Edit tour

Windows Analysis Report
Setup.exe

Overview

General Information

Sample name:	Setup.exe
Analysis ID:	1527618
MD5:	5f965231ae39bc8e6a816c8ce8e69d95
SHA1:	2863fc86614ebeabc319377ab9829d5d72091cd5
SHA256:	813159a778ae9c4c5f66cf60ac3b30fc30f6bbf574279c546751a012f906ab40
Tags:	exeuser-bloated7731
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Injects a PE file into a foreign processes

LummaC encrypted strings found

Machine Learning detection for sample

Sample uses string decryption to hide its real strings

Sigma detected: Silenttrinity Stager Msbuild Activity

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Checks if the current process is being debugged

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

Setup.exe (PID: 6576 cmdline: "C:\Users\user\Desktop\Setup.exe" MD5: 5F965231AE39BC8E6A816C8CE8E69D95)

MSBuild.exe (PID: 6596 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

WerFault.exe (PID: 6888 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6576 -s 636 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["studennotediw.stor", "bathdoomgaz.stor", "dissapoiznw.stor", "licendfilteo.site", "mobbipenju.stor", "spirittunek.stor", "clearancek.site", "eaglepawnoy.stor", "methodbojjewkl.shop"], "Build id": "2hNffM--krepostnoy"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmp	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
00000001.00000002.1688980606.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Unpacked PEs

Source	Rule	Description	Author
1.2.MSBuild.exe.400000.0.unpack	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
1.2.MSBuild.exe.400000.0.raw.unpack	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
0.2.Setup.exe.900000.0.unpack	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security

Sigma Signatures

System Summary

Sigma detected: Silenttrinity Stager Msbuild Activity

Source: Network Connection

Author: Kiran kumar s, oscd.community: Data: DestinationIp: 104.21.55.124, DestinationIsIpv6: false, DestinationPort: 443, EventID: 3, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, Initiated: true, ProcessId: 6596, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49730

Suricata Signatures

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T06:44:54.346545+0200	2054653	1	A Network Trojan was detected	192.168.2.4	49730	104.21.55.124	443	TCP
2024-10-07T06:44:56.621278+0200	2054653	1	A Network Trojan was detected	192.168.2.4	49735	104.21.53.8	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T06:44:54.346545+0200	2049836	1	A Network Trojan was detected	192.168.2.4	49730	104.21.55.124	443	TCP
2024-10-07T06:44:56.621278+0200	2049836	1	A Network Trojan was detected	192.168.2.4	49735	104.21.53.8	443	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T06:44:54.396629+0200	2056477	1	Domain Observed Used for C2 Detected	192.168.2.4	57070	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T06:44:54.430762+0200	2056471	1	Domain Observed Used for C2 Detected	192.168.2.4	55578	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T06:44:54.374341+0200	2056481	1	Domain Observed Used for C2 Detected	192.168.2.4	65261	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T06:44:54.363523+0200	2056483	1	Domain Observed Used for C2 Detected	192.168.2.4	51505	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T06:44:54.419957+0200	2056473	1	Domain Observed Used for C2 Detected	192.168.2.4	59576	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T06:44:54.352334+0200	2056485	1	Domain Observed Used for C2 Detected	192.168.2.4	58739	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T06:44:54.407209+0200	2056475	1	Domain Observed Used for C2 Detected	192.168.2.4	49797	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T06:44:54.385299+0200	2056479	1	Domain Observed Used for C2 Detected	192.168.2.4	55843	1.1.1.1	53	UDP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: Setup.exe

Avira: detected

Antivirus detection for URL or domain

Source: https://steamcommunity.com/profiles/76561199724331900	URL Reputation: Label: malware
Source: https://steamcommunity.com/profiles/76561199724331900/inventory/	URL Reputation: Label: malware
Source: https://steamcommunity.com/profiles/76561199724331900/badges	URL Reputation: Label: malware

Found malware configuration

Source: 0.2.Setup.exe.900000.0.unpack

Malware Configuration Extractor: LummaC {"C2 url": ["studennotediw.stor", "bathdoomgaz.stor", "dissapoiznw.stor", "licendfilteo.site", "mobbipenju.stor", "spirittunek.stor", "clearancek.site", "eaglepawnoy.stor", "methodbojjewkl.shop"], "Build id": "2hNffM--krepostnoy"}

Multi AV Scanner detection for submitted file

Source: Setup.exe

ReversingLabs: Detection: 68%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: Setup.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmp	String decryptor: clearancek.site
Source: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmp	String decryptor: licendfilteo.site
Source: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmp	String decryptor: spirittunek.stor
Source: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmp	String decryptor: bathdoomgaz.stor
Source: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmp	String decryptor: studennotediw.stor
Source: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmp	String decryptor: dissapoiznw.stor
Source: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmp	String decryptor: eaglepawnoy.stor
Source: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmp	String decryptor: mobbipenju.stor
Source: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmp	String decryptor: methodbojjewkl.shop
Source: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmp	String decryptor: - Screen Resoluton:
Source: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmp	String decryptor: Workgroup: -
Source: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmp	String decryptor: 2hNffM--krepostnoy

Source: Setup.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.21.55.124:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.64:443 -> 192.168.2.4:49746 version: TLS 1.2

Source: Setup.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\Setup.exe

Code function: 0_2_0091755F FindFirstFileExW,FindNextFileW,FindClose,FindClose,

0_2_0091755F

Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then mov ebp, eax	0_2_009321E0
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then mov word ptr [eax], dx	0_2_0094A140
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then mov word ptr [esi], ax	0_2_0094A140
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], C274D4CAh	0_2_0096E298
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	0_2_0095A2C0
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], C274D4CAh	0_2_0096E398
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then mov eax, dword ptr [esp+0Ch]	0_2_009543B7
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then mov eax, dword ptr [esi+04h]	0_2_0093E416
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then mov word ptr [eax], dx	0_2_0094A548
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	0_2_00956572
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then mov eax, dword ptr [esp+08h]	0_2_0096E6CF
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then movzx edx, byte ptr [esi+edi]	0_2_0092C880
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 27BAF212h	0_2_0096E83B
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], F3285E74h	0_2_0095082C
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F3285E74h	0_2_0096C920
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	0_2_00958A60
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], C85F7986h	0_2_00954BB0
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00954BB0
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], C85F7986h	0_2_00954BB0
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then cmp word ptr [eax+esi+02h], 0000h	0_2_00956B28
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then jmp eax	0_2_00952B50
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then mov word ptr [edx], ax	0_2_00952B71
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then cmp byte ptr [ebx], 00000000h	0_2_0093ECC2
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then jmp eax	0_2_00950C23
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00970C6A
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then movzx edi, byte ptr [ecx+esi]	0_2_0092ED80
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then mov eax, dword ptr [ebp-10h]	0_2_00938DCC
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then mov edi, ecx	0_2_0093CD0A
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then mov ecx, dword ptr [edx]	0_2_00928EE0
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then mov eax, dword ptr [esi+20h]	0_2_0093EE71
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then jmp ecx	0_2_00930FB8
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	0_2_0095AFDD
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00934FF0
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00934FF0
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then dec ebx	0_2_00966F10
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	0_2_0095AF7C
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then mov eax, dword ptr [esp+0Ch]	0_2_009550C1
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then movzx ebx, word ptr [ecx]	0_2_00953059
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then mov dword ptr [esp], 00000000h	0_2_009432F0
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_009453C7
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then movzx eax, word ptr [esi+ecx]	0_2_00969320
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 7789B0CBh	0_2_0096F400
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then movzx ecx, word ptr [edi+eax]	0_2_0096F5F0
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	0_2_00963530
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	0_2_0095568F
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_0096D609
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then mov eax, ebx	0_2_0093D655
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_00951667
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 53F09CFAh	0_2_009718B0
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F8FD61B8h	0_2_009478A4
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then mov byte ptr [edi], al	0_2_0095B81B
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 62429966h	0_2_0096B800
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then jmp dword ptr [0044FDB4h]	0_2_0093D851
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then cmp word ptr [ecx+eax+02h], 0000h	0_2_00945872
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then jmp eax	0_2_009399AD
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then jmp eax	0_2_0093991C
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then movzx edx, byte ptr [esi+ebx]	0_2_0092D930
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	0_2_0095B945
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then mov eax, dword ptr [esp+40h]	0_2_00939ACE
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then cmp word ptr [ebp+edi+02h], 0000h	0_2_0094FAE0
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 53F09CFAh	0_2_00971A40
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then mov eax, dword ptr [esp+000006B8h]	0_2_00945A4F
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then mov eax, dword ptr [esp+04h]	0_2_00937B80
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00971BC0
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then cmp dword ptr [ebp+edx*8+00h], 9ECF05EBh	0_2_00971BC0
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], A70A987Fh	0_2_00967B3E
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then mov byte ptr [edi], al	0_2_0095BB2A
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then mov byte ptr [edi], al	0_2_0095BB4B
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	0_2_00955C89
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then movzx ecx, word ptr [ebp+00h]	0_2_00933D90
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_0094DD50
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_0094FD40
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then mov eax, dword ptr [esp+40h]	0_2_00939D73
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then jmp ecx	0_2_0096DEB6
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then mov word ptr [edx], 0000h	0_2_00947EBF
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], F3285E74h	0_2_0096FEA0
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_0096FEA0
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then jmp eax	0_2_00951ECC
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00967E50
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then mov dword ptr [esp+1Ch], 5E46585Eh	0_2_00957F38
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	0_2_0095BF20
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then mov eax, dword ptr [esi+14h]	0_2_0095BF20
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F3285E74h	0_2_0096BF20
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then jmp ecx	0_2_0096DF74
Source: C:\Users\user\Desktop\Setup.exe	Code function: 4x nop then mov eax, dword ptr [esi+04h]	0_2_0093BF77
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp]	1_2_0040D110
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp]	1_2_0040D110
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], C274D4CAh	1_2_004463B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp]	1_2_00445700
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 27BAF212h	1_2_0044695B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp+04h]	1_2_0040FCA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F3285E74h	1_2_00444040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov ecx, dword ptr [edx]	1_2_00401000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esi+20h]	1_2_00416F91
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then dec ebx	1_2_0043F030
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp ecx	1_2_00446094
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp+0Ch]	1_2_0042D1E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov word ptr [eax], dx	1_2_00422260
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov word ptr [esi], ax	1_2_00422260
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esi+04h]	1_2_004142FC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov ebp, eax	1_2_0040A300
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	1_2_004323E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	1_2_004323E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	1_2_004323E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov byte ptr [edi], al	1_2_004323E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	1_2_004323E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esi+14h]	1_2_004323E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx eax, word ptr [esi+ecx]	1_2_00441440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov word ptr [eax], cx	1_2_0041D457
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp+0Ch]	1_2_0042C470
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	1_2_0042E40C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov dword ptr [esp], 00000000h	1_2_0041B410
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], C274D4CAh	1_2_004464B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov word ptr [eax], cx	1_2_00429510
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 7789B0CBh	1_2_00447520
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esi+04h]	1_2_00416536
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	1_2_0043B650
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	1_2_0042E66A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx ecx, word ptr [edi+eax]	1_2_00447710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp+08h]	1_2_004467EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	1_2_0042D7AF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov word ptr [eax], dx	1_2_004228E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp word ptr [ecx+eax+02h], 0000h	1_2_0041D961
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 62429966h	1_2_00443920
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 53F09CFAh	1_2_004499D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx edx, byte ptr [esi+edi]	1_2_004049A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F3285E74h	1_2_00444A40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx edx, byte ptr [esi+ebx]	1_2_00405A50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp eax	1_2_00411A3C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp eax	1_2_00411ACD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 53F09CFAh	1_2_00449B60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp+000006B8h]	1_2_0041DB6F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F8FD61B8h	1_2_0041DB6F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esi+04h]	1_2_00413BE2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp+40h]	1_2_00411BEE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	1_2_00430B80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp word ptr [eax+esi+02h], 0000h	1_2_0042EC48
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp word ptr [ebp+edi+02h], 0000h	1_2_00427C00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], A70A987Fh	1_2_0043FC20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], C85F7986h	1_2_0042CCD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp]	1_2_0042CCD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], C85F7986h	1_2_0042CCD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp]	1_2_00449CE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [ebp+edx*8+00h], 9ECF05EBh	1_2_00449CE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp eax	1_2_0042AC91
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov word ptr [edx], ax	1_2_0042AC91
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov dword ptr [esp+1Ch], 5E46585Eh	1_2_0042FD10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	1_2_0042DD29
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp]	1_2_00448D8A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx ebx, word ptr [ecx]	1_2_0042AE57
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov word ptr [eax], cx	1_2_00427E60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp]	1_2_00425E70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov edi, ecx	1_2_00414E2A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [ebp-10h]	1_2_00410EEC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp+40h]	1_2_00411E93
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx edi, byte ptr [ecx+esi]	1_2_00406EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx ecx, word ptr [ebp+00h]	1_2_0040BEB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp byte ptr [ebx], 00000000h	1_2_00416EBF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp eax	1_2_00429F62
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp]	1_2_0043FF70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], F3285E74h	1_2_00447FC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp]	1_2_00447FC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp ecx	1_2_00408FD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp ecx	1_2_00445FD6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov word ptr [edx], 0000h	1_2_0041FFDF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esi+20h]	1_2_00416F91

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2056473 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site) : 192.168.2.4:59576 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056483 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store) : 192.168.2.4:51505 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056477 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store) : 192.168.2.4:57070 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056481 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store) : 192.168.2.4:65261 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056479 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store) : 192.168.2.4:55843 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056485 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store) : 192.168.2.4:58739 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056471 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site) : 192.168.2.4:55578 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056475 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store) : 192.168.2.4:49797 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49735 -> 104.21.53.8:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49735 -> 104.21.53.8:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49730 -> 104.21.55.124:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49730 -> 104.21.55.124:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: studennotediw.stor
Source: Malware configuration extractor	URLs: bathdoomgaz.stor
Source: Malware configuration extractor	URLs: dissapoiznw.stor
Source: Malware configuration extractor	URLs: licendfilteo.site
Source: Malware configuration extractor	URLs: mobbipenju.stor
Source: Malware configuration extractor	URLs: spirittunek.stor
Source: Malware configuration extractor	URLs: clearancek.site
Source: Malware configuration extractor	URLs: eaglepawnoy.stor
Source: Malware configuration extractor	URLs: methodbojjewkl.shop

Source: Joe Sandbox View	IP Address: 104.21.53.8 104.21.53.8
Source: Joe Sandbox View	IP Address: 104.102.49.254 104.102.49.254

Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: methodbojjewkl.shop
Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: sergei-esenin.com

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com

Source: global traffic	DNS traffic detected: DNS query: methodbojjewkl.shop
Source: global traffic	DNS traffic detected: DNS query: mobbipenju.store
Source: global traffic	DNS traffic detected: DNS query: eaglepawnoy.store
Source: global traffic	DNS traffic detected: DNS query: dissapoiznw.store
Source: global traffic	DNS traffic detected: DNS query: studennotediw.store
Source: global traffic	DNS traffic detected: DNS query: bathdoomgaz.store
Source: global traffic	DNS traffic detected: DNS query: spirittunek.store
Source: global traffic	DNS traffic detected: DNS query: licendfilteo.site
Source: global traffic	DNS traffic detected: DNS query: clearancek.site
Source: global traffic	DNS traffic detected: DNS query: steamcommunity.com
Source: global traffic	DNS traffic detected: DNS query: sergei-esenin.com

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: methodbojjewkl.shop

Source: MSBuild.exe, 00000001.00000002.1689212426.0000000000D8D000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.1689414683.0000000000E39000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
Source: MSBuild.exe, 00000001.00000002.1689212426.0000000000D8D000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.1689414683.0000000000E39000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/privacy_agreement/
Source: MSBuild.exe, 00000001.00000002.1689212426.0000000000D8D000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.1689414683.0000000000E39000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/subscriber_agreement/
Source: Amcache.hve.4.dr	String found in binary or memory: http://upx.sf.net
Source: MSBuild.exe, 00000001.00000002.1689212426.0000000000D8D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg
Source: MSBuild.exe, 00000001.00000002.1689212426.0000000000D8D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/applications/community/main.css?v=Ev2sBLgkgyWJ&a
Source: MSBuild.exe, 00000001.00000002.1689212426.0000000000D8D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/images/skin_1/arrowDn9x5.gif
Source: MSBuild.exe, 00000001.00000002.1689212426.0000000000D8D000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.1689414683.0000000000E39000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
Source: MSBuild.exe, 00000001.00000002.1689212426.0000000000D8D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6
Source: MSBuild.exe, 00000001.00000002.1689212426.0000000000D8D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/main.js?v=10oP_O2R
Source: MSBuild.exe, 00000001.00000002.1689212426.0000000000D8D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/manifest.js?v=AeTz
Source: MSBuild.exe, 00000001.00000002.1689212426.0000000000D8D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://methodbojjewkl.shop/I1
Source: MSBuild.exe, 00000001.00000002.1689212426.0000000000DB4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mobbipenju.store/api
Source: MSBuild.exe, 00000001.00000002.1689212426.0000000000D78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mobbipenju.store/e
Source: MSBuild.exe, 00000001.00000002.1689212426.0000000000D78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mobbipenju.store/u
Source: MSBuild.exe, 00000001.00000002.1689212426.0000000000DB4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/
Source: MSBuild.exe, 00000001.00000002.1689212426.0000000000DB4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/api
Source: MSBuild.exe, 00000001.00000002.1689212426.0000000000DB4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/api6
Source: MSBuild.exe, 00000001.00000002.1689212426.0000000000D8D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com:443/apifiles/76561199724331900
Source: MSBuild.exe, 00000001.00000002.1689212426.0000000000DB4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://spirittunek.store/apiie
Source: MSBuild.exe, 00000001.00000002.1689212426.0000000000D8D000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.1689414683.0000000000E39000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
Source: MSBuild.exe, 00000001.00000002.1689212426.0000000000D8D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/badges
Source: MSBuild.exe, 00000001.00000002.1689212426.0000000000D8D000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.1689414683.0000000000E39000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/inventory/
Source: MSBuild.exe, 00000001.00000002.1689212426.0000000000D8D000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.1689414683.0000000000E39000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/legal/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50000 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50007 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49947 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49992 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49969 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49994 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50006 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49942
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49940
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49939
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49938
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49937
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49936
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49935
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49934
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49933
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49932
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49931
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49930
Source: unknown	Network traffic detected: HTTP traffic on port 49925 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50008 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49971 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49936 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49960 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49929
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49928
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49927
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49926
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49925
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49924
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49923
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49922
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49921
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49920
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443

Source: unknown	HTTPS traffic detected: 104.21.55.124:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.64:443 -> 192.168.2.4:49746 version: TLS 1.2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 1_2_00438720 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

1_2_00438720

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 1_2_00438720 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

1_2_00438720

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 1_2_004390EE GetDC,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetCurrentObject,GetObjectW,DeleteObject,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,

1_2_004390EE

Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_009020AD	0_2_009020AD
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00936080	0_2_00936080
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_009601B0	0_2_009601B0
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_009321E0	0_2_009321E0
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_0095E3D0	0_2_0095E3D0
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_009444D0	0_2_009444D0
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00966780	0_2_00966780
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00916775	0_2_00916775
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_0096C920	0_2_0096C920
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00954BB0	0_2_00954BB0
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00932DF0	0_2_00932DF0
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00928EE0	0_2_00928EE0
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_0092D090	0_2_0092D090
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_0092F0D0	0_2_0092F0D0
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_009591B0	0_2_009591B0
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_009291D7	0_2_009291D7
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_0095913A	0_2_0095913A
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_0092D12B	0_2_0092D12B
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_0090729C	0_2_0090729C
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00929283	0_2_00929283
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00933280	0_2_00933280
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_0092927A	0_2_0092927A
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_0092B490	0_2_0092B490
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_0092945D	0_2_0092945D
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_0092952F	0_2_0092952F
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_009637A0	0_2_009637A0
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00959740	0_2_00959740
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_0096F990	0_2_0096F990
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_0092FAD0	0_2_0092FAD0
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00945A4F	0_2_00945A4F
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00933D90	0_2_00933D90
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00955D8C	0_2_00955D8C
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00931D48	0_2_00931D48
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_0096FEA0	0_2_0096FEA0
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00901E1E	0_2_00901E1E
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00971FB0	0_2_00971FB0
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00939F10	0_2_00939F10
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_0096BF20	0_2_0096BF20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00410228	1_2_00410228
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00444040	1_2_00444040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00401000	1_2_00401000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00412030	1_2_00412030
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0044A0D0	1_2_0044A0D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00405160	1_2_00405160
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_004071F0	1_2_004071F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0040E1A0	1_2_0040E1A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_004382D0	1_2_004382D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_004312D0	1_2_004312D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_004012F7	1_2_004012F7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0040A300	1_2_0040A300
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_004323E0	1_2_004323E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0040B3A0	1_2_0040B3A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_004013A3	1_2_004013A3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0042C470	1_2_0042C470
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_004364F0	1_2_004364F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00414487	1_2_00414487
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0041049B	1_2_0041049B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0041C5F0	1_2_0041C5F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_004035B0	1_2_004035B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0040164F	1_2_0040164F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00448652	1_2_00448652
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0043F620	1_2_0043F620
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_004486F0	1_2_004486F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00431860	1_2_00431860
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0043B8C0	1_2_0043B8C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0043E8A0	1_2_0043E8A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0042098B	1_2_0042098B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_004489A0	1_2_004489A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00444A40	1_2_00444A40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00448A80	1_2_00448A80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00447AB0	1_2_00447AB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0041DB6F	1_2_0041DB6F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00407BF0	1_2_00407BF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00448C02	1_2_00448C02
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0042CCD0	1_2_0042CCD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00446CBF	1_2_00446CBF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00428D62	1_2_00428D62
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0042FD10	1_2_0042FD10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0042DD29	1_2_0042DD29
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0042AE57	1_2_0042AE57
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00448E70	1_2_00448E70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00414E2A	1_2_00414E2A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0040BEB0	1_2_0040BEB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00416EBF	1_2_00416EBF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0040AF10	1_2_0040AF10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00447FC0	1_2_00447FC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00408FD0	1_2_00408FD0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 0040CAA0 appears 48 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 0041D300 appears 152 times
Source: C:\Users\user\Desktop\Setup.exe	Code function: String function: 00907B50 appears 51 times
Source: C:\Users\user\Desktop\Setup.exe	Code function: String function: 009451E0 appears 152 times
Source: C:\Users\user\Desktop\Setup.exe	Code function: String function: 00934980 appears 93 times

Source: C:\Users\user\Desktop\Setup.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6576 -s 636

Source: Setup.exe, 00000000.00000002.1853687370.0000000000983000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameWinRTNetMUAHostServer.exej% vs Setup.exe
Source: Setup.exe	Binary or memory string: OriginalFilenameWinRTNetMUAHostServer.exej% vs Setup.exe

Source: Setup.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: Setup.exe

Static PE information: Section: .data ZLIB complexity 0.9911795236013986

Source: classification engine

Classification label: mal100.troj.evad.winEXE@4/5@11/3

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 1_2_00438220 CoCreateInstance,

1_2_00438220

Source: C:\Windows\SysWOW64\WerFault.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6576

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\561cf430-fbd3-4d3f-8484-497bf23b036e

Jump to behavior

Source: C:\Users\user\Desktop\Setup.exe	Command line argument: MZx	0_2_009020AD
Source: C:\Users\user\Desktop\Setup.exe	Command line argument: MZx	0_2_009020AD
Source: C:\Users\user\Desktop\Setup.exe	Command line argument: MZx	0_2_009020AD

Source: Setup.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Setup.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Setup.exe

ReversingLabs: Detection: 68%

Source: unknown	Process created: C:\Users\user\Desktop\Setup.exe "C:\Users\user\Desktop\Setup.exe"
Source: C:\Users\user\Desktop\Setup.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: C:\Users\user\Desktop\Setup.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6576 -s 636
Source: C:\Users\user\Desktop\Setup.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Setup.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: acgenral.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: Setup.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: Setup.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: Setup.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: Setup.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Setup.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: Setup.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: Setup.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: Setup.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: Setup.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: Setup.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: Setup.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: Setup.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: Setup.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_009020AD push edi; ret	0_2_00902982
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_009071A3 push ecx; ret	0_2_009071B6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0044D0A9 push ecx; ret	1_2_0044D0B4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0044F23B push edx; ret	1_2_0044F24B

Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\Setup.exe

API coverage: 1.2 %

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 6712

Thread sleep time: -30000s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\Setup.exe

Code function: 0_2_0091755F FindFirstFileExW,FindNextFileW,FindClose,FindClose,

0_2_0091755F

Source: Amcache.hve.4.dr	Binary or memory string: VMware
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.4.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.4.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.4.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.4.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.4.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: MSBuild.exe, 00000001.00000002.1689212426.0000000000DB4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.4.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: MSBuild.exe, 00000001.00000002.1689212426.0000000000DB4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW]
Source: Amcache.hve.4.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.4.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.4.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.4.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.4.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.4.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.4.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: MSBuild.exe, 00000001.00000002.1689212426.0000000000D8D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW({
Source: Amcache.hve.4.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.4.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.4.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.4.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.4.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.4.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.4.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.4.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.4.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.4.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\Desktop\Setup.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\Setup.exe

Code function: 0_2_00906DCC LdrInitializeThunk,___scrt_release_startup_lock,___scrt_is_nonwritable_in_current_image,___scrt_is_nonwritable_in_current_image,KiUserExceptionDispatcher,LdrInitializeThunk,___scrt_uninitialize_crt,

0_2_00906DCC

Source: C:\Users\user\Desktop\Setup.exe

Code function: 0_2_0090B736 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_0090B736

Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_009020AD mov edi, dword ptr fs:[00000030h]	0_2_009020AD
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00918038 mov eax, dword ptr fs:[00000030h]	0_2_00918038
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_0090EFEC mov ecx, dword ptr fs:[00000030h]	0_2_0090EFEC

Source: C:\Users\user\Desktop\Setup.exe

Code function: 0_2_0091A637 GetProcessHeap,

0_2_0091A637

Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_009075D0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_009075D0
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_0090B736 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0090B736
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_009078F8 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_009078F8
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00907A85 SetUnhandledExceptionFilter,	0_2_00907A85

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\Setup.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\Setup.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 value starts with: 4D5A

Jump to behavior

LummaC encrypted strings found

Source: Setup.exe	String found in binary or memory: mobbipenju.stor
Source: Setup.exe	String found in binary or memory: eaglepawnoy.stor
Source: Setup.exe	String found in binary or memory: methodbojjewkl.shop
Source: Setup.exe	String found in binary or memory: licendfilteo.site
Source: Setup.exe	String found in binary or memory: clearancek.site
Source: Setup.exe	String found in binary or memory: bathdoomgaz.stor
Source: Setup.exe	String found in binary or memory: spirittunek.stor
Source: Setup.exe	String found in binary or memory: dissapoiznw.stor
Source: Setup.exe	String found in binary or memory: studennotediw.stor

Writes to foreign memory regions

Source: C:\Users\user\Desktop\Setup.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 401000	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 44B000	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 44E000	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 45E000	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 93F008	Jump to behavior

Source: C:\Users\user\Desktop\Setup.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"

Jump to behavior

Source: C:\Users\user\Desktop\Setup.exe	Code function: GetLocaleInfoW,LdrInitializeThunk,	0_2_0091A0D7
Source: C:\Users\user\Desktop\Setup.exe	Code function: GetLocaleInfoW,	0_2_0091203C
Source: C:\Users\user\Desktop\Setup.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_0091A200
Source: C:\Users\user\Desktop\Setup.exe	Code function: GetUserDefaultLCID,IsValidCodePage,LdrInitializeThunk,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_0091A3D5
Source: C:\Users\user\Desktop\Setup.exe	Code function: GetLocaleInfoW,	0_2_0091A306
Source: C:\Users\user\Desktop\Setup.exe	Code function: LdrInitializeThunk,EnumSystemLocalesW,	0_2_00911B92
Source: C:\Users\user\Desktop\Setup.exe	Code function: LdrInitializeThunk,EnumSystemLocalesW,	0_2_00919DF9
Source: C:\Users\user\Desktop\Setup.exe	Code function: LdrInitializeThunk,EnumSystemLocalesW,	0_2_00919D13
Source: C:\Users\user\Desktop\Setup.exe	Code function: LdrInitializeThunk,EnumSystemLocalesW,	0_2_00919D5E
Source: C:\Users\user\Desktop\Setup.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,LdrInitializeThunk,	0_2_00919E84

