b621420087e2a
Instruction ID: c8cf8dc775adbea05c7782180e28194c845442e243ea5976e435678a84f73cea
Opcode Fuzzy Hash: 45ef6bd5a511383a4fc738d907a8f6db6601b93a86d58bba890b621420087e2a
Instruction Fuzzy Hash: 8A01CD35A11209CFCB04DF98E899BDDBB72FB88321F146116E506A77A0CB716D42CF60

Uniqueness

Uniqueness Score: -1.00%

Function 00DE3AA8, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.515970420.0000000000DE0000.00000040.00000001.sdmp, Offset: 00DE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6fc5ea566f10a22df88c1d633d4f3b90fa24c93abf6b038d20d8f5c82ac6bdf
Instruction ID: 7706199193c8af40bc882b4a2dccfeaa3b9073b0a220a39452a82b9ab7d42110
Opcode Fuzzy Hash: d6fc5ea566f10a22df88c1d633d4f3b90fa24c93abf6b038d20d8f5c82ac6bdf
Instruction Fuzzy Hash: 0BE0D8363042115B47109B5EF488C26B7EADFC5625308802AE109C3322CB60DC068760

Uniqueness

Uniqueness Score: -1.00%

Function 0119580B, Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.516124975.0000000001190000.00000040.00000001.sdmp, Offset: 01190000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22b5027465fc1a16b52cc49ce9f1b73b81b718c5ce5c21bbbeb3eb2a85c06a16
Instruction ID: b04f5662cfde9f8bf235bace24bd91fd9055cfa3f595530bab9dc03b82730444
Opcode Fuzzy Hash: 22b5027465fc1a16b52cc49ce9f1b73b81b718c5ce5c21bbbeb3eb2a85c06a16
Instruction Fuzzy Hash: 8CE0C935E041198FCF59DF94E5818EDB3B2AF44258B028496DD21AB361D774AD01CB91

Uniqueness

Uniqueness Score: -1.00%

Function 01195802, Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.516124975.0000000001190000.00000040.00000001.sdmp, Offset: 01190000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22b5027465fc1a16b52cc49ce9f1b73b81b718c5ce5c21bbbeb3eb2a85c06a16
Instruction ID: b04f5662cfde9f8bf235bace24bd91fd9055cfa3f595530bab9dc03b82730444
Opcode Fuzzy Hash: 22b5027465fc1a16b52cc49ce9f1b73b81b718c5ce5c21bbbeb3eb2a85c06a16
Instruction Fuzzy Hash: 8CE0C935E041198FCF59DF94E5818EDB3B2AF44258B028496DD21AB361D774AD01CB91

Uniqueness

Uniqueness Score: -1.00%

Function 01195B40, Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.516124975.0000000001190000.00000040.00000001.sdmp, Offset: 01190000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 439a2e7fc69e8b5c07e7582026dcf6d40e4f8af65134d5f9f10c13860b296888
Instruction ID: 0c8df65aab395b5c611b159ad73949ed3684ba91c21c24262200bcdfc37aefd1
Opcode Fuzzy Hash: 439a2e7fc69e8b5c07e7582026dcf6d40e4f8af65134d5f9f10c13860b296888
Instruction Fuzzy Hash: 24E04F35208B80CFDB268B20E490A87B7A1EB45308B05484AD19687A22C360BC46CF40

Uniqueness

Uniqueness Score: -1.00%

Function 0119A7C0, Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.516124975.0000000001190000.00000040.00000001.sdmp, Offset: 01190000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19d0d63cb913a7d094a0db4a8fc9d96bab3212d64d5e658457b166939ebc4695
Instruction ID: 78c2d318ef194b131ebc0a2196d07ce96279f7c3218bf0394f8c3b8d70f9a2a1
Opcode Fuzzy Hash: 19d0d63cb913a7d094a0db4a8fc9d96bab3212d64d5e658457b166939ebc4695
Instruction Fuzzy Hash: CCC01235600A308FCB298A28E00469A73F6BB48610F000519E64243A00C7B6AC418B80

Uniqueness

Uniqueness Score: -1.00%

Function 00DE42CE, Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.515970420.0000000000DE0000.00000040.00000001.sdmp, Offset: 00DE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1031db39071535b0f68e0a54f2e7f405f2f95df40198692dedc5f46d7bf1a229
Instruction ID: f175268dd15963f3d094112e8510485151c16c69e3eeeba53098fd15e9d8ef24
Opcode Fuzzy Hash: 1031db39071535b0f68e0a54f2e7f405f2f95df40198692dedc5f46d7bf1a229
Instruction Fuzzy Hash: 04B0123B34816547050426CB740486CE35ADAC023B3204123D10AC0150CB21881205A0

Uniqueness

Uniqueness Score: -1.00%

Function 00DE432B, Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.515970420.0000000000DE0000.00000040.00000001.sdmp, Offset: 00DE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9bba6c89e4df58ff8e33c5dd6295384eae0439e198b271ba08b18755ead56185
Instruction ID: e362c708e0d74cc13c76ca611ee718ccbd9c5625b0ee99ec66a678f2d9e98b01
Opcode Fuzzy Hash: 9bba6c89e4df58ff8e33c5dd6295384eae0439e198b271ba08b18755ead56185
Instruction Fuzzy Hash: A1B01237345161470504268A74144BCE31AD7C813B3300163D11BC1150CF214A5209B1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: powershell.exe PID: 7008 Parent PID: 4392 powershell.exeCOMMON

Executed Functions

Function 00398458, Relevance: 10.8, Strings: 8, Instructions: 770COMMON

Download Yara Rule

Strings

p\0k, xrefs: 00398811
p\0k, xrefs: 003984CE
p\0k, xrefs: 00398B38
605, xrefs: 00398A1E
Xl, xrefs: 00398637
p\0k, xrefs: 00398933
p\0k, xrefs: 003985C9
p\0k, xrefs: 00398D81

Memory Dump Source

Source File: 00000010.00000002.512088417.0000000000390000.00000040.00000001.sdmp, Offset: 00390000, based on PE: false

Similarity

API ID:
String ID: 605$p\0k$p\0k$p\0k$p\0k$p\0k$p\0k$ Xl
API String ID: 0-4056645869
Opcode ID: dfd3c6f1804f89417255c6cfec7e74c59cc588dcfcfe9eb1bfad30537aaeb58d
Instruction ID: 60b6f51913b8b273a553d8f044e2f3c4341a18606071e1e1d0f77ed57560883f
Opcode Fuzzy Hash: dfd3c6f1804f89417255c6cfec7e74c59cc588dcfcfe9eb1bfad30537aaeb58d
Instruction Fuzzy Hash: E7625B74B002148FCB54DF68D895BAEB7B2AF88304F1184A9D50AEB395DF34AD85CF90

Uniqueness

Uniqueness Score: -1.00%

Function 006E7F38, Relevance: 2.0, Strings: 1, Instructions: 761COMMON

Download Yara Rule

Strings

#, xrefs: 006E7F87

Memory Dump Source

Source File: 00000010.00000002.521398057.00000000006E0000.00000040.00000001.sdmp, Offset: 006E0000, based on PE: false

Similarity

API ID:
String ID: #
API String ID: 0-1885708031
Opcode ID: d7b65e3dd8cdff006406cb3502cbf923fc4dc4a451cda666658821596dbcf829
Instruction ID: fbc7e5e84545b637e8096d5c0ad3d6da601e9956eb8349d48c26c367e7c71557
Opcode Fuzzy Hash: d7b65e3dd8cdff006406cb3502cbf923fc4dc4a451cda666658821596dbcf829
Instruction Fuzzy Hash: 7B72F274A01358CFDB25CF65C884BD9BBB2BF48305F1084A9E90AAB390DB759D86DF50

Uniqueness

Uniqueness Score: -1.00%

Function 006EAFD0, Relevance: .7, Instructions: 737COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.521398057.00000000006E0000.00000040.00000001.sdmp, Offset: 006E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22a1de954348222b3928bf07cc4659c9e090809079e25daa164569f3a8cb85b0
Instruction ID: a9d37b99bbb6b7829540b7d65252adb062cdd50304c715873efd4b315a3f62e2
Opcode Fuzzy Hash: 22a1de954348222b3928bf07cc4659c9e090809079e25daa164569f3a8cb85b0
Instruction Fuzzy Hash: AD52BC34A013449FDB15DF65D854BAEBBF3AF88304F248469E906AB3A5CB34ED45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0039CA80, Relevance: 9.3, Strings: 7, Instructions: 506COMMON

Download Yara Rule

Strings

LG7, xrefs: 0039D001
,A7, xrefs: 0039CB10
lB7, xrefs: 0039CEAE
,A7, xrefs: 0039CB73
LG7, xrefs: 0039CD6E
lB7, xrefs: 0039CD32
LG7, xrefs: 0039CFBC

Memory Dump Source

Source File: 00000010.00000002.512088417.0000000000390000.00000040.00000001.sdmp, Offset: 00390000, based on PE: false

Similarity

API ID:
String ID: ,A7$,A7$LG7$LG7$LG7$lB7$lB7
API String ID: 0-3513381359
Opcode ID: ec650bded91a3a95aec20dc9c42ac0f5a8412db412e99db708d875d332a868c1
Instruction ID: 00986ac7c369788542f8bd2163a34fd33b39114673a111c4e08ba4d9b8aadf33
Opcode Fuzzy Hash: ec650bded91a3a95aec20dc9c42ac0f5a8412db412e99db708d875d332a868c1
Instruction Fuzzy Hash: 22221734A00305CFCB2ADFA4D5849ADB7B2FF89315F118969D51A9B764CB35EC86CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00399048, Relevance: 4.2, Strings: 3, Instructions: 435COMMON

Download Yara Rule

Strings

p\0k, xrefs: 00399093
{~gm^, xrefs: 003993B2
[~gm^, xrefs: 00399476

Memory Dump Source

Source File: 00000010.00000002.512088417.0000000000390000.00000040.00000001.sdmp, Offset: 00390000, based on PE: false

Similarity

API ID:
String ID: p\0k$[~gm^${~gm^
API String ID: 0-1567412047
Opcode ID: d3e7379acd72572d12d994c598edb4d8782fdf29863dfa76a05afbae4478a89c
Instruction ID: 30d6e627bbb7c456477c53d616be6647a1f549c5c02b05aa4d5af6c36e556c58
Opcode Fuzzy Hash: d3e7379acd72572d12d994c598edb4d8782fdf29863dfa76a05afbae4478a89c
Instruction Fuzzy Hash: 0D027D34B042099FCB15DFA8D994AAEB7F6AF88344F158429E506EB355DF30EC46CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00397DC8, Relevance: 4.0, Strings: 3, Instructions: 273COMMON

Download Yara Rule

Strings

[4, xrefs: 00397F68
p\0k, xrefs: 00397E67
p\0k, xrefs: 00397DFE

Memory Dump Source

Source File: 00000010.00000002.512088417.0000000000390000.00000040.00000001.sdmp, Offset: 00390000, based on PE: false

Similarity

API ID:
String ID: p\0k$p\0k$[4
API String ID: 0-470512276
Opcode ID: 0f97cb6fa20edfdd6471ef00c6e74878516289d3a6a6736fae9c76d9bbc69f0d
Instruction ID: c13b84408f379d8888d081879c10b1657f8161c04a315d4e0cd530796a3e2680
Opcode Fuzzy Hash: 0f97cb6fa20edfdd6471ef00c6e74878516289d3a6a6736fae9c76d9bbc69f0d
Instruction Fuzzy Hash: 49A1AF34B042049FDB04DF74D891BAFB7A3AFC8344F158428E906AB395DF38AD469B95

Uniqueness

Uniqueness Score: -1.00%

Function 0039CA70, Relevance: 4.0, Strings: 3, Instructions: 234COMMON

Download Yara Rule

Strings

,A7, xrefs: 0039CB73
LG7, xrefs: 0039CD6E
lB7, xrefs: 0039CD32

Memory Dump Source

Source File: 00000010.00000002.512088417.0000000000390000.00000040.00000001.sdmp, Offset: 00390000, based on PE: false

Similarity

API ID:
String ID: ,A7$LG7$lB7
API String ID: 0-932037183
Opcode ID: 9a2fd03bce1c766f736a0f450cef127be335d99f67b919a9514ba9e2cd050d96
Instruction ID: 481b69b52d30d1c581e203a9a0423fc99cbe1b244f265bb2609a2d1ce355830d
Opcode Fuzzy Hash: 9a2fd03bce1c766f736a0f450cef127be335d99f67b919a9514ba9e2cd050d96
Instruction Fuzzy Hash: EDA11634A00205CFCB2ADFA4C58496EB7F2FF89305F118569D51A9B764CB35EC86CB81

Uniqueness

Uniqueness Score: -1.00%

Function 006E7A80, Relevance: 2.9, Strings: 2, Instructions: 378COMMON

Download Yara Rule

Strings

lDv, xrefs: 006E7A9C
@ Xl, xrefs: 006E7DF9

Memory Dump Source

Source File: 00000010.00000002.521398057.00000000006E0000.00000040.00000001.sdmp, Offset: 006E0000, based on PE: false

Similarity

API ID:
String ID: @ Xl$lDv
API String ID: 0-2096324843
Opcode ID: c8b27160f0df145c4ce5365d0d2744c27dbf25f2c3964ab9ed1efb974994c791
Instruction ID: 50da0d389499de3d837360fcab7945613a8753a691bd32220a56569d6a8b273e
Opcode Fuzzy Hash: c8b27160f0df145c4ce5365d0d2744c27dbf25f2c3964ab9ed1efb974994c791
Instruction Fuzzy Hash: F4F19134A09249DFCB15CF69C584AAEBBF2FF88314F2585A9D5059B361C731EC46CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0039C4A0, Relevance: 2.7, Strings: 2, Instructions: 195COMMON

Download Yara Rule

Strings

Zr5, xrefs: 0039C4EF
p=7, xrefs: 0039C670

Memory Dump Source

Source File: 00000010.00000002.512088417.0000000000390000.00000040.00000001.sdmp, Offset: 00390000, based on PE: false

Similarity

API ID:
String ID: Zr5$p=7
API String ID: 0-2618707763
Opcode ID: aa3e6e2fdac81053e41e333c2e687b594628d1e3cf6c53bf26bfe04173bfd402
Instruction ID: c61332507a48db2ca16daa032d345c3a76ca3ce51748203aaf45b4beee8b5c19
Opcode Fuzzy Hash: aa3e6e2fdac81053e41e333c2e687b594628d1e3cf6c53bf26bfe04173bfd402
Instruction Fuzzy Hash: 0B715A75B041088FCB05DF68D9889AEBBF6FF89311B25846AE509EB361DB31EC41CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00388BA8, Relevance: 2.7, Strings: 2, Instructions: 174COMMON

Download Yara Rule

Strings

U;, xrefs: 00388D3B
U;, xrefs: 00388D59

Memory Dump Source

Source File: 00000010.00000002.511565285.0000000000380000.00000040.00000001.sdmp, Offset: 00380000, based on PE: false

Similarity

API ID:
String ID: U;$U;
API String ID: 0-1725397357
Opcode ID: cf1b3f9cb5171bd3a9c50b4a7660563cd3b5000036670016c64ec7f587415667
Instruction ID: 9506864523aed026ebf7d779cc3bcea8145d8a62c0fdd7d5204da628273a4bc5
Opcode Fuzzy Hash: cf1b3f9cb5171bd3a9c50b4a7660563cd3b5000036670016c64ec7f587415667
Instruction Fuzzy Hash: 6E716C30A04209CFCB19EFA5C544AAEB7B2FF84304F658569D405AF3A5DB74ED4ACB90

Uniqueness

Uniqueness Score: -1.00%

Function 0039EB28, Relevance: 2.6, Strings: 2, Instructions: 145COMMON

Download Yara Rule

Strings

(Rk, xrefs: 0039EB37
(Rk, xrefs: 0039EB41

Memory Dump Source

Source File: 00000010.00000002.512088417.0000000000390000.00000040.00000001.sdmp, Offset: 00390000, based on PE: false

Similarity

API ID:
String ID: (Rk$(Rk
API String ID: 0-447046401
Opcode ID: 4bcf8a7ebe121ec5848a8c74ad9f739ed6ca2d8e6125dbba95195d3f6e89a963
Instruction ID: b55e9424e68df27b70b38bc3a4303f5238ec7ffb74d380e585095546b35ac210
Opcode Fuzzy Hash: 4bcf8a7ebe121ec5848a8c74ad9f739ed6ca2d8e6125dbba95195d3f6e89a963
Instruction Fuzzy Hash: 1B511534B045058FDB55DF29C598AAAB7F2EF88714B2584A9E40ADB362DB30EC41CF50

Uniqueness

Uniqueness Score: -1.00%

Function 00388B98, Relevance: 2.6, Strings: 2, Instructions: 128COMMON

Download Yara Rule

Strings

U;, xrefs: 00388D3B
U;, xrefs: 00388D59

Memory Dump Source

Source File: 00000010.00000002.511565285.0000000000380000.00000040.00000001.sdmp, Offset: 00380000, based on PE: false

Similarity

API ID:
String ID: U;$U;
API String ID: 0-1725397357
Opcode ID: 4fa8ad6bc7dfe5251fc7672998940bca0b07263d0f39c2dd1df7863bf8ec4e00
Instruction ID: c43e9ae6dff8a6f0ee0b91477fb1d0d53e19f44ad0ba73dde030f2757969e93e
Opcode Fuzzy Hash: 4fa8ad6bc7dfe5251fc7672998940bca0b07263d0f39c2dd1df7863bf8ec4e00
Instruction Fuzzy Hash: EA517A30A00309CFCB19EF55D544A9EB7B2BF84304F2585A9E401AF3A5DB74AE8ACB40

Uniqueness

Uniqueness Score: -1.00%

Function 00387D48, Relevance: 2.6, Strings: 2, Instructions: 117COMMON

Download Yara Rule

Strings

E;, xrefs: 00387E0F
0G;, xrefs: 00387E36

Memory Dump Source

Source File: 00000010.00000002.511565285.0000000000380000.00000040.00000001.sdmp, Offset: 00380000, based on PE: false

Similarity

API ID:
String ID: E;$0G;
API String ID: 0-3736934837
Opcode ID: 632d070124e3cc7d0bfdf9314d7cde57e2dfc1f5d83d2cb371c699a5b3895fbb
Instruction ID: 31e4e299974b16c854bcc2fcfcf9ca985ae64cdf022d26dc1d37c2beb75296b6
Opcode Fuzzy Hash: 632d070124e3cc7d0bfdf9314d7cde57e2dfc1f5d83d2cb371c699a5b3895fbb
Instruction Fuzzy Hash: 0C4144603083844BD71A6B34986577A3B929F82708F1940ADEA42CF3C6DE64DC468791

Uniqueness

Uniqueness Score: -1.00%

Function 006E6660, Relevance: 2.6, Strings: 2, Instructions: 74COMMON

Download Yara Rule

Strings

3v, xrefs: 006E66A4
Agn, xrefs: 006E6723

Memory Dump Source

Source File: 00000010.00000002.521398057.00000000006E0000.00000040.00000001.sdmp, Offset: 006E0000, based on PE: false

Similarity

API ID:
String ID: Agn$3v
API String ID: 0-3714320488
Opcode ID: 6d9662a656a210dc4c0f9de130f45310bca013d0fd3a36dc71e948df1f9f8385
Instruction ID: 39eaaaafeadc20bff246f1fd54452d8f4c3c83969f58d9abaee71dc13584b3f2
Opcode Fuzzy Hash: 6d9662a656a210dc4c0f9de130f45310bca013d0fd3a36dc71e948df1f9f8385
Instruction Fuzzy Hash: 4B219A357042059FCB14DF69D494AAEFBF6FB88354F148A29E906AB340CB71AD46CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 003836B8, Relevance: 2.3, Strings: 1, Instructions: 1006COMMON

Download Yara Rule

Strings

,S:, xrefs: 003837E0

Memory Dump Source

Source File: 00000010.00000002.511565285.0000000000380000.00000040.00000001.sdmp, Offset: 00380000, based on PE: false

Similarity

API ID:
String ID: ,S:
API String ID: 0-2576134579
Opcode ID: ae1f97d093e032db991ce7968eff3b7b50e1c70db1f2a62ecc3ca7bf5ab676af
Instruction ID: 1a66f2c45fb0f02c034b05d1abf8378f9d4c64e8a8edef4bb6f46c0dafa3287f
Opcode Fuzzy Hash: ae1f97d093e032db991ce7968eff3b7b50e1c70db1f2a62ecc3ca7bf5ab676af
Instruction Fuzzy Hash: 72828D357042148FCB55EF68C894E6EB7B2FF89704B1285E8E50A9B761CB30ED85CB91

Uniqueness

Uniqueness Score: -1.00%

Function 003954C0, Relevance: 1.5, Strings: 1, Instructions: 286COMMON

Download Yara Rule

Strings

L1Rk, xrefs: 00395529

Memory Dump Source

Source File: 00000010.00000002.512088417.0000000000390000.00000040.00000001.sdmp, Offset: 00390000, based on PE: false

Similarity

API ID:
String ID: L1Rk
API String ID: 0-2277650488
Opcode ID: cc764eb6ecdc3728e703f43cbab8305389ff586b9be96fce89bee2f501b573e3
Instruction ID: fbe6b7c1926ecd83bd0f20a999b83ce6c065f764d6033fa9c5a70c702a2f1fae
Opcode Fuzzy Hash: cc764eb6ecdc3728e703f43cbab8305389ff586b9be96fce89bee2f501b573e3
Instruction Fuzzy Hash: 0AC16C70704B05DFCB55DF65E5849AEB7F6BF88308B118928D6069B760DB30ED85CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00395470, Relevance: 1.5, Strings: 1, Instructions: 256COMMON

Download Yara Rule

Strings

L1Rk, xrefs: 00395529

Memory Dump Source

Source File: 00000010.00000002.512088417.0000000000390000.00000040.00000001.sdmp, Offset: 00390000, based on PE: false

Similarity

API ID:
String ID: L1Rk
API String ID: 0-2277650488
Opcode ID: 87bce517fc19dedfc93e0766555ea2019b7d12aa8e6dd388e8b7d138339c7d04
Instruction ID: 46ea587a236bda25fb737fa3c4e63dda613eee9944664b66f5a488530ea75d8f
Opcode Fuzzy Hash: 87bce517fc19dedfc93e0766555ea2019b7d12aa8e6dd388e8b7d138339c7d04
Instruction Fuzzy Hash: 13A1B130604705CFCB52DF65E580AAEBBF1BF49308B018969D546DB761DB30ED85CB90

Uniqueness

Uniqueness Score: -1.00%

Function 006ED8E0, Relevance: 1.5, Strings: 1, Instructions: 215COMMON

Download Yara Rule

Strings

x#<, xrefs: 006ED94E

Memory Dump Source

Source File: 00000010.00000002.521398057.00000000006E0000.00000040.00000001.sdmp, Offset: 006E0000, based on PE: false