Source: C:\Users\user\Desktop\Setup.exe

Code function: 0_2_009077F2 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_009077F2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Amcache.hve.4.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: 1.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.MSBuild.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Setup.exe.900000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1688980606.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: 1.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.MSBuild.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Setup.exe.900000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1688980606.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	311 Process Injection	2 Virtualization/Sandbox Evasion	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Screen Capture	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 PowerShell	Boot or Logon Initialization Scripts	1 DLL Side-Loading	311 Process Injection	LSASS Memory	41 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Deobfuscate/Decode Files or Information	Security Account Manager	2 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	2 Clipboard Data	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	3 Obfuscated Files or Information	NTDS	1 File and Directory Discovery	Distributed Component Object Model	Input Capture	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Software Packing	LSA Secrets	13 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label
Setup.exe	68%	ReversingLabs	Win32.Spyware.Lummastealer
Setup.exe	100%	Avira	HEUR/AGEN.1310458
Setup.exe	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://steamcommunity.com/profiles/76561199724331900	100%	URL Reputation	malware
http://store.steampowered.com/privacy_agreement/	0%	URL Reputation	safe
http://upx.sf.net	0%	URL Reputation	safe
http://store.steampowered.com/subscriber_agreement/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/images/skin_1/arrowDn9x5.gif	0%	URL Reputation	safe
https://steamcommunity.com/profiles/76561199724331900/inventory/	100%	URL Reputation	malware
https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1	0%	URL Reputation	safe
http://store.steampowered.com/account/cookiepreferences/	0%	URL Reputation	safe
https://store.steampowered.com/legal/	0%	URL Reputation	safe
https://steamcommunity.com/profiles/76561199724331900/badges	100%	URL Reputation	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false	unknown
steamcommunity.com	104.102.49.254	true	false	unknown
s-part-0036.t-0009.t-msedge.net	13.107.246.64	true	false	unknown
methodbojjewkl.shop	104.21.55.124	true	true	unknown
sergei-esenin.com	104.21.53.8	true	true	unknown
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false	unknown
eaglepawnoy.store	unknown	unknown	false	unknown
bathdoomgaz.store	unknown	unknown	false	unknown
spirittunek.store	unknown	unknown	false	unknown
licendfilteo.site	unknown	unknown	true	unknown
studennotediw.store	unknown	unknown	false	unknown
mobbipenju.store	unknown	unknown	false	unknown
clearancek.site	unknown	unknown	true	unknown
dissapoiznw.store	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://steamcommunity.com/profiles/76561199724331900	true	URL Reputation: malware	unknown
licendfilteo.site	true		unknown
studennotediw.stor	true		unknown
methodbojjewkl.shop	true		unknown
https://methodbojjewkl.shop/api	true		unknown
spirittunek.stor	true		unknown
bathdoomgaz.stor	true		unknown
dissapoiznw.stor	true		unknown
eaglepawnoy.stor	true		unknown
https://sergei-esenin.com/api	true		unknown
clearancek.site	true		unknown
mobbipenju.stor	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://methodbojjewkl.shop/I1	MSBuild.exe, 00000001.00000002.1689212426.0000000000D8D000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://mobbipenju.store/u	MSBuild.exe, 00000001.00000002.1689212426.0000000000D78000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://store.steampowered.com/privacy_agreement/	MSBuild.exe, 00000001.00000002.1689212426.0000000000D8D000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.1689414683.0000000000E39000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://sergei-esenin.com/	MSBuild.exe, 00000001.00000002.1689212426.0000000000DB4000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://upx.sf.net	Amcache.hve.4.dr	false	URL Reputation: safe	unknown
http://store.steampowered.com/subscriber_agreement/	MSBuild.exe, 00000001.00000002.1689212426.0000000000D8D000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.1689414683.0000000000E39000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org	MSBuild.exe, 00000001.00000002.1689212426.0000000000D8D000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.1689414683.0000000000E39000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6	MSBuild.exe, 00000001.00000002.1689212426.0000000000D8D000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/images/skin_1/arrowDn9x5.gif	MSBuild.exe, 00000001.00000002.1689212426.0000000000D8D000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/profiles/76561199724331900/inventory/	MSBuild.exe, 00000001.00000002.1689212426.0000000000D8D000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.1689414683.0000000000E39000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
https://community.akamai.steamstatic.com/public/css/applications/community/main.css?v=Ev2sBLgkgyWJ&a	MSBuild.exe, 00000001.00000002.1689212426.0000000000D8D000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://sergei-esenin.com:443/apifiles/76561199724331900	MSBuild.exe, 00000001.00000002.1689212426.0000000000D8D000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg	MSBuild.exe, 00000001.00000002.1689212426.0000000000D8D000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://mobbipenju.store/api	MSBuild.exe, 00000001.00000002.1689212426.0000000000DB4000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/javascript/applications/community/main.js?v=10oP_O2R	MSBuild.exe, 00000001.00000002.1689212426.0000000000D8D000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1	MSBuild.exe, 00000001.00000002.1689212426.0000000000D8D000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.1689414683.0000000000E39000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://spirittunek.store/apiie	MSBuild.exe, 00000001.00000002.1689212426.0000000000DB4000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://store.steampowered.com/account/cookiepreferences/	MSBuild.exe, 00000001.00000002.1689212426.0000000000D8D000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.1689414683.0000000000E39000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/applications/community/manifest.js?v=AeTz	MSBuild.exe, 00000001.00000002.1689212426.0000000000D8D000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://mobbipenju.store/e	MSBuild.exe, 00000001.00000002.1689212426.0000000000D78000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/legal/	MSBuild.exe, 00000001.00000002.1689212426.0000000000D8D000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.1689414683.0000000000E39000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://sergei-esenin.com/api6	MSBuild.exe, 00000001.00000002.1689212426.0000000000DB4000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com/profiles/76561199724331900/badges	MSBuild.exe, 00000001.00000002.1689212426.0000000000D8D000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.21.53.8	sergei-esenin.com	United States	13335	CLOUDFLARENETUS	true
104.102.49.254	steamcommunity.com	United States	16625	AKAMAI-ASUS	false
104.21.55.124	methodbojjewkl.shop	United States	13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1527618
Start date and time:	2024-10-07 06:44:03 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 11s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Setup.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@4/5@11/3
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 63% Number of executed functions: 7 Number of non-executed functions: 153
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.190.159.64, 40.126.31.73, 20.190.159.71, 20.190.159.68, 20.190.159.4, 20.190.159.75, 20.190.159.0, 40.126.31.69, 199.232.214.172, 192.229.221.95, 4.245.163.56, 20.42.73.29, 13.85.23.206, 40.69.42.241
Excluded domains from analysis (whitelisted): prdv4a.aadg.msidentity.com, ctldl.windowsupdate.com.delivery.microsoft.com, slscr.update.microsoft.com, otelrules.azureedge.net, otelrules.afd.azureedge.net, www.tm.v4.a.prd.aadg.trafficmanager.net, ctldl.windowsupdate.com, login.msa.msidentity.com, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, ocsp.digicert.com, login.live.com, ocsp.edge.digicert.com, blobcollector.events.data.trafficmanager.net, onedsblobprdeus15.eastus.cloudapp.azure.com, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, azureedge-t-prod.trafficmanager.net, umwatson.events.data.microsoft.com, wu-b-net.trafficmanager.net, www.tm.lg.prod.aadmsa.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: Setup.exe

Simulations

Behavior and APIs

Time	Type	Description
00:44:53	API Interceptor	3x Sleep call for process: MSBuild.exe modified
00:45:12	API Interceptor	1x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.21.53.8	8ObkdHP9Hq.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Stealc	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	fASbbWNgm1.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	Launch.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC, Vidar	Browse
104.102.49.254	http://gtm-cn-j4g3qqvf603.steamproxy1.com/	Get hash	malicious	Unknown	Browse	www.valvesoftware.com/legal.htm
104.21.55.124	https://www.google.com/url?q=dCSMjVnvsqsqaP8pEWWm&rct=SpPq9HncUaCXUtCZusX0&sa=t&esrc=uZR6jk9A67Rj7RZhLuPE&source=&cd=eh0xIKCKpKh7i4kTt26p&cad=VEVtMkQKVNr1KW4fxShi&ved=NTDACygNXetEDbRT8YiY&uact=%20&url=amp/mithunaads.in/M%2f45043%2FaGFucy5hbmRlcnNvbkBhZy5zdGF0ZS5tbi51cw==	Get hash	malicious	HTMLPhisher, Tycoon2FA	Browse
104.21.55.124	UIrnX2zlka.exe	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s-part-0036.t-0009.t-msedge.net	https://sexyboobsme.pages.dev/	Get hash	malicious	Porn Scam	Browse	13.107.246.64
	https://ig-leaks.github.io/insta_chat/instagram/	Get hash	malicious	Unknown	Browse	13.107.246.64
	http://pub-0b94d4f0b06646c5bbfca320d917c04a.r2.dev/insured.html	Get hash	malicious	HTMLPhisher	Browse	13.107.246.64
	http://mbilalgit.github.io/Netflix-Clone	Get hash	malicious	HTMLPhisher	Browse	13.107.246.64
	https://us-usps-tsgczt.xyz/update/	Get hash	malicious	Unknown	Browse	13.107.246.64
	https://lynwoodgrove.com/Comerica/info.html	Get hash	malicious	Unknown	Browse	13.107.246.64
	https://main.yamadamms.com/	Get hash	malicious	HTMLPhisher	Browse	13.107.246.64
	https://suruchi2772.github.io/Cohort-	Get hash	malicious	HTMLPhisher	Browse	13.107.246.64
	https://multiresolveddappsweb.pages.dev/	Get hash	malicious	HTMLPhisher	Browse	13.107.246.64
	https://chattts-49f1.beszyrecala.workers.dev/8f4343f2-5122-469d-b1ec-a6=	Get hash	malicious	Unknown	Browse	13.107.246.64
sergei-esenin.com	file.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	p7SnjaA8NN.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Stealc, Vidar	Browse	172.67.206.204
	file.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	8ObkdHP9Hq.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Stealc	Browse	104.21.53.8
	MSCy5UvBYg.exe	Get hash	malicious	LummaC, Amadey, Stealc, Vidar	Browse	172.67.206.204
	file.exe	Get hash	malicious	LummaC	Browse	104.21.53.8
	file.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	E7Bu6a7eve.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	172.67.206.204
	file.exe	Get hash	malicious	LummaC	Browse	104.21.53.8
	file.exe	Get hash	malicious	LummaC	Browse	104.21.53.8
steamcommunity.com	file.exe	Get hash	malicious	LummaC	Browse	23.197.127.21
	p7SnjaA8NN.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Stealc, Vidar	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	8ObkdHP9Hq.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Stealc	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	MSCy5UvBYg.exe	Get hash	malicious	LummaC, Amadey, Stealc, Vidar	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	zncaKWwEdq.exe	Get hash	malicious	Vidar	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
bg.microsoft.map.fastly.net	cea5c9ffbf7c8ae9cf3f22399151956f3ee7145b95978.exe	Get hash	malicious	Unknown	Browse	199.232.214.172
	MPil9jkBPG.exe	Get hash	malicious	Vidar	Browse	199.232.210.172
	gpfSnYlScw.exe	Get hash	malicious	Vidar	Browse	199.232.214.172
	fe6yqly1Xh.exe	Get hash	malicious	Stealc, Vidar	Browse	199.232.214.172
	file.exe	Get hash	malicious	Stealc	Browse	199.232.214.172
	SecuriteInfo.com.Trojan.DownLoader47.42925.26493.18247.exe	Get hash	malicious	Amadey	Browse	199.232.214.172
	zncaKWwEdq.exe	Get hash	malicious	Vidar	Browse	199.232.214.172
	http://buckboosters.com/	Get hash	malicious	Unknown	Browse	199.232.210.172
	E7Bu6a7eve.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	199.232.210.172
	https://wchckwl.org/	Get hash	malicious	Unknown	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	VX7fQ2wEzC.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	p7SnjaA8NN.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Stealc, Vidar	Browse	172.67.206.204
	file.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	https://shorturl.at/5LwA8	Get hash	malicious	Unknown	Browse	172.67.69.88
	8ObkdHP9Hq.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Stealc	Browse	104.21.53.8
	https://maxask.com	Get hash	malicious	Unknown	Browse	172.66.0.227
	https://email.m.teachable.com/c/eJwszz3O6yAQheHV4NJiZjA_BcVtso1owOMYyZjIkLv-T47Sn0d6zxqTFQ6TRHC4aDLgaJLK5XhekqW8x7OsUSGCDcHRQggKcdpjELZb4ORzSAyrwUzJbgHE28XoDacSUaPRnjRYHQhm9M4s2iP7ZLOWpIyu8xDOO6dD5tzqdMR9jHdX9E_hQ-GjfoYc5dzaVXmUdvZyueW7rNI7v-QXR0QLenuXXbHz2j7nnMrJZxbUCMro133pK3veWzt-EMEZsO6G_yP-BQAA__8EPU-T	Get hash	malicious	Unknown	Browse	188.114.97.3
	MSCy5UvBYg.exe	Get hash	malicious	LummaC, Amadey, Stealc, Vidar	Browse	172.67.206.204
	file.exe	Get hash	malicious	LummaC	Browse	104.21.53.8
CLOUDFLARENETUS	AimBot.exe	Get hash	malicious	LummaC	Browse	172.67.178.50
	injcheat.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	VX7fQ2wEzC.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	p7SnjaA8NN.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Stealc, Vidar	Browse	172.67.206.204
	file.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	https://shorturl.at/5LwA8	Get hash	malicious	Unknown	Browse	172.67.69.88
	8ObkdHP9Hq.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Stealc	Browse	104.21.53.8
	https://maxask.com	Get hash	malicious	Unknown	Browse	172.66.0.227
	https://email.m.teachable.com/c/eJwszz3O6yAQheHV4NJiZjA_BcVtso1owOMYyZjIkLv-T47Sn0d6zxqTFQ6TRHC4aDLgaJLK5XhekqW8x7OsUSGCDcHRQggKcdpjELZb4ORzSAyrwUzJbgHE28XoDacSUaPRnjRYHQhm9M4s2iP7ZLOWpIyu8xDOO6dD5tzqdMR9jHdX9E_hQ-GjfoYc5dzaVXmUdvZyueW7rNI7v-QXR0QLenuXXbHz2j7nnMrJZxbUCMro133pK3veWzt-EMEZsO6G_yP-BQAA__8EPU-T	Get hash	malicious	Unknown	Browse	188.114.97.3
AKAMAI-ASUS	p7SnjaA8NN.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Stealc, Vidar	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	8ObkdHP9Hq.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Stealc	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	MSCy5UvBYg.exe	Get hash	malicious	LummaC, Amadey, Stealc, Vidar	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	zncaKWwEdq.exe	Get hash	malicious	Vidar	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	E7Bu6a7eve.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.102.49.254

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	AimBot.exe	Get hash	malicious	LummaC	Browse	13.107.246.64
	injcheat.exe	Get hash	malicious	LummaC	Browse	13.107.246.64
	cea5c9ffbf7c8ae9cf3f22399151956f3ee7145b95978.exe	Get hash	malicious	Unknown	Browse	13.107.246.64
	file.exe	Get hash	malicious	Credential Flusher	Browse	13.107.246.64
	p7SnjaA8NN.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Stealc, Vidar	Browse	13.107.246.64
	TVyKPaL2h0.exe	Get hash	malicious	Amadey	Browse	13.107.246.64
	MPil9jkBPG.exe	Get hash	malicious	Vidar	Browse	13.107.246.64
	gpfSnYlScw.exe	Get hash	malicious	Vidar	Browse	13.107.246.64
	fe6yqly1Xh.exe	Get hash	malicious	Stealc, Vidar	Browse	13.107.246.64
	https://shorturl.at/5LwA8	Get hash	malicious	Unknown	Browse	13.107.246.64
a0e9f5d64349fb13191bc781f81f42e1	AimBot.exe	Get hash	malicious	LummaC	Browse	104.21.53.8 104.102.49.254 104.21.55.124
	injcheat.exe	Get hash	malicious	LummaC	Browse	104.21.53.8 104.102.49.254 104.21.55.124
	setupa.exe	Get hash	malicious	GhostRat	Browse	104.21.53.8 104.102.49.254 104.21.55.124
	file.exe	Get hash	malicious	LummaC	Browse	104.21.53.8 104.102.49.254 104.21.55.124
	p7SnjaA8NN.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Stealc, Vidar	Browse	104.21.53.8 104.102.49.254 104.21.55.124
	TVyKPaL2h0.exe	Get hash	malicious	Amadey	Browse	104.21.53.8 104.102.49.254 104.21.55.124
	file.exe	Get hash	malicious	LummaC	Browse	104.21.53.8 104.102.49.254 104.21.55.124
	file.exe	Get hash	malicious	LummaC	Browse	104.21.53.8 104.102.49.254 104.21.55.124
	8ObkdHP9Hq.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Stealc	Browse	104.21.53.8 104.102.49.254 104.21.55.124
	file.exe	Get hash	malicious	LummaC	Browse	104.21.53.8 104.102.49.254 104.21.55.124

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Setup.exe_Micros_f154a420552aadfd6edff887bcf8cd9d2c902934_d4e2a79c_4268ced3-467b-466a-a0fa-08bb7222a531\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8905645133558936
Encrypted:	false
SSDEEP:	96:aXFg5JxTUspIteoI7RT6tQXIDcQvc6QcEVcw3cE/3+HbHg/1AnQECaVDPCoLnNfx:4kPTUq0BU/Qj3qzuiFaZ24IO82
MD5:	481834CC1F1018ED005F4ECE46F1F6DE
SHA1:	E8A7BC6B2256DBE9022316CC4876851C34045536
SHA-256:	E41666D0E3A020A150DACC4D81245C0FFACE4F255217D21F3D820E381650E77A
SHA-512:	B5AB981667969B6CF4BF1B366B7CBE45397B768EBB74F050EEBD3D00CD43DC144069F1FB8184F95BFCE97CE2C2B3B902D48135BEDAE29A79C834A110CA2CF27E
Malicious:	true
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.2.7.4.9.8.9.2.8.4.7.3.5.5.1.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.2.7.4.9.8.9.3.2.6.9.2.3.1.4.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.4.2.6.8.c.e.d.3.-.4.6.7.b.-.4.6.6.a.-.a.0.f.a.-.0.8.b.b.7.2.2.2.a.5.3.1.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.d.f.4.a.9.d.b.a.-.e.e.c.6.-.4.e.2.1.-.8.2.f.f.-.9.c.4.9.7.2.b.7.2.3.4.3.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.S.e.t.u.p...e.x.e._.M.i.c.r.o.s.o.f.t... .W.i.n.d.o.w.s... .O.p.e.r.a.t.i.n.g. .S.y.s.t.e.m.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.W.i.n.R.T.N.e.t.M.U.A.H.o.s.t.S.e.r.v.e.r...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.9.b.0.-.0.0.0.1.-.0.0.1.4.-.1.9.0.9.-.f.5.a.5.7.3.1.8.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.e.0.9.c.7.0.1.5.2.1.1.1.1.7.5.9.b.d.9.b.5.0.9.9.5.7.1.c.0.3.3.d.0.0.0.0.0.9.0.4.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF493.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Mon Oct 7 04:44:53 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	29240
Entropy (8bit):	2.169886273362607
Encrypted:	false
SSDEEP:	192:Q0V3GCNXDDGX/v9COYqAdTshEgSakCB+4:B2ChDsdWdTshdm
MD5:	E5764C7D0423433308459594B1564300
SHA1:	FA6F4DC60CEAB466FA20895BF540A2A646EC4D6A
SHA-256:	55FBE8ACEA4CE156E2B4F8262E184F121059F1A826B1A4715EDC52A73D858120
SHA-512:	A23B23E26BE82638CC1A3EA4BA241B9180B739ACAFDB1DF9DF6FD6FAC623100DDA9796AB8E3C00CDD2AAADE8AD6B748CB59CC9DF2AC827257BC69AF10BB523FF
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... .......Eg.g............4...........x...<.......T....$..........T.......8...........T...............PY......................................................................................................eJ......8.......GenuineIntel............T...........Dg.g.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF59E.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8472
Entropy (8bit):	3.7028336072726513
Encrypted:	false
SSDEEP:	192:R6l7wVeJUg6y/e6Y9lSU9FAQgmfhmkQprw89b6Wsf9em:R6lXJb6r6YfSU9FAQgmfhmk461fd
MD5:	2619021EBF71DCE7FFC1B53CD52D0513
SHA1:	8E53F7CD4B385EEDED5EED5E186C2602688BF653
SHA-256:	239C4C8CC3A2A395DC915659DCABC91A0F115A45B5CE01856BEA584C2CBE7565
SHA-512:	734BBFA93E6B5598274AB81E58DB97245C1CA06E170B49D8A7B50DA2E74077623BDC941045A1694600525D82594C7F7940A71243D69745E7E3FFA1B1D8652FDF
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.5.7.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF5BE.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	4908
Entropy (8bit):	4.546516086798612
Encrypted:	false
SSDEEP:	96:uIjfgI7Z97VWJ8TITTILjKRTINmQhrx3id:uIkYZ97wGKGYtorx3g
MD5:	D0CB4B2532456FFE2DE9BD40CBEB0AA1
SHA1:	DB3B16E484EBE6D5836B93DFD472D867642F3470
SHA-256:	48199CAE974A82CE7395DA75A06F7DDC9D24AB7E545E01ADB92FE4602C6014D3
SHA-512:	C94F1013794479441D17B85E57687FA60DD2271BA50DDEFD6C861B2EDBE6DB65B889C0EC402417AE54026157E1849F902B2F4D351283180DF431F0FBA5C46D9F
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="532547" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.465935883680433
Encrypted:	false
SSDEEP:	6144:VIXfpi67eLPU9skLmb0b4+WSPKaJG8nAgejZMMhA2gX4WABl0uNHdwBCswSbMN:WXD94+WlLZMM6YFH1+MN
MD5:	CD314796D7503DEC0F854B1D511D4C3A
SHA1:	D1FF6EBEEE977B3F2710231A838E021EB15A3D7C
SHA-256:	F417FBE7B9D16E2F2B6EE510B5BDD2ABD338BBF3E1951D89A6478D07A5F6955C
SHA-512:	A7932C6D35D3FA1A424FF10F8AD86A453CA320981AB2C4AABDE3AA910506AD71808D5556C2671E591E17CF23191C279C275498F4FAC1005CE611AC0F9A3AAD9C
Malicious:	false
Reputation:	low
Preview:	regf6...6....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm..I.s................................................................................................................................................................................................................................................................................................................................................q^.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.738386364601251
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Setup.exe
File size:	530'944 bytes
MD5:	5f965231ae39bc8e6a816c8ce8e69d95
SHA1:	2863fc86614ebeabc319377ab9829d5d72091cd5
SHA256:	813159a778ae9c4c5f66cf60ac3b30fc30f6bbf574279c546751a012f906ab40
SHA512:	6c97772e599375a21827d930907d041e6165e39aa6c99a66e28d1e06b3c0e19eb90a269636f5dc0619d0c79a568afe5cd50fc6df6bdaaf8baeeefe2cbe58bb27
SSDEEP:	12288:7GlHy378vzjNOft+PNCe8ktewwebHjskUDXa/NsP:7+GekKNTfRskiXz
TLSH:	4DB4F121B5D0C032E973153249E4EBB59E7EB8714E729E9F7B540F6F4F30281EA2152A
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........`.............E.......E...<...E.......E...............................................................Rich...................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x406f48
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x67011946 [Sat Oct 5 10:47:34 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	76c28592e04b2b2bb1f52b3aac6a5c55

Entrypoint Preview

Instruction
call 00007F674D20A277h
jmp 00007F674D2097FFh
push ebp
mov ebp, esp
mov eax, dword ptr [ebp+08h]
push esi
mov ecx, dword ptr [eax+3Ch]
add ecx, eax
movzx eax, word ptr [ecx+14h]
lea edx, dword ptr [ecx+18h]
add edx, eax
movzx eax, word ptr [ecx+06h]
imul esi, eax, 28h
add esi, edx
cmp edx, esi
je 00007F674D20999Bh
mov ecx, dword ptr [ebp+0Ch]
cmp ecx, dword ptr [edx+0Ch]
jc 00007F674D20998Ch
mov eax, dword ptr [edx+08h]
add eax, dword ptr [edx+0Ch]
cmp ecx, eax
jc 00007F674D20998Eh
add edx, 28h
cmp edx, esi
jne 00007F674D20996Ch
xor eax, eax
pop esi
pop ebp
ret
mov eax, edx
jmp 00007F674D20997Bh
push esi
call 00007F674D20A57Eh
test eax, eax
je 00007F674D2099A2h
mov eax, dword ptr fs:[00000018h]
mov esi, 004818C8h
mov edx, dword ptr [eax+04h]
jmp 00007F674D209986h
cmp edx, eax
je 00007F674D209992h
xor eax, eax
mov ecx, edx
lock cmpxchg dword ptr [esi], ecx
test eax, eax
jne 00007F674D209972h
xor al, al
pop esi
ret
mov al, 01h
pop esi
ret
push ebp
mov ebp, esp
cmp dword ptr [ebp+08h], 00000000h
jne 00007F674D209989h
mov byte ptr [004818CCh], 00000001h
call 00007F674D209C44h
call 00007F674D20CB31h
test al, al
jne 00007F674D209986h
xor al, al
pop ebp
ret
call 00007F674D213681h
test al, al
jne 00007F674D20998Ch
push 00000000h
call 00007F674D20CB38h
pop ecx
jmp 00007F674D20996Bh
mov al, 01h
pop ebp
ret
push ebp
mov ebp, esp
cmp byte ptr [004818CDh], 00000000h
je 00007F674D209986h
mov al, 01h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x26d40	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x83000	0x5f9	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x84000	0x1b14	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x25078	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x24fb8	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1e000	0x12c	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x1c80e	0x1ca00	71bd42ba4a9fde66559cb24c80ca23e3	False	0.5799843067685589	data	6.629985736530285	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x1e000	0x93fc	0x9400	0de6669182eec176310bbdec61645948	False	0.39025548986486486	OpenPGP Secret Key Version 2	4.691262241915467	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x28000	0x5a4e0	0x59600	b3ab493ff20a476633da5aea6044b2e2	False	0.9911795236013986	DOS executable (block device driver \377\377\377\377)	7.992737398046373	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x83000	0x5f9	0x600	d2bb79076fddc8ff2e63245032965831	False	0.4544270833333333	data	4.1941075572406525	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x84000	0x1b14	0x1c00	63a49076347f400dd6dce1c6cbeb20f6	False	0.73828125	data	6.450571546698224	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x830a0	0x3dc	data	English	United States	0.4382591093117409
RT_MANIFEST	0x8347c	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL

Import

KERNEL32.dll

GetConsoleWindow, MultiByteToWideChar, GetStringTypeW, WideCharToMultiByte, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionEx, DeleteCriticalSection, EncodePointer, DecodePointer, LCMapStringEx, GetCPInfo, IsProcessorFeaturePresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, GetStartupInfoW, GetModuleHandleW, CreateFileW, RaiseException, RtlUnwind, GetLastError, SetLastError, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, GetProcAddress, LoadLibraryExW, GetStdHandle, WriteFile, GetModuleFileNameW, ExitProcess, GetModuleHandleExW, HeapFree, LCMapStringW, GetLocaleInfoW, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, HeapAlloc, GetFileType, CloseHandle, FlushFileBuffers, GetConsoleOutputCP, GetConsoleMode, ReadFile, GetFileSizeEx, SetFilePointerEx, ReadConsoleW, HeapReAlloc, FindClose, FindFirstFileExW, FindNextFileW, IsValidCodePage, GetACP, GetOEMCP, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetStdHandle, GetProcessHeap, HeapSize, WriteConsoleW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-07T06:44:54.346545+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49730	104.21.55.124	443	TCP
2024-10-07T06:44:54.346545+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49730	104.21.55.124	443	TCP
2024-10-07T06:44:54.352334+0200	2056485	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store)	1	192.168.2.4	58739	1.1.1.1	53	UDP
2024-10-07T06:44:54.363523+0200	2056483	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store)	1	192.168.2.4	51505	1.1.1.1	53	UDP
2024-10-07T06:44:54.374341+0200	2056481	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store)	1	192.168.2.4	65261	1.1.1.1	53	UDP
2024-10-07T06:44:54.385299+0200	2056479	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store)	1	192.168.2.4	55843	1.1.1.1	53	UDP
2024-10-07T06:44:54.396629+0200	2056477	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store)	1	192.168.2.4	57070	1.1.1.1	53	UDP
2024-10-07T06:44:54.407209+0200	2056475	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store)	1	192.168.2.4	49797	1.1.1.1	53	UDP
2024-10-07T06:44:54.419957+0200	2056473	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site)	1	192.168.2.4	59576	1.1.1.1	53	UDP
2024-10-07T06:44:54.430762+0200	2056471	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site)	1	192.168.2.4	55578	1.1.1.1	53	UDP
2024-10-07T06:44:56.621278+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49735	104.21.53.8	443	TCP
2024-10-07T06:44:56.621278+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49735	104.21.53.8	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 7, 2024 06:44:53.347604036 CEST	49730	443	192.168.2.4	104.21.55.124
Oct 7, 2024 06:44:53.347640038 CEST	443	49730	104.21.55.124	192.168.2.4
Oct 7, 2024 06:44:53.347735882 CEST	49730	443	192.168.2.4	104.21.55.124
Oct 7, 2024 06:44:53.350353956 CEST	49730	443	192.168.2.4	104.21.55.124
Oct 7, 2024 06:44:53.350367069 CEST	443	49730	104.21.55.124	192.168.2.4
Oct 7, 2024 06:44:53.812143087 CEST	443	49730	104.21.55.124	192.168.2.4
Oct 7, 2024 06:44:53.812211037 CEST	49730	443	192.168.2.4	104.21.55.124
Oct 7, 2024 06:44:53.814790964 CEST	49730	443	192.168.2.4	104.21.55.124
Oct 7, 2024 06:44:53.814796925 CEST	443	49730	104.21.55.124	192.168.2.4
Oct 7, 2024 06:44:53.815037012 CEST	443	49730	104.21.55.124	192.168.2.4
Oct 7, 2024 06:44:53.866056919 CEST	49730	443	192.168.2.4	104.21.55.124
Oct 7, 2024 06:44:53.917541027 CEST	49730	443	192.168.2.4	104.21.55.124
Oct 7, 2024 06:44:53.917584896 CEST	49730	443	192.168.2.4	104.21.55.124
Oct 7, 2024 06:44:53.917670965 CEST	443	49730	104.21.55.124	192.168.2.4
Oct 7, 2024 06:44:54.346555948 CEST	443	49730	104.21.55.124	192.168.2.4
Oct 7, 2024 06:44:54.346648932 CEST	443	49730	104.21.55.124	192.168.2.4
Oct 7, 2024 06:44:54.346709013 CEST	49730	443	192.168.2.4	104.21.55.124
Oct 7, 2024 06:44:54.348483086 CEST	49730	443	192.168.2.4	104.21.55.124
Oct 7, 2024 06:44:54.348510027 CEST	443	49730	104.21.55.124	192.168.2.4
Oct 7, 2024 06:44:54.449171066 CEST	49732	443	192.168.2.4	104.102.49.254
Oct 7, 2024 06:44:54.449204922 CEST	443	49732	104.102.49.254	192.168.2.4
Oct 7, 2024 06:44:54.449287891 CEST	49732	443	192.168.2.4	104.102.49.254
Oct 7, 2024 06:44:54.449588060 CEST	49732	443	192.168.2.4	104.102.49.254
Oct 7, 2024 06:44:54.449600935 CEST	443	49732	104.102.49.254	192.168.2.4
Oct 7, 2024 06:44:55.099596024 CEST	443	49732	104.102.49.254	192.168.2.4
Oct 7, 2024 06:44:55.099669933 CEST	49732	443	192.168.2.4	104.102.49.254
Oct 7, 2024 06:44:55.187681913 CEST	49732	443	192.168.2.4	104.102.49.254
Oct 7, 2024 06:44:55.187701941 CEST	443	49732	104.102.49.254	192.168.2.4
Oct 7, 2024 06:44:55.188127995 CEST	443	49732	104.102.49.254	192.168.2.4
Oct 7, 2024 06:44:55.189631939 CEST	49732	443	192.168.2.4	104.102.49.254
Oct 7, 2024 06:44:55.231405973 CEST	443	49732	104.102.49.254	192.168.2.4
Oct 7, 2024 06:44:55.576695919 CEST	443	49732	104.102.49.254	192.168.2.4
Oct 7, 2024 06:44:55.576726913 CEST	443	49732	104.102.49.254	192.168.2.4
Oct 7, 2024 06:44:55.576747894 CEST	443	49732	104.102.49.254	192.168.2.4
Oct 7, 2024 06:44:55.576756001 CEST	49732	443	192.168.2.4	104.102.49.254
Oct 7, 2024 06:44:55.576766968 CEST	443	49732	104.102.49.254	192.168.2.4
Oct 7, 2024 06:44:55.576816082 CEST	49732	443	192.168.2.4	104.102.49.254
Oct 7, 2024 06:44:55.576839924 CEST	49732	443	192.168.2.4	104.102.49.254
Oct 7, 2024 06:44:55.669543982 CEST	443	49732	104.102.49.254	192.168.2.4
Oct 7, 2024 06:44:55.669569969 CEST	443	49732	104.102.49.254	192.168.2.4
Oct 7, 2024 06:44:55.669696093 CEST	49732	443	192.168.2.4	104.102.49.254
Oct 7, 2024 06:44:55.669707060 CEST	443	49732	104.102.49.254	192.168.2.4
Oct 7, 2024 06:44:55.669809103 CEST	49732	443	192.168.2.4	104.102.49.254
Oct 7, 2024 06:44:55.675000906 CEST	443	49732	104.102.49.254	192.168.2.4
Oct 7, 2024 06:44:55.675093889 CEST	49732	443	192.168.2.4	104.102.49.254
Oct 7, 2024 06:44:55.675102949 CEST	443	49732	104.102.49.254	192.168.2.4
Oct 7, 2024 06:44:55.675128937 CEST	443	49732	104.102.49.254	192.168.2.4
Oct 7, 2024 06:44:55.675146103 CEST	49732	443	192.168.2.4	104.102.49.254
Oct 7, 2024 06:44:55.675173044 CEST	49732	443	192.168.2.4	104.102.49.254
Oct 7, 2024 06:44:55.675220013 CEST	49732	443	192.168.2.4	104.102.49.254
Oct 7, 2024 06:44:55.675232887 CEST	443	49732	104.102.49.254	192.168.2.4
Oct 7, 2024 06:44:55.675240993 CEST	49732	443	192.168.2.4	104.102.49.254
Oct 7, 2024 06:44:55.675246000 CEST	443	49732	104.102.49.254	192.168.2.4
Oct 7, 2024 06:44:55.714827061 CEST	49735	443	192.168.2.4	104.21.53.8
Oct 7, 2024 06:44:55.714874983 CEST	443	49735	104.21.53.8	192.168.2.4
Oct 7, 2024 06:44:55.714947939 CEST	49735	443	192.168.2.4	104.21.53.8
Oct 7, 2024 06:44:55.715379000 CEST	49735	443	192.168.2.4	104.21.53.8
Oct 7, 2024 06:44:55.715395927 CEST	443	49735	104.21.53.8	192.168.2.4
Oct 7, 2024 06:44:56.182888031 CEST	443	49735	104.21.53.8	192.168.2.4
Oct 7, 2024 06:44:56.182950020 CEST	49735	443	192.168.2.4	104.21.53.8
Oct 7, 2024 06:44:56.185386896 CEST	49735	443	192.168.2.4	104.21.53.8
Oct 7, 2024 06:44:56.185395002 CEST	443	49735	104.21.53.8	192.168.2.4
Oct 7, 2024 06:44:56.185745001 CEST	443	49735	104.21.53.8	192.168.2.4
Oct 7, 2024 06:44:56.192512035 CEST	49735	443	192.168.2.4	104.21.53.8
Oct 7, 2024 06:44:56.192575932 CEST	49735	443	192.168.2.4	104.21.53.8
Oct 7, 2024 06:44:56.192675114 CEST	443	49735	104.21.53.8	192.168.2.4
Oct 7, 2024 06:44:56.621301889 CEST	443	49735	104.21.53.8	192.168.2.4
Oct 7, 2024 06:44:56.621404886 CEST	443	49735	104.21.53.8	192.168.2.4
Oct 7, 2024 06:44:56.623205900 CEST	49735	443	192.168.2.4	104.21.53.8
Oct 7, 2024 06:44:56.632601976 CEST	49735	443	192.168.2.4	104.21.53.8
Oct 7, 2024 06:44:56.632626057 CEST	443	49735	104.21.53.8	192.168.2.4
Oct 7, 2024 06:44:56.632654905 CEST	49735	443	192.168.2.4	104.21.53.8
Oct 7, 2024 06:44:56.632661104 CEST	443	49735	104.21.53.8	192.168.2.4
Oct 7, 2024 06:44:57.287966013 CEST	49675	443	192.168.2.4	173.222.162.32
Oct 7, 2024 06:45:52.318032026 CEST	49746	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:52.318074942 CEST	443	49746	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:52.318150997 CEST	49746	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:52.318437099 CEST	49746	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:52.318454027 CEST	443	49746	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:52.999723911 CEST	443	49746	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:52.999813080 CEST	49746	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:53.001971006 CEST	49746	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:53.001979113 CEST	443	49746	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:53.002232075 CEST	443	49746	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:53.012521982 CEST	49746	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:53.059411049 CEST	443	49746	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:53.115525007 CEST	443	49746	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:53.115546942 CEST	443	49746	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:53.115562916 CEST	443	49746	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:53.115725040 CEST	49746	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:53.115739107 CEST	443	49746	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:53.115796089 CEST	49746	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:53.206794977 CEST	443	49746	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:53.206830025 CEST	443	49746	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:53.206856012 CEST	49746	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:53.206878901 CEST	443	49746	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:53.206892967 CEST	49746	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:53.206913948 CEST	49746	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:53.208250046 CEST	443	49746	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:53.208266020 CEST	443	49746	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:53.208307028 CEST	49746	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:53.208314896 CEST	443	49746	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:53.208352089 CEST	49746	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:53.298595905 CEST	443	49746	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:53.298612118 CEST	443	49746	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:53.298706055 CEST	49746	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:53.298724890 CEST	443	49746	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:53.298763990 CEST	49746	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:53.299506903 CEST	443	49746	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:53.299521923 CEST	443	49746	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:53.299576044 CEST	49746	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:53.299585104 CEST	443	49746	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:53.299618006 CEST	49746	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:53.300252914 CEST	443	49746	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:53.300266981 CEST	443	49746	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:53.300307989 CEST	49746	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:53.300316095 CEST	443	49746	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:53.300348043 CEST	49746	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:53.301187992 CEST	443	49746	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:53.301202059 CEST	443	49746	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:53.301265001 CEST	49746	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:53.301271915 CEST	443	49746	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:53.301309109 CEST	49746	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:53.391457081 CEST	443	49746	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:53.391473055 CEST	443	49746	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:53.391551018 CEST	49746	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:53.391558886 CEST	443	49746	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:53.391593933 CEST	49746	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:53.391881943 CEST	443	49746	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:53.391896963 CEST	443	49746	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:53.391944885 CEST	49746	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:53.391952991 CEST	443	49746	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:53.391987085 CEST	49746	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:53.392292023 CEST	443	49746	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:53.392306089 CEST	443	49746	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:53.392359018 CEST	49746	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:53.392366886 CEST	443	49746	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:53.392405033 CEST	49746	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:53.392679930 CEST	443	49746	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:53.392694950 CEST	443	49746	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:53.392745018 CEST	49746	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:53.392752886 CEST	443	49746	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:53.392788887 CEST	49746	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:53.393156052 CEST	443	49746	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:53.393171072 CEST	443	49746	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:53.393219948 CEST	49746	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:53.393228054 CEST	443	49746	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:53.393260002 CEST	49746	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:53.393520117 CEST	443	49746	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:53.393533945 CEST	443	49746	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:53.393601894 CEST	49746	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:53.393609047 CEST	443	49746	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:53.393651962 CEST	49746	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:53.393657923 CEST	443	49746	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:53.393667936 CEST	443	49746	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:53.393702984 CEST	49746	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:53.393708944 CEST	443	49746	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:53.393724918 CEST	443	49746	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:53.393743038 CEST	49746	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:53.393774033 CEST	49746	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:53.393867016 CEST	49746	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:53.393884897 CEST	443	49746	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:53.393897057 CEST	49746	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:53.393903971 CEST	443	49746	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:53.449867010 CEST	49747	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:53.449925900 CEST	443	49747	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:53.449994087 CEST	49747	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:53.450083971 CEST	49748	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:53.450115919 CEST	443	49748	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:53.450155973 CEST	49748	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:53.450578928 CEST	49749	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:53.450615883 CEST	443	49749	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:53.450674057 CEST	49749	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:53.450789928 CEST	49747	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:53.450803995 CEST	443	49747	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:53.450920105 CEST	49749	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:53.450933933 CEST	443	49749	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:53.451020002 CEST	49748	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:53.451030970 CEST	443	49748	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:53.451126099 CEST	49750	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:53.451133966 CEST	443	49750	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:53.451188087 CEST	49750	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:53.451339960 CEST	49750	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:53.451353073 CEST	443	49750	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:53.451824903 CEST	49751	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:53.451833963 CEST	443	49751	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:53.451900005 CEST	49751	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:53.451994896 CEST	49751	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:53.452003002 CEST	443	49751	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:54.097781897 CEST	443	49748	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:54.098170042 CEST	443	49750	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:54.098418951 CEST	49748	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:54.098449945 CEST	443	49748	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:54.098896980 CEST	49748	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:54.098903894 CEST	443	49748	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:54.099121094 CEST	49750	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:54.099143982 CEST	443	49750	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:54.099481106 CEST	49750	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:54.099487066 CEST	443	49750	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:54.099539995 CEST	443	49749	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:54.099756956 CEST	49749	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:54.099764109 CEST	443	49749	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:54.100092888 CEST	49749	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:54.100095987 CEST	443	49749	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:54.112704039 CEST	443	49747	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:54.112948895 CEST	49747	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:54.112978935 CEST	443	49747	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:54.113290071 CEST	49747	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:54.113302946 CEST	443	49747	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:54.118479013 CEST	443	49751	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:54.118719101 CEST	49751	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:54.118746996 CEST	443	49751	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:54.119045019 CEST	49751	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:54.119051933 CEST	443	49751	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:54.195471048 CEST	443	49750	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:54.195559025 CEST	443	49750	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:54.195655107 CEST	49750	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:54.195683002 CEST	443	49750	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:54.195738077 CEST	443	49750	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:54.195785999 CEST	49750	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:54.197962999 CEST	49750	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:54.197983027 CEST	443	49750	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:54.198014021 CEST	49750	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:54.198019028 CEST	443	49750	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:54.200424910 CEST	443	49748	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:54.200720072 CEST	443	49748	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:54.200787067 CEST	49748	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:54.200913906 CEST	443	49749	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:54.200939894 CEST	443	49749	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:54.200990915 CEST	49749	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:54.201005936 CEST	443	49749	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:54.201018095 CEST	443	49749	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:54.201037884 CEST	49749	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:54.201065063 CEST	49749	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:54.207076073 CEST	49749	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:54.207096100 CEST	443	49749	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:54.207108021 CEST	49749	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:54.207113028 CEST	443	49749	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:54.213232040 CEST	49748	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:54.213249922 CEST	443	49748	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:54.220014095 CEST	443	49751	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:54.220168114 CEST	443	49751	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:54.220227003 CEST	49751	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:54.222584009 CEST	49751	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:54.222589970 CEST	443	49751	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:54.222620010 CEST	49751	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:54.222626925 CEST	443	49751	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:54.239814997 CEST	443	49747	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:54.239834070 CEST	443	49747	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:54.239945889 CEST	443	49747	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:54.239952087 CEST	49747	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:54.240009069 CEST	49747	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:54.259759903 CEST	49747	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:54.259788036 CEST	443	49747	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:54.259856939 CEST	49747	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:54.259872913 CEST	443	49747	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:54.297301054 CEST	49752	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:54.297348976 CEST	443	49752	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:54.297449112 CEST	49752	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:54.320514917 CEST	49753	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:54.320534945 CEST	443	49753	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:54.320605993 CEST	49753	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:54.321924925 CEST	49754	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:54.321930885 CEST	443	49754	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:54.321996927 CEST	49754	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:54.322541952 CEST	49755	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:54.322578907 CEST	443	49755	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:54.322657108 CEST	49755	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:54.322803974 CEST	49752	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:54.322824955 CEST	443	49752	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:54.322902918 CEST	49755	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:54.322916985 CEST	443	49755	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:54.323004961 CEST	49753	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:54.323015928 CEST	443	49753	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:54.323606968 CEST	49756	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:54.323689938 CEST	49754	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:54.323700905 CEST	443	49754	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:54.323707104 CEST	443	49756	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:54.323771954 CEST	49756	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:54.323844910 CEST	49756	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:54.323868990 CEST	443	49756	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:54.980781078 CEST	443	49753	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:54.981405973 CEST	443	49756	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:54.981467009 CEST	49753	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:54.981487036 CEST	443	49753	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:54.981714010 CEST	49756	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:54.981772900 CEST	443	49756	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:54.982167006 CEST	49756	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:54.982180119 CEST	443	49756	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:54.982917070 CEST	49753	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:54.982923985 CEST	443	49753	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:54.987651110 CEST	443	49752	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:54.988023996 CEST	49752	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:54.988101006 CEST	443	49752	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:54.989132881 CEST	49752	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:54.989147902 CEST	443	49752	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:54.992069006 CEST	443	49755	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:54.992400885 CEST	49755	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:54.992439032 CEST	443	49755	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:54.993482113 CEST	49755	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:54.993494034 CEST	443	49755	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:55.078955889 CEST	443	49753	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:55.079004049 CEST	443	49753	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:55.079190969 CEST	49753	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:55.079406023 CEST	49753	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:55.079421043 CEST	443	49753	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:55.079458952 CEST	49753	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:55.079466105 CEST	443	49753	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:55.084019899 CEST	49757	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:55.084059000 CEST	443	49757	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:55.084125996 CEST	49757	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:55.084302902 CEST	49757	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:55.084316015 CEST	443	49757	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:55.086894035 CEST	443	49756	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:55.087025881 CEST	443	49756	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:55.087084055 CEST	49756	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:55.087333918 CEST	49756	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:55.087362051 CEST	443	49756	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:55.087418079 CEST	49756	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:55.087433100 CEST	443	49756	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:55.091108084 CEST	443	49752	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:55.091169119 CEST	443	49752	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:55.091259956 CEST	49752	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:55.091437101 CEST	49752	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:55.091478109 CEST	443	49752	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:55.091485977 CEST	49758	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:55.091506004 CEST	49752	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:55.091510057 CEST	443	49758	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:55.091521978 CEST	443	49752	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:55.091553926 CEST	49758	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:55.091813087 CEST	49758	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:55.091821909 CEST	443	49758	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:55.094170094 CEST	443	49755	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:55.094317913 CEST	443	49755	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:55.094379902 CEST	49755	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:55.094407082 CEST	49755	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:55.094413996 CEST	443	49755	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:55.094425917 CEST	49755	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:55.094429970 CEST	443	49755	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:55.095289946 CEST	49759	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:55.095347881 CEST	443	49759	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:55.095418930 CEST	49759	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:55.095515966 CEST	49759	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:55.095531940 CEST	443	49759	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:55.097908974 CEST	49760	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:55.097929955 CEST	443	49760	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:55.098007917 CEST	49760	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:55.098119974 CEST	49760	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:55.098140001 CEST	443	49760	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:55.719023943 CEST	443	49757	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:55.719616890 CEST	49757	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:55.719639063 CEST	443	49757	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:55.720082998 CEST	49757	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:55.720088005 CEST	443	49757	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:55.739700079 CEST	443	49758	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:55.740201950 CEST	49758	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:55.740215063 CEST	443	49758	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:55.740703106 CEST	49758	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:55.740706921 CEST	443	49758	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:55.748774052 CEST	443	49760	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:55.749207973 CEST	49760	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:55.749243021 CEST	443	49760	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:55.749686956 CEST	49760	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:55.749699116 CEST	443	49760	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:55.762352943 CEST	443	49759	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:55.762795925 CEST	49759	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:55.762842894 CEST	443	49759	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:55.763636112 CEST	49759	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:55.763657093 CEST	443	49759	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:55.777023077 CEST	443	49754	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:55.777924061 CEST	49754	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:55.777935982 CEST	443	49754	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:55.778522015 CEST	49754	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:55.778527975 CEST	443	49754	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:55.819008112 CEST	443	49757	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:55.819128990 CEST	443	49757	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:55.819180012 CEST	49757	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:55.819329977 CEST	49757	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:55.819344044 CEST	443	49757	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:55.819353104 CEST	49757	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:55.819358110 CEST	443	49757	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:55.822268009 CEST	49761	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:55.822288990 CEST	443	49761	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:55.822346926 CEST	49761	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:55.822479963 CEST	49761	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:55.822488070 CEST	443	49761	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:55.849823952 CEST	443	49758	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:55.849877119 CEST	443	49758	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:55.849940062 CEST	49758	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:55.850176096 CEST	49758	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:55.850183964 CEST	443	49758	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:55.850193977 CEST	49758	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:55.850198984 CEST	443	49758	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:55.855884075 CEST	49762	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:55.855895996 CEST	443	49762	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:55.855967999 CEST	49762	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:55.856116056 CEST	49762	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:55.856122971 CEST	443	49762	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:55.882987976 CEST	443	49760	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:55.883147001 CEST	443	49760	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:55.883222103 CEST	49760	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:55.883450031 CEST	49760	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:55.883450031 CEST	49760	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:55.883479118 CEST	443	49760	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:55.883496046 CEST	443	49760	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:55.885780096 CEST	49763	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:55.885823965 CEST	443	49763	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:55.885886908 CEST	49763	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:55.886018991 CEST	49763	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:55.886035919 CEST	443	49763	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:55.888237953 CEST	443	49759	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:55.888379097 CEST	443	49759	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:55.888444901 CEST	49759	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:55.889899969 CEST	443	49754	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:55.889960051 CEST	443	49754	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:55.890010118 CEST	49754	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:55.895251036 CEST	49759	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:55.895283937 CEST	443	49759	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:55.895299911 CEST	49759	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:55.895308971 CEST	443	49759	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:55.895409107 CEST	49754	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:55.895427942 CEST	443	49754	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:55.895447016 CEST	49754	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:55.895453930 CEST	443	49754	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:55.898346901 CEST	49764	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:55.898391008 CEST	443	49764	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:55.898407936 CEST	49765	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:55.898427963 CEST	443	49765	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:55.898456097 CEST	49764	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:55.898478031 CEST	49765	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:55.898675919 CEST	49765	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:55.898690939 CEST	443	49765	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:55.898860931 CEST	49764	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:55.898878098 CEST	443	49764	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:56.469089031 CEST	443	49761	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:56.469708920 CEST	49761	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:56.469733953 CEST	443	49761	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:56.470362902 CEST	49761	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:56.470372915 CEST	443	49761	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:56.490191936 CEST	443	49762	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:56.490551949 CEST	49762	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:56.490565062 CEST	443	49762	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:56.491084099 CEST	49762	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:56.491087914 CEST	443	49762	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:56.524775982 CEST	443	49763	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:56.525177002 CEST	49763	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:56.525209904 CEST	443	49763	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:56.525715113 CEST	49763	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:56.525724888 CEST	443	49763	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:56.539092064 CEST	443	49765	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:56.539638996 CEST	49765	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:56.539665937 CEST	443	49765	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:56.540023088 CEST	49765	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:56.540029049 CEST	443	49765	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:56.558671951 CEST	443	49764	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:56.562577009 CEST	49764	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:56.562642097 CEST	443	49764	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:56.563118935 CEST	49764	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:56.563129902 CEST	443	49764	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:56.570137024 CEST	443	49761	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:56.570219040 CEST	443	49761	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:56.570288897 CEST	49761	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:56.570487976 CEST	49761	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:56.570508003 CEST	443	49761	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:56.570519924 CEST	49761	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:56.570524931 CEST	443	49761	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:56.580833912 CEST	49766	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:56.580869913 CEST	443	49766	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:56.580940008 CEST	49766	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:56.581075907 CEST	49766	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:56.581091881 CEST	443	49766	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:56.588646889 CEST	443	49762	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:56.588710070 CEST	443	49762	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:56.588968039 CEST	49762	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:56.588968992 CEST	49762	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:56.588968992 CEST	49762	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:56.591769934 CEST	49767	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:56.591829062 CEST	443	49767	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:56.591907024 CEST	49767	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:56.592067003 CEST	49767	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:56.592087030 CEST	443	49767	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:56.623016119 CEST	443	49763	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:56.623195887 CEST	443	49763	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:56.623251915 CEST	49763	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:56.623295069 CEST	49763	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:56.623295069 CEST	49763	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:56.623317003 CEST	443	49763	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:56.623332977 CEST	443	49763	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:56.625818968 CEST	49768	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:56.625847101 CEST	443	49768	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:56.625926018 CEST	49768	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:56.626058102 CEST	49768	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:56.626070023 CEST	443	49768	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:56.642448902 CEST	443	49765	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:56.642496109 CEST	443	49765	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:56.642781973 CEST	49765	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:56.642781973 CEST	49765	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:56.642781973 CEST	49765	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:56.645663023 CEST	49769	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:56.645689964 CEST	443	49769	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:56.645765066 CEST	49769	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:56.645900965 CEST	49769	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:56.645915031 CEST	443	49769	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:56.662764072 CEST	443	49764	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:56.662930012 CEST	443	49764	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:56.663153887 CEST	49764	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:56.663499117 CEST	49764	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:56.663530111 CEST	443	49764	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:56.663547993 CEST	49764	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:56.663554907 CEST	443	49764	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:56.666820049 CEST	49770	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:56.666861057 CEST	443	49770	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:56.666939020 CEST	49770	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:56.667084932 CEST	49770	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:56.667121887 CEST	443	49770	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:56.897744894 CEST	49762	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:56.897762060 CEST	443	49762	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:56.960253954 CEST	49765	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:56.960283995 CEST	443	49765	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:57.234462976 CEST	443	49767	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:57.237582922 CEST	443	49770	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:57.249548912 CEST	443	49766	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:57.264702082 CEST	49767	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:57.264749050 CEST	443	49767	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:57.265269041 CEST	49767	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:57.265280008 CEST	443	49767	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:57.265830994 CEST	49770	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:57.265850067 CEST	443	49770	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:57.266324997 CEST	49770	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:57.266330957 CEST	443	49770	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:57.266665936 CEST	49766	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:57.266699076 CEST	443	49766	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:57.267164946 CEST	49766	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:57.267172098 CEST	443	49766	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:57.285377979 CEST	443	49769	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:57.293200970 CEST	49769	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:57.293232918 CEST	443	49769	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:57.293777943 CEST	49769	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:57.293787003 CEST	443	49769	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:57.327675104 CEST	443	49768	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:57.329972029 CEST	49768	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:57.329988003 CEST	443	49768	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:57.330554008 CEST	49768	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:57.330559969 CEST	443	49768	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:57.360424995 CEST	443	49767	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:57.360481024 CEST	443	49767	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:57.360577106 CEST	49767	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:57.360881090 CEST	49767	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:57.360881090 CEST	49767	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:57.360899925 CEST	443	49767	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:57.360910892 CEST	443	49767	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:57.362049103 CEST	443	49770	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:57.362134933 CEST	443	49770	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:57.362179041 CEST	49770	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:57.362557888 CEST	49770	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:57.362567902 CEST	443	49770	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:57.362581968 CEST	49770	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:57.362587929 CEST	443	49770	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:57.367217064 CEST	49771	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:57.367250919 CEST	443	49771	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:57.367347002 CEST	49771	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:57.368133068 CEST	49772	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:57.368227959 CEST	443	49772	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:57.368294001 CEST	49772	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:57.368360043 CEST	49771	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:57.368372917 CEST	443	49771	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:57.368494034 CEST	49772	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:57.368527889 CEST	443	49772	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:57.372239113 CEST	443	49766	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:57.372325897 CEST	443	49766	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:57.372510910 CEST	49766	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:57.372562885 CEST	49766	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:57.372586966 CEST	443	49766	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:57.372601986 CEST	49766	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:57.372608900 CEST	443	49766	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:57.375871897 CEST	49773	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:57.375920057 CEST	443	49773	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:57.375992060 CEST	49773	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:57.376144886 CEST	49773	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:57.376158953 CEST	443	49773	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:57.388710022 CEST	443	49769	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:57.388830900 CEST	443	49769	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:57.388902903 CEST	49769	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:57.390054941 CEST	49769	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:57.390054941 CEST	49769	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:57.390069008 CEST	443	49769	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:57.390079975 CEST	443	49769	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:57.395185947 CEST	49774	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:57.395240068 CEST	443	49774	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:57.395308971 CEST	49774	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:57.402100086 CEST	49774	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:57.402133942 CEST	443	49774	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:57.432558060 CEST	443	49768	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:57.432637930 CEST	443	49768	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:57.432791948 CEST	49768	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:57.433041096 CEST	49768	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:57.433049917 CEST	443	49768	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:57.433059931 CEST	49768	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:57.433064938 CEST	443	49768	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:57.446002960 CEST	49775	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:57.446091890 CEST	443	49775	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:57.446172953 CEST	49775	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:57.446696997 CEST	49775	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:57.446727991 CEST	443	49775	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:58.002098083 CEST	443	49771	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:58.002715111 CEST	49771	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:58.002741098 CEST	443	49771	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:58.003315926 CEST	49771	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:58.003323078 CEST	443	49771	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:58.016187906 CEST	443	49772	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:58.016582012 CEST	49772	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:58.016613960 CEST	443	49772	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:58.017040968 CEST	49772	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:58.017051935 CEST	443	49772	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:58.026873112 CEST	443	49773	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:58.027283907 CEST	49773	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:58.027317047 CEST	443	49773	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:58.027757883 CEST	49773	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:58.027772903 CEST	443	49773	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:58.080044985 CEST	443	49774	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:58.080902100 CEST	49774	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:58.080928087 CEST	443	49774	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:58.081408978 CEST	49774	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:58.081419945 CEST	443	49774	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:58.082597017 CEST	443	49775	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:58.083009005 CEST	49775	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:58.083085060 CEST	443	49775	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:58.083431005 CEST	49775	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:58.083444118 CEST	443	49775	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:58.116272926 CEST	443	49771	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:58.116328955 CEST	443	49771	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:58.116384029 CEST	49771	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:58.116648912 CEST	49771	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:58.116662979 CEST	443	49771	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:58.116677999 CEST	49771	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:58.116683960 CEST	443	49771	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:58.119543076 CEST	49776	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:58.119581938 CEST	443	49776	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:58.119659901 CEST	49776	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:58.119955063 CEST	49776	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:58.119966030 CEST	443	49776	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:58.147547007 CEST	443	49772	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:58.147823095 CEST	443	49772	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:58.147886992 CEST	49772	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:58.147958040 CEST	49772	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:58.147958040 CEST	49772	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:58.147989988 CEST	443	49772	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:58.148010969 CEST	443	49772	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:58.150531054 CEST	49777	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:58.150558949 CEST	443	49777	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:58.150660038 CEST	49777	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:58.150796890 CEST	49777	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:58.150815010 CEST	443	49777	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:58.183381081 CEST	443	49775	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:58.183532953 CEST	443	49775	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:58.183593988 CEST	49775	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:58.183655977 CEST	49775	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:58.183665991 CEST	443	49775	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:58.183708906 CEST	49775	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:58.183716059 CEST	443	49775	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:58.185352087 CEST	443	49774	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:58.185516119 CEST	443	49774	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:58.185597897 CEST	49774	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:58.185641050 CEST	49774	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:58.185677052 CEST	443	49774	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:58.185705900 CEST	49774	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:58.185722113 CEST	443	49774	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:58.186319113 CEST	49778	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:58.186330080 CEST	443	49778	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:58.186393023 CEST	49778	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:58.186538935 CEST	49778	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:58.186556101 CEST	443	49778	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:58.187890053 CEST	49779	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:58.187906027 CEST	443	49779	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:58.188004017 CEST	49779	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:58.188146114 CEST	49779	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:58.188160896 CEST	443	49779	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:58.313832045 CEST	443	49773	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:58.313925028 CEST	443	49773	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:58.313988924 CEST	49773	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:58.314161062 CEST	49773	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:58.314178944 CEST	443	49773	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:58.314192057 CEST	49773	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:58.314198971 CEST	443	49773	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:58.317430973 CEST	49780	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:58.317466974 CEST	443	49780	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:58.317594051 CEST	49780	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:58.317761898 CEST	49780	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:58.317775965 CEST	443	49780	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:58.750439882 CEST	443	49776	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:58.751012087 CEST	49776	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:58.751028061 CEST	443	49776	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:58.751506090 CEST	49776	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:58.751511097 CEST	443	49776	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:58.789877892 CEST	443	49777	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:58.790365934 CEST	49777	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:58.790406942 CEST	443	49777	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:58.790833950 CEST	49777	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:58.790847063 CEST	443	49777	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:58.827828884 CEST	443	49779	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:58.828457117 CEST	49779	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:58.828474998 CEST	443	49779	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:58.828917980 CEST	49779	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:58.828922987 CEST	443	49779	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:58.849603891 CEST	443	49776	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:58.849664927 CEST	443	49776	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:58.849744081 CEST	49776	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:58.849976063 CEST	49776	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:58.849987984 CEST	443	49776	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:58.849999905 CEST	49776	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:58.850004911 CEST	443	49776	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:58.852835894 CEST	49781	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:58.852942944 CEST	443	49781	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:58.853029013 CEST	49781	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:58.853204966 CEST	49781	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:58.853240013 CEST	443	49781	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:58.855055094 CEST	443	49778	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:58.855410099 CEST	49778	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:58.855420113 CEST	443	49778	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:58.856024981 CEST	49778	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:58.856029987 CEST	443	49778	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:58.887651920 CEST	443	49777	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:58.887793064 CEST	443	49777	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:58.887861013 CEST	49777	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:58.887933016 CEST	49777	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:58.887949944 CEST	