Similarity

API ID:
String ID: x#<
API String ID: 0-879094556
Opcode ID: c0fad997c6e4881ff73a2407ebfef11ef6092143d89026d2d45d627e7d81a6c5
Instruction ID: 6f988c6d37cf5b6406814253b409d469ba1f8995908bc46f697a02288604e549
Opcode Fuzzy Hash: c0fad997c6e4881ff73a2407ebfef11ef6092143d89026d2d45d627e7d81a6c5
Instruction Fuzzy Hash: C3819D747112059FDB04DF69E894AAEBBF6FF88311F148069E506EB3A1DB30ED059B60

Uniqueness

Uniqueness Score: -1.00%

Function 0039C8C8, Relevance: 1.4, Strings: 1, Instructions: 140COMMON

Download Yara Rule

Strings

"\5, xrefs: 0039C8FB

Memory Dump Source

Source File: 00000010.00000002.512088417.0000000000390000.00000040.00000001.sdmp, Offset: 00390000, based on PE: false

Similarity

API ID:
String ID: "\5
API String ID: 0-2218106343
Opcode ID: c3ba6977a8eacda17f84780513752c92a099b5dae0963c8d2471d9957ad0424e
Instruction ID: 90e289c6d73361ea0225138b12f578ae19a738b7a43e263060995a353362ed71
Opcode Fuzzy Hash: c3ba6977a8eacda17f84780513752c92a099b5dae0963c8d2471d9957ad0424e
Instruction Fuzzy Hash: F24166717082408FDB269B2CD484A6EBBA6EFC5310B1A44BBE50ACB362CB30DC45C721

Uniqueness

Uniqueness Score: -1.00%

Function 00389AF0, Relevance: 1.4, Strings: 1, Instructions: 118COMMON

Download Yara Rule

Strings

L];, xrefs: 00389B7E

Memory Dump Source

Source File: 00000010.00000002.511565285.0000000000380000.00000040.00000001.sdmp, Offset: 00380000, based on PE: false

Similarity

API ID:
String ID: L];
API String ID: 0-954165131
Opcode ID: ba25737bdec49cd1bcfbbaec74cf65dc30ecf8e1e5514a1648fbcd3e9313ccac
Instruction ID: 993ddf895fd9ba5bc0272860b5123bc9a8f103df58aaa4d91c89ad8f73333a79
Opcode Fuzzy Hash: ba25737bdec49cd1bcfbbaec74cf65dc30ecf8e1e5514a1648fbcd3e9313ccac
Instruction Fuzzy Hash: 59419130608746DFC711DF24D5809AAB7B2FF85308B018E68D5458B665DB31FE89DBD0

Uniqueness

Uniqueness Score: -1.00%

Function 006E2760, Relevance: 1.4, Strings: 1, Instructions: 115COMMON

Download Yara Rule

Strings

N, xrefs: 006E27DA

Memory Dump Source

Source File: 00000010.00000002.521398057.00000000006E0000.00000040.00000001.sdmp, Offset: 006E0000, based on PE: false

Similarity

API ID:
String ID: N
API String ID: 0-1161386698
Opcode ID: c1c1adab56fc88a8687eb6f50068d9413e457e34d97ef2276eefa7ff5f264803
Instruction ID: e17e07895e122edc65d43667ce0172a7f1dbe1fff74075faa2cdac465b860ea2
Opcode Fuzzy Hash: c1c1adab56fc88a8687eb6f50068d9413e457e34d97ef2276eefa7ff5f264803
Instruction Fuzzy Hash: 7841CF71A052468FDB04DBAAC9586AEBBBBEF84300F048069E905DB391DB70DC45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00389B00, Relevance: 1.4, Strings: 1, Instructions: 110COMMON

Download Yara Rule

Strings

L];, xrefs: 00389B7E

Memory Dump Source

Source File: 00000010.00000002.511565285.0000000000380000.00000040.00000001.sdmp, Offset: 00380000, based on PE: false

Similarity

API ID:
String ID: L];
API String ID: 0-954165131
Opcode ID: 7685fa801879785f28b68fab856ff3aab1b2f1745672d0faa0b5102a3fbed953
Instruction ID: c06bf5399dafb510567d77a80c1cda2013c33b3311845e895f80b3b3697f480b
Opcode Fuzzy Hash: 7685fa801879785f28b68fab856ff3aab1b2f1745672d0faa0b5102a3fbed953
Instruction Fuzzy Hash: 93416F30608706DFC701DF64E5809AAB7B2FF84308B118E68D6458BA65DB31FE99DBD0

Uniqueness

Uniqueness Score: -1.00%

Function 0038D18A, Relevance: 1.4, Strings: 1, Instructions: 102COMMON

Download Yara Rule

Strings

@ Xl, xrefs: 0038D273

Memory Dump Source

Source File: 00000010.00000002.511565285.0000000000380000.00000040.00000001.sdmp, Offset: 00380000, based on PE: false

Similarity

API ID:
String ID: @ Xl
API String ID: 0-3027975150
Opcode ID: 964a5706fdada3b191d141ba0dc48cdfff97266f5d5ca53f5c6396b666ef8838
Instruction ID: 29dd45c156b0654139938d693071f1b3c898249ed4db5228759d98c14473208b
Opcode Fuzzy Hash: 964a5706fdada3b191d141ba0dc48cdfff97266f5d5ca53f5c6396b666ef8838
Instruction Fuzzy Hash: 4B41BE30600205AFCB05EF64D091AADB7E2FFC8318F118968D505AB792CB71AD85CB95

Uniqueness

Uniqueness Score: -1.00%

Function 0038D190, Relevance: 1.3, Strings: 1, Instructions: 98COMMON

Download Yara Rule

Strings

@ Xl, xrefs: 0038D273

Memory Dump Source

Source File: 00000010.00000002.511565285.0000000000380000.00000040.00000001.sdmp, Offset: 00380000, based on PE: false

Similarity

API ID:
String ID: @ Xl
API String ID: 0-3027975150
Opcode ID: a7b0976fd39142e56fa074a0017855d40315231062814db07c3f8197c1ca9250
Instruction ID: 41c7f56e98dbb65fe138da71e50baeabe404f1ec9f4b4e389a1592eeb0f27dce
Opcode Fuzzy Hash: a7b0976fd39142e56fa074a0017855d40315231062814db07c3f8197c1ca9250
Instruction Fuzzy Hash: E031AB30600209DFCB05EF64D095AADB7E2FFC8318F118968D505AB792CB71ED89CB94

Uniqueness

Uniqueness Score: -1.00%

Function 0039BCA0, Relevance: 1.3, Strings: 1, Instructions: 80COMMON

Download Yara Rule

Strings

867, xrefs: 0039BD34

Memory Dump Source

Source File: 00000010.00000002.512088417.0000000000390000.00000040.00000001.sdmp, Offset: 00390000, based on PE: false

Similarity

API ID:
String ID: 867
API String ID: 0-3835189568
Opcode ID: ffa041bf079b9b0809d7355124d53f4310c500d16a8dca7a2959cd54f29276de
Instruction ID: 09db976f9862d2ab82b14589a00e0efc08a449c111c3c7da4849a0480654b05f
Opcode Fuzzy Hash: ffa041bf079b9b0809d7355124d53f4310c500d16a8dca7a2959cd54f29276de
Instruction Fuzzy Hash: 00219F74B04605CFDB19DF68EA849AEB7B6EF84344B118469D909DB361DB31ED01CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 006ED8DC, Relevance: 1.3, Strings: 1, Instructions: 63COMMON

Download Yara Rule

Strings

x#<, xrefs: 006ED94E

Memory Dump Source

Source File: 00000010.00000002.521398057.00000000006E0000.00000040.00000001.sdmp, Offset: 006E0000, based on PE: false

Similarity

API ID:
String ID: x#<
API String ID: 0-879094556
Opcode ID: fb77f7d33bfaee50fc2324db9750d8602e69699eb2c94fac2b392e8e9b9e7d8b
Instruction ID: daec82870a8b154449b74ed00b99f6744cdb34423f9fe0269dd60cb119b3f4f6
Opcode Fuzzy Hash: fb77f7d33bfaee50fc2324db9750d8602e69699eb2c94fac2b392e8e9b9e7d8b
Instruction Fuzzy Hash: FA11DF35B222049BCB18DB65E844AAF7BB7EFC8311F108079E905A7394DF319C018BA0

Uniqueness

Uniqueness Score: -1.00%

Function 00382B98, Relevance: 1.3, Strings: 1, Instructions: 54COMMON

Download Yara Rule

Strings

`,8, xrefs: 00382C42

Memory Dump Source

Source File: 00000010.00000002.511565285.0000000000380000.00000040.00000001.sdmp, Offset: 00380000, based on PE: false

Similarity

API ID:
String ID: `,8
API String ID: 0-2795880706
Opcode ID: b4455ff37f44b4789cb21cdee515c8dbb5529ba742213e06e27b30cf12b6a82c
Instruction ID: e85623f8cc15dafff3056a000c9c3a8af9a2cec1e534dd58641d01681fb96f96
Opcode Fuzzy Hash: b4455ff37f44b4789cb21cdee515c8dbb5529ba742213e06e27b30cf12b6a82c
Instruction Fuzzy Hash: 57115B70A043199BDB1AEFA4C954BEEBBF5AF88304F108469D405B7280DB759985CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 006E6EF0, Relevance: .5, Instructions: 537COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.521398057.00000000006E0000.00000040.00000001.sdmp, Offset: 006E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd6793b79917daa72a467b5be5c63a6432d549a95db604f646b9d83a1bf54830
Instruction ID: 3720a2cf3ba2bf24301bd39dc7046897140d056af4e68000fb931b8e7cf0a54f
Opcode Fuzzy Hash: dd6793b79917daa72a467b5be5c63a6432d549a95db604f646b9d83a1bf54830
Instruction Fuzzy Hash: FB229E74A093958FCB11DF69C484A99BBF2FF49310F16859AE8459B362C731FC86CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00388EF0, Relevance: .5, Instructions: 492COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.511565285.0000000000380000.00000040.00000001.sdmp, Offset: 00380000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 667e63fd642c03ea983a3016a5af023cde52700d817f8b3d7238abc07f9ec445
Instruction ID: 65e5bcab9d5a717aea4522203061ba3a485b4b1b51c22b2401836c666f06b156
Opcode Fuzzy Hash: 667e63fd642c03ea983a3016a5af023cde52700d817f8b3d7238abc07f9ec445
Instruction Fuzzy Hash: 71226B34A04705CFCB15EF64C484BA9B7B2FF84314F1AC9A9D949AB252DB70ED85CB90

Uniqueness

Uniqueness Score: -1.00%

Function 006E4488, Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.521398057.00000000006E0000.00000040.00000001.sdmp, Offset: 006E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a14259c776f1641285c405578d0255b5829294d79ecb9c58f3d48a1b7185e360
Instruction ID: 083706a279b3b9241cf89d15c0cf0811e3bab238cc0c8e3db1da321a44cab3af
Opcode Fuzzy Hash: a14259c776f1641285c405578d0255b5829294d79ecb9c58f3d48a1b7185e360
Instruction Fuzzy Hash: D6E12534A04649CFCB14DF69C580A9DB7F2BF89314F218599E955AB322DB30ED85CF80

Uniqueness

Uniqueness Score: -1.00%

Function 006ECC38, Relevance: .3, Instructions: 297COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.521398057.00000000006E0000.00000040.00000001.sdmp, Offset: 006E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e64b648a9272ce4baa9478f3f6b057e61eaead728c298bae5dcd4ead3def0a5e
Instruction ID: e4c6d1566dad0ca040a9aaaa83f35b32de1ba0ea0fd13c1a15542222080b003c
Opcode Fuzzy Hash: e64b648a9272ce4baa9478f3f6b057e61eaead728c298bae5dcd4ead3def0a5e
Instruction Fuzzy Hash: C2A1C131A013448FCB15DB75C8506EEBBB2EF85355F14806AD90A9B390EB35EC47CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 006EC780, Relevance: .3, Instructions: 269COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.521398057.00000000006E0000.00000040.00000001.sdmp, Offset: 006E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f457f65b82ba1cbd5092ddc375d10e57c2a077f77044728a9274142e0fcd290
Instruction ID: ac165b671e384e88dba30b3c7a2462277153acafcda789f2ae9f9d3dcb299591
Opcode Fuzzy Hash: 3f457f65b82ba1cbd5092ddc375d10e57c2a077f77044728a9274142e0fcd290
Instruction Fuzzy Hash: 27B12C74A02245DFCB04DF69D68499DB7F3BF88314B2186A4E4059F3A6DB70ED42CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00394688, Relevance: .3, Instructions: 267COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.512088417.0000000000390000.00000040.00000001.sdmp, Offset: 00390000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa2bf5aed6ec769e6ce82ebe8d79fdff81861c048e47c8a2b738a87d7a1c74d7
Instruction ID: 2a46e4bdac2ad462651df5e7734f9d970aa2a058685ea5237f32921af91ac02e
Opcode Fuzzy Hash: aa2bf5aed6ec769e6ce82ebe8d79fdff81861c048e47c8a2b738a87d7a1c74d7
Instruction Fuzzy Hash: EB9120B0B042849FEF159BB8D844BAEBBE6EFC8304F144029E505E7380DFB59C468B51

Uniqueness

Uniqueness Score: -1.00%

Function 006EDD70, Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.521398057.00000000006E0000.00000040.00000001.sdmp, Offset: 006E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49d64505fd46db3544f81d15f313878d944c92d75472bb997ceb49c61c606437
Instruction ID: cce6b93d5c387ebca0183de09c7d164dfd085933198ce2ad8dc3e9dc7b19c30e
Opcode Fuzzy Hash: 49d64505fd46db3544f81d15f313878d944c92d75472bb997ceb49c61c606437
Instruction Fuzzy Hash: 7C918C31B052449FCB18DBB9D858AAEB7F7AF88700F154069E506EB7A0CF719C45CB91

Uniqueness

Uniqueness Score: -1.00%

Function 003996D8, Relevance: .2, Instructions: 223COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.512088417.0000000000390000.00000040.00000001.sdmp, Offset: 00390000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfe67bcaa9af176bb35fde9be7549e2113e486ef32f970239cedee337371020b
Instruction ID: be2e957b46d999d639ea03d53a8fbb4922010638a5fb64a4d142b2c177b9aaf8
Opcode Fuzzy Hash: cfe67bcaa9af176bb35fde9be7549e2113e486ef32f970239cedee337371020b
Instruction Fuzzy Hash: 04813B34B081088FCB44DB69D999B6E7BF6AF89300F25806AE90ADB355DF749C41CB61

Uniqueness

Uniqueness Score: -1.00%

Function 006EA958, Relevance: .2, Instructions: 214COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.521398057.00000000006E0000.00000040.00000001.sdmp, Offset: 006E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf1c820e69258d372e3d8fcefc04609dd51e0a8fc996b2a9a211fcd64dd43ff8
Instruction ID: 589c25f0570a5f4d509cc99d08ee428e78ef060d62e5ae3b63d35ef0301fb76e
Opcode Fuzzy Hash: bf1c820e69258d372e3d8fcefc04609dd51e0a8fc996b2a9a211fcd64dd43ff8
Instruction Fuzzy Hash: 3D81D1356006418FDB259FA6D8197AE7BB3FB88342F148029F906D73A5CF70AC85DB91

Uniqueness

Uniqueness Score: -1.00%

Function 006EBD70, Relevance: .2, Instructions: 194COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.521398057.00000000006E0000.00000040.00000001.sdmp, Offset: 006E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52eea1dee1c674cb9c01e8c460e31353da019b7154fd12e22d758a9bed4dd7ce
Instruction ID: 51823321cf2dfeda0e2f7c4141b3841cc593944951adc9e80df9531e25aa5ee3
Opcode Fuzzy Hash: 52eea1dee1c674cb9c01e8c460e31353da019b7154fd12e22d758a9bed4dd7ce
Instruction Fuzzy Hash: CA81F874A00245CFCB14DF69D988A9DBBF2BF88310B2546A9E815EB3A1DB31DD41CF64

Uniqueness

Uniqueness Score: -1.00%

Function 0039B9F8, Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.512088417.0000000000390000.00000040.00000001.sdmp, Offset: 00390000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a528b36c76b52f2016769b52ba65c9061ba6261d4a36aa16cc3b53a50e83885
Instruction ID: 410e46d23df7f09f4b1cf54cfc21a215dee13e44faece47242b0cd2ff6bbed62
Opcode Fuzzy Hash: 2a528b36c76b52f2016769b52ba65c9061ba6261d4a36aa16cc3b53a50e83885
Instruction Fuzzy Hash: 3661A030304201CFCB66DF29E694A29F3E6EF84314B19C869D10ACB6A5DB75EC86CF51

Uniqueness

Uniqueness Score: -1.00%

Function 0039FDD0, Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.512088417.0000000000390000.00000040.00000001.sdmp, Offset: 00390000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c72833f79d59a0e8017fec285651bfef66261d2a3e9244bfd15ed8798b123f8f
Instruction ID: f9b6d9434a48cd7ad0aa0207172b470aaf42eaff2ab9427605804142c193dd3a
Opcode Fuzzy Hash: c72833f79d59a0e8017fec285651bfef66261d2a3e9244bfd15ed8798b123f8f
Instruction Fuzzy Hash: D7518B35B04205CFCB15DF68D59496EB7F2EF89319B2584A9E50ACB366DB30EC42CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00395888, Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.512088417.0000000000390000.00000040.00000001.sdmp, Offset: 00390000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b73b894602dac8613c71da5330b989e86dc9e9a9daf11935f5a78c99c11ad9d5
Instruction ID: 4e8e63f5930fa8c2f4f123245587a1ba00861002bed7bfa00a607917a8cdd22a
Opcode Fuzzy Hash: b73b894602dac8613c71da5330b989e86dc9e9a9daf11935f5a78c99c11ad9d5
Instruction Fuzzy Hash: A1613B30A04209DFDB16DF69D998BADBBB5BF48315F25412AE806E73A0DB309D85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 00385E28, Relevance: .2, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.511565285.0000000000380000.00000040.00000001.sdmp, Offset: 00380000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f05aeac1393e4c9c1a5b92ec4ebb2448a98f425a43f70dd7a6955cb1a284c77
Instruction ID: f2c901c17c51daff5afa68986dc045bc3071a7a18a0f95f3306c6f2b51f76aec
Opcode Fuzzy Hash: 7f05aeac1393e4c9c1a5b92ec4ebb2448a98f425a43f70dd7a6955cb1a284c77
Instruction Fuzzy Hash: 3A612574E002199FCB05DFA9D891AEEBBF2EF88300F15846AE905AB351DB319D45CF94

Uniqueness

Uniqueness Score: -1.00%

Function 006EC260, Relevance: .2, Instructions: 165COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.521398057.00000000006E0000.00000040.00000001.sdmp, Offset: 006E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08201000e7f1e3f8685bb46b122832d92244e3a56eeea75570de6daeb3c6a23b
Instruction ID: 1596166dbe91addb471536ad34e8749768d3164cc4c856e389195dba38441a81
Opcode Fuzzy Hash: 08201000e7f1e3f8685bb46b122832d92244e3a56eeea75570de6daeb3c6a23b
Instruction Fuzzy Hash: 14518D71B006149FDB18DB79E850AEEB7E6AF88320F148139D906DB390DB31ED56CB90

Uniqueness

Uniqueness Score: -1.00%

Function 006EDD60, Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.521398057.00000000006E0000.00000040.00000001.sdmp, Offset: 006E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 430efdf700b8893d6cf431c5f179da80863a2fc9753528d214a03f8c1d09117d
Instruction ID: cff487c335494fa8db4a9c49d539694e1db8f2f714c35e4149f4d5231f32ad8a
Opcode Fuzzy Hash: 430efdf700b8893d6cf431c5f179da80863a2fc9753528d214a03f8c1d09117d
Instruction Fuzzy Hash: 77516B30A052489FCB24DF65D855BAEB7B7FF88700F158569E916AB7A0CF31AC45CB80

Uniqueness

Uniqueness Score: -1.00%

Function 003996C7, Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.512088417.0000000000390000.00000040.00000001.sdmp, Offset: 00390000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b28dcf4a33a26652ffc7c9a90e87aebb61d75e24b08c1779714b7925ba7d420
Instruction ID: 0a9a854a640660d26b158ff9eb2fe3ebad7f76329a93be86da8d8eb1c25de46f
Opcode Fuzzy Hash: 1b28dcf4a33a26652ffc7c9a90e87aebb61d75e24b08c1779714b7925ba7d420
Instruction Fuzzy Hash: A8517C35B081048FCB44DB79D99972E7BA2EF89301B25846AE90ACB3A5DF34DC41CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0038D4D2, Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.511565285.0000000000380000.00000040.00000001.sdmp, Offset: 00380000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 516356e62f18d50395e5f864288ebb4d08786bbcfa87855ed5ac9aad28d5893b
Instruction ID: c1349aa6c37b365a844f0cb23db1093a467d92362a41accb3024a99073955c99
Opcode Fuzzy Hash: 516356e62f18d50395e5f864288ebb4d08786bbcfa87855ed5ac9aad28d5893b
Instruction Fuzzy Hash: 96519034A10204DFDB05EF68D855BADB7B6EF88304F1581A9E906AB3A1CB35EC45CB60

Uniqueness

Uniqueness Score: -1.00%

Function 006E4E43, Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.521398057.00000000006E0000.00000040.00000001.sdmp, Offset: 006E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 206d34d1fae349323581abeb35925f5252764c30d1c88d54cf3a13408cfb8c32
Instruction ID: 1b11d26fc36dc9bba8fcb15a7fae278feab33b3b366221d417578abe955012a9
Opcode Fuzzy Hash: 206d34d1fae349323581abeb35925f5252764c30d1c88d54cf3a13408cfb8c32
Instruction Fuzzy Hash: 0E614730605344CFCB15DF60C044AADB7B2BF88318F1188A8E9069F3A5DB35ED8ADB90

Uniqueness

Uniqueness Score: -1.00%

Function 0038AB12, Relevance: .1, Instructions: 142COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.511565285.0000000000380000.00000040.00000001.sdmp, Offset: 00380000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3006aa96f69f13c9cb59e8c985c03daa029cab96a50fe8f5b32c4ef4dc44790
Instruction ID: 0315f19e6c516c26418cfa635128d72639615f4b98940960036321b811bbce2b
Opcode Fuzzy Hash: c3006aa96f69f13c9cb59e8c985c03daa029cab96a50fe8f5b32c4ef4dc44790
Instruction Fuzzy Hash: 9151E330A097998FDB16DB74C450BAEBFB2AF45300F0944DAE492EB392D734D841DB61

Uniqueness

Uniqueness Score: -1.00%

Function 00397968, Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.512088417.0000000000390000.00000040.00000001.sdmp, Offset: 00390000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05f07919511cad95010432746172ed7c9ad8e1f3686548b6af6acc11501c70bc
Instruction ID: 13b63cab0d93f84d58db7242f3d1ee3823fc94e797e7d707871e2f3c235ed61d
Opcode Fuzzy Hash: 05f07919511cad95010432746172ed7c9ad8e1f3686548b6af6acc11501c70bc
Instruction Fuzzy Hash: 4A516730A1420ACFCB15DF65D580AEEBBF2FF88304F148629D50AA7790DB70AE45DB90

Uniqueness

Uniqueness Score: -1.00%

Function 0038AB40, Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.511565285.0000000000380000.00000040.00000001.sdmp, Offset: 00380000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e32ac77626226692a4340e50c299713dc367e50224f6a5781ecca2ac302c43ad
Instruction ID: fcf689de59168eef1adbc340f69fec636b7f09658ed81ac8abd355dbef3080c0
Opcode Fuzzy Hash: e32ac77626226692a4340e50c299713dc367e50224f6a5781ecca2ac302c43ad
Instruction Fuzzy Hash: BF51CE30A093998FDB16DB75C050BAEBFB2AF45300F0944AAE452EB392D724D841DB61

Uniqueness

Uniqueness Score: -1.00%

Function 00393E20, Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.512088417.0000000000390000.00000040.00000001.sdmp, Offset: 00390000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b568f49837392cd582c4ffd9ed131ac8c855f87d018b8f74b5377ac85342cf8
Instruction ID: bb42a3e68de4e214395e299140d61cc76dc751f5b7fb02c36e08ee751fba58d9
Opcode Fuzzy Hash: 7b568f49837392cd582c4ffd9ed131ac8c855f87d018b8f74b5377ac85342cf8
Instruction Fuzzy Hash: 07412270A083548FCB25CB39D85427EBBF2EF85304F14887ED546CB691DB35AA4ACB50

Uniqueness

Uniqueness Score: -1.00%

Function 00385D51, Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.511565285.0000000000380000.00000040.00000001.sdmp, Offset: 00380000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: def97898c91e98d3a97beb1ff8b176c6d31312cb053b7bd54ea4816e4f74d871
Instruction ID: a8031e028d3bf7fafb825433124dc3cae93b112aac681c3add5e2fdb050b1551
Opcode Fuzzy Hash: def97898c91e98d3a97beb1ff8b176c6d31312cb053b7bd54ea4816e4f74d871
Instruction Fuzzy Hash: 3F411174A083498FCB05EFA8D4505EDBBF1EF89304F0184AAD985EB351DB34AD85CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00394C48, Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.512088417.0000000000390000.00000040.00000001.sdmp, Offset: 00390000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a011403a5624bd8fbac077fec9ee01e38687fd6b79e935b228bc461a922a7005
Instruction ID: 6bf7b337d9fe38e9564c20a410e866b1bc36d5c8f5622886f5ace06a2e0b2f62
Opcode Fuzzy Hash: a011403a5624bd8fbac077fec9ee01e38687fd6b79e935b228bc461a922a7005
Instruction Fuzzy Hash: 2341C035B04205AFCB11DF79E840AEEB7E5EF84369B048539E509DB281EB31ED49CB90

Uniqueness

Uniqueness Score: -1.00%

Function 006ED2BC, Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.521398057.00000000006E0000.00000040.00000001.sdmp, Offset: 006E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b67fce9cf0f0d311f3ea93ddeda6756830ce39647fc54cd96186f2ba09b2e429
Instruction ID: df894302cd937671d16b3a5996f08907462e356e58648c63e7267b7b209d69a4
Opcode Fuzzy Hash: b67fce9cf0f0d311f3ea93ddeda6756830ce39647fc54cd96186f2ba09b2e429
Instruction Fuzzy Hash: 5F41BD346002448FC714DF69D851AEDBBB2EF89305F1184ACE606EB3A1CB70ED85CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00389C88, Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.511565285.0000000000380000.00000040.00000001.sdmp, Offset: 00380000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9121f514ecf988266b303cd3a6700a4d2f55774daf8ea9480cd677754a7b47b1
Instruction ID: 7ef8f0a254ed757cbc2388bd531e6ba7ce2e66c43e1034c80651f0293cf93ed5
Opcode Fuzzy Hash: 9121f514ecf988266b303cd3a6700a4d2f55774daf8ea9480cd677754a7b47b1
Instruction Fuzzy Hash: 7E418135600215DFCB15EFA4D848BED7BB5EF89321F1941AAE405AB3A0CB319C45CB64

Uniqueness

Uniqueness Score: -1.00%

Function 006EDF6E, Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.521398057.00000000006E0000.00000040.00000001.sdmp, Offset: 006E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b2a344f578207efc23361a4976beea5f0856e547a34060b5b5b7cc60397fe59
Instruction ID: 04144f037dca596e7ecb2594244f7c5040570ab97cb789a5410e606d9954585f
Opcode Fuzzy Hash: 0b2a344f578207efc23361a4976beea5f0856e547a34060b5b5b7cc60397fe59
Instruction Fuzzy Hash: AA310735B042449FCB149B79C8186BE7BF7AFC8300F154069E406EB3A5CF758C428B91

Uniqueness

Uniqueness Score: -1.00%

Function 0039AD60, Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.512088417.0000000000390000.00000040.00000001.sdmp, Offset: 00390000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24e67d0211124939a35887720440aeaa039c72122b3e447ded6da74486fa3cbd
Instruction ID: 9f9c7f53652a9bacf49653affb63c4b8f7ea92d31a715356be08904d87e7e5f6
Opcode Fuzzy Hash: 24e67d0211124939a35887720440aeaa039c72122b3e447ded6da74486fa3cbd
Instruction Fuzzy Hash: 6F417C74B006058FC714EF64D99896EBBF2FF88305B108929DA1AD77A1DB30ED85CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00397C98, Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.512088417.0000000000390000.00000040.00000001.sdmp, Offset: 00390000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0d37f4fb38d1da89a16151e5296520cbc8a77defe714cfd4c7c207883049a74
Instruction ID: fcc3aa56a7cab76b0812ea8e778a88be28fa3c53381bbeb32e6acb7517974644
Opcode Fuzzy Hash: b0d37f4fb38d1da89a16151e5296520cbc8a77defe714cfd4c7c207883049a74
Instruction Fuzzy Hash: 5431E7B4A082059FCF55DF59C880AAAB7F2EF88314B18C469D909DB345D731ED82CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 0039453B, Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.512088417.0000000000390000.00000040.00000001.sdmp, Offset: 00390000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac82296c5e9eaf2199fc1f971da17a70e012ee748fcac9bf1a4da09b5b6b417f
Instruction ID: 9655e642d065b53b90fff777f1df0cac9694df9f0e172b0497db15cab9010b43
Opcode Fuzzy Hash: ac82296c5e9eaf2199fc1f971da17a70e012ee748fcac9bf1a4da09b5b6b417f
Instruction Fuzzy Hash: E531E230A003458FCB16DFA9D858BAEBBF2EF8A301F164069E806D7391DB359D42CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00394548, Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.512088417.0000000000390000.00000040.00000001.sdmp, Offset: 00390000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e22ec5fa7d765ad272678daadc2aff46c72e672d35b64b706196cc2d5133ec42
Instruction ID: 8070b49b6b2d0493b760116098f9b1bffa0f42956d97320808044e79f95cf5b0
Opcode Fuzzy Hash: e22ec5fa7d765ad272678daadc2aff46c72e672d35b64b706196cc2d5133ec42
Instruction Fuzzy Hash: 7231AD74B003059FCB15DBA9D858BAEBBF2EF89301F158029E81AA7790DB359C42CB51

Uniqueness

Uniqueness Score: -1.00%

Function 0039C978, Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.512088417.0000000000390000.00000040.00000001.sdmp, Offset: 00390000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0fab1171c4e651dc787dbe230f28615866826fc677c17777e7257043e49b5b3
Instruction ID: 1aca7bd531aadcc0a6f18521bdbd90d4f87a308555d7cf2d062a6f2a1c7679a8
Opcode Fuzzy Hash: f0fab1171c4e651dc787dbe230f28615866826fc677c17777e7257043e49b5b3
Instruction Fuzzy Hash: AC21D1317142448FEB2ADB18D484A7EB7A79F89714B29546AE106CB7A2CF70DC81CB51

Uniqueness

Uniqueness Score: -1.00%

Function 006E24E9, Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.521398057.00000000006E0000.00000040.00000001.sdmp, Offset: 006E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f61f488bdd2e906ed860a768d915d7c88143e20e07e0adfbc6f2fb9486159af
Instruction ID: 350b962019791eb6dc8d174ee574a984b5551350420c5c03cab9436504bbb277
Opcode Fuzzy Hash: 9f61f488bdd2e906ed860a768d915d7c88143e20e07e0adfbc6f2fb9486159af
Instruction Fuzzy Hash: 6C31B030A11359DFCB14DF64D450A99B7B2FF88300F218958E9456B351DB31ED46CB80

Uniqueness

Uniqueness Score: -1.00%

Function 006E24F8, Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.521398057.00000000006E0000.00000040.00000001.sdmp, Offset: 006E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27f095e916b15db294c53c9ce082e405b8395d7a5c2dac928fbd60edcbbe8497
Instruction ID: b8042f5d8f2195afd46c8b1d88e1e5a8cd6b569d992ed243876608f3a6e88b54
Opcode Fuzzy Hash: 27f095e916b15db294c53c9ce082e405b8395d7a5c2dac928fbd60edcbbe8497
Instruction Fuzzy Hash: C7318A34A10319DFCB04DF68D450A99B7B2FF88314F118999E846AB361DB31ED85CB80

Uniqueness

Uniqueness Score: -1.00%

Function 006E2638, Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.521398057.00000000006E0000.00000040.00000001.sdmp, Offset: 006E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54b6165a81e74de7641dff3df9cef4799f51da198e52fa71bd6b0a0b4f9581ad
Instruction ID: 8a13fd7516161e73353c22d43596ce2bef8081a1c8de2f8fa0d9da891b628027
Opcode Fuzzy Hash: 54b6165a81e74de7641dff3df9cef4799f51da198e52fa71bd6b0a0b4f9581ad
Instruction Fuzzy Hash: 9F312231B007499BE7149B65CC51BEFB367EF88305F11C528E5096BBC1DFB4A98A8B90

Uniqueness

Uniqueness Score: -1.00%

Function 006EAC98, Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.521398057.00000000006E0000.00000040.00000001.sdmp, Offset: 006E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bce2beee09b93fbeca844e81460a15079cb5f6c9979525fc65df4daba82498d9
Instruction ID: a641d8add4ed4542d84bcc5706158a7c3e2f99610ac3a440677a305d95fc60ae
Opcode Fuzzy Hash: bce2beee09b93fbeca844e81460a15079cb5f6c9979525fc65df4daba82498d9
Instruction Fuzzy Hash: 8C317C30A01218CFCB54DFA9C844ADEB7F6EF89305F158469D509EB760DB35AD42CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0039AD51, Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.512088417.0000000000390000.00000040.00000001.sdmp, Offset: 00390000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 888821e1267fab621f8917acb3be246e222cfb532ebec13ce84f0a61c7390058
Instruction ID: 1c1a920455c92f23c775ac79855be8cee0a288f28a44c941431d456cdf736040
Opcode Fuzzy Hash: 888821e1267fab621f8917acb3be246e222cfb532ebec13ce84f0a61c7390058
Instruction Fuzzy Hash: 6E21BF747006058FC714EF68D98596EBBF2EF88315B108939D60AC7761DB30ED89CB91

Uniqueness

Uniqueness Score: -1.00%

Function 006EC126, Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.521398057.00000000006E0000.00000040.00000001.sdmp, Offset: 006E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 056f013a82cc0855451355715647e26573b03f6a9140dc602eebd4e05bb7ba22
Instruction ID: e099043b1cad0f7d109f50ca4024d265aaf68944a8d34d65f9907b2039152f59
Opcode Fuzzy Hash: 056f013a82cc0855451355715647e26573b03f6a9140dc602eebd4e05bb7ba22
Instruction Fuzzy Hash: 82219C303007408FD721DF25E580AAAB7E3FFC4314F118A29D5868B7A6DB71F94A9B90

Uniqueness

Uniqueness Score: -1.00%

Function 0039FDC0, Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.512088417.0000000000390000.00000040.00000001.sdmp, Offset: 00390000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f31011834c40b82b391a1422362d8fae7af8ac55071817d486ca5acb18d41e95
Instruction ID: 5b84508cf536c02b1745fbcd6ae761deac6e9707a908ecd4a0e3fe088c7b9bf6
Opcode Fuzzy Hash: f31011834c40b82b391a1422362d8fae7af8ac55071817d486ca5acb18d41e95
Instruction Fuzzy Hash: 85213875B14501CFCB25DF28D99896ABBF2FF8931472544A9E41ACB366DB30EC42CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00393264, Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.512088417.0000000000390000.00000040.00000001.sdmp, Offset: 00390000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84e19487fe23cb8a380e54b66f53664da44cd246f097d01d5568bd02642e9420
Instruction ID: 20f81b28b0df62da6ab1a082a8eddbde3b4bf0907e2e410d6f7d4680c3d88fe2
Opcode Fuzzy Hash: 84e19487fe23cb8a380e54b66f53664da44cd246f097d01d5568bd02642e9420
Instruction Fuzzy Hash: C521FFB59003499FCF10CF9AD888BDEBBF4FB48314F10852AE959A7240D374A955CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 00394B71, Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.512088417.0000000000390000.00000040.00000001.sdmp, Offset: 00390000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60b80e1d5e54c49192548e532fc6d8cb0f6eabf83316c39c6f62a12cd2318f94
Instruction ID: 3e12fde8a7b07bdb83b40e6d41963d2816d71e739e028c61dc9fb2513d1831c5
Opcode Fuzzy Hash: 60b80e1d5e54c49192548e532fc6d8cb0f6eabf83316c39c6f62a12cd2318f94
Instruction Fuzzy Hash: 492100B5900349AFCF10CF99D884BDEBBF4FB49314F00842AE959A3240D374A955CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00394C38, Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.512088417.0000000000390000.00000040.00000001.sdmp, Offset: 00390000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7d3d3029e71b2fd4edbfa9e38ca8b001015f99a5f59343aa057d926767b3481
Instruction ID: 52cd8b1b7ad52d3b139d0e2a1598cbb05702cd6db9b43ddf88c3bf8d73e20e67
Opcode Fuzzy Hash: d7d3d3029e71b2fd4edbfa9e38ca8b001015f99a5f59343aa057d926767b3481
Instruction Fuzzy Hash: 9D110634A04204AFCB15DF79E841AAEBBE5EFC4355B00852DD509D7281DB30E945CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00382A68, Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.511565285.0000000000380000.00000040.00000001.sdmp, Offset: 00380000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe1ca31e8b36f608021da3e9084b5c6dd41b3814cc0e9f32e2d54549210c3186
Instruction ID: 16ddec7ddf2a20f8ac833dedd864a2e43dbb51b6bdda5830971748e280018651
Opcode Fuzzy Hash: fe1ca31e8b36f608021da3e9084b5c6dd41b3814cc0e9f32e2d54549210c3186
Instruction Fuzzy Hash: 96115E353042159FD728AB29F94456AB7A7FFC8329B058939D61AC3B40DF78AD45C780

Uniqueness

Uniqueness Score: -1.00%

Function 00389968, Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.511565285.0000000000380000.00000040.00000001.sdmp, Offset: 00380000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bfbeacceefd7cbdd5bf3e7047b6ff340be46b94844f42aea5b0e1952af1dc7d4
Instruction ID: fcc2fc42f07d3512455c79c3d00ae771180126b59e0bc43f739fdf4c61cba0c7
Opcode Fuzzy Hash: bfbeacceefd7cbdd5bf3e7047b6ff340be46b94844f42aea5b0e1952af1dc7d4
Instruction Fuzzy Hash: 52212474A04218CFCB08DFA8D9989ADBBF1FF4D304B1104A9E502AB361CB39AD05CF60

Uniqueness

Uniqueness Score: -1.00%

Function 0039A798, Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.512088417.0000000000390000.00000040.00000001.sdmp, Offset: 00390000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 162c81b0e42906f26e4fb86b7d53e0d40263f57a6ea69a902cf16ed5e7c6955d
Instruction ID: 9643e68f999fd5529b08226ac2b7b07d9a3871ab52f667a09e4358bfbb5305a7
Opcode Fuzzy Hash: 162c81b0e42906f26e4fb86b7d53e0d40263f57a6ea69a902cf16ed5e7c6955d
Instruction Fuzzy Hash: 890126777045141B57155ABE684056EF78BEFE42713258337E716C7280CD308C0653A5

Uniqueness

Uniqueness Score: -1.00%

Function 00389978, Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.511565285.0000000000380000.00000040.00000001.sdmp, Offset: 00380000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac2c9b7129ed0110ee6df5b3902c7a60c9143336a306cb8670a659e8ffa628b9
Instruction ID: 0902384d8518fbb6867c1bd20a67c917cb63a71f157918a4b67e643c0611419c
Opcode Fuzzy Hash: ac2c9b7129ed0110ee6df5b3902c7a60c9143336a306cb8670a659e8ffa628b9
Instruction Fuzzy Hash: AE21C375A04218CFCB08EFA8D9949ADB7F1FF4C304B1105A9E416AB361DB79AD05CF60

Uniqueness

Uniqueness Score: -1.00%

Function 006E8C09, Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.521398057.00000000006E0000.00000040.00000001.sdmp, Offset: 006E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33da126070a013a59c1cb279073d1eff2292b847827db12ff544c021d84a9270
Instruction ID: 395b31b2935747584f544c3620faa5acf545aa64ae78ea219447c2005ae52ddb
Opcode Fuzzy Hash: 33da126070a013a59c1cb279073d1eff2292b847827db12ff544c021d84a9270
Instruction Fuzzy Hash: 3311263160A7904FC321C735D8409AABFE59F82754B1981AAE8488B392CB70EC49C3B1

Uniqueness

Uniqueness Score: -1.00%

Function 003943E0, Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.512088417.0000000000390000.00000040.00000001.sdmp, Offset: 00390000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b250473fa15388fae1ed34da1d4f54fcc4692cf85a26195c6dc9ee3d4a8ebd88
Instruction ID: 7e7b5079b234631e4bb92afd4c4ad0bbc72c9696839c7d269213872c13b70dca
Opcode Fuzzy Hash: b250473fa15388fae1ed34da1d4f54fcc4692cf85a26195c6dc9ee3d4a8ebd88
Instruction Fuzzy Hash: F901C43260E3808FCF370B26A864B657FB19F82715F1A00ABD041C7992D7284C5BC752

Uniqueness

Uniqueness Score: -1.00%

Function 0039C400, Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.512088417.0000000000390000.00000040.00000001.sdmp, Offset: 00390000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d1b48ac8ff51305a12f4bb0ed46757ec9f27582e45be810061a17edd48932bd
Instruction ID: 8bfb6f334dcd6b11bd59a79101ea17d56b8395521553e1d642682f9d53bb9d57
Opcode Fuzzy Hash: 4d1b48ac8ff51305a12f4bb0ed46757ec9f27582e45be810061a17edd48932bd
Instruction Fuzzy Hash: 4801AD757141108F9B459F2AE96892EB7FAEFC9261320807AE20AC73A0CF30DC018B50

Uniqueness

Uniqueness Score: -1.00%

Function 006ED1F0, Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.521398057.00000000006E0000.00000040.00000001.sdmp, Offset: 006E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5b62a6ded072753a8a041e24840094731a16928cae027be1d9effc660891b36
Instruction ID: 7e00548699ebe73034d1a94ec2811f3b493ef4e07c4aee94d4369d98bdf351b6
Opcode Fuzzy Hash: d5b62a6ded072753a8a041e24840094731a16928cae027be1d9effc660891b36
Instruction Fuzzy Hash: 9B11C174E041089FCB44EFE0D800BAE7BF2EF80305F0085B8D649AB395EF305A859BA5

Uniqueness

Uniqueness Score: -1.00%

Function 006E6E31, Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.521398057.00000000006E0000.00000040.00000001.sdmp, Offset: 006E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc1b9c378f854340ed73e314d90dd854ceba438c3f66663bab2bb6c041e573aa
Instruction ID: 7ef87cfa947a1ddad4b0de8da7683de385bdf563edfe7fa455feca88c0e8302c
Opcode Fuzzy Hash: cc1b9c378f854340ed73e314d90dd854ceba438c3f66663bab2bb6c041e573aa
Instruction Fuzzy Hash: C511C43550D7D45FC703CB39D890499BFB0AF4A21071A85E7D449CB6A3C2259C05CB62

Uniqueness

Uniqueness Score: -1.00%

Function 0038D8C1, Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.511565285.0000000000380000.00000040.00000001.sdmp, Offset: 00380000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 784981bff890b20b09d376209a08f27106f75737b17acea5f0d3c649a43a3b5c
Instruction ID: 43d64a7e1dda1f93dc576e1f5d4f74d1b807293c656d2e326dc49a13d64c825b
Opcode Fuzzy Hash: 784981bff890b20b09d376209a08f27106f75737b17acea5f0d3c649a43a3b5c
Instruction Fuzzy Hash: B721E734A00205CFCB45DF64D494EAD7BB2EF88329F1595A8E501AB3A1CB35E881CF50

Uniqueness

Uniqueness Score: -1.00%

Function 0039467A, Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.512088417.0000000000390000.00000040.00000001.sdmp, Offset: 00390000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 320c08449c362f6520a45b577648d3242cf35d66920cb441c1f1db6d191cf867
Instruction ID: 7932438bb154a4e1416ab585225dbbb6abdf3908765778226f15d9fce66bb4a2
Opcode Fuzzy Hash: 320c08449c362f6520a45b577648d3242cf35d66920cb441c1f1db6d191cf867
Instruction Fuzzy Hash: 20F046B230D7461FEF260669B888A677BC9CB86368B01007BEA49C7241EF21C8078260

Uniqueness

Uniqueness Score: -1.00%

Function 006E4A4D, Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.521398057.00000000006E0000.00000040.00000001.sdmp, Offset: 006E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4923899f4009e6201d136060732e4e40415b1ddf717c9f3f57b91d86aec6adf
Instruction ID: 8436c0a963af280f0fb386ee88b8c1cb7a1ebbac9da298548895a804926c17b1
Opcode Fuzzy Hash: f4923899f4009e6201d136060732e4e40415b1ddf717c9f3f57b91d86aec6adf
Instruction Fuzzy Hash: 8121EC35A11709DFCB04DF68D554999B7F2FF88300F128699E955AB361DB30E945CF40