443	49777	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:58.887989998 CEST	49777	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:58.887998104 CEST	443	49777	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:58.890686989 CEST	49782	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:58.890739918 CEST	443	49782	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:58.890813112 CEST	49782	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:58.890980959 CEST	49782	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:58.891006947 CEST	443	49782	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:58.925427914 CEST	443	49779	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:58.925576925 CEST	443	49779	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:58.925649881 CEST	49779	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:58.925668955 CEST	49779	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:58.925688028 CEST	443	49779	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:58.925698996 CEST	49779	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:58.925703049 CEST	443	49779	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:58.928004026 CEST	49783	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:58.928045034 CEST	443	49783	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:58.928124905 CEST	49783	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:58.928282022 CEST	49783	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:58.928293943 CEST	443	49783	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:58.950870991 CEST	443	49780	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:58.951312065 CEST	49780	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:58.951328039 CEST	443	49780	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:58.951915979 CEST	49780	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:58.951929092 CEST	443	49780	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:58.957366943 CEST	443	49778	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:58.957521915 CEST	443	49778	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:58.957592964 CEST	49778	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:58.957633018 CEST	49778	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:58.957638979 CEST	443	49778	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:58.957650900 CEST	49778	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:58.957655907 CEST	443	49778	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:58.960139990 CEST	49784	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:58.960196972 CEST	443	49784	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:58.960280895 CEST	49784	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:58.960474968 CEST	49784	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:58.960494041 CEST	443	49784	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:59.049632072 CEST	443	49780	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:59.049712896 CEST	443	49780	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:59.049774885 CEST	49780	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:59.050056934 CEST	49780	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:59.050066948 CEST	443	49780	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:59.050098896 CEST	49780	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:59.050103903 CEST	443	49780	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:59.052663088 CEST	49785	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:59.052756071 CEST	443	49785	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:59.052836895 CEST	49785	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:59.052999020 CEST	49785	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:59.053020000 CEST	443	49785	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:59.425426960 CEST	443	49781	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:59.425909042 CEST	49781	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:59.426003933 CEST	443	49781	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:59.426326990 CEST	49781	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:59.426342010 CEST	443	49781	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:59.529050112 CEST	443	49781	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:59.529105902 CEST	443	49781	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:59.529190063 CEST	49781	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:59.529314995 CEST	49781	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:59.529366970 CEST	443	49781	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:59.529396057 CEST	49781	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:59.529411077 CEST	443	49781	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:59.532584906 CEST	49786	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:59.532691002 CEST	443	49786	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:59.532774925 CEST	49786	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:59.532928944 CEST	49786	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:59.532959938 CEST	443	49786	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:59.534699917 CEST	443	49782	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:59.535120010 CEST	49782	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:59.535140038 CEST	443	49782	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:59.535520077 CEST	49782	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:59.535530090 CEST	443	49782	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:59.591027975 CEST	443	49783	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:59.591758966 CEST	49783	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:59.591769934 CEST	443	49783	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:59.592350960 CEST	49783	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:59.592355967 CEST	443	49783	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:59.598834991 CEST	443	49784	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:59.599155903 CEST	49784	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:59.599169016 CEST	443	49784	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:59.599544048 CEST	49784	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:59.599548101 CEST	443	49784	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:59.632275105 CEST	443	49782	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:59.632344961 CEST	443	49782	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:59.632400990 CEST	49782	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:59.634021044 CEST	49782	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:59.634057045 CEST	443	49782	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:59.634084940 CEST	49782	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:59.634098053 CEST	443	49782	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:59.642034054 CEST	49787	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:59.642070055 CEST	443	49787	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:59.642137051 CEST	49787	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:59.642451048 CEST	49787	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:59.642462969 CEST	443	49787	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:59.694169044 CEST	443	49783	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:59.694241047 CEST	443	49783	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:59.694319963 CEST	49783	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:59.694550037 CEST	49783	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:59.694566965 CEST	49783	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:59.694577932 CEST	443	49783	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:59.694593906 CEST	443	49783	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:59.697223902 CEST	49788	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:59.697276115 CEST	443	49788	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:59.697280884 CEST	443	49784	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:59.697365999 CEST	49788	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:59.697428942 CEST	443	49784	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:59.697489977 CEST	49784	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:59.697506905 CEST	49788	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:59.697524071 CEST	443	49788	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:59.697654963 CEST	49784	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:59.697668076 CEST	443	49784	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:59.697700024 CEST	49784	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:59.697705030 CEST	443	49784	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:59.699528933 CEST	49789	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:59.699556112 CEST	443	49789	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:59.699625015 CEST	49789	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:59.699726105 CEST	49789	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:59.699738979 CEST	443	49789	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:59.714574099 CEST	443	49785	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:59.715269089 CEST	49785	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:59.715347052 CEST	443	49785	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:59.715687037 CEST	49785	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:59.715701103 CEST	443	49785	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:59.818537951 CEST	443	49785	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:59.818595886 CEST	443	49785	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:59.818762064 CEST	49785	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:59.818933964 CEST	49785	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:59.818963051 CEST	443	49785	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:59.818989992 CEST	49785	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:59.819003105 CEST	443	49785	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:59.911871910 CEST	49790	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:59.911902905 CEST	443	49790	13.107.246.64	192.168.2.4
Oct 7, 2024 06:45:59.912029028 CEST	49790	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:59.912148952 CEST	49790	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:45:59.912162066 CEST	443	49790	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:00.193317890 CEST	443	49786	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:00.194236040 CEST	49786	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:00.194298983 CEST	443	49786	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:00.194621086 CEST	49786	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:00.194634914 CEST	443	49786	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:00.280781031 CEST	443	49787	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:00.284086943 CEST	49787	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:00.284105062 CEST	443	49787	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:00.286062002 CEST	49787	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:00.286068916 CEST	443	49787	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:00.296220064 CEST	443	49786	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:00.296272993 CEST	443	49786	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:00.296370029 CEST	49786	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:00.300707102 CEST	49786	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:00.300707102 CEST	49786	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:00.300753117 CEST	443	49786	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:00.300781965 CEST	443	49786	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:00.303373098 CEST	49791	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:00.303430080 CEST	443	49791	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:00.303519011 CEST	49791	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:00.303666115 CEST	49791	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:00.303683043 CEST	443	49791	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:00.330965996 CEST	443	49788	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:00.336543083 CEST	49788	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:00.336565018 CEST	443	49788	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:00.336966038 CEST	49788	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:00.336972952 CEST	443	49788	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:00.365717888 CEST	443	49789	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:00.366157055 CEST	49789	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:00.366166115 CEST	443	49789	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:00.366880894 CEST	49789	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:00.366884947 CEST	443	49789	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:00.381560087 CEST	443	49787	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:00.381711006 CEST	443	49787	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:00.381777048 CEST	49787	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:00.381803989 CEST	49787	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:00.381819963 CEST	443	49787	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:00.381830931 CEST	49787	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:00.381836891 CEST	443	49787	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:00.386393070 CEST	49792	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:00.386511087 CEST	443	49792	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:00.386703968 CEST	49792	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:00.386771917 CEST	49792	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:00.386791945 CEST	443	49792	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:00.431754112 CEST	443	49788	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:00.431896925 CEST	443	49788	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:00.431957960 CEST	49788	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:00.432086945 CEST	49788	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:00.432106018 CEST	443	49788	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:00.432117939 CEST	49788	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:00.432125092 CEST	443	49788	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:00.435094118 CEST	49793	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:00.435122967 CEST	443	49793	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:00.435223103 CEST	49793	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:00.435388088 CEST	49793	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:00.435395956 CEST	443	49793	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:00.467896938 CEST	443	49789	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:00.468031883 CEST	443	49789	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:00.468112946 CEST	49789	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:00.468322992 CEST	49789	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:00.468336105 CEST	443	49789	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:00.468348026 CEST	49789	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:00.468353987 CEST	443	49789	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:00.471451998 CEST	49794	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:00.471461058 CEST	443	49794	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:00.471543074 CEST	49794	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:00.471759081 CEST	49794	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:00.471767902 CEST	443	49794	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:00.573048115 CEST	443	49790	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:00.573571920 CEST	49790	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:00.573596001 CEST	443	49790	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:00.574275970 CEST	49790	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:00.574282885 CEST	443	49790	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:00.675827980 CEST	443	49790	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:00.675915003 CEST	443	49790	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:00.675976038 CEST	49790	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:00.676213980 CEST	49790	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:00.676230907 CEST	443	49790	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:00.676244020 CEST	49790	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:00.676250935 CEST	443	49790	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:00.679439068 CEST	49795	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:00.679491043 CEST	443	49795	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:00.679594040 CEST	49795	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:00.679831028 CEST	49795	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:00.679861069 CEST	443	49795	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:00.947791100 CEST	443	49791	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:00.948349953 CEST	49791	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:00.948360920 CEST	443	49791	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:00.948807001 CEST	49791	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:00.948813915 CEST	443	49791	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:01.025779963 CEST	443	49792	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:01.026496887 CEST	49792	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:01.026557922 CEST	443	49792	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:01.026807070 CEST	49792	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:01.026820898 CEST	443	49792	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:01.050275087 CEST	443	49791	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:01.050359011 CEST	443	49791	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:01.050519943 CEST	49791	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:01.050822020 CEST	49791	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:01.050837994 CEST	443	49791	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:01.050875902 CEST	49791	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:01.050880909 CEST	443	49791	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:01.053924084 CEST	49796	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:01.053997993 CEST	443	49796	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:01.054091930 CEST	49796	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:01.054215908 CEST	49796	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:01.054231882 CEST	443	49796	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:01.075974941 CEST	443	49793	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:01.076803923 CEST	49793	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:01.076844931 CEST	443	49793	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:01.077301979 CEST	49793	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:01.077311993 CEST	443	49793	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:01.111217022 CEST	443	49794	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:01.111742020 CEST	49794	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:01.111753941 CEST	443	49794	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:01.112395048 CEST	49794	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:01.112401009 CEST	443	49794	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:01.123728037 CEST	443	49792	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:01.123853922 CEST	443	49792	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:01.124032974 CEST	49792	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:01.124032974 CEST	49792	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:01.124032974 CEST	49792	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:01.126707077 CEST	49797	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:01.126737118 CEST	443	49797	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:01.126838923 CEST	49797	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:01.127058029 CEST	49797	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:01.127069950 CEST	443	49797	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:01.174396038 CEST	443	49793	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:01.174561024 CEST	443	49793	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:01.174633980 CEST	49793	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:01.174909115 CEST	49793	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:01.174909115 CEST	49793	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:01.174923897 CEST	443	49793	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:01.174943924 CEST	443	49793	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:01.178118944 CEST	49798	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:01.178143978 CEST	443	49798	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:01.178237915 CEST	49798	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:01.178476095 CEST	49798	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:01.178486109 CEST	443	49798	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:01.211508036 CEST	443	49794	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:01.211652994 CEST	443	49794	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:01.211721897 CEST	49794	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:01.211816072 CEST	49794	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:01.211822987 CEST	443	49794	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:01.211837053 CEST	49794	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:01.211843014 CEST	443	49794	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:01.214241028 CEST	49799	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:01.214338064 CEST	443	49799	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:01.214456081 CEST	49799	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:01.214612007 CEST	49799	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:01.214649916 CEST	443	49799	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:01.336007118 CEST	443	49795	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:01.336570978 CEST	49795	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:01.336621046 CEST	443	49795	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:01.336869001 CEST	49795	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:01.336884022 CEST	443	49795	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:01.429156065 CEST	49792	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:01.429207087 CEST	443	49792	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:01.434205055 CEST	443	49795	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:01.434273958 CEST	443	49795	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:01.434326887 CEST	49795	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:01.434534073 CEST	49795	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:01.434549093 CEST	443	49795	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:01.434576035 CEST	49795	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:01.434590101 CEST	443	49795	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:01.437150002 CEST	49800	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:01.437190056 CEST	443	49800	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:01.437304020 CEST	49800	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:01.437427044 CEST	49800	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:01.437441111 CEST	443	49800	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:01.701533079 CEST	443	49796	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:01.702111959 CEST	49796	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:01.702136040 CEST	443	49796	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:01.702553034 CEST	49796	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:01.702559948 CEST	443	49796	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:01.731956959 CEST	443	49798	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:01.732510090 CEST	49798	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:01.732522964 CEST	443	49798	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:01.732878923 CEST	49798	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:01.732883930 CEST	443	49798	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:01.805599928 CEST	443	49796	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:01.805684090 CEST	443	49796	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:01.805809021 CEST	49796	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:01.806046963 CEST	49796	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:01.806058884 CEST	443	49796	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:01.806071997 CEST	49796	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:01.806077957 CEST	443	49796	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:01.808794975 CEST	49801	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:01.808824062 CEST	443	49801	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:01.808901072 CEST	443	49797	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:01.808908939 CEST	49801	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:01.809051991 CEST	49801	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:01.809077024 CEST	443	49801	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:01.809309006 CEST	49797	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:01.809323072 CEST	443	49797	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:01.809685946 CEST	49797	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:01.809690952 CEST	443	49797	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:01.830682993 CEST	443	49798	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:01.830843925 CEST	443	49798	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:01.830938101 CEST	49798	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:01.831091881 CEST	49798	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:01.831110001 CEST	443	49798	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:01.831124067 CEST	49798	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:01.831130028 CEST	443	49798	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:01.833993912 CEST	49802	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:01.834044933 CEST	443	49802	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:01.834141970 CEST	49802	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:01.834253073 CEST	49802	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:01.834263086 CEST	443	49802	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:01.903022051 CEST	443	49799	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:01.903626919 CEST	49799	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:01.903644085 CEST	443	49799	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:01.904028893 CEST	49799	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:01.904036045 CEST	443	49799	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:01.910558939 CEST	443	49797	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:01.910676003 CEST	443	49797	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:01.910864115 CEST	49797	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:01.910923958 CEST	49797	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:01.910940886 CEST	443	49797	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:01.910953045 CEST	49797	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:01.910958052 CEST	443	49797	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:01.914297104 CEST	49803	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:01.914334059 CEST	443	49803	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:01.914402962 CEST	49803	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:01.914591074 CEST	49803	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:01.914604902 CEST	443	49803	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:02.007824898 CEST	443	49799	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:02.007980108 CEST	443	49799	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:02.008066893 CEST	49799	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:02.008219957 CEST	49799	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:02.008235931 CEST	443	49799	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:02.008246899 CEST	49799	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:02.008253098 CEST	443	49799	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:02.011151075 CEST	49804	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:02.011250973 CEST	443	49804	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:02.011353016 CEST	49804	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:02.011532068 CEST	49804	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:02.011559963 CEST	443	49804	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:02.071614981 CEST	443	49800	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:02.072103977 CEST	49800	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:02.072118998 CEST	443	49800	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:02.072968006 CEST	49800	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:02.072976112 CEST	443	49800	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:02.171691895 CEST	443	49800	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:02.171747923 CEST	443	49800	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:02.171845913 CEST	49800	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:02.175371885 CEST	49800	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:02.175394058 CEST	443	49800	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:02.175410986 CEST	49800	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:02.175417900 CEST	443	49800	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:02.178482056 CEST	49805	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:02.178518057 CEST	443	49805	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:02.178606033 CEST	49805	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:02.178721905 CEST	49805	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:02.178729057 CEST	443	49805	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:02.442902088 CEST	443	49801	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:02.443461895 CEST	49801	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:02.443494081 CEST	443	49801	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:02.443931103 CEST	49801	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:02.443938971 CEST	443	49801	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:02.469336033 CEST	443	49802	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:02.469774961 CEST	49802	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:02.469785929 CEST	443	49802	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:02.470330954 CEST	49802	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:02.470336914 CEST	443	49802	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:02.544243097 CEST	443	49801	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:02.544306040 CEST	443	49801	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:02.544356108 CEST	49801	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:02.544502974 CEST	49801	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:02.544531107 CEST	443	49801	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:02.544548035 CEST	49801	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:02.544554949 CEST	443	49801	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:02.547862053 CEST	49806	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:02.547918081 CEST	443	49806	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:02.548003912 CEST	49806	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:02.548116922 CEST	49806	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:02.548132896 CEST	443	49806	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:02.568634987 CEST	443	49802	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:02.568694115 CEST	443	49802	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:02.568753004 CEST	49802	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:02.568840981 CEST	49802	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:02.568864107 CEST	443	49802	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:02.568877935 CEST	49802	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:02.568885088 CEST	443	49802	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:02.569828033 CEST	443	49803	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:02.570179939 CEST	49803	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:02.570203066 CEST	443	49803	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:02.570576906 CEST	49803	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:02.570584059 CEST	443	49803	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:02.571544886 CEST	49807	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:02.571645021 CEST	443	49807	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:02.571727037 CEST	49807	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:02.571969032 CEST	49807	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:02.572005987 CEST	443	49807	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:02.669893026 CEST	443	49803	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:02.670042038 CEST	443	49803	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:02.670191050 CEST	49803	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:02.670393944 CEST	49803	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:02.670409918 CEST	443	49803	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:02.670425892 CEST	49803	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:02.670433998 CEST	443	49803	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:02.673880100 CEST	49808	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:02.673916101 CEST	443	49808	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:02.673995018 CEST	49808	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:02.674160004 CEST	49808	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:02.674165010 CEST	443	49808	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:02.674890041 CEST	443	49804	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:02.675273895 CEST	49804	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:02.675303936 CEST	443	49804	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:02.675717115 CEST	49804	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:02.675729990 CEST	443	49804	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:02.780267000 CEST	443	49804	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:02.780436039 CEST	443	49804	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:02.780519009 CEST	49804	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:02.780615091 CEST	49804	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:02.780615091 CEST	49804	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:02.780663967 CEST	443	49804	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:02.780695915 CEST	443	49804	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:02.792079926 CEST	49809	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:02.792126894 CEST	443	49809	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:02.792193890 CEST	49809	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:02.792675018 CEST	49809	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:02.792701960 CEST	443	49809	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:02.814450979 CEST	443	49805	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:02.816366911 CEST	49805	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:02.816380024 CEST	443	49805	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:02.820831060 CEST	49805	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:02.820837021 CEST	443	49805	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:02.915982008 CEST	443	49805	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:02.916042089 CEST	443	49805	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:02.916095018 CEST	49805	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:03.035231113 CEST	49805	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:03.035257101 CEST	443	49805	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:03.035276890 CEST	49805	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:03.035284996 CEST	443	49805	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:03.126317024 CEST	49810	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:03.126377106 CEST	443	49810	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:03.126447916 CEST	49810	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:03.126595974 CEST	49810	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:03.126604080 CEST	443	49810	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:03.196810007 CEST	443	49806	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:03.199573040 CEST	49806	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:03.199596882 CEST	443	49806	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:03.200011969 CEST	49806	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:03.200017929 CEST	443	49806	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:03.221043110 CEST	443	49807	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:03.221546888 CEST	49807	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:03.221611977 CEST	443	49807	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:03.221951962 CEST	49807	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:03.221967936 CEST	443	49807	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:03.320712090 CEST	443	49808	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:03.321225882 CEST	49808	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:03.321259975 CEST	443	49808	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:03.321666956 CEST	49808	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:03.321672916 CEST	443	49808	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:03.322719097 CEST	443	49807	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:03.322897911 CEST	443	49807	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:03.322978973 CEST	49807	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:03.322979927 CEST	49807	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:03.323033094 CEST	49807	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:03.323055983 CEST	443	49807	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:03.325423002 CEST	49811	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:03.325453997 CEST	443	49811	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:03.325558901 CEST	49811	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:03.325663090 CEST	49811	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:03.325670004 CEST	443	49811	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:03.330630064 CEST	443	49806	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:03.330737114 CEST	443	49806	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:03.330826998 CEST	49806	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:03.331079006 CEST	49806	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:03.331104040 CEST	443	49806	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:03.331135035 CEST	49806	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:03.331142902 CEST	443	49806	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:03.333967924 CEST	49812	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:03.334007978 CEST	443	49812	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:03.334086895 CEST	49812	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:03.334255934 CEST	49812	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:03.334265947 CEST	443	49812	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:03.419420004 CEST	443	49808	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:03.419584036 CEST	443	49808	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:03.419800997 CEST	49808	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:03.420063019 CEST	49808	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:03.420063019 CEST	49808	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:03.420089006 CEST	443	49808	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:03.420101881 CEST	443	49808	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:03.422955990 CEST	49813	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:03.423028946 CEST	443	49813	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:03.423134089 CEST	49813	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:03.423333883 CEST	49813	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:03.423346043 CEST	443	49813	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:03.457124949 CEST	443	49809	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:03.457642078 CEST	49809	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:03.457659960 CEST	443	49809	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:03.458079100 CEST	49809	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:03.458091021 CEST	443	49809	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:03.555438042 CEST	443	49809	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:03.555638075 CEST	443	49809	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:03.555701971 CEST	49809	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:03.555896044 CEST	49809	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:03.555910110 CEST	443	49809	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:03.555919886 CEST	49809	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:03.555924892 CEST	443	49809	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:03.559098005 CEST	49814	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:03.559148073 CEST	443	49814	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:03.559228897 CEST	49814	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:03.559370995 CEST	49814	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:03.559391975 CEST	443	49814	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:03.768284082 CEST	443	49810	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:03.768783092 CEST	49810	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:03.768804073 CEST	443	49810	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:03.769243956 CEST	49810	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:03.769248962 CEST	443	49810	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:03.867712975 CEST	443	49810	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:03.867777109 CEST	443	49810	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:03.867851019 CEST	49810	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:03.868056059 CEST	49810	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:03.868096113 CEST	443	49810	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:03.868125916 CEST	49810	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:03.868141890 CEST	443	49810	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:03.870842934 CEST	49815	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:03.870907068 CEST	443	49815	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:03.870999098 CEST	49815	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:03.871119976 CEST	49815	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:03.871131897 CEST	443	49815	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:03.980174065 CEST	443	49812	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:03.980750084 CEST	49812	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:03.980782032 CEST	443	49812	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:03.981175900 CEST	49812	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:03.981185913 CEST	443	49812	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:03.992569923 CEST	443	49811	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:03.992984056 CEST	49811	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:03.993046999 CEST	443	49811	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:03.993531942 CEST	49811	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:03.993547916 CEST	443	49811	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:04.074707031 CEST	443	49813	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:04.075279951 CEST	49813	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:04.075347900 CEST	443	49813	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:04.075874090 CEST	49813	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:04.075895071 CEST	443	49813	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:04.083822966 CEST	443	49812	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:04.083914042 CEST	443	49812	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:04.083978891 CEST	49812	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:04.084224939 CEST	49812	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:04.084252119 CEST	443	49812	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:04.084289074 CEST	49812	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:04.084296942 CEST	443	49812	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:04.087450981 CEST	49816	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:04.087528944 CEST	443	49816	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:04.087630033 CEST	49816	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:04.087784052 CEST	49816	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:04.087800026 CEST	443	49816	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:04.095571995 CEST	443	49811	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:04.095803022 CEST	443	49811	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:04.095961094 CEST	49811	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:04.095961094 CEST	49811	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:04.095961094 CEST	49811	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:04.098099947 CEST	49817	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:04.098196030 CEST	443	49817	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:04.098294973 CEST	49817	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:04.098500013 CEST	49817	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:04.098535061 CEST	443	49817	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:04.174451113 CEST	443	49813	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:04.174601078 CEST	443	49813	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:04.174679995 CEST	49813	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:04.174859047 CEST	49813	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:04.174885035 CEST	443	49813	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:04.174902916 CEST	49813	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:04.174910069 CEST	443	49813	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:04.178081036 CEST	49818	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:04.178148985 CEST	443	49818	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:04.178307056 CEST	49818	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:04.178524017 CEST	49818	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:04.178559065 CEST	443	49818	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:04.199021101 CEST	443	49814	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:04.199639082 CEST	49814	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:04.199707031 CEST	443	49814	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:04.200064898 CEST	49814	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:04.200090885 CEST	443	49814	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:04.297544003 CEST	443	49814	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:04.297719002 CEST	443	49814	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:04.297806025 CEST	49814	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:04.297924995 CEST	49814	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:04.297950029 CEST	443	49814	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:04.297969103 CEST	49814	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:04.297976017 CEST	443	49814	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:04.301035881 CEST	49819	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:04.301101923 CEST	443	49819	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:04.301208973 CEST	49819	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:04.301400900 CEST	49819	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:04.301414967 CEST	443	49819	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:04.397917032 CEST	49811	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:04.397985935 CEST	443	49811	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:04.539118052 CEST	443	49815	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:04.539901972 CEST	49815	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:04.539932966 CEST	443	49815	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:04.540348053 CEST	49815	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:04.540354967 CEST	443	49815	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:04.642034054 CEST	443	49815	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:04.642199993 CEST	443	49815	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:04.642280102 CEST	49815	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:04.642437935 CEST	49815	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:04.642456055 CEST	443	49815	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:04.642477036 CEST	49815	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:04.642482996 CEST	443	49815	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:04.645247936 CEST	49820	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:04.645289898 CEST	443	49820	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:04.645368099 CEST	49820	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:04.645512104 CEST	49820	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:04.645525932 CEST	443	49820	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:04.724603891 CEST	443	49816	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:04.725399971 CEST	49816	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:04.725430012 CEST	443	49816	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:04.726253986 CEST	49816	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:04.726262093 CEST	443	49816	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:04.765649080 CEST	443	49817	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:04.766170025 CEST	49817	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:04.766207933 CEST	443	49817	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:04.766772032 CEST	49817	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:04.766781092 CEST	443	49817	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:04.823558092 CEST	443	49816	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:04.823635101 CEST	443	49816	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:04.823693991 CEST	49816	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:04.823874950 CEST	49816	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:04.823899984 CEST	443	49816	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:04.823913097 CEST	49816	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:04.823920965 CEST	443	49816	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:04.826436043 CEST	49821	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:04.826482058 CEST	443	49821	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:04.826595068 CEST	49821	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:04.826735020 CEST	49821	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:04.826741934 CEST	443	49821	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:04.831486940 CEST	443	49818	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:04.831904888 CEST	49818	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:04.831959963 CEST	443	49818	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:04.832339048 CEST	49818	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:04.832353115 CEST	443	49818	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:04.867582083 CEST	443	49817	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:04.867729902 CEST	443	49817	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:04.867811918 CEST	49817	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:04.867924929 CEST	49817	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:04.867983103 CEST	443	49817	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:04.868016958 CEST	49817	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:04.868031025 CEST	443	49817	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:04.870428085 CEST	49822	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:04.870465040 CEST	443	49822	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:04.870544910 CEST	49822	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:04.870677948 CEST	49822	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:04.870695114 CEST	443	49822	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:04.931238890 CEST	443	49818	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:04.931377888 CEST	443	49818	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:04.931485891 CEST	49818	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:04.931551933 CEST	49818	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:04.931567907 CEST	443	49818	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:04.931607962 CEST	49818	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:04.931618929 CEST	443	49818	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:04.934130907 CEST	49823	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:04.934165001 CEST	443	49823	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:04.934238911 CEST	49823	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:04.934371948 CEST	49823	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:04.934387922 CEST	443	49823	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:04.950520039 CEST	443	49819	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:04.950895071 CEST	49819	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:04.950908899 CEST	443	49819	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:04.951324940 CEST	49819	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:04.951332092 CEST	443	49819	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:05.049290895 CEST	443	49819	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:05.049377918 CEST	443	49819	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:05.049439907 CEST	49819	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:05.049614906 CEST	49819	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:05.049652100 CEST	443	49819	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:05.049670935 CEST	49819	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:05.049679041 CEST	443	49819	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:05.052037954 CEST	49824	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:05.052107096 CEST	443	49824	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:05.052212954 CEST	49824	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:05.052335024 CEST	49824	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:05.052347898 CEST	443	49824	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:05.325018883 CEST	443	49820	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:05.325447083 CEST	49820	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:05.325465918 CEST	443	49820	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:05.325867891 CEST	49820	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:05.325874090 CEST	443	49820	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:05.432291031 CEST	443	49820	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:05.432431936 CEST	443	49820	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:05.432491064 CEST	49820	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:05.432632923 CEST	49820	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:05.432658911 CEST	443	49820	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:05.432671070 CEST	49820	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:05.432677984 CEST	443	49820	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:05.435318947 CEST	49825	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:05.435345888 CEST	443	49825	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:05.435452938 CEST	49825	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:05.435606956 CEST	49825	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:05.435619116 CEST	443	49825	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:05.461971998 CEST	443	49821	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:05.464205027 CEST	49821	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:05.464221001 CEST	443	49821	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:05.464539051 CEST	49821	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:05.464545012 CEST	443	49821	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:05.538512945 CEST	443	49822	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:05.561342001 CEST	443	49821	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:05.561422110 CEST	443	49821	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:05.561515093 CEST	49821	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:05.585309982 CEST	49822	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:05.599106073 CEST	49822	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:05.599112988 CEST	443	49822	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:05.599705935 CEST	49822	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:05.599710941 CEST	443	49822	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:05.599961996 CEST	49821	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:05.599977970 CEST	443	49821	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:05.599996090 CEST	49821	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:05.600003958 CEST	443	49821	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:05.604402065 CEST	49826	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:05.604428053 CEST	443	49826	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:05.604491949 CEST	49826	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:05.604618073 CEST	49826	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:05.604628086 CEST	443	49826	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:05.607840061 