Uniqueness

Uniqueness Score: -1.00%

Function 006ECDE8, Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.521398057.00000000006E0000.00000040.00000001.sdmp, Offset: 006E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4c431cd31f253425a56fa6cd8d7b5ee8083297be62933586f87c78d9907643a
Instruction ID: 8a59ce32d68d5da588b9ab10a07c10042e9da5c50fca8cd6fecf61634533d93a
Opcode Fuzzy Hash: a4c431cd31f253425a56fa6cd8d7b5ee8083297be62933586f87c78d9907643a
Instruction Fuzzy Hash: 3401C430A013454FDB11CBA9D840BEFBBF9AF89310F044066D908E7341D7749A01CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 006EBEF4, Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.521398057.00000000006E0000.00000040.00000001.sdmp, Offset: 006E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 600f7cfdc83007baebe8af6bcb72ce9d405c24bf85871fadcd535b4fd2479ab9
Instruction ID: 540835e251af2f3f0d82a04d4e19b0fe0afdebc6f8f47b1ec3f9a410dc5e0960
Opcode Fuzzy Hash: 600f7cfdc83007baebe8af6bcb72ce9d405c24bf85871fadcd535b4fd2479ab9
Instruction Fuzzy Hash: 7F114C34A046468FC714DF68E644A8DB7F1EF48328B214794D855EB3A1C731EE42CF54

Uniqueness

Uniqueness Score: -1.00%

Function 006E8C18, Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.521398057.00000000006E0000.00000040.00000001.sdmp, Offset: 006E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a23a125b5f15378b0ef29e2fc8661fde21dca2adca4068fa4963425894d76410
Instruction ID: da308abe2081e00328daa65b66387481272c03a946af88328cf0d33458b1c0a6
Opcode Fuzzy Hash: a23a125b5f15378b0ef29e2fc8661fde21dca2adca4068fa4963425894d76410
Instruction Fuzzy Hash: B7012B316063608FC320D729D940AABBBD9AFC1754F15846AED498B351CB70EC45D7A0

Uniqueness

Uniqueness Score: -1.00%

Function 00C5D005, Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.530282294.0000000000C5D000.00000040.00000001.sdmp, Offset: 00C5D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cdf031954f17b53154c6b36f2d08e1e49cd95237bbe7bd2b803916edb2c269a3
Instruction ID: fd3a1741659e9f52eb04c9e50b3720ea31e96a3e1475d16b2d336c08d9ab6372
Opcode Fuzzy Hash: cdf031954f17b53154c6b36f2d08e1e49cd95237bbe7bd2b803916edb2c269a3
Instruction Fuzzy Hash: A001526140D3C05FD7128B258C94B52BFB8EF43224F1981DBE9959F2D7C2695C49C772

Uniqueness

Uniqueness Score: -1.00%

Function 00C5D01D, Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.530282294.0000000000C5D000.00000040.00000001.sdmp, Offset: 00C5D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2bd105565726dbe8844d2b38031a75a9d966f2421b2b482e0626588fc4b584fb
Instruction ID: e504862387bda05f6775947fdfa2fa0abdd2ed2d969da8c53b01ee450a386b3c
Opcode Fuzzy Hash: 2bd105565726dbe8844d2b38031a75a9d966f2421b2b482e0626588fc4b584fb
Instruction Fuzzy Hash: 8601F77440C3409ADB304E26DCC4B67BB88EF81369F188419FE165B2C6C37999C9CAB5

Uniqueness

Uniqueness Score: -1.00%

Function 00394408, Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.512088417.0000000000390000.00000040.00000001.sdmp, Offset: 00390000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54f78dd7b35e59c835917f157a5753d09200c9f85b263fd1d917a8c5304ba45e
Instruction ID: 8c31627dc01eb00857fad64f28595d2a47f82e56082f2e88089a6fb1f7339f45
Opcode Fuzzy Hash: 54f78dd7b35e59c835917f157a5753d09200c9f85b263fd1d917a8c5304ba45e
Instruction Fuzzy Hash: D5012D317057504FEF37562FA504B3A76E65BC0B25F16003DE14AC3A81DB388C5B8741

Uniqueness

Uniqueness Score: -1.00%

Function 00394490, Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.512088417.0000000000390000.00000040.00000001.sdmp, Offset: 00390000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a9cc42a90c414c03bb16b167865bca16233a58e55ab614468391a22dc601264
Instruction ID: a7c4a59ec23f62ee363634285b9fdbd355c5d6ddff39b3e9831c36fac14fa018
Opcode Fuzzy Hash: 4a9cc42a90c414c03bb16b167865bca16233a58e55ab614468391a22dc601264
Instruction Fuzzy Hash: 9501D4709083598BEF1ACFA4C809BEFBBF16B49308F16046DC141B7280CFB95A45C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 006E8D28, Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.521398057.00000000006E0000.00000040.00000001.sdmp, Offset: 006E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b514732ac090204062b6096ccb984cb20e705d26f16eb1493ae6e9e2384b00e6
Instruction ID: 75a3d231a46728ca78af3a1bc45b7fe8e182906bd0c36bdb7ebd0faf97ca0b33
Opcode Fuzzy Hash: b514732ac090204062b6096ccb984cb20e705d26f16eb1493ae6e9e2384b00e6
Instruction Fuzzy Hash: 6F01B070E0121ACFDB54DFAAD8486EEBBB2BF48311F144569D41AA3394DB389941CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00389C79, Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.511565285.0000000000380000.00000040.00000001.sdmp, Offset: 00380000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd36410b03fbba20e7e02e0734ea9cba3a7ac35956af1dc8c57e74a4f6864121
Instruction ID: 3f6c847147d82a51b59076ea2a3cd98c4c71ec8ef6076afe8bd18d61dcda4aec
Opcode Fuzzy Hash: cd36410b03fbba20e7e02e0734ea9cba3a7ac35956af1dc8c57e74a4f6864121
Instruction Fuzzy Hash: AAF0C235204210AFD3169B55E444EAA7BA6FBC5325F0A80BAE9098B352CB32DC44CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00385E9C, Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.511565285.0000000000380000.00000040.00000001.sdmp, Offset: 00380000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93c2f0817f48de0298d104518b5429b3eda1557edff88af0f401e71b985e3fd8
Instruction ID: cb2c86ece6c08edc32e3ef72ada9f1c405ca3aec15ddca6183659b1bc4ba6d45
Opcode Fuzzy Hash: 93c2f0817f48de0298d104518b5429b3eda1557edff88af0f401e71b985e3fd8
Instruction Fuzzy Hash: 56011D75F4020ACFCB05DFA4D1549ADB7B2EF88311F014055EE16AB391DB34AD02CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00382B40, Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.511565285.0000000000380000.00000040.00000001.sdmp, Offset: 00380000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1bbd589f547fa83a4eb0282c678127f9c6c973e352060511c1923d76e0ebc5e
Instruction ID: 3c93066a993dfede80f1cc8b84454ad5a2c691c916e4bacc819b96572ccaeb89
Opcode Fuzzy Hash: e1bbd589f547fa83a4eb0282c678127f9c6c973e352060511c1923d76e0ebc5e
Instruction Fuzzy Hash: E5E065313051940F871667EEA814499BFEACECA16130840FBD54DC7661CE958C438391

Uniqueness

Uniqueness Score: -1.00%

Function 006E8D2A, Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.521398057.00000000006E0000.00000040.00000001.sdmp, Offset: 006E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 018940a28a6a0a3b2190070197712094712376753d11c6e3dc03e36c76848b3f
Instruction ID: e6e715c4f30bb550b31276c98502cae843f0f75cde556aa7c8b93f59a618f546
Opcode Fuzzy Hash: 018940a28a6a0a3b2190070197712094712376753d11c6e3dc03e36c76848b3f
Instruction Fuzzy Hash: 8901DD70D0125ACFDF58CFAAD8446EEBBB2AF18304F14806AD019A3294DB389942CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0038D9FF, Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.511565285.0000000000380000.00000040.00000001.sdmp, Offset: 00380000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3e56d93660c2382c24d8774840037b5c89ef1f52d8d98594672776b8acef602
Instruction ID: a4f9322110a3748df666d320f0cce6ab7eaba1a501611be97409bf9afcf17959
Opcode Fuzzy Hash: a3e56d93660c2382c24d8774840037b5c89ef1f52d8d98594672776b8acef602
Instruction Fuzzy Hash: 7B01E735A01208DFDB05DF90E99ABDCBBB6FB88329F105125E606B7291CB752D82CF50

Uniqueness

Uniqueness Score: -1.00%

Function 00394660, Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.512088417.0000000000390000.00000040.00000001.sdmp, Offset: 00390000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1376ab667de2798020031791572d26f220276c190f0287a4cf746d2a71912ebe
Instruction ID: a3bd3077945327764b485c7e833a1b14ca553f83ee4acb8ef74430ac55312104
Opcode Fuzzy Hash: 1376ab667de2798020031791572d26f220276c190f0287a4cf746d2a71912ebe
Instruction Fuzzy Hash: C0F06D35749244DFDF12CB98E868BD8BBB0EF56318F2A80D3D9189B192C3769916CB41

Uniqueness

Uniqueness Score: -1.00%

Function 006E8D4B, Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.521398057.00000000006E0000.00000040.00000001.sdmp, Offset: 006E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61c83e104f02efcd1329f51b7c3c42984fa82c0d8e3bc94caafcd4187e95a45d
Instruction ID: f357def8d75cf1208b85a91803a26d4f19cc105948978cd3f1acf34ad93ed25d
Opcode Fuzzy Hash: 61c83e104f02efcd1329f51b7c3c42984fa82c0d8e3bc94caafcd4187e95a45d
Instruction Fuzzy Hash: 46F0F474A06249CFDF14CFA6C8447EDB7B1EF14308F055059D409A7394CB789806CB51

Uniqueness

Uniqueness Score: -1.00%

Function 0039B9A8, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.512088417.0000000000390000.00000040.00000001.sdmp, Offset: 00390000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e56d811d21aab0aea079c8849eecb1083dcb8f5f6dd166ff87b965c112a91c5
Instruction ID: e0b5b02bc39c45a21a8bc3437a33771c5fd1bad00a931662ad53edf868d36670
Opcode Fuzzy Hash: 6e56d811d21aab0aea079c8849eecb1083dcb8f5f6dd166ff87b965c112a91c5
Instruction Fuzzy Hash: 8AE048323042145F97109F5AF484C6AB7EBDFC8535319416AE209C7211CB649C458791

Uniqueness

Uniqueness Score: -1.00%

Function 00385E93, Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.511565285.0000000000380000.00000040.00000001.sdmp, Offset: 00380000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec95cabb7c65c54631677d561dfe19edb3197c42ab64c845ce1425d08b29ca00
Instruction ID: 4fd258c76d48da771b631145f172d169085b21adfbf9d62ef737dc48b125edf5
Opcode Fuzzy Hash: ec95cabb7c65c54631677d561dfe19edb3197c42ab64c845ce1425d08b29ca00
Instruction Fuzzy Hash: 10E0E535E0420ACFCB15EF94E6808EEF371AF44354B128091EE15AB361DB34EE02DB90

Uniqueness

Uniqueness Score: -1.00%

Function 00385E8A, Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.511565285.0000000000380000.00000040.00000001.sdmp, Offset: 00380000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec95cabb7c65c54631677d561dfe19edb3197c42ab64c845ce1425d08b29ca00
Instruction ID: 4fd258c76d48da771b631145f172d169085b21adfbf9d62ef737dc48b125edf5
Opcode Fuzzy Hash: ec95cabb7c65c54631677d561dfe19edb3197c42ab64c845ce1425d08b29ca00
Instruction Fuzzy Hash: 10E0E535E0420ACFCB15EF94E6808EEF371AF44354B128091EE15AB361DB34EE02DB90

Uniqueness

Uniqueness Score: -1.00%

Function 003861C8, Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.511565285.0000000000380000.00000040.00000001.sdmp, Offset: 00380000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42807e414475c5346a26c00c5cbeca0e2154bb2e7984f82ce303c36f14d3c2b5
Instruction ID: 4270d3dd0819bc728ea76c8f0aa7668b11d6a867ec9974b175d71566afa5b39e
Opcode Fuzzy Hash: 42807e414475c5346a26c00c5cbeca0e2154bb2e7984f82ce303c36f14d3c2b5
Instruction Fuzzy Hash: 3DE01A30008BC18FC7628B64E4559927BF1AF42218B054A9ED0928B567C7B0A896CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00395BF4, Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.512088417.0000000000390000.00000040.00000001.sdmp, Offset: 00390000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bdfd4c1def6b8a0dc306bd1ad2684b8d8ee5afe571590db8453a85785681bd5d
Instruction ID: e4137945c5467358453c6df6c528324a327b88a160458328b0743f0f6f6ea497
Opcode Fuzzy Hash: bdfd4c1def6b8a0dc306bd1ad2684b8d8ee5afe571590db8453a85785681bd5d
Instruction Fuzzy Hash: 0DE04F35600118DFCB00DF54E888A9CBB71FF84712F104056E501A7260CB319954CF90

Uniqueness

Uniqueness Score: -1.00%

Function 00392E80, Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.512088417.0000000000390000.00000040.00000001.sdmp, Offset: 00390000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34e8ba75ac68c431dd16b3c1008270976d0a3fdac63a40a8ebd90512bc3382eb
Instruction ID: 1ec03ed9b946b511a70b349d5376736944e5e253d418cdeab4aef871d9a15ed8
Opcode Fuzzy Hash: 34e8ba75ac68c431dd16b3c1008270976d0a3fdac63a40a8ebd90512bc3382eb
Instruction Fuzzy Hash: 1DD05E315083899FCB621B3558982067B386E81B4A39502A6E084D6451E721C428C396

Uniqueness

Uniqueness Score: -1.00%

Function 00392E01, Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.512088417.0000000000390000.00000040.00000001.sdmp, Offset: 00390000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 672e28342e63b190017a62fbbbde5e8debe779d134b01d324a1b4db86e2d6a5e
Instruction ID: da27e95b363f7113725aa80d99e2081285cb828f1efb14fee1e98fefedde6b4c
Opcode Fuzzy Hash: 672e28342e63b190017a62fbbbde5e8debe779d134b01d324a1b4db86e2d6a5e
Instruction Fuzzy Hash: 03D0123050C34A8FD7371B3658E8147BF25AD827847BA8096D144D641FEB21442886D2

Uniqueness

Uniqueness Score: -1.00%

Function 00392F00, Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.512088417.0000000000390000.00000040.00000001.sdmp, Offset: 00390000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 539e653a9556cc1da4df3bc3269ea9134d04bf377bb498811b61b0ba556af1bd
Instruction ID: e1ce3b63619245fc321494fb7e84edd446479265841a117048f4241f28fa3beb
Opcode Fuzzy Hash: 539e653a9556cc1da4df3bc3269ea9134d04bf377bb498811b61b0ba556af1bd
Instruction Fuzzy Hash: 2BD0803110C384CFD7021B75B81D2C47F34ED0161531580D7D954CA417DB314861C7A3

Uniqueness

Uniqueness Score: -1.00%

Function 00392E40, Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.512088417.0000000000390000.00000040.00000001.sdmp, Offset: 00390000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9fdab45844defc8285de35255cdb56b8ed3c8c427d2d7dfe71004dc8cfbce61
Instruction ID: 949bdf97e18f5a20d169898c91994616f3083c1c1fe61fa4500283c95a777ac6
Opcode Fuzzy Hash: e9fdab45844defc8285de35255cdb56b8ed3c8c427d2d7dfe71004dc8cfbce61
Instruction Fuzzy Hash: 9FC0802080D3CDBEDB3707746D985667F748D416047494597E1C4CA453C6395454C256

Uniqueness

Uniqueness Score: -1.00%

Function 0038AD10, Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.511565285.0000000000380000.00000040.00000001.sdmp, Offset: 00380000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e958f84b6875d337dad16fa6cd86f712a3e59d58ccbf05bef8dbcbfd558e542
Instruction ID: 1f8d6b4b97453afa1a3e72b07c60900c17682f441b0fd8441f29f24219676289
Opcode Fuzzy Hash: 7e958f84b6875d337dad16fa6cd86f712a3e59d58ccbf05bef8dbcbfd558e542
Instruction Fuzzy Hash: CFC01230200A308BCB309A24E00468AB3F1AB48711F01458ED94283A00C774EC89CB80

Uniqueness

Uniqueness Score: -1.00%

Function 0039C1A6, Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.512088417.0000000000390000.00000040.00000001.sdmp, Offset: 00390000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e35998e011fec00461e5d58c72fab46d0b0398677644da11efb336e801eddb6
Instruction ID: ff1c33ba8f7362b1739b9d7951babaa82b100c7a1daefffc40b670785763fcd2
Opcode Fuzzy Hash: 4e35998e011fec00461e5d58c72fab46d0b0398677644da11efb336e801eddb6
Instruction Fuzzy Hash: D8B01233308010471D052389B00807CF77BDAC0E363201033D30AC08008A3608431151

Uniqueness

Uniqueness Score: -1.00%

Function 0039C203, Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.512088417.0000000000390000.00000040.00000001.sdmp, Offset: 00390000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac19538d55ad7af27e85d8496c5b676cc8fdeee9eaec41c7de6f84b64514a089
Instruction ID: 2a342c5bc6f89f0e47da07a09925d8867ad7c6400cf44ee7f8aa72116e4caff2
Opcode Fuzzy Hash: ac19538d55ad7af27e85d8496c5b676cc8fdeee9eaec41c7de6f84b64514a089
Instruction Fuzzy Hash: 88B01233348010871C05329AB0081BCF36BEAC09362300033F30AC04408B2548030150

Uniqueness

Uniqueness Score: -1.00%

Function 00392E10, Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.512088417.0000000000390000.00000040.00000001.sdmp, Offset: 00390000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4936c3203beb71890ef2ac75aa626be4a70a5a3425b34da559ec13401480723f
Instruction ID: 9a916f314bec0db3f2056929d7d309a8171d1842b7ad5c08444f69ea4fd73e62
Opcode Fuzzy Hash: 4936c3203beb71890ef2ac75aa626be4a70a5a3425b34da559ec13401480723f
Instruction Fuzzy Hash: F4A0223000830C8F832023B03C0CB0E330CA080800BA0802AE00C830088F32E00080C2

Uniqueness

Uniqueness Score: -1.00%

Function 00392E50, Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.512088417.0000000000390000.00000040.00000001.sdmp, Offset: 00390000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa038428e23033448466dcc7e2a5582b7b357b84f33dfe338d99b7e729eaa1b6
Instruction ID: dcbb7b920b41ac096e526dd5b9ec1bb98c2681d8236da39cff43658c8f99b3d1
Opcode Fuzzy Hash: aa038428e23033448466dcc7e2a5582b7b357b84f33dfe338d99b7e729eaa1b6
Instruction Fuzzy Hash: 7BA0223000030C8F822023B03C0CB0C330C8880800380802AE00C830008F32E00080C2

Uniqueness

Uniqueness Score: -1.00%

Function 00392E90, Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.512088417.0000000000390000.00000040.00000001.sdmp, Offset: 00390000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1bf339a32afe47b757c5d7b9832737630320f409bbac6e3752c5a4b0fa2fb1e
Instruction ID: 156b66e52f829994d7950dd055eed4151c8afa94cff406d00cd88b53b97c6169
Opcode Fuzzy Hash: a1bf339a32afe47b757c5d7b9832737630320f409bbac6e3752c5a4b0fa2fb1e
Instruction Fuzzy Hash: 45A0223200030C8F82A023B83C0CB8C330C808082A380822AE00C830008F32E000C0C2

Uniqueness

Uniqueness Score: -1.00%

Function 00392F10, Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.512088417.0000000000390000.00000040.00000001.sdmp, Offset: 00390000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: adf363d8f0ff5c3d8144b18a117d63e8f95a111599caf93631a8e3226549c223
Instruction ID: 07275b9d80c8d949c12806a7d5680828c59b19468b54052f7dc26ce95f0eee69
Opcode Fuzzy Hash: adf363d8f0ff5c3d8144b18a117d63e8f95a111599caf93631a8e3226549c223
Instruction Fuzzy Hash: 69A0223000030CCF8B0023B0380CB0C330CB080C02BA0802AE00C830008F33E00002C2

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0039E730, Relevance: 9.0, Strings: 7, Instructions: 232COMMON

Download Yara Rule

Strings

Pa7, xrefs: 0039E9E9
"\5, xrefs: 0039E93C
@ Xl, xrefs: 0039E8F3
Pa7, xrefs: 0039E774
Pa7, xrefs: 0039E8AC
d, xrefs: 0039E886
"\5, xrefs: 0039E86C

Memory Dump Source

Source File: 00000010.00000002.512088417.0000000000390000.00000040.00000001.sdmp, Offset: 00390000, based on PE: false

Similarity

API ID:
String ID: "\5$"\5$@ Xl$Pa7$Pa7$Pa7$d
API String ID: 0-3855130609
Opcode ID: 22ce5ac59598b2ba8f7155c7d2fe2147e97cff592aa23b2f0c90c4a7b1506c01
Instruction ID: c6dfa2ad90a1e15dee367966af97b787482a293d62105bc2ce3d04f73770fde1
Opcode Fuzzy Hash: 22ce5ac59598b2ba8f7155c7d2fe2147e97cff592aa23b2f0c90c4a7b1506c01
Instruction Fuzzy Hash: E991D034B082018FCB16DF64C890AAEB7E2AF88305F158979D9059F796DB34DC45CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 006E6BC0, Relevance: 6.5, Strings: 5, Instructions: 204COMMON

Download Yara Rule

Strings

9v, xrefs: 006E6CD6
x;v, xrefs: 006E6C4A
9v, xrefs: 006E6C8B
9v, xrefs: 006E6C04
9v, xrefs: 006E6DD5

Memory Dump Source

Source File: 00000010.00000002.521398057.00000000006E0000.00000040.00000001.sdmp, Offset: 006E0000, based on PE: false

Similarity

API ID:
String ID: x;v$9v$9v$9v$9v
API String ID: 0-2989573838
Opcode ID: 474fa0a93c7b3d798df3be32f58e4cd16a0fbbb984dd7d9a2476fd623864c6f6
Instruction ID: 309b3a2bc0eb93c614a8762452d6cdd5d94da40ba34c2cff60925d2c8e554dad
Opcode Fuzzy Hash: 474fa0a93c7b3d798df3be32f58e4cd16a0fbbb984dd7d9a2476fd623864c6f6
Instruction Fuzzy Hash: 57810534B053489FCB14DFAAC580A9EB7F6AF5C354B1584A9E946EB360DB34EC418F90

Uniqueness

Uniqueness Score: -1.00%

Function 00387F50, Relevance: 5.1, Strings: 4, Instructions: 137COMMON

Download Yara Rule

Strings

TK;, xrefs: 003880E5
hL;, xrefs: 00387F92
TK;, xrefs: 0038800F
P@;, xrefs: 00388052

Memory Dump Source

Source File: 00000010.00000002.511565285.0000000000380000.00000040.00000001.sdmp, Offset: 00380000, based on PE: false

Similarity

API ID:
String ID: P@;$TK;$TK;$hL;
API String ID: 0-2092316477
Opcode ID: daad999f55a0bce863eb5e7764859835f42d4deb97504c1e86728fbeef43e3c6
Instruction ID: 0faa92a00667e947e6c6e5fa945db9a7494f162f1d1c48722e852893cbeb6bdb
Opcode Fuzzy Hash: daad999f55a0bce863eb5e7764859835f42d4deb97504c1e86728fbeef43e3c6
Instruction Fuzzy Hash: A3515C34E0030A9FCB15DFA5C884AAEFBB2FF88304F258559D915AB355DB70E946CB80

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: powershell.exe PID: 7104 Parent PID: 4392 powershell.exeCOMMON

Executed Functions

Function 010284B8, Relevance: 2.0, Strings: 1, Instructions: 764COMMON

Download Yara Rule

Strings

#, xrefs: 01028507

Memory Dump Source

Source File: 00000013.00000002.525588764.0000000001020000.00000040.00000001.sdmp, Offset: 01020000, based on PE: false

Similarity

API ID:
String ID: #
API String ID: 0-1885708031
Opcode ID: fc8260f4b6e56c9ff5382f26001b498d81e6f4a7118a318e68b3a66d88c89f1e
Instruction ID: 3d48d2fa32d1e2e08e4d599d739599d20860d12baeb71e3c232179523eb844b6
Opcode Fuzzy Hash: fc8260f4b6e56c9ff5382f26001b498d81e6f4a7118a318e68b3a66d88c89f1e
Instruction Fuzzy Hash: 2C72F578A00228CFDB65DF64C884B9DBBF2FF48305F1484AAE949AB351DB759981CF50

Uniqueness

Uniqueness Score: -1.00%

Function 0102B150, Relevance: .7, Instructions: 740COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.525588764.0000000001020000.00000040.00000001.sdmp, Offset: 01020000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0043cf27eb606f45e5e949cb9dd85de5b0e55203d325f40d61a38c9df9e2d04a
Instruction ID: 84a1b9efe1a43ed1430a136420c96f134bdbaaf5d4881be902e2723ed96e103a
Opcode Fuzzy Hash: 0043cf27eb606f45e5e949cb9dd85de5b0e55203d325f40d61a38c9df9e2d04a
Instruction Fuzzy Hash: 9E52AC30B002149FDB15DF68D895BAEBBF2BF88314F148469E946AB391CB74EC45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 01066F88, Relevance: .5, Instructions: 490COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.526288637.0000000001060000.00000040.00000001.sdmp, Offset: 01060000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46ee6aa0d7fcc9db0c46da8fd1b559fd6975fe24e6f66b7d0bff827d5b5c6bd8
Instruction ID: a30e5d59020a4582f531f5e8d4de0d68d60db953448d3d57eec87ddd9147cfed
Opcode Fuzzy Hash: 46ee6aa0d7fcc9db0c46da8fd1b559fd6975fe24e6f66b7d0bff827d5b5c6bd8
Instruction Fuzzy Hash: E7028C30B082058FCB04DF78D894AAEBBF6EF89208B0585A9D645DF761DB74ED41CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00BB84E1, Relevance: 2.7, Strings: 2, Instructions: 166COMMON

Download Yara Rule

Strings

(Rk, xrefs: 00BB8537
(Rk, xrefs: 00BB8541

Memory Dump Source

Source File: 00000013.00000002.511017415.0000000000BB0000.00000040.00000001.sdmp, Offset: 00BB0000, based on PE: false

Similarity

API ID:
String ID: (Rk$(Rk
API String ID: 0-447046401
Opcode ID: d63fb7d4c32ef98b4d16382f62a5db7a61d0527f692f55f7bcc71c99c5b08126
Instruction ID: 70b81af9a656fcde8dbf1ebd0c5c5ce91e442d400930962f184b452932a66209
Opcode Fuzzy Hash: d63fb7d4c32ef98b4d16382f62a5db7a61d0527f692f55f7bcc71c99c5b08126
Instruction Fuzzy Hash: 09615C747042418FCB15DF28D9989A9BBF2EF99314B1980EAD40ADB3A6DF70EC01CB51

Uniqueness

Uniqueness Score: -1.00%

Function 010616C2, Relevance: 1.5, Strings: 1, Instructions: 284COMMON

Download Yara Rule

Strings

d, xrefs: 01061939

Memory Dump Source

Source File: 00000013.00000002.526288637.0000000001060000.00000040.00000001.sdmp, Offset: 01060000, based on PE: false

Similarity

API ID:
String ID: d
API String ID: 0-2564639436
Opcode ID: 645d8d3f880bf7ba5ed61eaa124dc11a77fbf13eaa2bb2a449cd60d88c4b1520
Instruction ID: 23790f0306bd80a4cf147f50b275a9f16888929f4abb3b5ca89f4699b994573a
Opcode Fuzzy Hash: 645d8d3f880bf7ba5ed61eaa124dc11a77fbf13eaa2bb2a449cd60d88c4b1520
Instruction Fuzzy Hash: 57C17A306046068FCB14CF19C5809AAB7F6FFC8314B1ACA99D59A9B762D730F846CB90

Uniqueness

Uniqueness Score: -1.00%

Function 01028208, Relevance: 1.4, Strings: 1, Instructions: 186COMMON

Download Yara Rule

Strings

@ Xl, xrefs: 01028379

Memory Dump Source

Source File: 00000013.00000002.525588764.0000000001020000.00000040.00000001.sdmp, Offset: 01020000, based on PE: false

Similarity

API ID:
String ID: @ Xl
API String ID: 0-3027975150
Opcode ID: a62bd8b0ba970e371806fec98832dab86539a6807e7cbe44730bea0ac6a5a5fe
Instruction ID: b46674c82fda947ed776faba6e3a98349324f57318de5fcccfc33ba108590561
Opcode Fuzzy Hash: a62bd8b0ba970e371806fec98832dab86539a6807e7cbe44730bea0ac6a5a5fe
Instruction Fuzzy Hash: D2815734A04218DFCB54CF68D594AADBBF2FF88304F15C46AE545AB261CB34EC42CB90

Uniqueness

Uniqueness Score: -1.00%

Function 01028207, Relevance: 1.4, Strings: 1, Instructions: 168COMMON

Download Yara Rule

Strings

@ Xl, xrefs: 01028379

Memory Dump Source

Source File: 00000013.00000002.525588764.0000000001020000.00000040.00000001.sdmp, Offset: 01020000, based on PE: false

Similarity

API ID:
String ID: @ Xl
API String ID: 0-3027975150
Opcode ID: 4e235942b497c90b0db58f16b38b1aedc050903651b4a83bdc9b8268ebe28714
Instruction ID: 025458de95d33185284547813ea62d52c9e36fb37c7aac63ec1e1358ace42024
Opcode Fuzzy Hash: 4e235942b497c90b0db58f16b38b1aedc050903651b4a83bdc9b8268ebe28714
Instruction Fuzzy Hash: 25615974A04219DFCB58DF68D584AADBBF2FF88304F15C46AE545AB261DB30EC46CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00BB8500, Relevance: 1.4, Strings: 1, Instructions: 134COMMON

Download Yara Rule

Strings

(Rk, xrefs: 00BB8537

Memory Dump Source

Source File: 00000013.00000002.511017415.0000000000BB0000.00000040.00000001.sdmp, Offset: 00BB0000, based on PE: false

Similarity

API ID:
String ID: (Rk
API String ID: 0-717472383
Opcode ID: 945c662d3e9c481482a70ebc61cf37b3532a3e4f4d7c9c9e954ba868b387eef9
Instruction ID: ed72624e3fbaefdf7c001ac965a1f66b0d82ea2db2e280a3c036483d22e860c2
Opcode Fuzzy Hash: 945c662d3e9c481482a70ebc61cf37b3532a3e4f4d7c9c9e954ba868b387eef9
Instruction Fuzzy Hash: 785158347046418FCB15DF28C995AA97BF6EF99314B1940EAE40ADB362DF30EC01CB50

Uniqueness

Uniqueness Score: -1.00%

Function 01022968, Relevance: 1.4, Strings: 1, Instructions: 115COMMON

Download Yara Rule

Strings

N, xrefs: 010229E2

Memory Dump Source

Source File: 00000013.00000002.525588764.0000000001020000.00000040.00000001.sdmp, Offset: 01020000, based on PE: false

Similarity

API ID:
String ID: N
API String ID: 0-1161386698
Opcode ID: b1006e1c53beceb6c704346127284d9a34cce35772d16376178875028abd77de
Instruction ID: 9a6dc33b1789074afd2ecc8bcccb8008f707d4ab2147255df083c8c8eb01df4f
Opcode Fuzzy Hash: b1006e1c53beceb6c704346127284d9a34cce35772d16376178875028abd77de
Instruction Fuzzy Hash: 6B41BD31B002169FDB14DFA8C9496BEFFF6EF84305F0480A9DA45EB692CB749851CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0106D259, Relevance: 1.4, Strings: 1, Instructions: 114COMMON

Download Yara Rule

Strings

@ Xl, xrefs: 0106D353

Memory Dump Source

Source File: 00000013.00000002.526288637.0000000001060000.00000040.00000001.sdmp, Offset: 01060000, based on PE: false

Similarity

API ID:
String ID: @ Xl
API String ID: 0-3027975150
Opcode ID: c292b81f4fc8af64ccd429a289e9a2fb9e841c6f2588727ccb73316a863e8034
Instruction ID: 17f4ee3c4c66de87aa4a30e0dc694603e6a4d0d3fb2edb9ca1cdf852ae19ee3f
Opcode Fuzzy Hash: c292b81f4fc8af64ccd429a289e9a2fb9e841c6f2588727ccb73316a863e8034
Instruction Fuzzy Hash: F441F230704206DFCB04EF68D454AADBBF2FF88324F148969D545AB792DB70AD45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0106D270, Relevance: 1.3, Strings: 1, Instructions: 98COMMON

Download Yara Rule

Strings

@ Xl, xrefs: 0106D353

Memory Dump Source

Source File: 00000013.00000002.526288637.0000000001060000.00000040.00000001.sdmp, Offset: 01060000, based on PE: false

Similarity

API ID:
String ID: @ Xl
API String ID: 0-3027975150
Opcode ID: c8c4d4d7beff66634f39d5c1d5cd29b6c3a581986ecfd58c3fabc8411281edc8
Instruction ID: 1cfa6c1f90b94dad0ee5d5bec380095becd19ed895899b72a73387d149b8a258
Opcode Fuzzy Hash: c8c4d4d7beff66634f39d5c1d5cd29b6c3a581986ecfd58c3fabc8411281edc8
Instruction Fuzzy Hash: 7D31CC30700206DFCB04EF68E194AADB7E2FF88314F14CA29D645AB791CB71AD45CB91

Uniqueness

Uniqueness Score: -1.00%

Function 01066C77, Relevance: 1.3, Strings: 1, Instructions: 92COMMON

Download Yara Rule

Strings

*, xrefs: 01066C0F

Memory Dump Source

Source File: 00000013.00000002.526288637.0000000001060000.00000040.00000001.sdmp, Offset: 01060000, based on PE: false

Similarity

API ID:
String ID: *
API String ID: 0-163128923
Opcode ID: ff594f22c446bff7c2b6cf5410060ebb326f71cb0b285078c9ddf597513d1577
Instruction ID: 67bbd45446c336b8b5ae019749c2e4e6554c2889d5b9c4085c294204a312acd1
Opcode Fuzzy Hash: ff594f22c446bff7c2b6cf5410060ebb326f71cb0b285078c9ddf597513d1577
Instruction Fuzzy Hash: 4831C1B1E04619CFCB91CFA8D954ABEBBF4EF58310F0480AAD855DB245DB31C942CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 01029CC8, Relevance: 1.3, Strings: 1, Instructions: 64COMMON

Download Yara Rule

Strings

KA, xrefs: 01029D06

Memory Dump Source

Source File: 00000013.00000002.525588764.0000000001020000.00000040.00000001.sdmp, Offset: 01020000, based on PE: false

Similarity

API ID:
String ID: KA
API String ID: 0-4133974868
Opcode ID: 7b3de1d8c136685eead412a11d19f72ddf145f33ca3e4743f804f19cd526621f
Instruction ID: 41b971311520226d22110e018874d46201b210fae041f968a383b35de66338ad
Opcode Fuzzy Hash: 7b3de1d8c136685eead412a11d19f72ddf145f33ca3e4743f804f19cd526621f
Instruction Fuzzy Hash: 891193316086159BC711AB35E950AAFB7A3FBC431CB058A29EA4A8F624DF70ED4597C0

Uniqueness

Uniqueness Score: -1.00%

Function 01029CB6, Relevance: 1.3, Strings: 1, Instructions: 59COMMON

Download Yara Rule

Strings

KA, xrefs: 01029D06

Memory Dump Source

Source File: 00000013.00000002.525588764.0000000001020000.00000040.00000001.sdmp, Offset: 01020000, based on PE: false

Similarity

API ID:
String ID: KA
API String ID: 0-4133974868
Opcode ID: bf073f2755dd163176aa7a1ce385530ab1a46e858c94f983dc4250e4521e9e1e
Instruction ID: 218df6f3f2860d34baf90525c4dd7bb805a57181980922876c6d648893783848
Opcode Fuzzy Hash: bf073f2755dd163176aa7a1ce385530ab1a46e858c94f983dc4250e4521e9e1e
Instruction Fuzzy Hash: B311233120C3169FC311AF25E8509AFB7A3BFC4328B04862AEA458B620DF74DC85D7D0

Uniqueness

Uniqueness Score: -1.00%

Function 00BBE6D0, Relevance: .6, Instructions: 646COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.511017415.0000000000BB0000.00000040.00000001.sdmp, Offset: 00BB0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1e3afc6cb7164296d02c6e605e4dfe17cdab8251fceb7818b07e040e85164b0
Instruction ID: c86974a3c0436cab6b850c0fdbde077ad58090418bc43aed831e731cddc47c50
Opcode Fuzzy Hash: b1e3afc6cb7164296d02c6e605e4dfe17cdab8251fceb7818b07e040e85164b0
Instruction Fuzzy Hash: 0F324D757081188FC748DB68C8949BE77F2FF8A704B2149A8E516DF7A1CB70EC458BA1

Uniqueness

Uniqueness Score: -1.00%

Function 00BBDE60, Relevance: .6, Instructions: 629COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.511017415.0000000000BB0000.00000040.00000001.sdmp, Offset: 00BB0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1338fe59bb9ebb9140d0ebcdb548c2c1ac3a7726e3ed572c6456dfe6ae483570
Instruction ID: 42bbe0bf0f905efcc4ae5c821cc8c17fe4c75bdaaa013e1c2977582319527139
Opcode Fuzzy Hash: 1338fe59bb9ebb9140d0ebcdb548c2c1ac3a7726e3ed572c6456dfe6ae483570
Instruction Fuzzy Hash: 243224356042158FCB14DB68C894EA9B7F2FF89314F1681E9E61A9B771CB31EC85CB90

Uniqueness

Uniqueness Score: -1.00%

Function 01068FB0, Relevance: .5, Instructions: 499COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.526288637.0000000001060000.00000040.00000001.sdmp, Offset: 01060000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff2c984c404ea36385edd9e453ce36f16302e337eeaa656e7b6c889b160be7c0
Instruction ID: 1d301f8fe59cf662a904d76d9560155c34b47f42ff317a428cde6d013b2be45f
Opcode Fuzzy Hash: ff2c984c404ea36385edd9e453ce36f16302e337eeaa656e7b6c889b160be7c0
Instruction Fuzzy Hash: A2227B30A00605CFDB51DF68C584BA9B7F2FF84318F15CA99D549AB652EB30ED86CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00BB60E0, Relevance: .5, Instructions: 481COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.511017415.0000000000BB0000.00000040.00000001.sdmp, Offset: 00BB0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a38490b5d561d0550d02aaf142fff14e481156ce7d95f90f99aca9c6fd07ad49
Instruction ID: 98d7510dc7a245151c01646f39a4108082e8255ad0ec8106a662365943b7acbe
Opcode Fuzzy Hash: a38490b5d561d0550d02aaf142fff14e481156ce7d95f90f99aca9c6fd07ad49
Instruction Fuzzy Hash: EA224834A00204CFCB25DFA4D594AAEBBF2FF88315B108869E50A9B765CB75EC46CF50

Uniqueness

Uniqueness Score: -1.00%

Function 00BBEA50, Relevance: .3, Instructions: 341COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.511017415.0000000000BB0000.00000040.00000001.sdmp, Offset: 00BB0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd44b9f903402e1b530c1edb7ae49cbabf9a846d70d2bf5b49e461f1fdd6a113
Instruction ID: 9f3975691b6deea300388ea5304bdb4be5e47ce7b4817b4025f0837a8cc3f5e7
Opcode Fuzzy Hash: dd44b9f903402e1b530c1edb7ae49cbabf9a846d70d2bf5b49e461f1fdd6a113
Instruction Fuzzy Hash: 29D1BB75348119CF8788DB68C8948AE77B2FF8A704B2149E4E5278F771DB30EC448BA1

Uniqueness

Uniqueness Score: -1.00%

Function 01024648, Relevance: .3, Instructions: 328COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.525588764.0000000001020000.00000040.00000001.sdmp, Offset: 01020000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d318cbd438c679d5f8b0938b97cf6b3f0a0b74ed937bda6964c9f260990ef8b4
Instruction ID: c26998b5b3855c237883bf7fe9b225754ff7c71008c2c0a0ed7afbe812408ee7
Opcode Fuzzy Hash: d318cbd438c679d5f8b0938b97cf6b3f0a0b74ed937bda6964c9f260990ef8b4
Instruction Fuzzy Hash: 81E11330A00619CFCB64DF68C580A9DB7F1FF48314F218A99E995AB661DB70ED81CF90

Uniqueness

Uniqueness Score: -1.00%

Function 00BB5338, Relevance: .3, Instructions: 313COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.511017415.0000000000BB0000.00000040.00000001.sdmp, Offset: 00BB0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f740413978163984c79863c82baccd7c242c739a119ab6b87b6e77f5005b9b3
Instruction ID: f90a46959523b037c572edce21af91b7b320d112afa1a97c4a939b401919fdf6
Opcode Fuzzy Hash: 5f740413978163984c79863c82baccd7c242c739a119ab6b87b6e77f5005b9b3
Instruction Fuzzy Hash: CCA12F30B06811CF96591B6E99681BDB6E76BD4741328448BF013CB7B4DFB48D03ABA7

Uniqueness

Uniqueness Score: -1.00%

Function 00BB530A, Relevance: .3, Instructions: 313COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.511017415.0000000000BB0000.00000040.00000001.sdmp, Offset: 00BB0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71423be289fe0da150ce48464c6e357f85a85f80fa760fb7d084f79d99a6d6f1
Instruction ID: a389667a8e6d8a7859f17470fbb9f5699812a1ae50da82cb15af269b72c22a20
Opcode Fuzzy Hash: 71423be289fe0da150ce48464c6e357f85a85f80fa760fb7d084f79d99a6d6f1
Instruction Fuzzy Hash: 63A10F30B06811CFD6591B6D9A686BDB6E76FD074132C448BE013CB3B4DFA48D03AB66

Uniqueness

Uniqueness Score: -1.00%

Function 01020DA0, Relevance: .3, Instructions: 304COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.525588764.0000000001020000.00000040.00000001.sdmp, Offset: 01020000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cba02e43b6c6fdeb8566b1da738b388dde5c6d71ba8554155d3361b2339ad94e
Instruction ID: a57bdbef67b1d7743acd6c2ef6e63551ad699d4e6c0ac3a7dda5f91cc93c2351
Opcode Fuzzy Hash: cba02e43b6c6fdeb8566b1da738b388dde5c6d71ba8554155d3361b2339ad94e
Instruction Fuzzy Hash: 15C18C30A00259CFDB14CFA5D854BAEBBF6EF88304F1084AAE949AB394DB759D45CF50

Uniqueness

Uniqueness Score: -1.00%

Function 01027470, Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.525588764.0000000001020000.00000040.00000001.sdmp, Offset: 01020000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ccc2c98e9330e61543517a0b714db5a14a1c0926c7ab5b006a6c20ee9fe78b82
Instruction ID: df4da7de9d284eb0486bbe03030b321f99e8778f24adafe2444f5300c6a5e55b
Opcode Fuzzy Hash: ccc2c98e9330e61543517a0b714db5a14a1c0926c7ab5b006a6c20ee9fe78b82
Instruction Fuzzy Hash: 02D16974A04225CFCB15DF68C484999FBF2BF49314B1A859AD859AB362C731FC82CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0102C900, Relevance: .3, Instructions: 269COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.525588764.0000000001020000.00000040.00000001.sdmp, Offset: 01020000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a25035400f095f9abc0cf09c574e04491f5e16f5faa5acd27e594be22b081439
Instruction ID: e276ee954ab6656994851c9bc7ea4cf73c86d1fa6d625d8d0c91b7293f7fbf4a
Opcode Fuzzy Hash: a25035400f095f9abc0cf09c574e04491f5e16f5faa5acd27e594be22b081439
Instruction Fuzzy Hash: C8B13C74A02215DFDB08CF68E68099DB7F2BF88314F2246A8E5459F3A5DB30ED41CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00BB88F8, Relevance: .2, Instructions: 250COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.511017415.0000000000BB0000.00000040.00000001.sdmp, Offset: 00BB0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10ffb16fcdb1b7bbce99b46ac818bb783b913f721e7488cdc6b7d354904a9012
Instruction ID: 89145bf7356edc5d67f9bca398e541634b6e86d7e7eb146c2d3b56bac4859d5e
Opcode Fuzzy Hash: 10ffb16fcdb1b7bbce99b46ac818bb783b913f721e7488cdc6b7d354904a9012
Instruction Fuzzy Hash: 12B1E374A042088FDB14DFA8D994AEDBBF5EF48314F1584A9E905EB3A1DB71EC41CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00BB60D0, Relevance: .2, Instructions: 234COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.511017415.0000000000BB0000.00000040.00000001.sdmp, Offset: 00BB0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aaefd538d5483c69ad8b223b027a971c049571f74ed80187c34e6c8dce0f6ab7
Instruction ID: 25d8a591dea41606ed468b0005fb81b8c2b7ccc639b88cb0c01f95f0e54e7caf
Opcode Fuzzy Hash: aaefd538d5483c69ad8b223b027a971c049571f74ed80187c34e6c8dce0f6ab7
Instruction Fuzzy Hash: B3A16B34A00605CFCB14DFA4C594AAEBBF2FF88315B1189A9D40A9B761DB75EC86CF40