CEST	443	49823	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:05.608480930 CEST	49823	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:05.608494043 CEST	443	49823	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:05.609055042 CEST	49823	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:05.609069109 CEST	443	49823	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:05.696585894 CEST	443	49824	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:05.699060917 CEST	443	49822	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:05.699119091 CEST	443	49822	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:05.699174881 CEST	49822	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:05.699189901 CEST	443	49822	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:05.699240923 CEST	443	49822	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:05.699295044 CEST	49822	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:05.708947897 CEST	49824	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:05.708967924 CEST	443	49824	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:05.709429979 CEST	443	49823	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:05.709582090 CEST	443	49823	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:05.709641933 CEST	49823	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:05.712815046 CEST	49824	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:05.712826014 CEST	443	49824	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:05.712986946 CEST	49822	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:05.713002920 CEST	443	49822	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:05.713022947 CEST	49822	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:05.713028908 CEST	443	49822	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:05.720807076 CEST	49823	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:05.720830917 CEST	443	49823	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:05.720844030 CEST	49823	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:05.720851898 CEST	443	49823	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:05.743823051 CEST	49827	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:05.743855953 CEST	443	49827	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:05.743937016 CEST	49827	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:05.744050980 CEST	49827	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:05.744061947 CEST	443	49827	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:05.747807980 CEST	49828	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:05.747847080 CEST	443	49828	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:05.747915983 CEST	49828	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:05.748030901 CEST	49828	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:05.748048067 CEST	443	49828	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:05.808969975 CEST	443	49824	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:05.809109926 CEST	443	49824	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:05.809175014 CEST	49824	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:05.835799932 CEST	49824	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:05.835823059 CEST	443	49824	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:05.835836887 CEST	49824	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:05.835844994 CEST	443	49824	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:05.853832006 CEST	49829	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:05.853924036 CEST	443	49829	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:05.854006052 CEST	49829	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:05.854132891 CEST	49829	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:05.854156017 CEST	443	49829	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:06.087110043 CEST	443	49825	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:06.088443995 CEST	49825	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:06.088474035 CEST	443	49825	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:06.088907003 CEST	49825	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:06.088913918 CEST	443	49825	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:06.189378977 CEST	443	49825	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:06.189443111 CEST	443	49825	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:06.189579010 CEST	443	49825	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:06.189680099 CEST	49825	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:06.189680099 CEST	49825	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:06.189975977 CEST	49825	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:06.189975977 CEST	49825	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:06.190011024 CEST	443	49825	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:06.190028906 CEST	443	49825	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:06.192481041 CEST	49830	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:06.192569017 CEST	443	49830	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:06.192663908 CEST	49830	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:06.192800045 CEST	49830	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:06.192820072 CEST	443	49830	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:06.237781048 CEST	443	49826	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:06.238265991 CEST	49826	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:06.238291979 CEST	443	49826	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:06.238672972 CEST	49826	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:06.238681078 CEST	443	49826	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:06.338280916 CEST	443	49826	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:06.338304043 CEST	443	49826	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:06.338356972 CEST	443	49826	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:06.338480949 CEST	49826	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:06.338723898 CEST	49826	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:06.338747025 CEST	443	49826	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:06.338785887 CEST	49826	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:06.338793039 CEST	443	49826	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:06.341341019 CEST	49831	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:06.341389894 CEST	443	49831	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:06.341463089 CEST	49831	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:06.341584921 CEST	49831	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:06.341593027 CEST	443	49831	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:06.387952089 CEST	443	49827	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:06.388423920 CEST	49827	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:06.388457060 CEST	443	49827	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:06.388865948 CEST	49827	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:06.388875961 CEST	443	49827	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:06.389081001 CEST	443	49828	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:06.389333010 CEST	49828	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:06.389358997 CEST	443	49828	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:06.389667034 CEST	49828	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:06.389677048 CEST	443	49828	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:06.488010883 CEST	443	49827	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:06.488176107 CEST	443	49827	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:06.488238096 CEST	49827	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:06.488457918 CEST	49827	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:06.488481998 CEST	443	49827	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:06.488497972 CEST	49827	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:06.488512039 CEST	443	49827	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:06.489267111 CEST	443	49828	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:06.489331961 CEST	443	49828	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:06.489397049 CEST	49828	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:06.489434004 CEST	443	49828	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:06.489461899 CEST	443	49828	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:06.489507914 CEST	49828	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:06.489562988 CEST	49828	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:06.489586115 CEST	443	49828	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:06.489598036 CEST	49828	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:06.489604950 CEST	443	49828	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:06.491890907 CEST	49832	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:06.491940022 CEST	443	49832	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:06.492018938 CEST	49832	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:06.492125988 CEST	49833	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:06.492146015 CEST	49832	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:06.492155075 CEST	443	49832	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:06.492168903 CEST	443	49833	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:06.492219925 CEST	49833	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:06.492301941 CEST	49833	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:06.492311001 CEST	443	49833	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:06.508673906 CEST	443	49829	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:06.509094000 CEST	49829	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:06.509157896 CEST	443	49829	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:06.509531021 CEST	49829	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:06.509550095 CEST	443	49829	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:06.608778000 CEST	443	49829	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:06.608855009 CEST	443	49829	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:06.608927965 CEST	49829	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:06.609095097 CEST	49829	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:06.609095097 CEST	49829	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:06.609138966 CEST	443	49829	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:06.609165907 CEST	443	49829	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:06.612116098 CEST	49834	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:06.612160921 CEST	443	49834	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:06.612225056 CEST	49834	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:06.612415075 CEST	49834	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:06.612428904 CEST	443	49834	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:06.882173061 CEST	443	49830	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:06.882869959 CEST	49830	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:06.882889032 CEST	443	49830	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:06.883322001 CEST	49830	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:06.883328915 CEST	443	49830	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:06.977808952 CEST	443	49831	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:06.978317976 CEST	49831	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:06.978331089 CEST	443	49831	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:06.978730917 CEST	49831	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:06.978737116 CEST	443	49831	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:06.989729881 CEST	443	49830	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:06.989989042 CEST	443	49830	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:06.990160942 CEST	49830	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:06.990161896 CEST	49830	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:06.990161896 CEST	49830	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:06.992989063 CEST	49835	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:06.993029118 CEST	443	49835	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:06.993108034 CEST	49835	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:06.993273020 CEST	49835	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:06.993287086 CEST	443	49835	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:07.076483011 CEST	443	49831	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:07.076550961 CEST	443	49831	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:07.076601028 CEST	49831	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:07.076695919 CEST	49831	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:07.076711893 CEST	443	49831	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:07.076724052 CEST	49831	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:07.076731920 CEST	443	49831	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:07.078941107 CEST	49836	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:07.078978062 CEST	443	49836	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:07.079045057 CEST	49836	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:07.079159975 CEST	49836	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:07.079174042 CEST	443	49836	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:07.145888090 CEST	443	49833	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:07.146648884 CEST	49833	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:07.146694899 CEST	443	49833	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:07.147094011 CEST	49833	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:07.147099018 CEST	443	49833	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:07.177527905 CEST	443	49832	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:07.178026915 CEST	49832	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:07.178056002 CEST	443	49832	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:07.178443909 CEST	49832	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:07.178451061 CEST	443	49832	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:07.254179001 CEST	443	49834	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:07.254843950 CEST	49834	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:07.254869938 CEST	443	49834	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:07.255300045 CEST	49834	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:07.255305052 CEST	443	49834	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:07.281286955 CEST	443	49832	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:07.281447887 CEST	443	49832	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:07.281538963 CEST	49832	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:07.281594992 CEST	49832	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:07.281615019 CEST	443	49832	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:07.281629086 CEST	49832	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:07.281636953 CEST	443	49832	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:07.284037113 CEST	49837	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:07.284096003 CEST	443	49837	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:07.284172058 CEST	49837	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:07.284279108 CEST	49837	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:07.284290075 CEST	443	49837	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:07.304080963 CEST	49830	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:07.304136992 CEST	443	49830	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:07.332026958 CEST	443	49833	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:07.332210064 CEST	443	49833	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:07.332309961 CEST	49833	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:07.332468987 CEST	49833	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:07.332483053 CEST	443	49833	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:07.332493067 CEST	49833	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:07.332498074 CEST	443	49833	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:07.334908009 CEST	49838	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:07.334965944 CEST	443	49838	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:07.335038900 CEST	49838	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:07.335181952 CEST	49838	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:07.335205078 CEST	443	49838	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:07.352157116 CEST	443	49834	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:07.352236986 CEST	443	49834	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:07.352303028 CEST	49834	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:07.352397919 CEST	49834	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:07.352408886 CEST	443	49834	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:07.352416992 CEST	49834	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:07.352421045 CEST	443	49834	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:07.354406118 CEST	49839	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:07.354443073 CEST	443	49839	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:07.354516029 CEST	49839	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:07.354640007 CEST	49839	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:07.354650974 CEST	443	49839	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:07.651120901 CEST	443	49835	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:07.651540041 CEST	49835	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:07.651561022 CEST	443	49835	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:07.651969910 CEST	49835	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:07.651976109 CEST	443	49835	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:07.719130039 CEST	443	49836	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:07.719611883 CEST	49836	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:07.719625950 CEST	443	49836	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:07.720079899 CEST	49836	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:07.720087051 CEST	443	49836	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:07.750741959 CEST	443	49835	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:07.751137972 CEST	443	49835	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:07.751209974 CEST	49835	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:07.751246929 CEST	49835	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:07.751266956 CEST	443	49835	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:07.751281023 CEST	49835	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:07.751288891 CEST	443	49835	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:07.753868103 CEST	49840	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:07.753931999 CEST	443	49840	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:07.754008055 CEST	49840	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:07.754129887 CEST	49840	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:07.754147053 CEST	443	49840	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:07.818784952 CEST	443	49836	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:07.818902016 CEST	443	49836	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:07.819196939 CEST	49836	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:07.819196939 CEST	49836	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:07.819302082 CEST	49836	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:07.819320917 CEST	443	49836	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:07.821844101 CEST	49841	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:07.821899891 CEST	443	49841	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:07.821993113 CEST	49841	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:07.822113991 CEST	49841	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:07.822137117 CEST	443	49841	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:07.920304060 CEST	443	49837	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:07.920928001 CEST	49837	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:07.920955896 CEST	443	49837	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:07.921369076 CEST	49837	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:07.921375036 CEST	443	49837	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:07.983395100 CEST	443	49838	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:07.983947039 CEST	49838	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:07.983971119 CEST	443	49838	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:07.984357119 CEST	49838	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:07.984363079 CEST	443	49838	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:07.989042997 CEST	443	49839	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:07.989397049 CEST	49839	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:07.989413977 CEST	443	49839	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:07.991435051 CEST	49839	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:07.991462946 CEST	443	49839	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:08.020945072 CEST	443	49837	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:08.021099091 CEST	443	49837	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:08.021174908 CEST	49837	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:08.021331072 CEST	49837	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:08.021358013 CEST	443	49837	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:08.021369934 CEST	49837	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:08.021378994 CEST	443	49837	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:08.024379969 CEST	49842	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:08.024435043 CEST	443	49842	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:08.024499893 CEST	49842	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:08.024637938 CEST	49842	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:08.024647951 CEST	443	49842	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:08.084033966 CEST	443	49838	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:08.084069014 CEST	443	49838	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:08.084122896 CEST	443	49838	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:08.084125042 CEST	49838	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:08.084161997 CEST	49838	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:08.084391117 CEST	49838	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:08.084391117 CEST	49838	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:08.084423065 CEST	443	49838	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:08.084435940 CEST	443	49838	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:08.087445974 CEST	49843	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:08.087497950 CEST	443	49843	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:08.087567091 CEST	49843	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:08.087707043 CEST	49843	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:08.087722063 CEST	443	49843	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:08.089684010 CEST	443	49839	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:08.089790106 CEST	443	49839	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:08.089900970 CEST	49839	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:08.089900970 CEST	49839	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:08.089900970 CEST	49839	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:08.092128992 CEST	49844	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:08.092164040 CEST	443	49844	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:08.092227936 CEST	49844	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:08.092370033 CEST	49844	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:08.092382908 CEST	443	49844	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:08.398339033 CEST	49839	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:08.398365021 CEST	443	49839	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:08.413243055 CEST	443	49840	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:08.414246082 CEST	49840	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:08.414263964 CEST	443	49840	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:08.418049097 CEST	49840	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:08.418076992 CEST	443	49840	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:08.456058979 CEST	443	49841	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:08.460081100 CEST	49841	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:08.460122108 CEST	443	49841	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:08.463972092 CEST	49841	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:08.463993073 CEST	443	49841	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:08.517524004 CEST	443	49840	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:08.517652035 CEST	443	49840	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:08.517724991 CEST	443	49840	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:08.517735958 CEST	49840	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:08.517772913 CEST	49840	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:08.517887115 CEST	49840	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:08.517904997 CEST	443	49840	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:08.517918110 CEST	49840	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:08.517925024 CEST	443	49840	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:08.530174971 CEST	49845	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:08.530241013 CEST	443	49845	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:08.530330896 CEST	49845	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:08.530487061 CEST	49845	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:08.530503988 CEST	443	49845	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:08.558643103 CEST	443	49841	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:08.558825016 CEST	443	49841	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:08.558937073 CEST	49841	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:08.585926056 CEST	49841	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:08.585957050 CEST	443	49841	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:08.585971117 CEST	49841	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:08.585977077 CEST	443	49841	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:08.598690033 CEST	49846	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:08.598742962 CEST	443	49846	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:08.598854065 CEST	49846	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:08.610105038 CEST	49846	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:08.610136032 CEST	443	49846	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:08.687685013 CEST	443	49842	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:08.688832998 CEST	49842	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:08.688859940 CEST	443	49842	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:08.689606905 CEST	49842	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:08.689611912 CEST	443	49842	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:08.728190899 CEST	443	49843	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:08.728745937 CEST	49843	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:08.728781939 CEST	443	49843	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:08.729593992 CEST	49843	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:08.729610920 CEST	443	49843	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:08.781163931 CEST	443	49844	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:08.781625986 CEST	49844	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:08.781657934 CEST	443	49844	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:08.785363913 CEST	49844	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:08.785373926 CEST	443	49844	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:08.792551041 CEST	443	49842	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:08.792709112 CEST	443	49842	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:08.792784929 CEST	49842	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:08.792860985 CEST	49842	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:08.792881966 CEST	443	49842	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:08.792926073 CEST	49842	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:08.792932034 CEST	443	49842	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:08.796554089 CEST	49847	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:08.796596050 CEST	443	49847	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:08.796653986 CEST	49847	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:08.796799898 CEST	49847	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:08.796813965 CEST	443	49847	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:08.829480886 CEST	443	49843	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:08.829660892 CEST	443	49843	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:08.829739094 CEST	49843	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:08.829809904 CEST	49843	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:08.829837084 CEST	443	49843	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:08.829879999 CEST	49843	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:08.829888105 CEST	443	49843	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:08.832834005 CEST	49848	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:08.832896948 CEST	443	49848	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:08.832963943 CEST	49848	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:08.833139896 CEST	49848	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:08.833159924 CEST	443	49848	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:08.887737036 CEST	443	49844	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:08.887795925 CEST	443	49844	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:08.887857914 CEST	443	49844	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:08.887860060 CEST	49844	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:08.887892962 CEST	49844	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:08.888123035 CEST	49844	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:08.888140917 CEST	443	49844	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:08.888154030 CEST	49844	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:08.888159037 CEST	443	49844	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:08.890645981 CEST	49849	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:08.890677929 CEST	443	49849	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:08.890871048 CEST	49849	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:08.890894890 CEST	49849	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:08.890901089 CEST	443	49849	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:09.171622038 CEST	443	49845	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:09.172162056 CEST	49845	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:09.172185898 CEST	443	49845	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:09.172600985 CEST	49845	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:09.172607899 CEST	443	49845	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:09.244431973 CEST	443	49846	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:09.244839907 CEST	49846	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:09.244854927 CEST	443	49846	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:09.245266914 CEST	49846	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:09.245273113 CEST	443	49846	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:09.269689083 CEST	443	49845	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:09.269838095 CEST	443	49845	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:09.269964933 CEST	49845	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:09.270107031 CEST	49845	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:09.270128965 CEST	443	49845	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:09.270162106 CEST	49845	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:09.270169020 CEST	443	49845	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:09.272725105 CEST	49850	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:09.272768974 CEST	443	49850	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:09.273277044 CEST	49850	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:09.273277044 CEST	49850	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:09.273308992 CEST	443	49850	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:09.347851038 CEST	443	49846	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:09.348012924 CEST	443	49846	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:09.348077059 CEST	49846	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:09.348166943 CEST	49846	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:09.348195076 CEST	443	49846	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:09.348210096 CEST	49846	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:09.348216057 CEST	443	49846	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:09.350702047 CEST	49851	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:09.350755930 CEST	443	49851	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:09.350841999 CEST	49851	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:09.351259947 CEST	49851	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:09.351275921 CEST	443	49851	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:09.434468031 CEST	443	49847	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:09.434856892 CEST	49847	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:09.434884071 CEST	443	49847	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:09.435319901 CEST	49847	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:09.435324907 CEST	443	49847	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:09.466849089 CEST	443	49848	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:09.467212915 CEST	49848	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:09.467230082 CEST	443	49848	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:09.467662096 CEST	49848	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:09.467667103 CEST	443	49848	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:09.533788919 CEST	443	49847	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:09.533996105 CEST	443	49847	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:09.534061909 CEST	49847	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:09.534107924 CEST	49847	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:09.534122944 CEST	443	49847	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:09.534132957 CEST	49847	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:09.534137964 CEST	443	49847	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:09.536624908 CEST	49852	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:09.536685944 CEST	443	49852	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:09.536755085 CEST	49852	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:09.536880970 CEST	49852	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:09.536896944 CEST	443	49852	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:09.565989017 CEST	443	49848	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:09.566060066 CEST	443	49848	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:09.566112995 CEST	49848	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:09.566139936 CEST	443	49848	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:09.566179991 CEST	443	49848	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:09.566229105 CEST	49848	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:09.566345930 CEST	49848	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:09.566359997 CEST	443	49848	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:09.566380978 CEST	49848	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:09.566385984 CEST	443	49848	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:09.569453955 CEST	49853	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:09.569483042 CEST	443	49853	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:09.569540977 CEST	49853	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:09.569885969 CEST	49853	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:09.569900036 CEST	443	49853	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:09.576113939 CEST	443	49849	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:09.576683998 CEST	49849	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:09.576708078 CEST	443	49849	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:09.577513933 CEST	49849	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:09.577519894 CEST	443	49849	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:09.679783106 CEST	443	49849	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:09.679951906 CEST	443	49849	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:09.680020094 CEST	49849	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:09.680151939 CEST	49849	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:09.680151939 CEST	49849	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:09.680166960 CEST	443	49849	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:09.680175066 CEST	443	49849	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:09.682781935 CEST	49854	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:09.682830095 CEST	443	49854	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:09.682914019 CEST	49854	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:09.683054924 CEST	49854	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:09.683073997 CEST	443	49854	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:09.958439112 CEST	443	49850	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:09.959239006 CEST	49850	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:09.959252119 CEST	443	49850	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:09.959590912 CEST	49850	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:09.959594965 CEST	443	49850	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:09.987811089 CEST	443	49851	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:09.988224983 CEST	49851	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:09.988257885 CEST	443	49851	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:09.988668919 CEST	49851	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:09.988676071 CEST	443	49851	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:10.062957048 CEST	443	49850	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:10.063023090 CEST	443	49850	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:10.063095093 CEST	49850	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:10.063127041 CEST	443	49850	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:10.063152075 CEST	443	49850	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:10.063216925 CEST	49850	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:10.063318968 CEST	49850	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:10.063318968 CEST	49850	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:10.063338995 CEST	443	49850	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:10.063349009 CEST	443	49850	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:10.066152096 CEST	49855	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:10.066210032 CEST	443	49855	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:10.066292048 CEST	49855	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:10.066404104 CEST	49855	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:10.066414118 CEST	443	49855	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:10.086764097 CEST	443	49851	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:10.086896896 CEST	443	49851	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:10.086956978 CEST	49851	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:10.086991072 CEST	49851	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:10.087009907 CEST	443	49851	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:10.087022066 CEST	49851	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:10.087028980 CEST	443	49851	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:10.089051008 CEST	49856	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:10.089077950 CEST	443	49856	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:10.089142084 CEST	49856	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:10.089288950 CEST	49856	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:10.089308023 CEST	443	49856	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:10.192192078 CEST	443	49852	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:10.192703962 CEST	49852	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:10.192720890 CEST	443	49852	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:10.193299055 CEST	49852	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:10.193304062 CEST	443	49852	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:10.220521927 CEST	443	49853	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:10.220982075 CEST	49853	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:10.221028090 CEST	443	49853	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:10.221553087 CEST	49853	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:10.221560955 CEST	443	49853	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:10.292570114 CEST	443	49852	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:10.292782068 CEST	443	49852	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:10.292912006 CEST	49852	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:10.293086052 CEST	49852	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:10.293108940 CEST	443	49852	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:10.293138981 CEST	49852	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:10.293144941 CEST	443	49852	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:10.305777073 CEST	49857	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:10.305826902 CEST	443	49857	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:10.305948973 CEST	49857	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:10.306232929 CEST	49857	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:10.306252956 CEST	443	49857	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:10.321434975 CEST	443	49853	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:10.321605921 CEST	443	49853	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:10.321697950 CEST	49853	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:10.321757078 CEST	49853	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:10.321783066 CEST	443	49853	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:10.321799040 CEST	49853	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:10.321805954 CEST	443	49853	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:10.324893951 CEST	49858	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:10.324925900 CEST	443	49858	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:10.325027943 CEST	49858	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:10.325200081 CEST	49858	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:10.325217009 CEST	443	49858	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:10.334856033 CEST	443	49854	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:10.335274935 CEST	49854	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:10.335298061 CEST	443	49854	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:10.336107016 CEST	49854	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:10.336116076 CEST	443	49854	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:10.434381008 CEST	443	49854	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:10.434453964 CEST	443	49854	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:10.434529066 CEST	49854	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:10.434566975 CEST	443	49854	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:10.434595108 CEST	443	49854	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:10.434644938 CEST	49854	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:10.434727907 CEST	49854	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:10.434748888 CEST	443	49854	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:10.434762955 CEST	49854	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:10.434768915 CEST	443	49854	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:10.437464952 CEST	49859	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:10.437517881 CEST	443	49859	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:10.437582970 CEST	49859	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:10.437869072 CEST	49859	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:10.437886000 CEST	443	49859	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:10.724101067 CEST	443	49856	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:10.724881887 CEST	49856	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:10.724915981 CEST	443	49856	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:10.725589991 CEST	49856	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:10.725598097 CEST	443	49856	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:10.757487059 CEST	443	49855	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:10.757894993 CEST	49855	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:10.757929087 CEST	443	49855	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:10.758421898 CEST	49855	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:10.758428097 CEST	443	49855	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:10.822850943 CEST	443	49856	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:10.823144913 CEST	443	49856	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:10.823230982 CEST	49856	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:10.823314905 CEST	49856	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:10.823314905 CEST	49856	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:10.823360920 CEST	443	49856	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:10.823407888 CEST	443	49856	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:10.825709105 CEST	49860	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:10.825766087 CEST	443	49860	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:10.825937986 CEST	49860	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:10.826334953 CEST	49860	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:10.826353073 CEST	443	49860	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:10.864561081 CEST	443	49855	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:10.864806890 CEST	443	49855	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:10.864885092 CEST	49855	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:10.864921093 CEST	49855	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:10.864955902 CEST	443	49855	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:10.864980936 CEST	49855	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:10.864988089 CEST	443	49855	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:10.867747068 CEST	49861	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:10.867786884 CEST	443	49861	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:10.867867947 CEST	49861	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:10.867990017 CEST	49861	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:10.868000031 CEST	443	49861	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:10.961786985 CEST	443	49857	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:10.962378025 CEST	49857	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:10.962418079 CEST	443	49857	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:10.962833881 CEST	49857	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:10.962841988 CEST	443	49857	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:10.993300915 CEST	443	49858	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:10.993752956 CEST	49858	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:10.993763924 CEST	443	49858	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:10.994208097 CEST	49858	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:10.994215012 CEST	443	49858	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:11.068639994 CEST	443	49857	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:11.068859100 CEST	443	49857	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:11.068939924 CEST	49857	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:11.068989038 CEST	49857	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:11.069015026 CEST	443	49857	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:11.069030046 CEST	49857	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:11.069037914 CEST	443	49857	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:11.072313070 CEST	49862	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:11.072370052 CEST	443	49862	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:11.072446108 CEST	49862	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:11.072757006 CEST	49862	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:11.072776079 CEST	443	49862	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:11.098392963 CEST	443	49858	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:11.098453045 CEST	443	49858	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:11.098501921 CEST	443	49858	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:11.098522902 CEST	49858	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:11.098556995 CEST	49858	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:11.098691940 CEST	49858	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:11.098701954 CEST	443	49858	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:11.098718882 CEST	49858	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:11.098725080 CEST	443	49858	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:11.101630926 CEST	49863	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:11.101676941 CEST	443	49863	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:11.101738930 CEST	49863	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:11.101890087 CEST	49863	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:11.101897955 CEST	443	49863	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:11.118992090 CEST	443	49859	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:11.119488001 CEST	49859	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:11.119518995 CEST	443	49859	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:11.120115995 CEST	49859	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:11.120121956 CEST	443	49859	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:11.222424030 CEST	443	49859	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:11.222536087 CEST	443	49859	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:11.222598076 CEST	49859	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:11.222743988 CEST	49859	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:11.222775936 CEST	443	49859	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:11.222790956 CEST	49859	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:11.222799063 CEST	443	49859	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:11.225970984 CEST	49864	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:11.226072073 CEST	443	49864	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:11.226149082 CEST	49864	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:11.226336002 CEST	49864	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:11.226372004 CEST	443	49864	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:11.461194038 CEST	443	49860	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:11.461827040 CEST	49860	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:11.461868048 CEST	443	49860	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:11.462440968 CEST	49860	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:11.462447882 CEST	443	49860	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:11.553173065 CEST	443	49861	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:11.554143906 CEST	49861	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:11.554183960 CEST	443	49861	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:11.554553986 CEST	49861	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:11.554580927 CEST	443	49861	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:11.559485912 CEST	443	49860	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:11.559561968 CEST	443	49860	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:11.559634924 CEST	49860	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:11.559843063 CEST	49860	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:11.559870005 CEST	443	49860	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:11.559884071 CEST	49860	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:11.559890985 CEST	443	49860	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:11.563153982 CEST	49865	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:11.563211918 CEST	443	49865	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:11.563304901 CEST	49865	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:11.563486099 CEST	49865	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:11.563508034 CEST	443	49865	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:11.657869101 CEST	443	49861	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:11.658027887 CEST	443	49861	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:11.658114910 CEST	49861	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:11.663866997 CEST	49861	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:11.663866997 CEST	49861	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:11.663896084 CEST	443	49861	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:11.663908958 CEST	443	49861	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:11.667088985 CEST	49866	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:11.667145014 CEST	443	49866	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:11.667226076 CEST	49866	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:11.667356014 CEST	49866	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:11.667378902 CEST	443	49866	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:11.712553024 CEST	443	49862	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:11.713229895 CEST	49862	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:11.713246107 CEST	443	49862	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:11.713697910 CEST	49862	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:11.713706017 CEST	443	49862	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:11.741585970 CEST	443	49863	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:11.742208958 CEST	49863	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:11.742302895 CEST	443	49863	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:11.742805004 CEST	49863	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:11.742815971 CEST	443	49863	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:11.810955048 CEST	443	49862	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:11.810997009 CEST	443	49862	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:11.811058998 CEST	443	49862	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:11.811074018 CEST	49862	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:11.811115026 CEST	49862	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:11.811259031 CEST	49862	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:11.811280012 CEST	443	49862	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:11.811292887 CEST	49862	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:11.811300039 CEST	443	49862	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:11.814227104 CEST	49867	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:11.814284086 CEST	443	49867	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:11.814357996 CEST	49867	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:11.814569950 CEST	49867	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:11.814588070 CEST	443	49867	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:11.839277029 CEST	443	49863	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:11.839529991 CEST	443	49863	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:11.839606047 CEST	49863	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:11.839657068 CEST	49863	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:11.839658022 CEST	49863	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:11.839680910 CEST	443	49863	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:11.839694023 CEST	443	49863	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:11.842106104 CEST	49868	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:11.842191935 CEST	443	49868	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:11.842289925 CEST	49868	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:11.842611074 CEST	49868	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:11.842629910 CEST	443	49868	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:11.865041971 CEST	443	49864	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:11.865631104 CEST	49864	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:11.865670919 CEST	443	49864	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:11.866069078 CEST	49864	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:11.866080999 CEST	443	49864	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:11.964838028 CEST	443	49864	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:11.965970039 CEST	443	49864	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:11.966073990 CEST	49864	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:11.966201067 CEST	49864	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:11.966201067 CEST	49864	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:11.966242075 CEST	443	49864	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:11.966260910 CEST	443	49864	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:11.969408989 CEST	49869	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:11.969460964 CEST	443	49869	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:11.969541073 CEST	49869	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:11.969731092 CEST	49869	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:11.969747066 CEST	443	49869	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:12.199661970 CEST	443	49865	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:12.200150967 CEST	49865	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:12.200185061 CEST	443	49865	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:12.200625896 CEST	49865	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:12.200633049 CEST	443	49865	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:12.308347940 CEST	443	49866	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:12.309144974 CEST	49866	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:12.309194088 CEST	443	49866	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:12.309634924 CEST	49866	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:12.309642076 CEST	443	49866	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:12.310714960 CEST	443	49865	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:12.317954063 CEST	443	49865	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:12.318032026 CEST	49865	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:12.318089962 CEST	49865	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:12.318089962 CEST	49865	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:12.318126917 CEST	443	49865	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:12.318152905 CEST	443	49865	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:12.321063042 CEST	49870	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:12.321111917 CEST	443	49870	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:12.321192026 CEST	49870	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:12.321383953 CEST	49870	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:12.321398973 CEST	443	49870	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:12.407917976 CEST	443	49866	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:12.408144951 CEST	443	49866	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:12.408195019 CEST	49866	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:12.408216000 CEST	443	49866	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:12.408233881 CEST	443	49866	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:12.408289909 CEST	49866	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:12.408289909 CEST	49866	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:12.408317089 CEST	49866	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:12.408330917 CEST	443	49866	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:12.411189079 CEST	49871	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:12.411245108 CEST	443	49871	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:12.411312103 CEST	49871	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:12.411582947 CEST	49871	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:12.411595106 CEST	443	49871	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:12.453219891 CEST	443	49867	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:12.453730106 CEST	49867	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:12.453792095 CEST	443	49867	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:12.454153061 CEST	49867	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:12.454169035 CEST	443	49867	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:12.478821039 CEST	443	49868	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:12.479167938 CEST	49868	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:12.479202032 CEST	443	49868	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:12.479549885 CEST	49868	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:12.479558945 CEST	443	49868	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:12.550930023 CEST	443	49867	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:12.551234961 CEST	443	49867	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:12.551342010 CEST	49867	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:12.551448107 CEST	49867	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:12.551496029 CEST	443	49867	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:12.551527977 CEST	49867	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:12.551546097 CEST	443	49867	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:12.554779053 CEST	49872	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:12.554828882 CEST	443	49872	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:12.554922104 CEST	49872	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:12.555196047 CEST	49872	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:12.555214882 CEST	443	49872	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:12.578089952 CEST	443	49868	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:12.578696012 CEST	443	49868	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:12.578762054 CEST	443	49868	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:12.578762054 CEST	49868	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:12.578815937 CEST	49868	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:12.578949928 CEST	49868	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:12.578963995 CEST	443	49868	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:12.578980923 CEST	49868	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:12.578986883 CEST	443	49868	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:12.581226110 CEST	49873	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:12.581283092 CEST	443	49873	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:12.581342936 CEST	49873	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:12.581517935 CEST	49873	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:12.581533909 CEST	443	49873	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:12.651171923 CEST	443	49869	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:12.651665926 CEST	49869	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:12.651699066 CEST	443	49869	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:12.652148962 CEST	49869	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:12.652158976 CEST	443	49869	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:12.755103111 CEST	443	49869	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:12.755268097 CEST	443	49869	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:12.755496979 CEST	49869	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:12.755923033 CEST	49869	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:12.755944967 CEST	443	49869	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:12.755963087 CEST	49869	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:12.755969048 CEST	443	49869	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:12.758903027 CEST	49874	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:12.758949995 CEST	443	49874	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:12.759032011 CEST	49874	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:12.759212971 CEST	49874	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:12.759226084 CEST	443	49874	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:12.961554050 CEST	443	49870	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:12.965400934 CEST	49870	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:12.965420008 CEST	443	49870	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:12.965867996 CEST	49870	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:12.965873003 CEST	443	49870	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:13.063047886 CEST	443	49871	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:13.063560009 CEST	49871	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:13.063606024 CEST	443	49871	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:13.063988924 CEST	49871	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:13.063994884 CEST	443	49871	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:13.078593969 CEST	443	49870	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:13.078620911 CEST	443	49870	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:13.078691006 CEST	443	49870	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:13.078732967 CEST	49870	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:13.078834057 CEST	49870	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:13.079022884 CEST	49870	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:13.079060078 CEST	443	49870	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:13.079075098 CEST	49870	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:13.079082012 CEST	443	49870	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:13.081507921 CEST	49875	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:13.081562042 CEST	443	49875	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:13.081636906 CEST	49875	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:13.081763029 CEST	49875	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:13.081783056 CEST	443	49875	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:13.162921906 CEST	443	49871	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:13.163285017 CEST	443	49871	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:13.163381100 CEST	49871	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:13.199534893 CEST	443	49872	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:13.209371090 CEST	49871	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:13.209391117 CEST	443	49871	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:13.209424973 CEST	49871	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:13.209434032 CEST	443	49871	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:13.210823059 CEST	49872	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:13.210866928 CEST	443	49872	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:13.211256981 CEST	49872	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:13.211265087 CEST	443	49872	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:13.213680029 CEST	49876	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:13.213771105 CEST	443	49876	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:13.213850975 CEST	49876	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:13.213969946 CEST	49876	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:13.213992119 CEST	443	49876	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:13.219578981 CEST	443	49873	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:13.219887018 CEST	49873	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:13.219926119 CEST	443	49873	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:13.220298052 CEST	49873	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:13.220304012 CEST	443	49873	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:13.318425894 CEST	443	49873	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:13.318466902 CEST	443	49872	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:13.318551064 CEST	443	49872	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:13.318558931 CEST	443	49873	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:13.318627119 CEST	49872	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:13.318661928 CEST	443	49872	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:13.318665981 CEST	49873	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:13.318713903 CEST	443	49872	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:13.318763018 CEST	49872	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:13.320668936 CEST	49872	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:13.320687056 CEST	443	49872	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:13.320699930 CEST	49872	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:13.320705891 CEST	443	49872	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:13.328414917 CEST	49873	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:13.328453064 CEST	443	49873	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:13.328512907 CEST	49873	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:13.328521967 CEST	443	49873	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:13.353549004 CEST	49877	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:13.353600025 CEST	443	49877	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:13.353672981 CEST	49877	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:13.357446909 CEST	49877	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:13.357465982 CEST	443	49877	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:13.364689112 CEST	49878	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:13.364703894 CEST	443	49878	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:13.364778996 CEST	49878	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:13.364885092 CEST	49878	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:13.364897966 CEST	443	49878	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:13.401704073 CEST	443	49874	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:13.411952019 CEST	49874	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:13.412010908 CEST	443	49874	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:13.422429085 CEST	49874	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:13.422444105 CEST	443	49874	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:13.518942118 CEST	443	49874	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:13.519005060 CEST	443	49874	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:13.519072056 CEST	49874	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:13.519104004 CEST	443	49874	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:13.519165039 CEST	49874	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:13.526587963 CEST	49874	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:13.526587963 CEST	49874	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:13.526640892 CEST	443	49874	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:13.526670933 CEST	443	49874	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:13.531327009 CEST	49879	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:13.531419992 CEST	443	49879	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:13.531503916 CEST	49879	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:13.531929016 CEST	49879	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:13.531977892 CEST	443	49879	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:13.726068974 CEST	443	49875	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:13.726584911 CEST	49875	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:13.726608038 CEST	443	49875	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:13.727173090 CEST	49875	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:13.727180004 CEST	443	49875	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:13.824898958 CEST	443	49875	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:13.825453997 CEST	443	49875	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:13.825539112 CEST	49875	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:13.825570107 CEST	49875	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:13.825570107 CEST	49875	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:13.825587988 CEST	443	49875	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:13.825598001 CEST	443	49875	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:13.828641891 CEST	49880	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:13.828685045 CEST	443	49880	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:13.828757048 CEST	49880	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:13.828910112 CEST	49880	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:13.828922987 CEST	443	49880	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:13.861537933 CEST	443	49876	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:13.862015963 CEST	49876	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:13.862080097 CEST	443	49876	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:13.862575054 CEST	49876	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:13.862590075 CEST	443	49876	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:13.925484896 CEST	443	49877	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:13.925918102 CEST	49877	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:13.925950050 CEST	443	49877	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:13.926537037 CEST	49877	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:13.926542997 CEST	443	49877	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:13.960813999 CEST	443	49876	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:13.960958958 CEST	443	49876	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:13.961138010 CEST	49876	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:13.961138964 CEST	49876	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:13.961138964 CEST	49876	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:13.964227915 CEST	49881	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:13.964256048 CEST	443	49881	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:13.964330912 CEST	49881	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:13.964502096 CEST	49881	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:13.964515924 CEST	443	49881	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:14.017447948 CEST	443	49878	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:14.017990112 CEST	49878	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:14.018022060 CEST	443	49878	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:14.018563986 CEST	49878	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:14.018569946 CEST	443	49878	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:14.024878979 CEST	443	49877	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:14.024947882 CEST	443	49877	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:14.025015116 CEST	49877	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:14.025024891 CEST	443	49877	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:14.025098085 CEST	443	49877	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:14.025151968 CEST	49877	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:14.025228024 CEST	49877	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:14.025245905 CEST	443	49877	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:14.025257111 CEST	49877	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:14.025263071 CEST	443	49877	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:14.028295994 CEST	49882	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:14.028311014 CEST	443	49882	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:14.028409004 CEST	49882	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:14.028546095 CEST	49882	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:14.028557062 CEST	443	49882	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:14.117366076 CEST	443	49878	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:14.117470980 CEST	443	49878	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:14.117536068 CEST	49878	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:14.117691040 CEST	49878	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:14.117702961 CEST	443	49878	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:14.117713928 CEST	49878	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:14.117718935 CEST	443	49878	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:14.120956898 CEST	49883	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:14.121006966 CEST	443	49883	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:14.121100903 CEST	49883	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:14.121268988 CEST	49883	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:14.121282101 CEST	443	49883	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:14.172282934 CEST	443	49879	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:14.172777891 CEST	49879	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:14.172861099 CEST	443	49879	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:14.173362970 CEST	49879	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:14.173377037 CEST	443	49879	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:14.270658016 CEST	443	49879	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:14.270812988 CEST	443	49879	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:14.270891905 CEST	49879	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:14.270982027 CEST	49879	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:14.271032095 CEST	443	49879	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:14.271060944 CEST	49879	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:14.271076918 CEST	443	49879	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:14.272865057 CEST	49876	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:14.272877932 CEST	443	49876	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:14.274271011 CEST	49884	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:14.274307013 CEST	443	49884	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:14.274378061 CEST	49884	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:14.274580002 CEST	49884	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:14.274591923 CEST	443	49884	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:14.495790958 CEST	443	49880	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:14.496373892 CEST	49880	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:14.496400118 CEST	443	49880	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:14.496995926 CEST	49880	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:14.497003078 CEST	443	49880	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:14.606621981 CEST	443	49880	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:14.606703997 CEST	443	49880	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:14.606759071 CEST	49880	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:14.606775999 CEST	443	49880	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:14.606829882 CEST	443	49880	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:14.606874943 CEST	49880	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:14.607105970 CEST	49880	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:14.607125998 CEST	443	49880	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:14.607141972 CEST	49880	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:14.607147932 CEST	443	49880	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:14.609664917 CEST	443	49881	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:14.610161066 CEST	49881	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:14.610183001 CEST	443	49881	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:14.610737085 CEST	49881	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:14.610742092 CEST	443	49881	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:14.611018896 CEST	49885	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:14.611116886 CEST	443	49885	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:14.611215115 CEST	49885	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:14.611455917 CEST	49885	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:14.611490965 CEST	443	49885	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:14.708364964 CEST	443	49881	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:14.708513975 CEST	443	49881	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:14.708584070 CEST	49881	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:14.708765984 CEST	49881	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:14.708779097 CEST	443	49881	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:14.708789110 CEST	49881	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:14.708792925 CEST	443	49881	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:14.711765051 CEST	49886	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:14.711813927 CEST	443	49886	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:14.711914062 CEST	49886	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:14.712073088 CEST	49886	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:14.712089062 CEST	443	49886	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:14.714258909 CEST	443	49882	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:14.714684963 CEST	49882	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:14.714693069 CEST	443	49882	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:14.715099096 CEST	49882	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:14.715106010 CEST	443	49882	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:14.751773119 CEST	443	49883	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:14.752203941 CEST	49883	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:14.752230883 CEST	443	49883	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:14.752645969 CEST	49883	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:14.752654076 CEST	443	49883	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:14.815968990 CEST	443	49882	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:14.866663933 CEST	49882	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:14.866682053 CEST	443	49882	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:14.866940975 CEST	49882	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:14.866952896 CEST	443	49882	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:14.866985083 CEST	49882	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:14.867381096 CEST	443	49882	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:14.867517948 CEST	443	49882	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:14.867564917 CEST	49882	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:14.870071888 CEST	49887	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:14.870126963 CEST	443	49887	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:14.870194912 CEST	49887	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:14.870332956 CEST	49887	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:14.870349884 CEST	443	49887	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:15.010363102 CEST	443	49883	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:15.010436058 CEST	443	49883	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:15.010603905 CEST	49883	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:15.010770082 CEST	49883	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:15.010793924 CEST	443	49883	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:15.010811090 CEST	49883	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:15.010818005 CEST	443	49883	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:15.013056993 CEST	443	49884	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:15.013528109 CEST	49884	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:15.013561964 CEST	443	49884	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:15.013859034 CEST	49888	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:15.013895988 CEST	443	49888	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:15.013978958 CEST	49888	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:15.014089108 CEST	49888	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:15.014096022 CEST	443	49888	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:15.014219999 CEST	49884	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:15.014225960 CEST	443	49884	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:15.113410950 CEST	443	49884	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:15.113569021 CEST	443	49884	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:15.113631964 CEST	443	49884	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:15.113782883 CEST	49884	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:15.113782883 CEST	49884	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:15.113905907 CEST	49884	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:15.113905907 CEST	49884	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:15.113929033 CEST	443	49884	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:15.113940954 CEST	443	49884	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:15.117471933 CEST	49889	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:15.117573977 CEST	443	49889	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:15.117702961 CEST	49889	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:15.117907047 CEST	49889	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:15.117945910 CEST	443	49889	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:15.246198893 CEST	443	49885	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:15.246855974 CEST	49885	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:15.246922970 CEST	443	49885	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:15.247328997 CEST	49885	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:15.247344017 CEST	443	49885	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:15.343574047 CEST	443	49885	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:15.343735933 CEST	443	49885	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:15.343815088 CEST	49885	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:15.343903065 CEST	49885	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:15.343929052 CEST	443	49885	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:15.343944073 CEST	49885	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:15.343951941 CEST	443	49885	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:15.346585035 CEST	49890	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:15.346618891 CEST	443	49890	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:15.346715927 CEST	49890	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:15.346829891 CEST	49890	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:15.346843004 CEST	443	49890	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:15.365716934 CEST	443	49886	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:15.366126060 CEST	49886	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:15.366148949 CEST	443	49886	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:15.366602898 CEST	49886	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:15.366609097 CEST	443	49886	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:15.467180014 CEST	443	49886	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:15.467406988 CEST	443	49886	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:15.467459917 CEST	443	49886	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:15.467484951 CEST	49886	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:15.467550993 CEST	49886	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:15.474440098 CEST	49886	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:15.474490881 CEST	443	49886	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:15.474520922 CEST	49886	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:15.474536896 CEST	443	49886	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:15.477591991 CEST	49891	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:15.477647066 CEST	443	49891	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:15.477736950 CEST	49891	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:15.477876902 CEST	49891	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:15.477901936 CEST	443	49891	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:15.657299042 CEST	443	49887	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:15.658318996 CEST	49887	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:15.658351898 CEST	443	49887	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:15.659621000 CEST	49887	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:15.659631968 CEST	443	49887	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:15.665407896 CEST	443	49888	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:15.668668032 CEST	49888	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:15.668704033 CEST	443	49888	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:15.669975996 CEST	49888	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:15.669981003 CEST	443	49888	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:15.758131981 CEST	443	49887	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:15.758300066 CEST	443	49887	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:15.758416891 CEST	49887	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:15.758474112 CEST	49887	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:15.758474112 CEST	49887	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:15.758500099 CEST	443	49887	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:15.758511066 CEST	443	49887	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:15.761035919 CEST	49892	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:15.761096001 CEST	443	49892	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:15.761174917 CEST	49892	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:15.761305094 CEST	49892	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:15.761317015 CEST	443	49892	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:15.768752098 CEST	443	49889	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:15.769120932 CEST	49889	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:15.769208908 CEST	443	49889	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:15.769543886 CEST	49889	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:15.769558907 CEST	443	49889	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:15.773256063 CEST	443	49888	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:15.773397923 CEST	443	49888	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:15.773463964 CEST	49888	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:15.774348021 CEST	49888	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:15.774353981 CEST	443	49888	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:15.774384975 CEST	49888	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:15.774389982 CEST	443	49888	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:15.776690960 CEST	49893	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:15.776731014 CEST	443	49893	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:15.776794910 CEST	49893	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:15.776891947 CEST	49893	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:15.776901960 CEST	443	49893	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:15.867503881 CEST	443	49889	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:15.867705107 CEST	443	49889	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:15.867821932 CEST	49889	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:15.877955914 CEST	49889	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:15.878006935 CEST	443	49889	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:15.878036022 CEST	49889	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:15.878051996 CEST	443	49889	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:15.880527973 CEST	49894	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:15.880569935 CEST	443	49894	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:15.880628109 CEST	49894	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:15.880759954 CEST	49894	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:15.880769968 CEST	443	49894	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:15.997392893 CEST	443	49890	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:16.003169060 CEST	49890	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:16.003207922 CEST	443	49890	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:16.003612041 CEST	49890	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:16.003621101 CEST	443	49890	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:16.100505114 CEST	443	49890	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:16.100816965 CEST	443	49890	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:16.100904942 CEST	49890	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:16.101509094 CEST	49890	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:16.101562977 CEST	443	49890	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:16.101593971 CEST	49890	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:16.101610899 CEST	443	49890	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:16.151032925 CEST	49895	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:16.151089907 CEST	443	49895	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:16.151155949 CEST	49895	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:16.151371002 CEST	49895	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:16.151393890 CEST	443	49895	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:16.166774988 CEST	443	49891	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:16.173470020 CEST	49891	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:16.173495054 CEST	443	49891	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:16.173903942 CEST	49891	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:16.173907995 CEST	443	49891	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:16.274858952 CEST	443	49891	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:16.275007963 CEST	443	49891	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:16.275078058 CEST	49891	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:16.277256966 CEST	49891	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:16.277285099 CEST	443	49891	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:16.277302027 CEST	49891	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:16.277308941 CEST	443	49891	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:16.296981096 CEST	49896	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:16.297085047 CEST	443	49896	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:16.297338963 CEST	49896	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:16.297339916 CEST	49896	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:16.297478914 CEST	443	49896	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:16.412854910 CEST	443	49892	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:16.414138079 CEST	49892	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:16.414158106 CEST	443	49892	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:16.414582014 CEST	49892	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:16.414588928 CEST	443	49892	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:16.426973104 CEST	443	49893	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:16.427408934 CEST	49893	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:16.427448988 CEST	443	49893	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:16.427747965 CEST	49893	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:16.427759886 CEST	443	49893	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:16.516297102 CEST	443	49892	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:16.516446114 CEST	443	49892	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:16.516490936 CEST	49892	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:16.516674995 CEST	49892	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:16.516700983 CEST	443	49892	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:16.516715050 CEST	49892	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:16.516721964 CEST	443	49892	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:16.521092892 CEST	49897	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:16.521143913 CEST	443	49897	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:16.521208048 CEST	49897	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:16.522222042 CEST	49897	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:16.522241116 CEST	443	49897	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:16.527991056 CEST	443	49893	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:16.528363943 CEST	443	49893	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:16.528420925 CEST	49893	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:16.536029100 CEST	49893	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:16.536060095 CEST	443	49893	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:16.536076069 CEST	49893	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:16.536083937 CEST	443	49893	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:16.538779020 CEST	49898	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:16.538793087 CEST	443	49898	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:16.538851023 CEST	49898	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:16.539021969 CEST	49898	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:16.539032936 CEST	443	49898	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:16.549886942 CEST	443	49894	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:16.550242901 CEST	49894	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:16.550268888 CEST	443	49894	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:16.550682068 CEST	49894	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:16.550693989 CEST	443	49894	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:16.654278994 CEST	443	49894	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:16.654354095 CEST	443	49894	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:16.654417038 CEST	49894	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:16.654448032 CEST	443	49894	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:16.654493093 CEST	443	49894	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:16.654540062 CEST	49894	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:16.654709101 CEST	49894	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:16.654728889 CEST	443	49894	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:16.654742002 CEST	49894	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:16.654748917 CEST	443	49894	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:16.658528090 CEST	49899	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:16.658565998 CEST	443	49899	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:16.658626080 CEST	49899	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:16.659296036 CEST	49899	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:16.659329891 CEST	443	49899	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:16.792246103 CEST	443	49895	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:16.793031931 CEST	49895	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:16.793050051 CEST	443	49895	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:16.793497086 CEST	49895	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:16.793504953 CEST	443	49895	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:16.891993046 CEST	443	49895	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:16.892153025 CEST	443	49895	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:16.892239094 CEST	49895	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:16.892278910 CEST	49895	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:16.892302990 CEST	443	49895	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:16.892318010 CEST	49895	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:16.892324924 CEST	443	49895	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:16.894799948 CEST	49900	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:16.894849062 CEST	443	49900	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:16.894925117 CEST	49900	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:16.895076036 CEST	49900	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:16.895091057 CEST	443	49900	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:16.967772961 CEST	443	49896	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:16.968360901 CEST	49896	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:16.968447924 CEST	443	49896	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:16.968794107 CEST	49896	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:16.968811989 CEST	443	49896	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:17.069793940 CEST	443	49896	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:17.069974899 CEST	443	49896	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:17.070097923 CEST	49896	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:17.071074963 CEST	49896	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:17.071119070 CEST	443	49896	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:17.071149111 CEST	49896	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:17.071163893 CEST	443	49896	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:17.073754072 CEST	49901	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:17.073853016 CEST	443	49901	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:17.073962927 CEST	49901	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:17.074085951 CEST	49901	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:17.074105024 CEST	443	49901	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:17.179582119 CEST	443	49898	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:17.182632923 CEST	49898	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:17.182682991 CEST	443	49898	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:17.182967901 CEST	49898	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:17.182976007 CEST	443	49898	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:17.189750910 CEST	443	49897	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:17.190803051 CEST	49897	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:17.190819025 CEST	443	49897	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:17.191395044 CEST	49897	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:17.191401005 CEST	443	49897	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:17.279452085 CEST	443	49898	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:17.279505968 CEST	443	49898	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:17.279582024 CEST	443	49898	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:17.279599905 CEST	49898	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:17.279638052 CEST	49898	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:17.279869080 CEST	49898	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:17.279894114 CEST	443	49898	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:17.279907942 CEST	49898	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:17.279917002 CEST	443	49898	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:17.282675982 CEST	49902	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:17.282738924 CEST	443	49902	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:17.282838106 CEST	49902	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:17.282973051 CEST	49902	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:17.282989025 CEST	443	49902	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:17.291085958 CEST	443	49897	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:17.291232109 CEST	443	49897	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:17.291310072 CEST	49897	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:17.291456938 CEST	49897	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:17.291464090 CEST	443	49897	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:17.291476965 CEST	49897	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:17.291485071 CEST	443	49897	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:17.293661118 CEST	49903	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:17.293713093 CEST	443	49903	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:17.293800116 CEST	49903	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:17.293915033 CEST	49903	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:17.293932915 CEST	443	49903	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:17.302165985 CEST	443	49899	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:17.302846909 CEST	49899	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:17.302881002 CEST	443	49899	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:17.303436995 CEST	49899	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:17.303445101 CEST	443	49899	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:17.401377916 CEST	443	49899	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:17.401449919 CEST	443	49899	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:17.401571035 CEST	443	49899	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:17.401650906 CEST	49899	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:17.401765108 CEST	49899	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:17.401791096 CEST	443	49899	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:17.401806116 CEST	49899	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:17.401813030 CEST	443	49899	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:17.404823065 CEST	49904	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:17.404871941 CEST	443	49904	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:17.405069113 CEST	49904	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:17.405297041 CEST	49904	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:17.405317068 CEST	443	49904	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:17.537401915 CEST	443	49900	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:17.539266109 CEST	49900	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:17.539303064 CEST	443	49900	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:17.539629936 CEST	49900	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:17.539639950 CEST	443	49900	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:17.635763884 CEST	443	49900	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:17.635826111 CEST	443	49900	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:17.635895014 CEST	49900	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:17.635929108 CEST	443	49900	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:17.635957003 CEST	443	49900	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:17.636027098 CEST	49900	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:17.636256933 CEST	49900	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:17.636275053 CEST	443	49900	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:17.636293888 CEST	49900	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:17.636301041 CEST	443	49900	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:17.639194965 CEST	49905	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:17.639235020 CEST	443	49905	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:17.639302969 CEST	49905	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:17.639520884 CEST	49905	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:17.639533997 CEST	443	49905	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:17.749727011 CEST	443	49901	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:17.750252008 CEST	49901	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:17.750283003 CEST	443	49901	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:17.750695944 CEST	49901	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:17.750705957 CEST	443	49901	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:17.856874943 CEST	443	49901	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:17.856950045 CEST	443	49901	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:17.857084036 CEST	49901	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:17.857275963 CEST	49901	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:17.857325077 CEST	443	49901	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:17.857355118 CEST	49901	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:17.857371092 CEST	443	49901	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:17.860443115 CEST	49906	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:17.860481977 CEST	443	49906	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:17.860544920 CEST	49906	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:17.860726118 CEST	49906	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:17.860742092 CEST	443	49906	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:17.875144958 CEST	443	49903	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:17.875771046 CEST	49903	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:17.875797033 CEST	443	49903	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:17.876367092 CEST	49903	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:17.876374960 CEST	443	49903	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:17.914045095 CEST	443	49902	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:17.914570093 CEST	49902	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:17.914596081 CEST	443	49902	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:17.915014982 CEST	49902	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:17.915020943 CEST	443	49902	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:17.976973057 CEST	443	49903	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:17.977142096 CEST	443	49903	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:17.977210999 CEST	49903	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:17.977335930 CEST	49903	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:17.977356911 CEST	443	49903	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:17.977374077 CEST	49903	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:17.977380991 CEST	443	49903	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:17.980365038 CEST	49907	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:17.980417967 CEST	443	49907	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:17.980494976 CEST	49907	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:17.980683088 CEST	49907	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:17.980705023 CEST	443	49907	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:18.011965990 CEST	443	49902	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:18.012128115 CEST	443	49902	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:18.012180090 CEST	443	49902	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:18.012181044 CEST	49902	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:18.012238979 CEST	49902	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:18.012409925 CEST	49902	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:18.012432098 CEST	443	49902	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:18.012445927 CEST	49902	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:18.012453079 CEST	443	49902	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:18.014992952 CEST	49908	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:18.015084982 CEST	443	49908	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:18.015352011 CEST	49908	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:18.015674114 CEST	49908	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:18.015712976 CEST	443	49908	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:18.232872009 CEST	443	49904	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:18.237458944 CEST	49904	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:18.237494946 CEST	443	49904	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:18.238277912 CEST	49904	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:18.238285065 CEST	443	49904	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:18.342592001 CEST	443	49904	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:18.342612028 CEST	443	49904	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:18.342660904 CEST	443	49904	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:18.342690945 CEST	49904	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:18.342749119 CEST	49904	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:18.343003988 CEST	49904	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:18.343022108 CEST	443	49904	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:18.343051910 CEST	49904	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:18.343058109 CEST	443	49904	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:18.346390009 CEST	49909	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:18.346420050 CEST	443	49909	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:18.346612930 CEST	49909	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:18.346688032 CEST	49909	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:18.346698999 CEST	443	49909	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:18.497157097 CEST	443	49906	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:18.498460054 CEST	49906	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:18.498461008 CEST	49906	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:18.498478889 CEST	443	49906	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:18.498497009 CEST	443	49906	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:18.596519947 CEST	443	49906	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:18.596565962 CEST	443	49906	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:18.596616983 CEST	443	49906	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:18.596695900 CEST	49906	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:18.599370956 CEST	49906	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:18.603694916 CEST	49906	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:18.603694916 CEST	49906	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:18.603719950 CEST	443	49906	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:18.603732109 CEST	443	49906	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:18.607418060 CEST	49910	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:18.607458115 CEST	443	49910	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:18.607642889 CEST	49910	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:18.608752012 CEST	49910	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:18.608762026 CEST	443	49910	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:18.647440910 CEST	443	49907	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:18.647954941 CEST	49907	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:18.647984028 CEST	443	49907	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:18.648869991 CEST	49907	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:18.648876905 CEST	443	49907	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:18.653872967 CEST	443	49908	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:18.654284000 CEST	49908	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:18.654346943 CEST	443	49908	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:18.656526089 CEST	49908	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:18.656539917 CEST	443	49908	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:18.748899937 CEST	443	49907	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:18.749171019 CEST	443	49907	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:18.749243021 CEST	49907	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:18.749489069 