Uniqueness

Uniqueness Score: -1.00%

Function 01066438, Relevance: .2, Instructions: 215COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.526288637.0000000001060000.00000040.00000001.sdmp, Offset: 01060000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4aa51e8f75ddae6b4cd5f73f3f47bbdecd2bada1b379740ee18e31eb57a2f37b
Instruction ID: c710c193be8617586e78d3198300715a3f7904ca92c7e972dcf00a12e90a5bc7
Opcode Fuzzy Hash: 4aa51e8f75ddae6b4cd5f73f3f47bbdecd2bada1b379740ee18e31eb57a2f37b
Instruction Fuzzy Hash: FA81CB306082059FCB05DF74E854AAE7BF6EF85308F0049ADE646CB6A1DF36AD45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 01029350, Relevance: .2, Instructions: 214COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.525588764.0000000001020000.00000040.00000001.sdmp, Offset: 01020000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53a4206cd514a85a93a1da5146c8a0606f5fa216991c3dcf15f04f9e60d091ce
Instruction ID: d3021168b368eccd1dc2d45ea5e3e4e3417747147c9303c064c13340db19721c
Opcode Fuzzy Hash: 53a4206cd514a85a93a1da5146c8a0606f5fa216991c3dcf15f04f9e60d091ce
Instruction Fuzzy Hash: B081AC306006109FD725DB64D594BAFB7E2FF88318F14892DD6868BB90CF79E845CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0102AAD8, Relevance: .2, Instructions: 214COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.525588764.0000000001020000.00000040.00000001.sdmp, Offset: 01020000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d8786b048c161ab64a10c75edb8be3f11f2ed3c4dbc5a160621dc72143b52d5
Instruction ID: c7720d3e69bd5c0901374d27b1b0ed7c785285bcd9a3430b8ad35c692124ed79
Opcode Fuzzy Hash: 4d8786b048c161ab64a10c75edb8be3f11f2ed3c4dbc5a160621dc72143b52d5
Instruction Fuzzy Hash: E381D431700601CFDB259F65E8197ABBBF7FF88301F044469E64697AA6CF74A851CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0102BEF0, Relevance: .2, Instructions: 194COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.525588764.0000000001020000.00000040.00000001.sdmp, Offset: 01020000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c213b3cb5380570ece6d9bfa0ca8054e4bc205d1901e463799057a11c0205b1
Instruction ID: 80a132126abbec4d9df5b556867d15362be7e511751da6fa96db8d63de0e7cd1
Opcode Fuzzy Hash: 1c213b3cb5380570ece6d9bfa0ca8054e4bc205d1901e463799057a11c0205b1
Instruction Fuzzy Hash: A6813834A002148FDB14DF69E689A9DBBF1BF8D350B2542A8E545EB3A1DB31ED41CF60

Uniqueness

Uniqueness Score: -1.00%

Function 01028000, Relevance: .2, Instructions: 181COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.525588764.0000000001020000.00000040.00000001.sdmp, Offset: 01020000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ce10fc1a20876c5a2c95debf29b08f2428b3da235311111d578b101eed13a63
Instruction ID: 14177e1a3061c19675cbee7faed8a614a0cf8cfb6cadd1db01f83c44b70ca16d
Opcode Fuzzy Hash: 2ce10fc1a20876c5a2c95debf29b08f2428b3da235311111d578b101eed13a63
Instruction Fuzzy Hash: 0F71C4346046558FCB05CF68C4D4AAAFBF1FF48310B25869ADA459B361C735FC41CB94

Uniqueness

Uniqueness Score: -1.00%

Function 01024AE0, Relevance: .2, Instructions: 181COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.525588764.0000000001020000.00000040.00000001.sdmp, Offset: 01020000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f585b9a902c796bee15c6351ba6401af8464584962efea8790bba38f98a8f33e
Instruction ID: 485aeff2ab3822b3bea8491eca883e722f424814a7e5eea99e43f6625e8070fa
Opcode Fuzzy Hash: f585b9a902c796bee15c6351ba6401af8464584962efea8790bba38f98a8f33e
Instruction Fuzzy Hash: 61814570A01209DFCB54DF68D584AADB7F2FF88314F2189A8E545AB362DB34ED45CB80

Uniqueness

Uniqueness Score: -1.00%

Function 01068C68, Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.526288637.0000000001060000.00000040.00000001.sdmp, Offset: 01060000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e05fdd6467a425e4420f1269bcd19fe7301d4fdd161fe14170e4cafd354b548e
Instruction ID: c7ff4f8c98563180c055bad8f201e2b85ca4be5cd78197fe1e5e6fe5505757b3
Opcode Fuzzy Hash: e05fdd6467a425e4420f1269bcd19fe7301d4fdd161fe14170e4cafd354b548e
Instruction Fuzzy Hash: 88715930A00209CFCB58DF64C594AAEB7F2BF94314F15C56AE505AB395DB74ED46CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00BB0040, Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.511017415.0000000000BB0000.00000040.00000001.sdmp, Offset: 00BB0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1727ac2fdb49497172bcfb90927b71c7f20d68649d6a53b80216b51d7cbdc89
Instruction ID: f6ae3f7be5c3eb7046c88bc23fbf394c571392cde2865717f9bd719475aa1d7d
Opcode Fuzzy Hash: e1727ac2fdb49497172bcfb90927b71c7f20d68649d6a53b80216b51d7cbdc89
Instruction Fuzzy Hash: 07612774A14209DFCB24EF69E958ABEBBF1FF48310F144069E906E72A1DB749C81CB54

Uniqueness

Uniqueness Score: -1.00%

Function 01066A7F, Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.526288637.0000000001060000.00000040.00000001.sdmp, Offset: 01060000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba81c3e285ac6f8d44ccfb604ef85b8474456a43fd1df4c3bf63132853026ec1
Instruction ID: 7d8d3272c55fd46ceb31cbaacdf6f8c319eae7b9274801d3d4300b8167160f9b
Opcode Fuzzy Hash: ba81c3e285ac6f8d44ccfb604ef85b8474456a43fd1df4c3bf63132853026ec1
Instruction Fuzzy Hash: C75106356082408FC705CF68D8949AA7BF1FF99318B1945E9D589DB362CF31EC06CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 01065EE0, Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.526288637.0000000001060000.00000040.00000001.sdmp, Offset: 01060000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28053759cd5f6b245a7a9dac200bba718dc4d2c4269c08f1f445a1d9f1b66078
Instruction ID: e5dca0ced726560cb9c9eb8d9f2c24845b081a80232e12dd4487c0c9c94f824f
Opcode Fuzzy Hash: 28053759cd5f6b245a7a9dac200bba718dc4d2c4269c08f1f445a1d9f1b66078
Instruction Fuzzy Hash: 7A612574E002199FCB05DFA8D8849EEBBF6FF88310F15846AE915AB351DB35AD01CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0102C3E0, Relevance: .2, Instructions: 165COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.525588764.0000000001020000.00000040.00000001.sdmp, Offset: 01020000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 126b467c28ad8bf0924ce67319dee58a07b576e615e672d38967ffa322999463
Instruction ID: d46e6dbe81e6ed30ae0e03915e3afecf7763b58c38ea3bdc9793ac889743a29b
Opcode Fuzzy Hash: 126b467c28ad8bf0924ce67319dee58a07b576e615e672d38967ffa322999463
Instruction Fuzzy Hash: 56517C71B006249FEB14DB79D4406AEB7F6EF88211F14817ADA06DB791DB31DC46CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00BB5AF0, Relevance: .2, Instructions: 164COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.511017415.0000000000BB0000.00000040.00000001.sdmp, Offset: 00BB0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6bf4565be0c3b90f76eabbe310ed906e05d1d19413156e55c0e02ca5533a433
Instruction ID: a01734216a8dcf986b220aa1871a7c086ef736094cb13fea3af73443ca596912
Opcode Fuzzy Hash: d6bf4565be0c3b90f76eabbe310ed906e05d1d19413156e55c0e02ca5533a433
Instruction Fuzzy Hash: 58513D75A00505CFCB15DF68D9989ADBBF2FF49310B1580A9E506EB361DB30EC46CB60

Uniqueness

Uniqueness Score: -1.00%

Function 0106D5B0, Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.526288637.0000000001060000.00000040.00000001.sdmp, Offset: 01060000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae66a0a9ee855655082c6d562730d1f94b8237f10af066bcda6cd660d258f3de
Instruction ID: 06bd2bf8a8cd49a3a90119543bab433ae1231bf7140d251d889e92932d8b29d8
Opcode Fuzzy Hash: ae66a0a9ee855655082c6d562730d1f94b8237f10af066bcda6cd660d258f3de
Instruction Fuzzy Hash: 92619E75A002049FD710DF68D895BEDBBF6FF88300F0580A9E985AB3A1DB75AC45CB60

Uniqueness

Uniqueness Score: -1.00%

Function 01067021, Relevance: .2, Instructions: 162COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.526288637.0000000001060000.00000040.00000001.sdmp, Offset: 01060000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55b0d617db84a88a7ab2b6b9d48f0866334a2cba05c01f8e263ac6f51b380c6d
Instruction ID: 256100828891ca3a1ba9f4354696f05d8a4569015756e01bcef77dc3cbfc0d66
Opcode Fuzzy Hash: 55b0d617db84a88a7ab2b6b9d48f0866334a2cba05c01f8e263ac6f51b380c6d
Instruction Fuzzy Hash: 3051B030A0420ACFC744DF68D980AAEB7F6FF84318F01866AD555DB765DB30AD85CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 01066E0F, Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.526288637.0000000001060000.00000040.00000001.sdmp, Offset: 01060000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ceb23f4ff30546e3536748076356a4753e4e997988f9aeb521bdab3d9909b0ca
Instruction ID: 400f660af33f5335b5480f609e7ebc97cef4167686fe1450a9fd78abbb3315cd
Opcode Fuzzy Hash: ceb23f4ff30546e3536748076356a4753e4e997988f9aeb521bdab3d9909b0ca
Instruction Fuzzy Hash: 11518974B042048FCB15DF69C894AAEBBF6AF89314B1141A9E646CB3A1DF71DC46CB90

Uniqueness

Uniqueness Score: -1.00%

Function 01025003, Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.525588764.0000000001020000.00000040.00000001.sdmp, Offset: 01020000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 485e7521459d2a31bb647a7c9be4de4451622975e0e060d56e8176c27ea8df37
Instruction ID: 6d007e49b1896097e54e5b91c068a4022137ab7799f2c63e4c273844cba60147
Opcode Fuzzy Hash: 485e7521459d2a31bb647a7c9be4de4451622975e0e060d56e8176c27ea8df37
Instruction Fuzzy Hash: AE615B30604204DFCB15DF64C894AADBBB2FF89358F2148A8E5469F3A5DB35ED85CB80

Uniqueness

Uniqueness Score: -1.00%

Function 0106AB9F, Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.526288637.0000000001060000.00000040.00000001.sdmp, Offset: 01060000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa91b5a7e94355c2f021f7fabc8529b180cbb87963663ce214b15799a6eac574
Instruction ID: f185ca66e6315252c31bac00cb1a4ebf27a104a10f22c998310edfa190595cbf
Opcode Fuzzy Hash: fa91b5a7e94355c2f021f7fabc8529b180cbb87963663ce214b15799a6eac574
Instruction Fuzzy Hash: 1451F170A09399CFCB12DB78C0507AEBFF6AF56315F1844E9D492AB392D7349801CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0106ABF0, Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.526288637.0000000001060000.00000040.00000001.sdmp, Offset: 01060000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d697026a075a14b9e1e48305cd9bbe4d491045e6246f1cc003839494c3c0372e
Instruction ID: 1bf4e7b4486132045c697abe064d8ffca77d647648570a174f47b1bbe318a66c
Opcode Fuzzy Hash: d697026a075a14b9e1e48305cd9bbe4d491045e6246f1cc003839494c3c0372e
Instruction Fuzzy Hash: 1C51E270A08398CFCB15DB78C0507AEBFF2AF56215F1844E9E496AB392D734D841CB61

Uniqueness

Uniqueness Score: -1.00%

Function 01068C58, Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.526288637.0000000001060000.00000040.00000001.sdmp, Offset: 01060000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db28177475112653af830af3c4c97ad5e9947963f2e7e0ee27e79e92398650cc
Instruction ID: 8149784af5ca2d7ab47dd0b84df0bc1228100e7d4ad2a92f209508305ff6348a
Opcode Fuzzy Hash: db28177475112653af830af3c4c97ad5e9947963f2e7e0ee27e79e92398650cc
Instruction Fuzzy Hash: F4516730A00209CFCB14CF64D584AAEB7F2BF94314F21C5AAE505AF3A5EB70AD46CB40

Uniqueness

Uniqueness Score: -1.00%

Function 0106AC20, Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.526288637.0000000001060000.00000040.00000001.sdmp, Offset: 01060000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc9e89535eedf5a5a109ee11c00e7341c7d85835ac64f77d02ff69785afbcaa7
Instruction ID: 2c3a48dc506c92c7120dc6547dfe8e2da2f6698e59d1a1ad6e12492fb370f3f8
Opcode Fuzzy Hash: bc9e89535eedf5a5a109ee11c00e7341c7d85835ac64f77d02ff69785afbcaa7
Instruction Fuzzy Hash: 9B51F330A08399CFDB15EB78D090BAEBFF2AF45211F1844E9E496A7392D734D841CB60

Uniqueness

Uniqueness Score: -1.00%

Function 010662C8, Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.526288637.0000000001060000.00000040.00000001.sdmp, Offset: 01060000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e015abee31c81b65c9856df9fa9e1ed9c7e658fc82777187cd022e8b18def212
Instruction ID: 66676c237fda2804be3f974aeac79d3649c3f437671b98d11b2bf577b2e49221
Opcode Fuzzy Hash: e015abee31c81b65c9856df9fa9e1ed9c7e658fc82777187cd022e8b18def212
Instruction Fuzzy Hash: 7841BB30B00215AFDB04DFB8C8446AE7BEAEF85218F1084BDD6459B790DB3A9D41CB50

Uniqueness

Uniqueness Score: -1.00%

Function 01020D9E, Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.525588764.0000000001020000.00000040.00000001.sdmp, Offset: 01020000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2700c09b428df1971c4d425b3d67250c7c99f834a1c3f759624d28573f7fe6c
Instruction ID: 805c42766f450694ed2ab13ebb6d251d23204144e1a2b723d6f3d55b04e9086a
Opcode Fuzzy Hash: e2700c09b428df1971c4d425b3d67250c7c99f834a1c3f759624d28573f7fe6c
Instruction Fuzzy Hash: 18416C74A003598FDB00CFA5C844AAEBBF6FF88300F148169E945AB754EB74AC45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00BBC720, Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.511017415.0000000000BB0000.00000040.00000001.sdmp, Offset: 00BB0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf80a9f937a441886a381b29e212630ed5c8fa33b1e8f83ca80a4f8aedc2eda4
Instruction ID: 0095732089a2da1966e9e4d475cb45185ecb5ea6f622d854d25a44ae3f5fadf3
Opcode Fuzzy Hash: cf80a9f937a441886a381b29e212630ed5c8fa33b1e8f83ca80a4f8aedc2eda4
Instruction Fuzzy Hash: F8419431A092498FCF01DFA8D9908CDBFB1EF85304B154996D504EF266D774AD4ACB51

Uniqueness

Uniqueness Score: -1.00%

Function 01024968, Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.525588764.0000000001020000.00000040.00000001.sdmp, Offset: 01020000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 644e6b55fbc1d02fd4e5c28b86b8e117fd54a4853abaf683b57a417af90e49f3
Instruction ID: 55328e320b51764d6ec0b71cb1d05dd40b858d0f6e88998f4ecf8533702fe4d2
Opcode Fuzzy Hash: 644e6b55fbc1d02fd4e5c28b86b8e117fd54a4853abaf683b57a417af90e49f3
Instruction Fuzzy Hash: 2141EE74A042198FCB54DF68D280A9EB7F1BF48218F168998E941AB761D731EE44CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 00BB3EA0, Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.511017415.0000000000BB0000.00000040.00000001.sdmp, Offset: 00BB0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b9db3d2a528fba35ab8f181627a7e95dc475f65ee851be7ab7664af883a8a1c
Instruction ID: cb11171f5ac1905511f8021e77c6034f2fb49d0fdf2ba596d8ac0b29b23cfb20
Opcode Fuzzy Hash: 8b9db3d2a528fba35ab8f181627a7e95dc475f65ee851be7ab7664af883a8a1c
Instruction Fuzzy Hash: 0C417B74B046068FC714DF68D9989AEBBF2FF89200B51896AD5069B7A1CF30ED45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00BBC768, Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.511017415.0000000000BB0000.00000040.00000001.sdmp, Offset: 00BB0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47ba86ff564e6df81421b9d4fa7fb68db22dae59bfdda7feec13931ba1478d3d
Instruction ID: 8e13aae0449f5688d9f21dea9436933cea52668bea935aadba31999db7d36bef
Opcode Fuzzy Hash: 47ba86ff564e6df81421b9d4fa7fb68db22dae59bfdda7feec13931ba1478d3d
Instruction Fuzzy Hash: A931DA35A04209DFCF44DFA8E5808CDBBF1FF88318B158965E908AB325D771AE46CB90

Uniqueness

Uniqueness Score: -1.00%

Function 01022830, Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.525588764.0000000001020000.00000040.00000001.sdmp, Offset: 01020000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b77c39fced3ba75d76960be430ffa8c8f510b3be130908508858248db0851452
Instruction ID: 3f79298ff26c90a5cd521e54bf8032e4f71ec821bb299d8747c01270f4d2f26d
Opcode Fuzzy Hash: b77c39fced3ba75d76960be430ffa8c8f510b3be130908508858248db0851452
Instruction Fuzzy Hash: 28315231A007099BE7159B68CC017EFB3A6EF99304F10C029E1457BAC1DFB5A88AC7A0

Uniqueness

Uniqueness Score: -1.00%

Function 01066428, Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.526288637.0000000001060000.00000040.00000001.sdmp, Offset: 01060000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 156ea79d05ce5e65d5811c1666aaf45de60851d161154d2bcf38928766921d81
Instruction ID: 84933873eb049c32ab1b584623d3725289974cad31ae883fddf858aa2c92c117
Opcode Fuzzy Hash: 156ea79d05ce5e65d5811c1666aaf45de60851d161154d2bcf38928766921d81
Instruction Fuzzy Hash: 5C319030209305DFC750DF24E985A9ABBF6FF85318F408D68E5468B6A1EB71FA45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00BBD158, Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.511017415.0000000000BB0000.00000040.00000001.sdmp, Offset: 00BB0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 597d1f3edafa66d82c4a7c14d53a53696dcffa1564bbc0bf829d81ba77c69b86
Instruction ID: 8fb298de43281f341dbfe661e8434612eaee7a6b80a6dc639cbf34898c057d6e
Opcode Fuzzy Hash: 597d1f3edafa66d82c4a7c14d53a53696dcffa1564bbc0bf829d81ba77c69b86
Instruction Fuzzy Hash: B521E1327082018FC7159F28E9944A9FBE2FFC93247158ABBD119CB6A1DF349D46C790

Uniqueness

Uniqueness Score: -1.00%

Function 010662B8, Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.526288637.0000000001060000.00000040.00000001.sdmp, Offset: 01060000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e07410882a308a86559bf08a785c76a12693d098ffe9c2ae0ddf14e4fa10091c
Instruction ID: b01f8352504dc69fc85ca95c3c7da73d31306a9af15650db57d4cbc3440e8c77
Opcode Fuzzy Hash: e07410882a308a86559bf08a785c76a12693d098ffe9c2ae0ddf14e4fa10091c
Instruction Fuzzy Hash: CD31CC317003259FDB198F69C840AAE7BEABF89314F0488BDE645CB3A0DB76D945CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00BB5FD8, Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.511017415.0000000000BB0000.00000040.00000001.sdmp, Offset: 00BB0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8abe4bd64a5310a8e614181bd9f14a01738e99d6552e57006c1a89b1b659b07d
Instruction ID: 0a67e14ccdc31b16b22b9b2508fd295b063fd511716c499832a980f42a44a572
Opcode Fuzzy Hash: 8abe4bd64a5310a8e614181bd9f14a01738e99d6552e57006c1a89b1b659b07d
Instruction Fuzzy Hash: 872174307051008FCB28AB19D4D4ABE77E6EB85704B65449AE106CB7A2CFF5EC85DB51

Uniqueness

Uniqueness Score: -1.00%

Function 01022700, Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.525588764.0000000001020000.00000040.00000001.sdmp, Offset: 01020000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb2825b7ee499e58190b8dfe9d92efda0c2920b943374bbab71e0aded35306da
Instruction ID: c38bd159787e9cbd57e34cd338fc834b2836e042882429b418fd0af66bb58087
Opcode Fuzzy Hash: eb2825b7ee499e58190b8dfe9d92efda0c2920b943374bbab71e0aded35306da
Instruction Fuzzy Hash: F1315934A14319DFCB04DFA8D484A99B7B2FF88314F118599E885AB361DB71ED41CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00BB4A90, Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.511017415.0000000000BB0000.00000040.00000001.sdmp, Offset: 00BB0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 404935b7903896cb8af9feb6ede7d780cffa5fd61434b99c6302ec36c94f8644
Instruction ID: de16ff449d5a14d5cb1ffe976024412d54b7c84f34c0405d1de86c00ca784fe6
Opcode Fuzzy Hash: 404935b7903896cb8af9feb6ede7d780cffa5fd61434b99c6302ec36c94f8644
Instruction Fuzzy Hash: AA2190A260E7D06FC7234734ADA45A5BFB1AE8B22430E05DFC0C5CB1A7D9585D0AC367

Uniqueness

Uniqueness Score: -1.00%

Function 010615E0, Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.526288637.0000000001060000.00000040.00000001.sdmp, Offset: 01060000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f85fa862a91ea11bb53035d2abdb173e72f0a14aa0e733acda444860b52a781
Instruction ID: a2da3ce531a42f0bc103895a3f1f640487f9487f7fbfddb8d384166d5ce81049
Opcode Fuzzy Hash: 8f85fa862a91ea11bb53035d2abdb173e72f0a14aa0e733acda444860b52a781
Instruction Fuzzy Hash: 5E312735700305DFC754DF79D48096BB7FABF89214B1488A9E59A8B361DB31ED42CB90

Uniqueness

Uniqueness Score: -1.00%

Function 01022840, Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.525588764.0000000001020000.00000040.00000001.sdmp, Offset: 01020000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bbc234fab254b499ec98eea1de25c23c4521babcf784c916bed4bed1510e9fb
Instruction ID: f79541cac69a696fa669cd413d15df6a41007fb659416de4fde920b7a6fb01c9
Opcode Fuzzy Hash: 6bbc234fab254b499ec98eea1de25c23c4521babcf784c916bed4bed1510e9fb
Instruction Fuzzy Hash: E831E531A007095BE7149B69CC517EFB366EF85304F10C528E1457BAC1DFB4B885C790

Uniqueness

Uniqueness Score: -1.00%

Function 010226F1, Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.525588764.0000000001020000.00000040.00000001.sdmp, Offset: 01020000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a8bef71a1d10f2d2a026b1d6340864a4bc11d3c3c5c50e26241ba63dd4c3b71
Instruction ID: 706f2c79e8e4b7d1571371413b4bc34193eef21cacd17e2a4975987615eb7201
Opcode Fuzzy Hash: 0a8bef71a1d10f2d2a026b1d6340864a4bc11d3c3c5c50e26241ba63dd4c3b71
Instruction Fuzzy Hash: 92318B34A15319EFCB05DFA8D450AADB7B2FF88314F118599E885AB361DB31ED42CB80

Uniqueness

Uniqueness Score: -1.00%

Function 0102AE18, Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.525588764.0000000001020000.00000040.00000001.sdmp, Offset: 01020000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f06d9696b1bcd96e806592e2e4a3e718bba287ebd247fcd90fa924854696d244
Instruction ID: 1dbbfd42b595388d2c1c6129214e064d593f6ee8f8715f57f5c6d26611974e06
Opcode Fuzzy Hash: f06d9696b1bcd96e806592e2e4a3e718bba287ebd247fcd90fa924854696d244
Instruction Fuzzy Hash: 7E314630B00228CFCF54DFA9D800A9EB7F6FF88314F1584A9D549AB750DB35AD428BA1

Uniqueness

Uniqueness Score: -1.00%

Function 00BBCF80, Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.511017415.0000000000BB0000.00000040.00000001.sdmp, Offset: 00BB0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7590fe8e6cdc85666b47b1e851e441e535d6ab73fb4ff738a0b6a9ed19336ecd
Instruction ID: 921f9530aa4d64116894beafad99cdb669d9a482c8805da84e55ef3dd049f54d
Opcode Fuzzy Hash: 7590fe8e6cdc85666b47b1e851e441e535d6ab73fb4ff738a0b6a9ed19336ecd
Instruction Fuzzy Hash: 15316971D0A7898FCB01CFB9D8800DDBFF1FF8A200B1445AAD054E7652D7349944CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0102C2A6, Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.525588764.0000000001020000.00000040.00000001.sdmp, Offset: 01020000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3837e0984bdf0c1c96fcbf177b6fc06e08ac8c34cb911003a2070814354b0bb4
Instruction ID: 658b56d9d2b67c59001f751782a74b1f1f72b8996cbf6ea4c7372b12e9dca5e6
Opcode Fuzzy Hash: 3837e0984bdf0c1c96fcbf177b6fc06e08ac8c34cb911003a2070814354b0bb4
Instruction Fuzzy Hash: 73215E303007008BE720DF25D680AAEB7E2BF85314B15CA6DD5868B6A5DB75F9498B90

Uniqueness

Uniqueness Score: -1.00%

Function 01067E89, Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.526288637.0000000001060000.00000040.00000001.sdmp, Offset: 01060000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fffcb0ab1196a46b7efd1a52d088d1b4c981f123e71076115a36fe7d898c40ff
Instruction ID: 25f9b12ba2a4b49adb866c05e09f886de9bcd1fee1f36a7644f75796c732570f
Opcode Fuzzy Hash: fffcb0ab1196a46b7efd1a52d088d1b4c981f123e71076115a36fe7d898c40ff
Instruction Fuzzy Hash: C92181213881582BF70627349869F7E3AD7DBC6B14F4440ADE6868F3D5DE658C828792

Uniqueness

Uniqueness Score: -1.00%

Function 010267E0, Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.525588764.0000000001020000.00000040.00000001.sdmp, Offset: 01020000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da128cc31fe62b19936638428b6e98837e68241f470fe478bf79f92950a6b496
Instruction ID: b831a9e6567046122845d198dc06a82817f4af7b2dfbd7a46e0e41dbc4b11afd
Opcode Fuzzy Hash: da128cc31fe62b19936638428b6e98837e68241f470fe478bf79f92950a6b496
Instruction Fuzzy Hash: 5B219C75B042059FCB14DF69D854AAEBBF6FB88210F14862AE909DB340CB71EC41CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 0102AE08, Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.525588764.0000000001020000.00000040.00000001.sdmp, Offset: 01020000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8f974b856f9159601f1d17b43d32eeb3263c68abff519c90e06018793c74335
Instruction ID: 62fcd03fba33611d562440878c2f45c440636c025ca8149133379641ef23e4eb
Opcode Fuzzy Hash: b8f974b856f9159601f1d17b43d32eeb3263c68abff519c90e06018793c74335
Instruction Fuzzy Hash: 70215A30A04229CFCF54DF69D80469EB7F5FF88314F1584A9D549ABA60EB34AD42CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 010615D2, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.526288637.0000000001060000.00000040.00000001.sdmp, Offset: 01060000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bad7effa5c5f3da66eab597ace014919eb0d0d9af6f5b594dba8e6d61cb7108e
Instruction ID: 69da0cd1586230dcfea78eb0e3d620e034bf8947ea8dadda7d19028c56ec7ee8
Opcode Fuzzy Hash: bad7effa5c5f3da66eab597ace014919eb0d0d9af6f5b594dba8e6d61cb7108e
Instruction Fuzzy Hash: 69218E34B053459FC715DF78D84086BBBFAAF89204B1444AEE585CB352DB30ED06CB90

Uniqueness

Uniqueness Score: -1.00%

Function 01065EB0, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.526288637.0000000001060000.00000040.00000001.sdmp, Offset: 01060000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 016de62c3f2b137197eded753dbd3d362d3ff97006fd842ff7b71087516a4017
Instruction ID: 3c99a97254b8057c61c2e5fe85f299aec035e63df3ad89256b6b9f34b6630dca
Opcode Fuzzy Hash: 016de62c3f2b137197eded753dbd3d362d3ff97006fd842ff7b71087516a4017
Instruction Fuzzy Hash: 23215CB0D053198FCB45DFA9C4418EEBBF1BF49260B0080AAD855EB362E734AD05CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 01067E98, Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.526288637.0000000001060000.00000040.00000001.sdmp, Offset: 01060000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9f2d40706d48878eaa57bb3c9defeff1aebe3af1fa68748b1ac45d490225b32
Instruction ID: b9253734ae8021a3cb8f7e20ec3d7680b3401d954cb65325a78bb628e2d603af
Opcode Fuzzy Hash: e9f2d40706d48878eaa57bb3c9defeff1aebe3af1fa68748b1ac45d490225b32
Instruction Fuzzy Hash: 071193217881182BF70527249C69F3F39DBCBC5B04F4440ADE7468F3D4DE618C828792

Uniqueness

Uniqueness Score: -1.00%

Function 01066BC0, Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.526288637.0000000001060000.00000040.00000001.sdmp, Offset: 01060000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7812578ddce18f1e021b63f9f3140e6b8da509bcf0ba7051925b14504db3c25c
Instruction ID: f26b4e9268e3284f92ed9c39a3ece5ccb8a9f7a2aaab6f84dc8874eb79976db0
Opcode Fuzzy Hash: 7812578ddce18f1e021b63f9f3140e6b8da509bcf0ba7051925b14504db3c25c
Instruction Fuzzy Hash: BF214C75A00A198FCB45CF98D984A7EBBF9FB88311F1580A4E955EB355CB31E841CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 01066588, Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.526288637.0000000001060000.00000040.00000001.sdmp, Offset: 01060000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b37c0431c531c40eca630ad107ad92fd0239ec1068a60cb2331ab5ba6c3530d1
Instruction ID: 4eeb3f35c43d91ab5975745882ae7b858463e0b030b831df042ca622c034360c
Opcode Fuzzy Hash: b37c0431c531c40eca630ad107ad92fd0239ec1068a60cb2331ab5ba6c3530d1
Instruction Fuzzy Hash: DB119A35B002158FC7199F69D850ABF36EAEF89214B1504BDEA05CB360DF32DC01CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00BB5FD6, Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.511017415.0000000000BB0000.00000040.00000001.sdmp, Offset: 00BB0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb766da20210db03ad0a266b28e82522d35fc4a905d1e096b6bd23591512315a
Instruction ID: b74cedc40cf71af35a2435279924de4022858de54d7012b2a493191025eadf1f
Opcode Fuzzy Hash: eb766da20210db03ad0a266b28e82522d35fc4a905d1e096b6bd23591512315a
Instruction Fuzzy Hash: 3D1196713016008FC724AF19D5C49BEB7E2EF85314B5544AAE106CB7B2CBB4DC45CB51

Uniqueness

Uniqueness Score: -1.00%

Function 01069E38, Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.526288637.0000000001060000.00000040.00000001.sdmp, Offset: 01060000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c01db0713d9c7d8aca3d6a0fcbd9084225e5f46e3e885fbb29c54271f3b5735
Instruction ID: f42b9b26a643897fcc9be9ad78160c3a3ba6f979d388e79e35d54b02dd818ed1
Opcode Fuzzy Hash: 8c01db0713d9c7d8aca3d6a0fcbd9084225e5f46e3e885fbb29c54271f3b5735
Instruction Fuzzy Hash: 9A21C475A04218CFCB04EFA8D9949DDB7B1FF4C714B1104A8E506AB761CB79AD05CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 00BBD2C8, Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.511017415.0000000000BB0000.00000040.00000001.sdmp, Offset: 00BB0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4a6237b9fa206070c1ab8f9ae9b2053b84c23cee2d4380b021b9074628a5ea7
Instruction ID: 4db64f58cdf55bd07684f3db602d45dc05fe7b415b600df540613eeaf67e7cc0
Opcode Fuzzy Hash: c4a6237b9fa206070c1ab8f9ae9b2053b84c23cee2d4380b021b9074628a5ea7
Instruction Fuzzy Hash: 69119A70A0421A8BDB14CBB4C954BEEBAF1EF48304F14847AD001B7291DFB89901CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 00BB38E0, Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.511017415.0000000000BB0000.00000040.00000001.sdmp, Offset: 00BB0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1715bf22e624e8eca0d78f9e21b27a750c9c60cb53b0228be6491eae40b2cda
Instruction ID: 6a25140331e77b516b4bb2417727c28e8e972e680ff120fd8cfffdf37e66f446
Opcode Fuzzy Hash: f1715bf22e624e8eca0d78f9e21b27a750c9c60cb53b0228be6491eae40b2cda
Instruction Fuzzy Hash: AA01F477B082101B1724A6BE7C805BEB7CBDBE57743248737E656CB290CE718D02A3A4

Uniqueness

Uniqueness Score: -1.00%

Function 00BB5A30, Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.511017415.0000000000BB0000.00000040.00000001.sdmp, Offset: 00BB0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27c3f7ba73ce5a4b6263a58e21fd3daa8df3ec55139471c2868a8f4cbf2c1f7f
Instruction ID: 3c2d612bd81b3c531b70761dfa26605dc4656ec3687eadc8d3471649dd2b1e3d
Opcode Fuzzy Hash: 27c3f7ba73ce5a4b6263a58e21fd3daa8df3ec55139471c2868a8f4cbf2c1f7f
Instruction Fuzzy Hash: F911AD75704601CFC7149B28E898AA9BBF2FF8932131481AAE406D7361DB70DC02CB91

Uniqueness

Uniqueness Score: -1.00%

Function 010273B1, Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.525588764.0000000001020000.00000040.00000001.sdmp, Offset: 01020000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b27ad49c30d9597bc1a6b0d93a67aa2dad1f3ae15d6ecfb7c65e9e8a44a20dc
Instruction ID: 0973cb5420db5cc6f8294e83ccf2e7b3364e032a05fcc79e268e2813a0af4397
Opcode Fuzzy Hash: 5b27ad49c30d9597bc1a6b0d93a67aa2dad1f3ae15d6ecfb7c65e9e8a44a20dc
Instruction Fuzzy Hash: 2D115E3150E7E49FC7139B3888504557FF4EE4B25431A41E7D488CF6A3D7299C46CB62

Uniqueness

Uniqueness Score: -1.00%

Function 01069E48, Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.526288637.0000000001060000.00000040.00000001.sdmp, Offset: 01060000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc99fce1fed16b82425db111ac57ec846c953fffadb0ac72177b17542f235a1e
Instruction ID: 8aba1b16d297d417eaf9dcac156bec393a1202c5667ef4d08bda8f8d1c40c306
Opcode Fuzzy Hash: bc99fce1fed16b82425db111ac57ec846c953fffadb0ac72177b17542f235a1e
Instruction Fuzzy Hash: DF21B075A00228CFCB04EFA8D99499DB7B5FF4C304B1105A8E506AB361CB39AD05CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 00BB5A40, Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.511017415.0000000000BB0000.00000040.00000001.sdmp, Offset: 00BB0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e7e8c3baff84687733912332ff0bf9d30f82b907623f4d4c5e7e113caea475d
Instruction ID: 82043de3af97e847ceea9e5bb0770047b168123fba052a3433289a012d041f6d
Opcode Fuzzy Hash: 4e7e8c3baff84687733912332ff0bf9d30f82b907623f4d4c5e7e113caea475d
Instruction Fuzzy Hash: 6801AD353049118FC7249B2CE998A6EBBE6FB8831131481BAE506D73A1CF70DC02CB91

Uniqueness

Uniqueness Score: -1.00%

Function 01029188, Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.525588764.0000000001020000.00000040.00000001.sdmp, Offset: 01020000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90cd3fcc3b466bff323fc8ec45173ab5c776f63b7fd8e62ba05f8eafeb973406
Instruction ID: 9b3673661c0681e16e523cb53887cb1f4757bc8f8475d88618752b7d4cedda7c
Opcode Fuzzy Hash: 90cd3fcc3b466bff323fc8ec45173ab5c776f63b7fd8e62ba05f8eafeb973406
Instruction Fuzzy Hash: 0211263160A3204FD311C738C5409A6BBE5AF81758F0585ABE984CB751CB74DC49CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0106D9A1, Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.526288637.0000000001060000.00000040.00000001.sdmp, Offset: 01060000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa1a4034ad21c35d8c91dea4382dff1094bcca89452ad23e413137859d21b7ce
Instruction ID: f887423438bea86696b3836f445263d51bddccfbe404c27a93a1caf54753a41d
Opcode Fuzzy Hash: fa1a4034ad21c35d8c91dea4382dff1094bcca89452ad23e413137859d21b7ce
Instruction Fuzzy Hash: 5C21F934A10205CFDB04DFA4D498E9DBBB2FF88325F159568D505AB365CB75E881CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0102C074, Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.525588764.0000000001020000.00000040.00000001.sdmp, Offset: 01020000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 768418708f92c1024aab0afa632cbe3e36fb5cff260552712c2d1bf2f79a2fc4
Instruction ID: f6149da29b4415d53875ee4800aade980a93ee6a486f83b4cc15612acdd201f4
Opcode Fuzzy Hash: 768418708f92c1024aab0afa632cbe3e36fb5cff260552712c2d1bf2f79a2fc4
Instruction Fuzzy Hash: 27113634A042158FDB10DF68E64598CB7F1BF48368B214698D696EB3A1CB31EE42CF50

Uniqueness

Uniqueness Score: -1.00%

Function 01029198, Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.525588764.0000000001020000.00000040.00000001.sdmp, Offset: 01020000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4fc1b078cbd265616e551af5c32e93a03150172a78be734f1830cfa3b7eab9dd
Instruction ID: e94121b6f840eecde2308091622bf31068f5d8b6319a0f6510018a669bd95b35
Opcode Fuzzy Hash: 4fc1b078cbd265616e551af5c32e93a03150172a78be734f1830cfa3b7eab9dd
Instruction Fuzzy Hash: A601F7716093305FD320C629D540AABBBD5AFC1758F05856AED848B341CB70EC48D7A1

Uniqueness

Uniqueness Score: -1.00%

Function 010FD01D, Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.527957352.00000000010FD000.00000040.00000001.sdmp, Offset: 010FD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef44ad6bf87e520d9e3d32983259a222f6e19a2fae05f8f65e1c94a84b3f8f75
Instruction ID: 44a64ca1e90b0850dceff93af15044f8d0475586a2a7db6c2db5291833c828d5
Opcode Fuzzy Hash: ef44ad6bf87e520d9e3d32983259a222f6e19a2fae05f8f65e1c94a84b3f8f75
Instruction Fuzzy Hash: 4101F77040C340AAE7104A65DC8576BBFC8EF422A8F08C55EFF855B686C3799545C7B1

Uniqueness

Uniqueness Score: -1.00%

Function 01029298, Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.525588764.0000000001020000.00000040.00000001.sdmp, Offset: 01020000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c354c4a2e24280d0cf025666165076d44498db7cf46ba538c39581ee3bb90ef
Instruction ID: 5d9165338e90a697085ee67907ac0d26cfb1d26f6411b7fb912c24fd9f3b4cb9
Opcode Fuzzy Hash: 8c354c4a2e24280d0cf025666165076d44498db7cf46ba538c39581ee3bb90ef
Instruction Fuzzy Hash: 35011771D05229CFDB91CFB9D4456ADBBF0FF49318F1091A9D099E6290E3385802CF50

Uniqueness

Uniqueness Score: -1.00%

Function 010292A8, Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.525588764.0000000001020000.00000040.00000001.sdmp, Offset: 01020000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d4945bb571246370d8133497366ba6ffcce6ef839a76da34de79d5cace056d3
Instruction ID: 16016765916dca2556a0bce393d9d02db3ef41df303b5cd210cf93b2aeff0e06
Opcode Fuzzy Hash: 2d4945bb571246370d8133497366ba6ffcce6ef839a76da34de79d5cace056d3
Instruction Fuzzy Hash: A9010C70D05229CFCB94DFA9D4496ADBBF1FF48314F0091AAD45AE3290D7385905CB94

Uniqueness

Uniqueness Score: -1.00%

Function 010FD01C, Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.527957352.00000000010FD000.00000040.00000001.sdmp, Offset: 010FD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6df2f16552c2e761d73bd9200f0fc5d6c2f0b9ec4fa7f1185c8a44f3959506f
Instruction ID: 6ef39e15ad2bf889b6f0408fcd2489acbba2ab219ee2307e331596ddeb380464
Opcode Fuzzy Hash: f6df2f16552c2e761d73bd9200f0fc5d6c2f0b9ec4fa7f1185c8a44f3959506f
Instruction Fuzzy Hash: 97F068714043449EE7118E15CC84767FFD8EF42664F14C55AFE445B686C3755844CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 01065F54, Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.526288637.0000000001060000.00000040.00000001.sdmp, Offset: 01060000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2822a70f8803cf8ac5f8b2e5ffe572799f38005db7568d55d5c4bfaa73060b15
Instruction ID: ab294bd7ad3598d8b8ab29d631e87346faa580a4ddd9d25863c9f7e20d10c1ff
Opcode Fuzzy Hash: 2822a70f8803cf8ac5f8b2e5ffe572799f38005db7568d55d5c4bfaa73060b15
Instruction Fuzzy Hash: 8F01F675B00209CFCB04DFA4E4959ADB3B2FF88255F114499E912AB3D0DB38AD42CB80

Uniqueness

Uniqueness Score: -1.00%

Function 01029D98, Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.525588764.0000000001020000.00000040.00000001.sdmp, Offset: 01020000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4dee222bb1b541f41276f2eae101545af89519d2b2fd4825cd962b8e4a18310e
Instruction ID: c9d9a8d1154ea0797996e871c2fbbc3c7dc8aa40e4712c76f2a7365643ae3531
Opcode Fuzzy Hash: 4dee222bb1b541f41276f2eae101545af89519d2b2fd4825cd962b8e4a18310e
Instruction Fuzzy Hash: 00F090312093459FC701AB69F41489E77B6EFC56283018A6AE186CF260DF706E0BDBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0106DADF, Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.526288637.0000000001060000.00000040.00000001.sdmp, Offset: 01060000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08967b2e679628f7d0ee111b2ff58388309657c71b8babd7bbe3eed3b20bbe97
Instruction ID: 3a3a21335ff3b8add09bbc6eae09fc17d54b3bfac034f743bb55916ff8efddb7
Opcode Fuzzy Hash: 08967b2e679628f7d0ee111b2ff58388309657c71b8babd7bbe3eed3b20bbe97
Instruction Fuzzy Hash: FE01B235A00208CFDB04DBD0E99ABDCBBB2FB8C321F102115E50AA7694CB712D82CF50

Uniqueness

Uniqueness Score: -1.00%

Function 010292CB, Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.525588764.0000000001020000.00000040.00000001.sdmp, Offset: 01020000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cbcdd126a782243124b64e6dd82fb1868d08c9f44f02bd77bc77ff7dfc0669c
Instruction ID: 226e162bdb2e0b49697f3eef0e16dbf6cc609cde768c33a0b477dabd7236fca1
Opcode Fuzzy Hash: 6cbcdd126a782243124b64e6dd82fb1868d08c9f44f02bd77bc77ff7dfc0669c
Instruction Fuzzy Hash: E2F01770E05229CFDF50CFA9C484BADBBB0FF08308F45A09AD459A7291C738D846CB51

Uniqueness

Uniqueness Score: -1.00%

Function 01029DA8, Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.525588764.0000000001020000.00000040.00000001.sdmp, Offset: 01020000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7830ab0e8c05c4be67c223cf4e0948dda0344c96df938ee6e78a9241445d066
Instruction ID: f7b399261e6f4043cba38950435f7b3c168a8b78f0a9efdeaed2c0a9979769a4
Opcode Fuzzy Hash: f7830ab0e8c05c4be67c223cf4e0948dda0344c96df938ee6e78a9241445d066
Instruction Fuzzy Hash: F2E0ED313042459BC714EB29F40489EB3ABFFC4629300CA2DE146CB260CF70BE0A97E0

Uniqueness

Uniqueness Score: -1.00%

Function 00BBD290, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.511017415.0000000000BB0000.00000040.00000001.sdmp, Offset: 00BB0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f22bf15bd85d55c14206b6ccc068e4413ba105d19c2af2c43b8787bcca354252
Instruction ID: b6252960ac389bf4b9d6bf305739d0826643191f2c57529eaa36af30ac975fa9
Opcode Fuzzy Hash: f22bf15bd85d55c14206b6ccc068e4413ba105d19c2af2c43b8787bcca354252
Instruction Fuzzy Hash: 4AE0B632300414574614969EA9145AEFBDEDAC5675318807BE60DC7361DEA2DD0387A4