CEST	49907	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:18.749489069 CEST	49907	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:18.749509096 CEST	443	49907	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:18.749520063 CEST	443	49907	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:18.753140926 CEST	443	49908	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:18.753252983 CEST	443	49908	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:18.753315926 CEST	49908	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:18.754487038 CEST	49908	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:18.754515886 CEST	443	49908	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:18.754539967 CEST	49908	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:18.754549026 CEST	443	49908	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:18.754930973 CEST	49911	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:18.754959106 CEST	443	49911	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:18.755031109 CEST	49911	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:18.755398035 CEST	49911	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:18.755414963 CEST	443	49911	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:18.757153988 CEST	49912	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:18.757205009 CEST	443	49912	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:18.757409096 CEST	49912	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:18.757566929 CEST	49912	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:18.757585049 CEST	443	49912	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:19.191241026 CEST	443	49909	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:19.192183018 CEST	49909	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:19.192205906 CEST	443	49909	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:19.192599058 CEST	49909	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:19.192605972 CEST	443	49909	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:19.289746046 CEST	443	49910	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:19.293483973 CEST	49910	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:19.293497086 CEST	443	49910	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:19.293853045 CEST	49910	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:19.293858051 CEST	443	49910	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:19.294929028 CEST	443	49909	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:19.295082092 CEST	443	49909	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:19.295309067 CEST	49909	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:19.295309067 CEST	49909	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:19.295309067 CEST	49909	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:19.298670053 CEST	49913	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:19.298705101 CEST	443	49913	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:19.299189091 CEST	49913	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:19.299298048 CEST	49913	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:19.299304962 CEST	443	49913	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:19.393459082 CEST	443	49911	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:19.394118071 CEST	49911	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:19.394182920 CEST	443	49911	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:19.394558907 CEST	49911	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:19.394573927 CEST	443	49911	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:19.394972086 CEST	443	49910	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:19.395071030 CEST	443	49910	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:19.395117998 CEST	443	49910	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:19.395169020 CEST	49910	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:19.395184040 CEST	49910	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:19.395320892 CEST	49910	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:19.395322084 CEST	49910	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:19.395339966 CEST	443	49910	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:19.395354033 CEST	443	49910	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:19.398017883 CEST	49914	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:19.398050070 CEST	443	49914	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:19.398117065 CEST	49914	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:19.398304939 CEST	49914	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:19.398322105 CEST	443	49914	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:19.400707960 CEST	443	49912	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:19.402031898 CEST	49912	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:19.402096987 CEST	443	49912	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:19.402458906 CEST	49912	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:19.402473927 CEST	443	49912	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:19.494900942 CEST	443	49911	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:19.495002985 CEST	443	49911	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:19.495112896 CEST	49911	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:19.495342970 CEST	49911	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:19.495342970 CEST	49911	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:19.495409012 CEST	443	49911	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:19.495436907 CEST	443	49911	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:19.498014927 CEST	49915	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:19.498128891 CEST	443	49915	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:19.499205112 CEST	443	49912	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:19.499274969 CEST	443	49912	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:19.499324083 CEST	49915	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:19.499375105 CEST	443	49912	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:19.499428034 CEST	49912	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:19.499485016 CEST	49915	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:19.499517918 CEST	443	49915	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:19.499543905 CEST	49912	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:19.499543905 CEST	49912	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:19.499586105 CEST	49912	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:19.499605894 CEST	443	49912	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:19.501687050 CEST	49916	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:19.501753092 CEST	443	49916	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:19.501977921 CEST	49916	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:19.502155066 CEST	49916	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:19.502171993 CEST	443	49916	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:19.601125002 CEST	49909	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:19.601165056 CEST	443	49909	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:19.958861113 CEST	443	49913	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:19.959445953 CEST	49913	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:19.959472895 CEST	443	49913	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:19.960235119 CEST	49913	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:19.960239887 CEST	443	49913	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:20.048752069 CEST	443	49914	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:20.049241066 CEST	49914	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:20.049273968 CEST	443	49914	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:20.049820900 CEST	49914	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:20.049827099 CEST	443	49914	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:20.059567928 CEST	443	49913	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:20.059976101 CEST	443	49913	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:20.060045004 CEST	49913	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:20.060086966 CEST	49913	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:20.060107946 CEST	443	49913	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:20.060120106 CEST	49913	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:20.060126066 CEST	443	49913	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:20.063173056 CEST	49917	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:20.063232899 CEST	443	49917	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:20.063334942 CEST	49917	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:20.063510895 CEST	49917	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:20.063529015 CEST	443	49917	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:20.148529053 CEST	443	49914	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:20.148595095 CEST	443	49914	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:20.148653984 CEST	443	49914	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:20.148674965 CEST	49914	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:20.148830891 CEST	49914	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:20.149019957 CEST	49914	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:20.149034023 CEST	443	49914	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:20.149044991 CEST	49914	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:20.149049997 CEST	443	49914	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:20.152602911 CEST	49918	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:20.152667046 CEST	443	49918	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:20.152808905 CEST	49918	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:20.153042078 CEST	49918	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:20.153062105 CEST	443	49918	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:20.163580894 CEST	443	49915	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:20.164232969 CEST	49915	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:20.164263964 CEST	443	49915	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:20.164907932 CEST	49915	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:20.164913893 CEST	443	49915	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:20.186145067 CEST	443	49916	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:20.186806917 CEST	49916	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:20.186836004 CEST	443	49916	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:20.187191963 CEST	49916	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:20.187199116 CEST	443	49916	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:20.265753984 CEST	443	49915	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:20.265875101 CEST	443	49915	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:20.266161919 CEST	49915	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:20.266206026 CEST	49915	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:20.266225100 CEST	443	49915	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:20.266242027 CEST	49915	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:20.266248941 CEST	443	49915	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:20.269785881 CEST	49919	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:20.269820929 CEST	443	49919	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:20.270010948 CEST	49919	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:20.270010948 CEST	49919	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:20.270035982 CEST	443	49919	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:20.289932013 CEST	443	49916	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:20.290081024 CEST	443	49916	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:20.290199995 CEST	49916	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:20.290503979 CEST	49916	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:20.290503979 CEST	49916	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:20.290525913 CEST	443	49916	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:20.290534973 CEST	443	49916	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:20.292776108 CEST	49920	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:20.292830944 CEST	443	49920	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:20.292907000 CEST	49920	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:20.293029070 CEST	49920	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:20.293045044 CEST	443	49920	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:20.869220972 CEST	443	49905	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:20.873259068 CEST	443	49918	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:20.875403881 CEST	49905	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:20.875421047 CEST	443	49905	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:20.875639915 CEST	49905	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:20.875648975 CEST	443	49905	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:20.879755020 CEST	49918	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:20.879789114 CEST	443	49918	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:20.879793882 CEST	443	49917	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:20.884603024 CEST	49918	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:20.884608030 CEST	443	49918	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:20.884855986 CEST	49917	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:20.884862900 CEST	443	49917	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:20.885219097 CEST	49917	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:20.885224104 CEST	443	49917	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:20.931787014 CEST	443	49919	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:20.934473038 CEST	443	49920	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:20.936625004 CEST	49919	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:20.936652899 CEST	443	49919	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:20.941431999 CEST	49919	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:20.941441059 CEST	443	49919	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:20.946053028 CEST	49920	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:20.946078062 CEST	443	49920	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:20.950261116 CEST	49920	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:20.950274944 CEST	443	49920	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:20.971139908 CEST	443	49905	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:20.971205950 CEST	443	49905	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:20.971317053 CEST	443	49905	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:20.971381903 CEST	49905	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:20.972532988 CEST	49905	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:20.973125935 CEST	49905	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:20.973126888 CEST	49905	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:20.973153114 CEST	443	49905	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:20.973162889 CEST	443	49905	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:20.983160973 CEST	443	49918	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:20.983330965 CEST	443	49918	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:20.983412027 CEST	49918	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:20.984785080 CEST	49918	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:20.984802008 CEST	443	49918	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:20.984812021 CEST	49918	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:20.984817028 CEST	443	49918	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:20.985490084 CEST	443	49917	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:20.986382008 CEST	443	49917	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:20.986449957 CEST	49917	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:20.988779068 CEST	49917	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:20.988782883 CEST	443	49917	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:20.988816977 CEST	49917	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:20.988820076 CEST	443	49917	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:21.038638115 CEST	443	49919	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:21.038733959 CEST	443	49919	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:21.038820982 CEST	49919	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:21.045528889 CEST	443	49920	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:21.046026945 CEST	443	49920	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:21.046077967 CEST	49920	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:21.046103954 CEST	443	49920	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:21.046135902 CEST	443	49920	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:21.046180964 CEST	49920	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:21.056740046 CEST	49921	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:21.056802034 CEST	443	49921	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:21.056910038 CEST	49921	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:21.069633961 CEST	49922	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:21.069672108 CEST	443	49922	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:21.069762945 CEST	49922	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:21.070660114 CEST	49923	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:21.070708036 CEST	443	49923	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:21.070779085 CEST	49923	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:21.081656933 CEST	49923	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:21.081675053 CEST	443	49923	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:21.081737995 CEST	49922	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:21.081772089 CEST	443	49922	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:21.081856012 CEST	49919	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:21.081886053 CEST	443	49919	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:21.081898928 CEST	49919	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:21.081906080 CEST	443	49919	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:21.094377995 CEST	49920	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:21.094393969 CEST	443	49920	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:21.094403982 CEST	49920	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:21.094408035 CEST	443	49920	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:21.094760895 CEST	49924	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:21.094806910 CEST	443	49924	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:21.094860077 CEST	49924	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:21.094927073 CEST	49921	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:21.094960928 CEST	443	49921	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:21.095459938 CEST	49924	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:21.095479012 CEST	443	49924	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:21.096921921 CEST	49925	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:21.096961021 CEST	443	49925	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:21.097018957 CEST	49925	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:21.097183943 CEST	49925	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:21.097202063 CEST	443	49925	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:21.736104012 CEST	443	49924	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:21.736562967 CEST	49924	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:21.736633062 CEST	443	49924	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:21.736985922 CEST	49924	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:21.737005949 CEST	443	49924	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:21.741861105 CEST	443	49925	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:21.742201090 CEST	49925	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:21.742237091 CEST	443	49925	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:21.742604017 CEST	49925	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:21.742613077 CEST	443	49925	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:21.743536949 CEST	443	49923	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:21.743910074 CEST	49923	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:21.743942022 CEST	443	49923	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:21.744529009 CEST	49923	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:21.744534969 CEST	443	49923	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:21.749402046 CEST	443	49921	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:21.749713898 CEST	49921	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:21.749747038 CEST	443	49921	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:21.750227928 CEST	49921	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:21.750236034 CEST	443	49921	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:21.758306980 CEST	443	49922	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:21.758655071 CEST	49922	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:21.758692980 CEST	443	49922	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:21.759200096 CEST	49922	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:21.759211063 CEST	443	49922	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:21.834651947 CEST	443	49924	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:21.834722996 CEST	443	49924	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:21.834841967 CEST	443	49924	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:21.834850073 CEST	49924	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:21.834909916 CEST	49924	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:21.835239887 CEST	49924	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:21.835262060 CEST	443	49924	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:21.835277081 CEST	49924	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:21.835283041 CEST	443	49924	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:21.838395119 CEST	49926	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:21.838454008 CEST	443	49926	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:21.838560104 CEST	49926	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:21.838761091 CEST	49926	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:21.838777065 CEST	443	49926	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:21.842926025 CEST	443	49925	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:21.843077898 CEST	443	49925	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:21.843146086 CEST	49925	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:21.843203068 CEST	49925	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:21.843218088 CEST	443	49925	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:21.843240023 CEST	49925	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:21.843245983 CEST	443	49925	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:21.845793962 CEST	49927	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:21.845845938 CEST	443	49927	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:21.846004009 CEST	49927	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:21.846211910 CEST	49927	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:21.846241951 CEST	443	49927	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:21.846362114 CEST	443	49923	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:21.846637011 CEST	443	49923	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:21.846693039 CEST	49923	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:21.846724987 CEST	49923	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:21.846743107 CEST	443	49923	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:21.846755981 CEST	49923	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:21.846761942 CEST	443	49923	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:21.849020004 CEST	49928	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:21.849057913 CEST	443	49928	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:21.849133968 CEST	49928	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:21.849319935 CEST	49928	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:21.849334955 CEST	443	49928	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:21.849852085 CEST	443	49921	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:21.850037098 CEST	443	49921	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:21.850107908 CEST	49921	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:21.850147009 CEST	49921	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:21.850169897 CEST	443	49921	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:21.850183964 CEST	49921	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:21.850191116 CEST	443	49921	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:21.852346897 CEST	49929	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:21.852382898 CEST	443	49929	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:21.852463961 CEST	49929	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:21.858016014 CEST	49929	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:21.858031034 CEST	443	49929	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:21.862374067 CEST	443	49922	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:21.862494946 CEST	443	49922	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:21.862546921 CEST	443	49922	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:21.862571955 CEST	49922	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:21.862626076 CEST	49922	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:21.862704992 CEST	49922	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:21.862761021 CEST	443	49922	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:21.862797022 CEST	49922	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:21.862813950 CEST	443	49922	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:21.865454912 CEST	49930	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:21.865466118 CEST	443	49930	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:21.865525007 CEST	49930	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:21.865691900 CEST	49930	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:21.865704060 CEST	443	49930	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:22.482745886 CEST	443	49927	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:22.483237982 CEST	49927	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:22.483300924 CEST	443	49927	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:22.483664989 CEST	49927	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:22.483680964 CEST	443	49927	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:22.489320040 CEST	443	49926	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:22.489648104 CEST	49926	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:22.489685059 CEST	443	49926	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:22.490041018 CEST	49926	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:22.490048885 CEST	443	49926	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:22.506299973 CEST	443	49930	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:22.506597996 CEST	49930	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:22.506628990 CEST	443	49930	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:22.506963968 CEST	49930	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:22.506968975 CEST	443	49930	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:22.524621010 CEST	443	49929	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:22.524931908 CEST	49929	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:22.524945021 CEST	443	49929	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:22.525291920 CEST	49929	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:22.525296926 CEST	443	49929	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:22.581885099 CEST	443	49927	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:22.582053900 CEST	443	49927	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:22.582145929 CEST	49927	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:22.582191944 CEST	49927	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:22.582215071 CEST	443	49927	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:22.582230091 CEST	49927	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:22.582236052 CEST	443	49927	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:22.584706068 CEST	49931	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:22.584752083 CEST	443	49931	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:22.584849119 CEST	49931	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:22.584964991 CEST	49931	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:22.584980011 CEST	443	49931	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:22.590383053 CEST	443	49926	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:22.590454102 CEST	443	49926	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:22.590503931 CEST	49926	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:22.590529919 CEST	443	49926	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:22.590578079 CEST	443	49926	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:22.590583086 CEST	49926	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:22.590583086 CEST	49926	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:22.590626001 CEST	443	49926	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:22.592489004 CEST	49932	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:22.592530966 CEST	443	49932	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:22.592606068 CEST	49932	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:22.592725039 CEST	49932	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:22.592732906 CEST	443	49932	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:22.601109982 CEST	49926	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:22.601134062 CEST	443	49926	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:22.606599092 CEST	443	49930	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:22.606669903 CEST	443	49930	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:22.606725931 CEST	49930	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:22.606746912 CEST	443	49930	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:22.606792927 CEST	443	49930	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:22.606838942 CEST	49930	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:22.606880903 CEST	49930	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:22.606892109 CEST	443	49930	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:22.606900930 CEST	49930	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:22.606904984 CEST	443	49930	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:22.608800888 CEST	49933	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:22.608884096 CEST	443	49933	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:22.609091997 CEST	49933	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:22.609198093 CEST	49933	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:22.609220028 CEST	443	49933	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:22.626693964 CEST	443	49929	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:22.626744986 CEST	443	49929	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:22.626796961 CEST	49929	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:22.626807928 CEST	443	49929	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:22.626873016 CEST	443	49929	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:22.626882076 CEST	49929	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:22.626910925 CEST	49929	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:22.626919985 CEST	443	49929	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:22.626926899 CEST	443	49929	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:22.626930952 CEST	49929	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:22.626934052 CEST	443	49929	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:22.628753901 CEST	49934	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:22.628783941 CEST	443	49934	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:22.628870964 CEST	49934	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:22.628981113 CEST	49934	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:22.628993988 CEST	443	49934	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:23.217578888 CEST	443	49931	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:23.218182087 CEST	49931	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:23.218205929 CEST	443	49931	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:23.218650103 CEST	49931	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:23.218656063 CEST	443	49931	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:23.265218973 CEST	443	49934	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:23.265948057 CEST	49934	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:23.266006947 CEST	443	49934	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:23.266511917 CEST	49934	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:23.266525030 CEST	443	49934	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:23.268718004 CEST	443	49932	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:23.269171000 CEST	49932	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:23.269196987 CEST	443	49932	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:23.269633055 CEST	49932	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:23.269637108 CEST	443	49932	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:23.285113096 CEST	443	49933	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:23.285788059 CEST	49933	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:23.285809994 CEST	443	49933	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:23.286233902 CEST	49933	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:23.286245108 CEST	443	49933	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:23.319457054 CEST	443	49931	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:23.319541931 CEST	443	49931	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:23.319602013 CEST	49931	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:23.320055008 CEST	49931	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:23.320055008 CEST	49931	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:23.320081949 CEST	443	49931	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:23.320091963 CEST	443	49931	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:23.322866917 CEST	49935	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:23.322916031 CEST	443	49935	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:23.322976112 CEST	49935	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:23.323148966 CEST	49935	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:23.323164940 CEST	443	49935	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:23.365622044 CEST	443	49934	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:23.365664005 CEST	443	49934	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:23.365720034 CEST	443	49934	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:23.365781069 CEST	49934	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:23.365781069 CEST	49934	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:23.366162062 CEST	49934	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:23.366199017 CEST	443	49934	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:23.366255999 CEST	49934	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:23.366271973 CEST	443	49934	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:23.370496035 CEST	443	49932	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:23.370594025 CEST	443	49932	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:23.370666981 CEST	49932	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:23.370686054 CEST	443	49932	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:23.370712042 CEST	443	49932	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:23.370757103 CEST	49932	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:23.371737003 CEST	49936	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:23.371792078 CEST	443	49936	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:23.371849060 CEST	49936	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:23.371917009 CEST	49932	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:23.371927977 CEST	443	49932	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:23.371937990 CEST	49932	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:23.371942043 CEST	443	49932	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:23.372926950 CEST	49936	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:23.372948885 CEST	443	49936	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:23.373954058 CEST	49937	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:23.373997927 CEST	443	49937	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:23.374062061 CEST	49937	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:23.374160051 CEST	49937	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:23.374170065 CEST	443	49937	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:23.389926910 CEST	443	49933	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:23.390001059 CEST	443	49933	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:23.390147924 CEST	49933	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:23.390342951 CEST	49933	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:23.390367985 CEST	443	49933	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:23.390393019 CEST	49933	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:23.390419960 CEST	443	49933	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:23.392700911 CEST	49938	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:23.392750978 CEST	443	49938	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:23.392832041 CEST	49938	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:23.392949104 CEST	49938	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:23.392960072 CEST	443	49938	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:23.963355064 CEST	443	49935	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:23.966561079 CEST	49935	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:23.966598988 CEST	443	49935	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:23.970060110 CEST	49935	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:23.970067024 CEST	443	49935	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:24.012202978 CEST	443	49936	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:24.012550116 CEST	49936	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:24.012581110 CEST	443	49936	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:24.012923002 CEST	49936	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:24.012931108 CEST	443	49936	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:24.022392035 CEST	443	49937	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:24.022820950 CEST	49937	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:24.022855997 CEST	443	49937	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:24.023341894 CEST	49937	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:24.023350000 CEST	443	49937	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:24.061971903 CEST	443	49938	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:24.062453032 CEST	49938	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:24.062478065 CEST	443	49938	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:24.062712908 CEST	49938	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:24.062717915 CEST	443	49938	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:24.064802885 CEST	443	49935	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:24.064877033 CEST	443	49935	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:24.064930916 CEST	49935	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:24.065035105 CEST	49935	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:24.065053940 CEST	443	49935	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:24.065066099 CEST	49935	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:24.065078974 CEST	443	49935	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:24.067545891 CEST	49939	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:24.067593098 CEST	443	49939	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:24.067667961 CEST	49939	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:24.067812920 CEST	49939	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:24.067827940 CEST	443	49939	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:24.112401009 CEST	443	49936	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:24.112545013 CEST	443	49936	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:24.112587929 CEST	443	49936	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:24.112720966 CEST	49936	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:24.112720966 CEST	49936	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:24.112720966 CEST	49936	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:24.112720966 CEST	49936	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:24.114800930 CEST	49940	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:24.114835024 CEST	443	49940	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:24.114909887 CEST	49940	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:24.115039110 CEST	49940	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:24.115050077 CEST	443	49940	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:24.122984886 CEST	443	49937	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:24.123317957 CEST	443	49937	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:24.123364925 CEST	49937	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:24.123389006 CEST	49937	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:24.123403072 CEST	443	49937	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:24.123414993 CEST	49937	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:24.123419046 CEST	443	49937	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:24.125286102 CEST	49941	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:24.125313997 CEST	443	49941	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:24.125377893 CEST	49941	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:24.125525951 CEST	49941	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:24.125536919 CEST	443	49941	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:24.179229021 CEST	443	49938	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:24.179291010 CEST	443	49938	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:24.179333925 CEST	443	49938	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:24.179420948 CEST	49938	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:24.179635048 CEST	49938	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:24.179653883 CEST	443	49938	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:24.179666042 CEST	49938	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:24.179672003 CEST	443	49938	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:24.182091951 CEST	49942	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:24.182130098 CEST	443	49942	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:24.182205915 CEST	49942	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:24.182351112 CEST	49942	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:24.182360888 CEST	443	49942	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:24.413698912 CEST	49936	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:24.413734913 CEST	443	49936	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:24.778881073 CEST	443	49940	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:24.779448032 CEST	49940	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:24.779527903 CEST	443	49940	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:24.779890060 CEST	49940	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:24.779903889 CEST	443	49940	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:24.780937910 CEST	443	49941	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:24.781301022 CEST	49941	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:24.781326056 CEST	443	49941	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:24.781698942 CEST	49941	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:24.781706095 CEST	443	49941	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:24.794375896 CEST	443	49939	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:24.794768095 CEST	49939	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:24.794802904 CEST	443	49939	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:24.795172930 CEST	49939	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:24.795185089 CEST	443	49939	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:24.847547054 CEST	443	49942	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:24.848063946 CEST	49942	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:24.848107100 CEST	443	49942	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:24.848500013 CEST	49942	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:24.848505974 CEST	443	49942	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:24.878298044 CEST	443	49940	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:24.878398895 CEST	443	49940	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:24.878501892 CEST	49940	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:24.878658056 CEST	49940	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:24.878659010 CEST	49940	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:24.878706932 CEST	443	49940	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:24.878736973 CEST	443	49940	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:24.881398916 CEST	49943	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:24.881454945 CEST	443	49943	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:24.881565094 CEST	49943	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:24.881716013 CEST	49943	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:24.881735086 CEST	443	49943	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:24.882538080 CEST	443	49941	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:24.882895947 CEST	443	49941	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:24.882957935 CEST	443	49941	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:24.882987976 CEST	49941	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:24.883018017 CEST	49941	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:24.883058071 CEST	49941	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:24.883079052 CEST	443	49941	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:24.883090019 CEST	49941	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:24.883095026 CEST	443	49941	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:24.884789944 CEST	49944	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:24.884828091 CEST	443	49944	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:24.884897947 CEST	49944	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:24.884991884 CEST	49944	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:24.885005951 CEST	443	49944	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:24.898309946 CEST	443	49939	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:24.898402929 CEST	443	49939	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:24.898452997 CEST	49939	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:24.898535967 CEST	49939	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:24.898557901 CEST	443	49939	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:24.898581028 CEST	49939	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:24.898590088 CEST	443	49939	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:24.900479078 CEST	49945	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:24.900525093 CEST	443	49945	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:24.900599957 CEST	49945	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:24.900727034 CEST	49945	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:24.900744915 CEST	443	49945	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:24.927943945 CEST	443	49928	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:24.928319931 CEST	49928	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:24.928337097 CEST	443	49928	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:24.928730965 CEST	49928	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:24.928736925 CEST	443	49928	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:24.949461937 CEST	443	49942	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:24.949764967 CEST	443	49942	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:24.949906111 CEST	49942	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:24.951766014 CEST	49942	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:24.951766014 CEST	49942	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:24.951776028 CEST	49946	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:24.951786995 CEST	443	49942	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:24.951797962 CEST	443	49942	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:24.951823950 CEST	443	49946	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:24.951894999 CEST	49946	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:24.952013016 CEST	49946	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:24.952028036 CEST	443	49946	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:25.027513027 CEST	443	49928	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:25.027580023 CEST	443	49928	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:25.027631998 CEST	49928	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:25.027647972 CEST	443	49928	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:25.027827024 CEST	49928	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:25.027831078 CEST	443	49928	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:25.027837992 CEST	49928	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:25.027882099 CEST	49928	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:25.027888060 CEST	443	49928	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:25.027910948 CEST	443	49928	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:25.030101061 CEST	49947	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:25.030170918 CEST	443	49947	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:25.030246019 CEST	49947	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:25.030404091 CEST	49947	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:25.030427933 CEST	443	49947	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:25.515532017 CEST	443	49943	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:25.516074896 CEST	49943	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:25.516159058 CEST	443	49943	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:25.516598940 CEST	49943	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:25.516613007 CEST	443	49943	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:25.547966003 CEST	443	49944	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:25.548497915 CEST	49944	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:25.548521996 CEST	443	49944	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:25.548922062 CEST	49944	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:25.548928976 CEST	443	49944	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:25.561904907 CEST	443	49945	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:25.562221050 CEST	49945	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:25.562258005 CEST	443	49945	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:25.562565088 CEST	49945	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:25.562577963 CEST	443	49945	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:25.614588022 CEST	443	49943	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:25.614837885 CEST	443	49943	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:25.614911079 CEST	49943	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:25.614995003 CEST	49943	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:25.614995003 CEST	49943	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:25.615045071 CEST	443	49943	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:25.615073919 CEST	443	49943	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:25.616277933 CEST	443	49946	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:25.616655111 CEST	49946	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:25.616684914 CEST	443	49946	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:25.617424965 CEST	49946	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:25.617435932 CEST	443	49946	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:25.618056059 CEST	49948	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:25.618103027 CEST	443	49948	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:25.618165016 CEST	49948	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:25.618313074 CEST	49948	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:25.618330956 CEST	443	49948	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:25.651077032 CEST	443	49944	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:25.651328087 CEST	443	49944	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:25.651388884 CEST	49944	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:25.651396036 CEST	443	49944	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:25.651454926 CEST	49944	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:25.651484966 CEST	49944	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:25.651484966 CEST	49944	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:25.651504993 CEST	443	49944	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:25.651515007 CEST	443	49944	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:25.653740883 CEST	49949	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:25.653775930 CEST	443	49949	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:25.653832912 CEST	49949	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:25.654103041 CEST	49949	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:25.654118061 CEST	443	49949	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:25.665374041 CEST	443	49945	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:25.667061090 CEST	443	49945	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:25.667123079 CEST	49945	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:25.667167902 CEST	49945	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:25.667167902 CEST	49945	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:25.667191982 CEST	443	49945	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:25.667202950 CEST	443	49945	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:25.669496059 CEST	49950	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:25.669528961 CEST	443	49950	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:25.669620037 CEST	49950	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:25.669770002 CEST	49950	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:25.669780970 CEST	443	49950	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:25.713802099 CEST	443	49947	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:25.714253902 CEST	49947	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:25.714283943 CEST	443	49947	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:25.714855909 CEST	49947	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:25.714864016 CEST	443	49947	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:25.719312906 CEST	443	49946	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:25.719350100 CEST	443	49946	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:25.719408035 CEST	49946	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:25.719420910 CEST	443	49946	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:25.719464064 CEST	49946	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:25.719688892 CEST	49946	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:25.719713926 CEST	443	49946	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:25.719728947 CEST	49946	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:25.719737053 CEST	443	49946	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:25.722239971 CEST	49951	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:25.722286940 CEST	443	49951	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:25.722342968 CEST	49951	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:25.722508907 CEST	49951	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:25.722523928 CEST	443	49951	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:25.815316916 CEST	443	49947	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:25.815603971 CEST	443	49947	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:25.815681934 CEST	49947	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:25.815726995 CEST	49947	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:25.815726995 CEST	49947	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:25.815746069 CEST	443	49947	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:25.815757036 CEST	443	49947	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:25.818316936 CEST	49952	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:25.818366051 CEST	443	49952	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:25.818469048 CEST	49952	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:25.818598986 CEST	49952	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:25.818608999 CEST	443	49952	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:26.249906063 CEST	443	49948	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:26.250551939 CEST	49948	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:26.250574112 CEST	443	49948	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:26.251003027 CEST	49948	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:26.251009941 CEST	443	49948	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:26.292324066 CEST	443	49949	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:26.323823929 CEST	443	49950	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:26.335768938 CEST	49949	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:26.354919910 CEST	49949	