Uniqueness

Uniqueness Score: -1.00%

Function 00BB4B20, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.511017415.0000000000BB0000.00000040.00000001.sdmp, Offset: 00BB0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27327a8e5b4718928b28fcb7bbbe4a3f87975e04453b4e7237052ac6fa129a6f
Instruction ID: de1bd20a6aa18fc2b576daa564ab183bb6253c08975ba14e49aced3077c8a921
Opcode Fuzzy Hash: 27327a8e5b4718928b28fcb7bbbe4a3f87975e04453b4e7237052ac6fa129a6f
Instruction Fuzzy Hash: 28E048313052155B47219F5EF584DABBBEEDBC4525305456BE20DC7221CE60DC059751

Uniqueness

Uniqueness Score: -1.00%

Function 00BBD280, Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.511017415.0000000000BB0000.00000040.00000001.sdmp, Offset: 00BB0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 885df5064dd4d312dcbab00352f64420d1b7034ef1526a50365099688db08e7d
Instruction ID: 61d2496e7ee64a7d22e6e65916abef4c1b72f615d17fadfb5d7680956dccb532
Opcode Fuzzy Hash: 885df5064dd4d312dcbab00352f64420d1b7034ef1526a50365099688db08e7d
Instruction Fuzzy Hash: ADE0C2323051408FC31586699D2456ABBEACFC662031880FFD00DCB3A1EEA1CC0383A0

Uniqueness

Uniqueness Score: -1.00%

Function 01065F42, Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.526288637.0000000001060000.00000040.00000001.sdmp, Offset: 01060000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37f34f8f432621db1c5901882014c56dde7b72e6f9750710609644dccfa4a7d2
Instruction ID: fb2745706f6ca1292cf109509a942a1151e9d1b3faf057fdf1b50d8aa8d5acdf
Opcode Fuzzy Hash: 37f34f8f432621db1c5901882014c56dde7b72e6f9750710609644dccfa4a7d2
Instruction Fuzzy Hash: AEE0E575E0420ACFCB54DF94E580CEEB371AF44298B028491DD61AB3A1DB34FE42CB90

Uniqueness

Uniqueness Score: -1.00%

Function 01065F4B, Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.526288637.0000000001060000.00000040.00000001.sdmp, Offset: 01060000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37f34f8f432621db1c5901882014c56dde7b72e6f9750710609644dccfa4a7d2
Instruction ID: fb2745706f6ca1292cf109509a942a1151e9d1b3faf057fdf1b50d8aa8d5acdf
Opcode Fuzzy Hash: 37f34f8f432621db1c5901882014c56dde7b72e6f9750710609644dccfa4a7d2
Instruction Fuzzy Hash: AEE0E575E0420ACFCB54DF94E580CEEB371AF44298B028491DD61AB3A1DB34FE42CB90

Uniqueness

Uniqueness Score: -1.00%

Function 01066281, Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.526288637.0000000001060000.00000040.00000001.sdmp, Offset: 01060000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aac382201e164857a1ad2e5d0dc588b0186bf3402c63b020cdebf5e3e4ba55c3
Instruction ID: 099f622127fd2c7163829c70b090121ff1a9c3a9dccbff63d33c9e8ddeb06f90
Opcode Fuzzy Hash: aac382201e164857a1ad2e5d0dc588b0186bf3402c63b020cdebf5e3e4ba55c3
Instruction Fuzzy Hash: B8E08C31108B80CFC326CB64E440993BBE1AF00328F01895ED0C283E20C7F4E885CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00BB03AC, Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.511017415.0000000000BB0000.00000040.00000001.sdmp, Offset: 00BB0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f50e16f04c492a5d9567e96dd5b3e9f887e462f30aa68c62c4b08826362d37b
Instruction ID: 095f236f7377b7e5d0b41920f6b1e1c54bf1ba0bb62f6dcb57b2a269a8953676
Opcode Fuzzy Hash: 0f50e16f04c492a5d9567e96dd5b3e9f887e462f30aa68c62c4b08826362d37b
Instruction Fuzzy Hash: 26E0467AA14018DFCB00DF94F888AEDBBB1FF88322F204066F60297261CB319D51CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0106ADDE, Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.526288637.0000000001060000.00000040.00000001.sdmp, Offset: 01060000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0fb7d1895898369acac8c1393c0efa2f36325edef7005ed4693924b9dbfc1148
Instruction ID: 1609739183563840c3f6b6bbd7f151f7653dde6e3c8f27b96727ccd2812e4101
Opcode Fuzzy Hash: 0fb7d1895898369acac8c1393c0efa2f36325edef7005ed4693924b9dbfc1148
Instruction Fuzzy Hash: 26E0127168C7998FCB52DF60A8141D97BF2BB56220F0484AFD88662952D37EAC41CB81

Uniqueness

Uniqueness Score: -1.00%

Function 0106ADF0, Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.526288637.0000000001060000.00000040.00000001.sdmp, Offset: 01060000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e96f13a62c8f4ba2666e3806650ac645789cd7538a3ef4fb6f76a64551b10e2
Instruction ID: e728f6af48a22036d1c127f18f863a55f14dca73543a61b70879fb44b800e147
Opcode Fuzzy Hash: 6e96f13a62c8f4ba2666e3806650ac645789cd7538a3ef4fb6f76a64551b10e2
Instruction Fuzzy Hash: 17C01231200A30CBCB209A28E80468A73E4BB88721F04054AD48243700C7B8AC418AC0

Uniqueness

Uniqueness Score: -1.00%

Function 00BB57AB, Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.511017415.0000000000BB0000.00000040.00000001.sdmp, Offset: 00BB0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eafca0f285fc2b96f995f8c2b250670541a2ee78803dbd555abec7ca16f630d7
Instruction ID: ed65a5069304513f7d544cc9e1028124c7f76f216930bb63076e4a6415c3063c
Opcode Fuzzy Hash: eafca0f285fc2b96f995f8c2b250670541a2ee78803dbd555abec7ca16f630d7
Instruction Fuzzy Hash: D3B012373054104B1404125DB8448BCE357E6D02362344473D11AC10509E51480715D1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: Payment_Advice_pdf.exe PID: 6728 Parent PID: 4392 Payment_Advice_pdf.exeCOMMON

Executed Functions

Function 012B6940, Relevance: 6.1, APIs: 4, Instructions: 120threadCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 012B69A0
GetCurrentThread.KERNEL32 ref: 012B69DD
GetCurrentProcess.KERNEL32 ref: 012B6A1A
GetCurrentThreadId.KERNEL32 ref: 012B6A73

Memory Dump Source

Source File: 00000016.00000002.528541646.00000000012B0000.00000040.00000001.sdmp, Offset: 012B0000, based on PE: false

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 348f7f5b1f11f53fb75df737ab48adea8a62012669bfd807203a310ad75fa2ca
Instruction ID: 2803c04e1c7aed4f864494494a8ae644b9fc181dca986f79f6d8fdef28b0758b
Opcode Fuzzy Hash: 348f7f5b1f11f53fb75df737ab48adea8a62012669bfd807203a310ad75fa2ca
Instruction Fuzzy Hash: 1B5164B09146498FDB14CFAADA88BDEBFF1AF89308F248459E119A7350C7746884CF65

Uniqueness

Uniqueness Score: -1.00%

Function 012B5084, Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 012B51A2

Memory Dump Source

Source File: 00000016.00000002.528541646.00000000012B0000.00000040.00000001.sdmp, Offset: 012B0000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 8442603bcefc590cdd5dc6469aa35dacd9ebdc353332c6531b277a03621109fe
Instruction ID: da9e30ff345de86331cffa9f9249f259831bac04d4c9f2baabf9ff7c2f34c2b2
Opcode Fuzzy Hash: 8442603bcefc590cdd5dc6469aa35dacd9ebdc353332c6531b277a03621109fe
Instruction Fuzzy Hash: 9851EEB1D10309DFDB14CFA9C984ADEBFB1BF48354F24812AE919AB210D7B49885CF90

Uniqueness

Uniqueness Score: -1.00%

Function 012B5090, Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 012B51A2

Memory Dump Source

Source File: 00000016.00000002.528541646.00000000012B0000.00000040.00000001.sdmp, Offset: 012B0000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 200a4a483dbe5539b26fdeb91662ab6531eb044c8be280d50890f9cb8ba37d4b
Instruction ID: 10afc817f6b9be0553b141ff0e095579148754eea327b58f58d853e0ef38df69
Opcode Fuzzy Hash: 200a4a483dbe5539b26fdeb91662ab6531eb044c8be280d50890f9cb8ba37d4b
Instruction Fuzzy Hash: B841DEB1D143099FDB14CFAAC884ADEBFB5BF48354F64812AE918AB210D7749885CF90

Uniqueness

Uniqueness Score: -1.00%

Function 012B779C, Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 012B7F01

Memory Dump Source

Source File: 00000016.00000002.528541646.00000000012B0000.00000040.00000001.sdmp, Offset: 012B0000, based on PE: false

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: ea23cbae5dd0e6d76d37eacdbf8ed14ebcaa0528bb8c3cf6dca80096188784b6
Instruction ID: 5adf3e121d5ee4094588b0179747384f75d8bdf04abe9d43bf5e8b2dee0d38b0
Opcode Fuzzy Hash: ea23cbae5dd0e6d76d37eacdbf8ed14ebcaa0528bb8c3cf6dca80096188784b6
Instruction Fuzzy Hash: 284149B4A14309CFDB14CF99C488AAEBBF5FF89314F248499E519A7361D774A841CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 012B6B68, Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 012B6BEF

Memory Dump Source

Source File: 00000016.00000002.528541646.00000000012B0000.00000040.00000001.sdmp, Offset: 012B0000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 94ba294f0469fd0bdf5f46fa674ceee71d72a1b30d34c4a32bcb611dcc9e4894
Instruction ID: 1ccb7459988035247f33613055485b39090dde5be98656db12bd82c4e498bf19
Opcode Fuzzy Hash: 94ba294f0469fd0bdf5f46fa674ceee71d72a1b30d34c4a32bcb611dcc9e4894
Instruction Fuzzy Hash: 4221E2B59042089FDB10CFA9D984ADEBBF8EB48324F14841AE914B3310D378A954CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 012B6B62, Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 012B6BEF

Memory Dump Source

Source File: 00000016.00000002.528541646.00000000012B0000.00000040.00000001.sdmp, Offset: 012B0000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 7b2c92dcc94cc6975bd01b8135004352b4b4b97a040a88a90411ea33fbe64d06
Instruction ID: 28376fd71135c4ce5fc23faf0c0d6959572eaf4a89c7ef70142b16d1c0a9dd2b
Opcode Fuzzy Hash: 7b2c92dcc94cc6975bd01b8135004352b4b4b97a040a88a90411ea33fbe64d06
Instruction Fuzzy Hash: 2F21EFB5D042089FDB10CFA9D984AEEBBF8EB48324F15841AE914B3350D378A954CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 012BBE78, Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000), ref: 012BBF02

Memory Dump Source

Source File: 00000016.00000002.528541646.00000000012B0000.00000040.00000001.sdmp, Offset: 012B0000, based on PE: false

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: aae3605c07a58374ce952337aa2aa6992381088370c529c5ce26ea416100314b
Instruction ID: 1f84519d09da8e4cd96a384525b31166f2dee200721186dbb2bacef36fcabc6d
Opcode Fuzzy Hash: aae3605c07a58374ce952337aa2aa6992381088370c529c5ce26ea416100314b
Instruction Fuzzy Hash: 54219AB2814345CFEB10CFA9C9483DEBFF0FB19315F24882AE405A7641C77A59448F61

Uniqueness

Uniqueness Score: -1.00%

Function 012BBE88, Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000), ref: 012BBF02

Memory Dump Source

Source File: 00000016.00000002.528541646.00000000012B0000.00000040.00000001.sdmp, Offset: 012B0000, based on PE: false

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: 5400c55f02da95e8b4c15d8e76fb71f915123eed6532476b9892b05f3ace51f4
Instruction ID: 6c4017f67dc810b6ee92caca493709d4005c9351b95363243740b687c9ecbc4f
Opcode Fuzzy Hash: 5400c55f02da95e8b4c15d8e76fb71f915123eed6532476b9892b05f3ace51f4
Instruction Fuzzy Hash: 30118971914309CFEB20DFA9C8487CEBFF4FB09324F248429E404A7641CB7969448FA1

Uniqueness

Uniqueness Score: -1.00%

Function 00FAD53C, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.526286763.0000000000FAD000.00000040.00000001.sdmp, Offset: 00FAD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c06f2b7c34e22a594500d0889e7435cff4af267f6238156b75b649db8f795a2a
Instruction ID: fe38cb6640c9b666e33c12772054ec83a33c67f8a3d602d910ee90eebc3032c4
Opcode Fuzzy Hash: c06f2b7c34e22a594500d0889e7435cff4af267f6238156b75b649db8f795a2a
Instruction Fuzzy Hash: 692167F2904244DFCF05DF00D9C0B27BF65FB89328F288568E9064B646C336D856EBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00FBD01C, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.526705187.0000000000FBD000.00000040.00000001.sdmp, Offset: 00FBD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a721474b9f0c6670d28d9dbb3fd364605c111162d2af6a1917b3fa16e1a9ac04
Instruction ID: 1ab0fb489dd6f5de93a828ed90278b9bf8d81f7ae302fb401256bd14c85aa7c3
Opcode Fuzzy Hash: a721474b9f0c6670d28d9dbb3fd364605c111162d2af6a1917b3fa16e1a9ac04
Instruction Fuzzy Hash: 48213775A08240DFCB14EF14D9C0B66BB65FB88368F24C569D9094B24AD33AD847EF62

Uniqueness

Uniqueness Score: -1.00%

Function 00FBD005, Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.526705187.0000000000FBD000.00000040.00000001.sdmp, Offset: 00FBD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6746183f011b79bc7add786b75029a1c2ebfccf75c5d84c1d87613e94bbb967c
Instruction ID: b06ef3b12efb924d238c288d843ad97afd8ece4b00167c3b5186d96cc04d7d4f
Opcode Fuzzy Hash: 6746183f011b79bc7add786b75029a1c2ebfccf75c5d84c1d87613e94bbb967c
Instruction Fuzzy Hash: 6D2180755093C08FCB12CF20D990755BF71EB46324F28C5EAD8498B697C33A980ADF62

Uniqueness

Uniqueness Score: -1.00%

Function 00FAD537, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.526286763.0000000000FAD000.00000040.00000001.sdmp, Offset: 00FAD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba42586fe108d7709ad1863fbbc2413aba52469b4b07adaff3d52a3c2845cd8f
Instruction ID: a737bd49777657b959282e3cd6ea996e4278b4c48cc5c2382393838cd5b97be6
Opcode Fuzzy Hash: ba42586fe108d7709ad1863fbbc2413aba52469b4b07adaff3d52a3c2845cd8f
Instruction Fuzzy Hash: 9311D6B6804280CFCF15CF10D5C4B16BF71FB99324F28C5A9D8054B616C336D856DBA1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: Payment_Advice_pdf.exe PID: 5600 Parent PID: 3472 Payment_Advice_pdf.exeCOMMON

Executed Functions

Function 014C0457, Relevance: .3, Instructions: 257COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.356531198.00000000014C0000.00000040.00000001.sdmp, Offset: 014C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6d9e2d4350a30a5fbb37c15d21cac301d48e7d687fc643fe43a7b26735f196f
Instruction ID: 7f2b316e07ef57c63c9747b8e7c7b1ebbb44a6d670a7609e0199a893e78f889b
Opcode Fuzzy Hash: b6d9e2d4350a30a5fbb37c15d21cac301d48e7d687fc643fe43a7b26735f196f
Instruction Fuzzy Hash: 24915C20609601D6D718BFB4F55912FAEB2EB94344F8288ADE4C5866ADCF36C47CC393

Uniqueness

Uniqueness Score: -1.00%

Function 014C0468, Relevance: .2, Instructions: 250COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.356531198.00000000014C0000.00000040.00000001.sdmp, Offset: 014C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d64538764c958fb4f7e50933a1c62a13df61ac9fb635f9f94bfc6f4c95cf08ce
Instruction ID: 62b383f2a82ec9282a9c0f7a50ec66eda2244443de576a3d38b32d44bd9f665b
Opcode Fuzzy Hash: d64538764c958fb4f7e50933a1c62a13df61ac9fb635f9f94bfc6f4c95cf08ce
Instruction Fuzzy Hash: 85813C31609605D6D718BFB4F55912FAEA2EBA4344F82886DE4C5826ACDF36C47CC393

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: Payment_Advice_pdf.exe PID: 6944 Parent PID: 3472 Payment_Advice_pdf.exeCOMMON

Executed Functions

Function 01850457, Relevance: .3, Instructions: 258COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.524554639.0000000001850000.00000040.00000001.sdmp, Offset: 01850000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b89f8399dbcaf651f67ab0d30c630a9711b0064aab9d53991f6790c6ff04d4b
Instruction ID: 86228c8dd01994d78339700ddd5117b27859ecc5504a0a10c0c37df69317496e
Opcode Fuzzy Hash: 8b89f8399dbcaf651f67ab0d30c630a9711b0064aab9d53991f6790c6ff04d4b
Instruction Fuzzy Hash: E1915C3060960196D718BFB4F55956FAEA2EB94304F8288ADE0C58669CDF36C47CC793

Uniqueness

Uniqueness Score: -1.00%

Function 01850468, Relevance: .2, Instructions: 250COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.524554639.0000000001850000.00000040.00000001.sdmp, Offset: 01850000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2827af03c40ddbb4fbe141560ce2a068c6d6972268768c4f79a9f08499b990cb
Instruction ID: dc9b52c97fe5aec74955edbd5577b39a1584b274f6aac10829338be83debcfa9
Opcode Fuzzy Hash: 2827af03c40ddbb4fbe141560ce2a068c6d6972268768c4f79a9f08499b990cb
Instruction Fuzzy Hash: E0815C3060D60596D718BFB4F55952FAEA2EBA4304F82886CE4C58669CDF36C47CC793

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: Payment_Advice_pdf.exe PID: 5360 Parent PID: 3472 Payment_Advice_pdf.exeCOMMON

Executed Functions

Function 00B80457, Relevance: .3, Instructions: 255COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.523741352.0000000000B80000.00000040.00000001.sdmp, Offset: 00B80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5271a6843db52bf2360e0c112c3b39d5df25291d302048f65c4bbad5d0c03612
Instruction ID: f1d1d55d8656828aa2e667c383de4f245f32eedccf6d8eaabbbe22580b761a76
Opcode Fuzzy Hash: 5271a6843db52bf2360e0c112c3b39d5df25291d302048f65c4bbad5d0c03612
Instruction Fuzzy Hash: C7916F3061D51196D708BFB4F55912FAEA2EF94344F8288ADE4C9826A9DF35C4BCC393

Uniqueness

Uniqueness Score: -1.00%

Function 00B80468, Relevance: .2, Instructions: 250COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.523741352.0000000000B80000.00000040.00000001.sdmp, Offset: 00B80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca92ad4d490b1e4f2528ecbce6768b39bf82b615e7e627da3d17b344bfcdbf8d
Instruction ID: 1e750902667e57fff6718b07466a2586b7afa9ffab674b67812a3a947051c500
Opcode Fuzzy Hash: ca92ad4d490b1e4f2528ecbce6768b39bf82b615e7e627da3d17b344bfcdbf8d
Instruction Fuzzy Hash: 8F815D3061951192D708BFB4F51912FAEA2EF94344F82886DE4C9826A8DF36C4BCC393

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: Payment_Advice_pdf.exe PID: 5916 Parent PID: 3472 Payment_Advice_pdf.exeCOMMON

Executed Functions

Function 01660457, Relevance: .3, Instructions: 257COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.527664862.0000000001660000.00000040.00000001.sdmp, Offset: 01660000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b11b3a26db235da91ddfec74df0ac3712bf1edb3528266dba25158f91f0aadf2
Instruction ID: 8caffee3535a9eddc32cbac08d0f7047f6e16fc9e11d12f3a58a175088bd48aa
Opcode Fuzzy Hash: b11b3a26db235da91ddfec74df0ac3712bf1edb3528266dba25158f91f0aadf2
Instruction Fuzzy Hash: DD914D3061D60196D718BFB4F95912FAEA2EB94304F8288ADE0C58669DDF36C47CC393

Uniqueness

Uniqueness Score: -1.00%

Function 01660468, Relevance: .2, Instructions: 250COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.527664862.0000000001660000.00000040.00000001.sdmp, Offset: 01660000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 369d76e0200042ba367e72795fb87b24deeaa3cfa1c0b203b7da09e426c9de62
Instruction ID: bc1893f72cb65ae84d3de8f0825a5e2aa204920a205a2bf2278783680693e182
Opcode Fuzzy Hash: 369d76e0200042ba367e72795fb87b24deeaa3cfa1c0b203b7da09e426c9de62
Instruction Fuzzy Hash: DB814C3060950596D718BFB4F95912FAEA2EB94304F83886DE4C58269CDF32C87CC393

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: Payment_Advice_pdf.exe PID: 5536 Parent PID: 3472 Payment_Advice_pdf.exeCOMMON

Executed Functions

Function 014B0457, Relevance: .3, Instructions: 257COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.528545339.00000000014B0000.00000040.00000001.sdmp, Offset: 014B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aaf4dd94155c8839488b1bc23e03e6622d959b5ee920d244ccc478667baad45a
Instruction ID: 03f5a3e8f12c97a575c98ed3d8687342aaefd9300cc89e7f90bf09fe8f78a390
Opcode Fuzzy Hash: aaf4dd94155c8839488b1bc23e03e6622d959b5ee920d244ccc478667baad45a
Instruction Fuzzy Hash: 2A914D2060960197D718BF74F55912FAEB2EBA4345F8288ADE0C5866ADDF36C47CC393

Uniqueness

Uniqueness Score: -1.00%

Function 014B0468, Relevance: .2, Instructions: 250COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.528545339.00000000014B0000.00000040.00000001.sdmp, Offset: 014B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d04dbdb2219b6cf7c9111a0a5dc6a7c5c21a6d2603723e20edff57aa9d784f5a
Instruction ID: ae7914296967f1023d54068a50e0e50b7e1467c8c7d94be39a872282ae5e09b9
Opcode Fuzzy Hash: d04dbdb2219b6cf7c9111a0a5dc6a7c5c21a6d2603723e20edff57aa9d784f5a
Instruction Fuzzy Hash: B2814C2060960597D718BFB4F55912FAEB2EBA4345F82886DE4C5826ACDF36C47CC393

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use startup items automatically executed at boot initialization to establish persistence. Startup items execute during the final phase of the boot process and contain shell scripts or other executable files along with configuration information used by the system to determine the execution order for all startup items.
Tactics:	Persistence, Privilege Escalation
Data Sources:	File monitoring, Process monitoring
Platforms:	macOS
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	File monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network protocol analysis, Packet capture, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report Payment_Advice_pdf.exe

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

Signature Overview

AV Detection:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Possible Origin

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTPS Packets

Code Manipulations