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:26.354950905 CEST	443	49949	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:26.355163097 CEST	443	49948	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:26.355284929 CEST	443	49948	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:26.355350018 CEST	49948	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:26.355492115 CEST	49949	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:26.355503082 CEST	443	49949	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:26.356013060 CEST	49950	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:26.356028080 CEST	443	49950	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:26.356363058 CEST	49950	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:26.356383085 CEST	443	49950	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:26.356714964 CEST	49948	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:26.356743097 CEST	443	49948	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:26.356758118 CEST	49948	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:26.356765032 CEST	443	49948	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:26.359076023 CEST	443	49951	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:26.359407902 CEST	49951	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:26.359426022 CEST	443	49951	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:26.359786987 CEST	49951	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:26.359792948 CEST	443	49951	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:26.359922886 CEST	49953	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:26.359971046 CEST	443	49953	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:26.360029936 CEST	49953	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:26.360129118 CEST	49953	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:26.360141993 CEST	443	49953	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:26.450548887 CEST	443	49949	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:26.450615883 CEST	443	49949	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:26.450666904 CEST	49949	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:26.450692892 CEST	443	49949	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:26.450733900 CEST	443	49949	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:26.450778008 CEST	49949	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:26.452620983 CEST	49949	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:26.452640057 CEST	443	49949	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:26.452651024 CEST	49949	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:26.452656031 CEST	443	49949	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:26.452882051 CEST	443	49950	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:26.453196049 CEST	443	49950	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:26.453247070 CEST	49950	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:26.458534956 CEST	443	49951	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:26.458973885 CEST	443	49951	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:26.459041119 CEST	49951	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:26.460227966 CEST	49951	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:26.460254908 CEST	443	49951	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:26.460270882 CEST	49951	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:26.460278988 CEST	443	49951	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:26.467873096 CEST	49950	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:26.467896938 CEST	443	49950	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:26.467910051 CEST	49950	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:26.467916012 CEST	443	49950	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:26.483720064 CEST	443	49952	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:26.489442110 CEST	49954	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:26.489495993 CEST	443	49954	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:26.489557981 CEST	49954	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:26.503907919 CEST	49955	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:26.503963947 CEST	443	49955	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:26.504019976 CEST	49955	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:26.506144047 CEST	49952	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:26.506159067 CEST	443	49952	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:26.506783962 CEST	49952	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:26.506791115 CEST	443	49952	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:26.506985903 CEST	49954	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:26.507004976 CEST	443	49954	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:26.592855930 CEST	49955	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:26.592894077 CEST	443	49955	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:26.593861103 CEST	49956	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:26.593902111 CEST	443	49956	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:26.593976021 CEST	49956	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:26.594084978 CEST	49956	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:26.594099045 CEST	443	49956	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:26.606872082 CEST	443	49952	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:26.607198954 CEST	443	49952	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:26.607245922 CEST	49952	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:26.607261896 CEST	443	49952	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:26.607280016 CEST	443	49952	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:26.607327938 CEST	49952	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:26.607362032 CEST	49952	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:26.607378960 CEST	443	49952	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:26.607404947 CEST	49952	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:26.607412100 CEST	443	49952	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:26.609666109 CEST	49957	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:26.609721899 CEST	443	49957	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:26.609778881 CEST	49957	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:26.609890938 CEST	49957	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:26.609904051 CEST	443	49957	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:27.023205042 CEST	443	49953	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:27.023725033 CEST	49953	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:27.023758888 CEST	443	49953	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:27.024169922 CEST	49953	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:27.024175882 CEST	443	49953	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:27.126430988 CEST	443	49953	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:27.126513004 CEST	443	49953	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:27.126636982 CEST	49953	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:27.126833916 CEST	49953	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:27.126859903 CEST	443	49953	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:27.126872063 CEST	49953	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:27.126883030 CEST	443	49953	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:27.129369020 CEST	49958	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:27.129422903 CEST	443	49958	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:27.129484892 CEST	49958	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:27.129617929 CEST	49958	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:27.129635096 CEST	443	49958	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:27.159508944 CEST	443	49954	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:27.160144091 CEST	49954	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:27.160157919 CEST	443	49954	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:27.160583019 CEST	49954	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:27.160588026 CEST	443	49954	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:27.230249882 CEST	443	49956	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:27.230731010 CEST	49956	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:27.230763912 CEST	443	49956	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:27.231132984 CEST	49956	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:27.231139898 CEST	443	49956	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:27.243726015 CEST	443	49957	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:27.248008966 CEST	49957	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:27.248058081 CEST	443	49957	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:27.248615980 CEST	49957	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:27.248625994 CEST	443	49957	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:27.255831003 CEST	443	49955	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:27.259196043 CEST	49955	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:27.259222984 CEST	443	49955	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:27.259432077 CEST	443	49954	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:27.259597063 CEST	443	49954	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:27.259603977 CEST	49955	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:27.259610891 CEST	443	49955	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:27.259663105 CEST	49954	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:27.259849072 CEST	49954	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:27.259865046 CEST	443	49954	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:27.259875059 CEST	49954	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:27.259881020 CEST	443	49954	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:27.262368917 CEST	49959	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:27.262408018 CEST	443	49959	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:27.262494087 CEST	49959	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:27.262615919 CEST	49959	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:27.262624979 CEST	443	49959	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:27.329552889 CEST	443	49956	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:27.329663992 CEST	443	49956	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:27.329745054 CEST	49956	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:27.329921961 CEST	49956	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:27.329941034 CEST	443	49956	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:27.329953909 CEST	49956	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:27.329960108 CEST	443	49956	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:27.333093882 CEST	49960	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:27.333154917 CEST	443	49960	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:27.333337069 CEST	49960	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:27.333672047 CEST	49960	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:27.333684921 CEST	443	49960	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:27.343446016 CEST	443	49957	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:27.343532085 CEST	443	49957	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:27.343621016 CEST	49957	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:27.343781948 CEST	49957	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:27.343807936 CEST	443	49957	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:27.343830109 CEST	49957	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:27.343835115 CEST	443	49957	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:27.346097946 CEST	49961	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:27.346133947 CEST	443	49961	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:27.346277952 CEST	49961	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:27.346396923 CEST	49961	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:27.346407890 CEST	443	49961	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:27.358472109 CEST	443	49955	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:27.358654022 CEST	443	49955	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:27.358714104 CEST	443	49955	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:27.358747959 CEST	49955	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:27.358803988 CEST	49955	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:27.358849049 CEST	49955	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:27.358866930 CEST	443	49955	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:27.358880997 CEST	49955	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:27.358886957 CEST	443	49955	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:27.361001968 CEST	49962	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:27.361018896 CEST	443	49962	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:27.361088037 CEST	49962	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:27.361217976 CEST	49962	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:27.361233950 CEST	443	49962	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:28.051615953 CEST	443	49959	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:28.052268982 CEST	49959	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:28.052299023 CEST	443	49959	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:28.052402973 CEST	443	49958	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:28.052670956 CEST	49958	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:28.052695990 CEST	443	49958	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:28.052731991 CEST	49959	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:28.052743912 CEST	443	49959	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:28.053092957 CEST	49958	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:28.053098917 CEST	443	49958	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:28.153278112 CEST	443	49958	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:28.153542042 CEST	443	49958	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:28.153608084 CEST	443	49958	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:28.153609991 CEST	49958	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:28.153661013 CEST	49958	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:28.153717995 CEST	49958	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:28.153733969 CEST	443	49958	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:28.153755903 CEST	49958	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:28.153760910 CEST	443	49958	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:28.155757904 CEST	443	49959	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:28.155855894 CEST	443	49959	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:28.155911922 CEST	49959	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:28.155941010 CEST	49959	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:28.155956984 CEST	443	49959	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:28.155968904 CEST	49959	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:28.155975103 CEST	443	49959	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:28.156265974 CEST	49963	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:28.156301975 CEST	443	49963	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:28.156358004 CEST	49963	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:28.156514883 CEST	49963	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:28.156526089 CEST	443	49963	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:28.157800913 CEST	49964	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:28.157830954 CEST	443	49964	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:28.157888889 CEST	49964	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:28.158111095 CEST	49964	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:28.158119917 CEST	443	49964	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:28.237494946 CEST	443	49961	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:28.238019943 CEST	49961	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:28.238049030 CEST	443	49961	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:28.238476992 CEST	49961	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:28.238483906 CEST	443	49961	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:28.241836071 CEST	443	49962	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:28.242156982 CEST	49962	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:28.242182016 CEST	443	49962	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:28.242537975 CEST	49962	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:28.242547035 CEST	443	49962	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:28.244544983 CEST	443	49960	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:28.244858980 CEST	49960	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:28.244879007 CEST	443	49960	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:28.245258093 CEST	49960	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:28.245263100 CEST	443	49960	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:28.337387085 CEST	443	49961	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:28.337479115 CEST	443	49961	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:28.337548971 CEST	49961	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:28.337713003 CEST	49961	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:28.337730885 CEST	443	49961	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:28.337742090 CEST	49961	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:28.337747097 CEST	443	49961	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:28.340272903 CEST	49965	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:28.340327978 CEST	443	49965	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:28.340404034 CEST	49965	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:28.340543032 CEST	49965	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:28.340553999 CEST	443	49965	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:28.343357086 CEST	443	49962	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:28.343404055 CEST	443	49962	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:28.343446016 CEST	49962	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:28.343460083 CEST	443	49962	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:28.343477964 CEST	443	49962	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:28.343517065 CEST	49962	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:28.343596935 CEST	49962	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:28.343601942 CEST	443	49962	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:28.343611956 CEST	49962	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:28.343615055 CEST	443	49962	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:28.345532894 CEST	49966	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:28.345542908 CEST	443	49966	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:28.345609903 CEST	49966	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:28.345731974 CEST	49966	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:28.345741034 CEST	443	49966	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:28.353125095 CEST	443	49960	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:28.353156090 CEST	443	49960	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:28.353197098 CEST	49960	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:28.353204012 CEST	443	49960	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:28.353243113 CEST	49960	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:28.353343010 CEST	49960	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:28.353360891 CEST	443	49960	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:28.353373051 CEST	49960	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:28.353378057 CEST	443	49960	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:28.355114937 CEST	49967	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:28.355151892 CEST	443	49967	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:28.355226994 CEST	49967	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:28.355334044 CEST	49967	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:28.355346918 CEST	443	49967	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:28.792926073 CEST	443	49963	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:28.793385029 CEST	49963	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:28.793453932 CEST	443	49963	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:28.793812990 CEST	49963	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:28.793831110 CEST	443	49963	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:28.796720028 CEST	443	49964	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:28.797034979 CEST	49964	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:28.797065973 CEST	443	49964	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:28.797382116 CEST	49964	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:28.797386885 CEST	443	49964	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:28.891693115 CEST	443	49963	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:28.892184019 CEST	443	49963	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:28.892385006 CEST	49963	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:28.892385006 CEST	49963	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:28.892385006 CEST	49963	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:28.894772053 CEST	443	49964	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:28.894821882 CEST	49968	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:28.894874096 CEST	443	49968	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:28.894929886 CEST	49968	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:28.894933939 CEST	443	49964	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:28.894980907 CEST	49964	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:28.895041943 CEST	49968	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:28.895055056 CEST	443	49968	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:28.895065069 CEST	49964	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:28.895082951 CEST	443	49964	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:28.895092010 CEST	49964	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:28.895097017 CEST	443	49964	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:28.896724939 CEST	49969	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:28.896799088 CEST	443	49969	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:28.896867037 CEST	49969	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:28.896960974 CEST	49969	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:28.896980047 CEST	443	49969	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:28.989062071 CEST	443	49965	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:28.989512920 CEST	49965	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:28.989593029 CEST	443	49965	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:28.989947081 CEST	49965	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:28.989976883 CEST	443	49965	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:28.998661995 CEST	443	49966	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:28.999089003 CEST	49966	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:28.999145031 CEST	443	49966	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:28.999476910 CEST	49966	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:28.999485970 CEST	443	49966	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:29.000643015 CEST	443	49967	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:29.000981092 CEST	49967	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:29.001008987 CEST	443	49967	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:29.001352072 CEST	49967	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:29.001357079 CEST	443	49967	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:29.089520931 CEST	443	49965	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:29.089690924 CEST	443	49965	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:29.089755058 CEST	49965	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:29.091752052 CEST	49965	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:29.091778994 CEST	443	49965	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:29.091805935 CEST	49965	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:29.091814041 CEST	443	49965	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:29.094357967 CEST	49970	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:29.094408035 CEST	443	49970	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:29.094470978 CEST	49970	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:29.094603062 CEST	49970	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:29.094614029 CEST	443	49970	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:29.099510908 CEST	443	49966	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:29.099659920 CEST	443	49966	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:29.099710941 CEST	49966	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:29.099716902 CEST	443	49966	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:29.099761009 CEST	49966	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:29.099793911 CEST	49966	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:29.099809885 CEST	443	49966	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:29.099824905 CEST	49966	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:29.099836111 CEST	443	49966	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:29.101756096 CEST	443	49967	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:29.101810932 CEST	443	49967	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:29.101877928 CEST	49967	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:29.104866982 CEST	49967	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:29.104891062 CEST	443	49967	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:29.104913950 CEST	49967	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:29.104921103 CEST	443	49967	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:29.139060020 CEST	49971	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:29.139105082 CEST	443	49971	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:29.139189005 CEST	49971	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:29.150383949 CEST	49972	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:29.150415897 CEST	443	49972	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:29.150491953 CEST	49972	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:29.150558949 CEST	49971	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:29.150583982 CEST	443	49971	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:29.154241085 CEST	49972	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:29.154253960 CEST	443	49972	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:29.196393013 CEST	49963	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:29.196438074 CEST	443	49963	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:29.532121897 CEST	443	49969	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:29.532644033 CEST	49969	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:29.532661915 CEST	443	49969	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:29.533119917 CEST	49969	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:29.533124924 CEST	443	49969	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:29.558228970 CEST	443	49968	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:29.558751106 CEST	49968	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:29.558800936 CEST	443	49968	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:29.559138060 CEST	49968	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:29.559144020 CEST	443	49968	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:29.630966902 CEST	443	49969	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:29.631133080 CEST	443	49969	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:29.631257057 CEST	49969	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:29.631500006 CEST	49969	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:29.631520987 CEST	443	49969	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:29.631535053 CEST	49969	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:29.631541967 CEST	443	49969	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:29.637190104 CEST	49973	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:29.637253046 CEST	443	49973	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:29.637335062 CEST	49973	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:29.637579918 CEST	49973	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:29.637593031 CEST	443	49973	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:29.660711050 CEST	443	49968	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:29.660878897 CEST	443	49968	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:29.660996914 CEST	49968	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:29.661082029 CEST	49968	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:29.661108971 CEST	443	49968	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:29.661125898 CEST	49968	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:29.661130905 CEST	443	49968	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:29.664114952 CEST	49974	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:29.664170027 CEST	443	49974	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:29.664254904 CEST	49974	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:29.664393902 CEST	49974	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:29.664406061 CEST	443	49974	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:29.728502989 CEST	443	49970	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:29.729042053 CEST	49970	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:29.729063034 CEST	443	49970	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:29.729595900 CEST	49970	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:29.729603052 CEST	443	49970	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:29.787283897 CEST	443	49972	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:29.787808895 CEST	49972	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:29.787832022 CEST	443	49972	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:29.788073063 CEST	443	49971	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:29.788284063 CEST	49972	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:29.788288116 CEST	443	49972	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:29.788675070 CEST	49971	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:29.788707972 CEST	443	49971	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:29.789119005 CEST	49971	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:29.789124012 CEST	443	49971	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:29.827296972 CEST	443	49970	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:29.827713966 CEST	443	49970	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:29.827774048 CEST	49970	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:29.827811956 CEST	49970	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:29.827831030 CEST	443	49970	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:29.827845097 CEST	49970	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:29.827851057 CEST	443	49970	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:29.830610037 CEST	49975	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:29.830657959 CEST	443	49975	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:29.830741882 CEST	49975	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:29.830903053 CEST	49975	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:29.830913067 CEST	443	49975	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:29.885615110 CEST	443	49972	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:29.885735989 CEST	443	49972	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:29.885802984 CEST	49972	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:29.886008024 CEST	49972	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:29.886008024 CEST	49972	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:29.886024952 CEST	443	49972	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:29.886034012 CEST	443	49972	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:29.887108088 CEST	443	49971	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:29.887192011 CEST	443	49971	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:29.887248039 CEST	49971	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:29.887337923 CEST	49971	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:29.887358904 CEST	443	49971	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:29.887367964 CEST	49971	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:29.887373924 CEST	443	49971	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:29.888999939 CEST	49976	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:29.889060974 CEST	443	49976	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:29.889134884 CEST	49976	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:29.889182091 CEST	49977	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:29.889230967 CEST	443	49977	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:29.889296055 CEST	49977	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:29.889316082 CEST	49976	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:29.889334917 CEST	443	49976	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:29.889432907 CEST	49977	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:29.889450073 CEST	443	49977	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:30.268651009 CEST	443	49973	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:30.269267082 CEST	49973	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:30.269296885 CEST	443	49973	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:30.269737959 CEST	49973	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:30.269743919 CEST	443	49973	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:30.331671953 CEST	443	49974	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:30.332205057 CEST	49974	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:30.332221985 CEST	443	49974	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:30.332668066 CEST	49974	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:30.332670927 CEST	443	49974	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:30.370820999 CEST	443	49973	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:30.370912075 CEST	443	49973	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:30.370968103 CEST	49973	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:30.371133089 CEST	49973	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:30.371155024 CEST	443	49973	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:30.371165991 CEST	49973	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:30.371171951 CEST	443	49973	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:30.374092102 CEST	49978	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:30.374145031 CEST	443	49978	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:30.374228954 CEST	49978	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:30.374389887 CEST	49978	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:30.374402046 CEST	443	49978	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:30.434257984 CEST	443	49974	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:30.434319973 CEST	443	49974	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:30.434382915 CEST	49974	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:30.434386015 CEST	443	49974	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:30.434431076 CEST	49974	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:30.434647083 CEST	49974	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:30.434667110 CEST	443	49974	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:30.434679985 CEST	49974	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:30.434684992 CEST	443	49974	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:30.437336922 CEST	49979	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:30.437387943 CEST	443	49979	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:30.437470913 CEST	49979	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:30.437628031 CEST	49979	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:30.437642097 CEST	443	49979	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:30.468703985 CEST	443	49975	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:30.469146013 CEST	49975	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:30.469172955 CEST	443	49975	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:30.469579935 CEST	49975	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:30.469589949 CEST	443	49975	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:30.526715994 CEST	443	49976	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:30.527069092 CEST	49976	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:30.527107954 CEST	443	49976	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:30.527458906 CEST	49976	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:30.527467966 CEST	443	49976	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:30.550961018 CEST	443	49977	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:30.551327944 CEST	49977	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:30.551358938 CEST	443	49977	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:30.551696062 CEST	49977	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:30.551702023 CEST	443	49977	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:30.567977905 CEST	443	49975	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:30.568254948 CEST	443	49975	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:30.568299055 CEST	49975	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:30.568331957 CEST	49975	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:30.568351984 CEST	443	49975	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:30.568363905 CEST	49975	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:30.568368912 CEST	443	49975	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:30.570765972 CEST	49980	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:30.570806980 CEST	443	49980	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:30.570883036 CEST	49980	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:30.571019888 CEST	49980	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:30.571031094 CEST	443	49980	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:30.625657082 CEST	443	49976	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:30.625767946 CEST	443	49976	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:30.625816107 CEST	443	49976	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:30.625821114 CEST	49976	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:30.625864983 CEST	49976	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:30.625989914 CEST	49976	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:30.626013994 CEST	443	49976	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:30.626029968 CEST	49976	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:30.626036882 CEST	443	49976	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:30.628391981 CEST	49981	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:30.628429890 CEST	443	49981	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:30.628501892 CEST	49981	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:30.628669024 CEST	49981	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:30.628679991 CEST	443	49981	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:30.653211117 CEST	443	49977	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:30.653294086 CEST	443	49977	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:30.653352022 CEST	49977	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:30.653436899 CEST	49977	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:30.653454065 CEST	443	49977	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:30.653470993 CEST	49977	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:30.653476000 CEST	443	49977	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:30.655539036 CEST	49982	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:30.655567884 CEST	443	49982	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:30.655635118 CEST	49982	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:30.655766010 CEST	49982	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:30.655775070 CEST	443	49982	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:31.008322954 CEST	443	49978	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:31.008922100 CEST	49978	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:31.009022951 CEST	443	49978	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:31.009315014 CEST	49978	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:31.009330034 CEST	443	49978	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:31.067461967 CEST	443	49979	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:31.068012953 CEST	49979	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:31.068053961 CEST	443	49979	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:31.068511963 CEST	49979	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:31.068520069 CEST	443	49979	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:31.107247114 CEST	443	49978	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:31.107279062 CEST	443	49978	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:31.107326984 CEST	443	49978	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:31.107336044 CEST	49978	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:31.107404947 CEST	49978	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:31.107566118 CEST	49978	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:31.107597113 CEST	443	49978	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:31.107629061 CEST	49978	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:31.107635975 CEST	443	49978	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:31.110364914 CEST	49983	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:31.110404015 CEST	443	49983	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:31.110456944 CEST	49983	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:31.111072063 CEST	49983	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:31.111079931 CEST	443	49983	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:31.165124893 CEST	443	49979	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:31.165227890 CEST	443	49979	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:31.165297031 CEST	49979	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:31.165441036 CEST	49979	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:31.165466070 CEST	443	49979	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:31.165489912 CEST	49979	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:31.165497065 CEST	443	49979	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:31.167866945 CEST	49984	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:31.167897940 CEST	443	49984	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:31.167963982 CEST	49984	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:31.168096066 CEST	49984	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:31.168107986 CEST	443	49984	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:31.218451023 CEST	443	49980	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:31.219017029 CEST	49980	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:31.219060898 CEST	443	49980	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:31.219619989 CEST	49980	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:31.219625950 CEST	443	49980	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:31.269201040 CEST	443	49981	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:31.269685030 CEST	49981	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:31.269716024 CEST	443	49981	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:31.270180941 CEST	49981	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:31.270185947 CEST	443	49981	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:31.319401026 CEST	443	49980	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:31.319500923 CEST	443	49980	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:31.319668055 CEST	49980	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:31.319765091 CEST	49980	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:31.319786072 CEST	443	49980	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:31.319798946 CEST	49980	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:31.319804907 CEST	443	49980	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:31.321806908 CEST	443	49982	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:31.322422028 CEST	49985	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:31.322479010 CEST	443	49985	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:31.322546959 CEST	49985	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:31.322668076 CEST	49985	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:31.322680950 CEST	443	49985	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:31.322813988 CEST	49982	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:31.322825909 CEST	443	49982	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:31.323213100 CEST	49982	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:31.323216915 CEST	443	49982	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:31.369528055 CEST	443	49981	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:31.369604111 CEST	443	49981	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:31.369667053 CEST	49981	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:31.373366117 CEST	49981	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:31.373390913 CEST	443	49981	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:31.373404026 CEST	49981	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:31.373409986 CEST	443	49981	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:31.376200914 CEST	49986	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:31.376251936 CEST	443	49986	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:31.376317978 CEST	49986	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:31.376601934 CEST	49986	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:31.376616001 CEST	443	49986	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:31.424654961 CEST	443	49982	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:31.425023079 CEST	443	49982	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:31.425085068 CEST	443	49982	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:31.425132990 CEST	49982	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:31.425206900 CEST	49982	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:31.425206900 CEST	49982	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:31.426239014 CEST	49982	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:31.426253080 CEST	443	49982	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:31.427565098 CEST	49987	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:31.427620888 CEST	443	49987	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:31.427720070 CEST	49987	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:31.427834988 CEST	49987	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:31.427848101 CEST	443	49987	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:32.004307985 CEST	443	49983	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:32.005256891 CEST	443	49984	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:32.008049965 CEST	49983	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:32.008083105 CEST	443	49983	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:32.011696100 CEST	49983	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:32.011704922 CEST	443	49983	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:32.011993885 CEST	49984	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:32.012061119 CEST	443	49984	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:32.017796993 CEST	49984	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:32.017818928 CEST	443	49984	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:32.106590033 CEST	443	49983	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:32.106723070 CEST	443	49983	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:32.106777906 CEST	49983	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:32.107100964 CEST	49983	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:32.107122898 CEST	443	49983	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:32.107134104 CEST	49983	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:32.107140064 CEST	443	49983	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:32.109570026 CEST	49988	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:32.109602928 CEST	443	49988	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:32.109679937 CEST	49988	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:32.112549067 CEST	443	49984	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:32.112693071 CEST	443	49984	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:32.112761021 CEST	49984	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:32.116647959 CEST	49988	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:32.116672039 CEST	443	49988	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:32.116836071 CEST	49984	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:32.116888046 CEST	443	49984	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:32.116920948 CEST	49984	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:32.116938114 CEST	443	49984	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:32.123811960 CEST	49989	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:32.123929977 CEST	443	49989	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:32.124047995 CEST	49989	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:32.124161005 CEST	49989	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:32.124186993 CEST	443	49989	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:32.388304949 CEST	443	49986	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:32.389159918 CEST	49986	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:32.389206886 CEST	443	49986	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:32.389532089 CEST	49986	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:32.389540911 CEST	443	49986	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:32.390115023 CEST	443	49985	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:32.390132904 CEST	443	49987	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:32.390613079 CEST	49985	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:32.390628099 CEST	443	49985	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:32.391194105 CEST	49985	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:32.391201973 CEST	443	49985	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:32.391556978 CEST	49987	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:32.391598940 CEST	443	49987	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:32.391980886 CEST	49987	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:32.391987085 CEST	443	49987	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:32.489192963 CEST	443	49985	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:32.489237070 CEST	443	49985	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:32.489306927 CEST	443	49985	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:32.489478111 CEST	49985	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:32.489602089 CEST	49985	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:32.489967108 CEST	49985	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:32.489995003 CEST	443	49985	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:32.490009069 CEST	49985	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:32.490016937 CEST	443	49985	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:32.490860939 CEST	443	49987	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:32.490909100 CEST	443	49987	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:32.490958929 CEST	49987	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:32.490997076 CEST	443	49987	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:32.491029978 CEST	443	49987	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:32.491067886 CEST	49987	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:32.491147995 CEST	49987	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:32.491172075 CEST	443	49987	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:32.491183996 CEST	49987	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:32.491190910 CEST	443	49987	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:32.491362095 CEST	443	49986	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:32.491564989 CEST	443	49986	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:32.491625071 CEST	49986	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:32.492279053 CEST	49986	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:32.492294073 CEST	443	49986	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:32.492321014 CEST	49986	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:32.492327929 CEST	443	49986	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:32.493275881 CEST	49990	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:32.493371964 CEST	443	49990	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:32.493438959 CEST	49990	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:32.493724108 CEST	49990	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:32.493756056 CEST	443	49990	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:32.494817019 CEST	49991	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:32.494858980 CEST	443	49991	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:32.495008945 CEST	49991	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:32.495104074 CEST	49991	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:32.495117903 CEST	443	49991	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:32.495261908 CEST	49992	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:32.495307922 CEST	443	49992	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:32.495357037 CEST	49992	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:32.495455980 CEST	49992	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:32.495467901 CEST	443	49992	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:32.786860943 CEST	443	49988	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:32.787379980 CEST	49988	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:32.787415028 CEST	443	49988	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:32.787774086 CEST	49988	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:32.787780046 CEST	443	49988	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:32.792347908 CEST	443	49989	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:32.792753935 CEST	49989	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:32.792835951 CEST	443	49989	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:32.793087959 CEST	49989	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:32.793102980 CEST	443	49989	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:32.888700008 CEST	443	49988	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:32.888757944 CEST	443	49988	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:32.888895035 CEST	443	49988	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:32.888931036 CEST	49988	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:32.888967037 CEST	49988	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:32.889071941 CEST	49988	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:32.889091015 CEST	443	49988	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:32.889101982 CEST	49988	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:32.889106989 CEST	443	49988	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:32.891706944 CEST	49993	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:32.891793966 CEST	443	49993	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:32.891917944 CEST	49993	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:32.891999960 CEST	49993	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:32.892014980 CEST	443	49993	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:32.894594908 CEST	443	49989	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:32.894664049 CEST	443	49989	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:32.894732952 CEST	49989	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:32.894767046 CEST	443	49989	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:32.894798994 CEST	443	49989	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:32.894839048 CEST	49989	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:32.894865990 CEST	443	49989	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:32.894876003 CEST	49989	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:32.894881964 CEST	443	49989	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:32.897073030 CEST	49994	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:32.897099018 CEST	443	49994	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:32.897172928 CEST	49994	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:32.897382975 CEST	49994	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:32.897408962 CEST	443	49994	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:33.131863117 CEST	443	49991	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:33.132432938 CEST	49991	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:33.132469893 CEST	443	49991	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:33.132776022 CEST	443	49992	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:33.132909060 CEST	49991	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:33.132914066 CEST	443	49991	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:33.133029938 CEST	49992	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:33.133063078 CEST	443	49992	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:33.133330107 CEST	49992	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:33.133337975 CEST	443	49992	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:33.180105925 CEST	443	49990	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:33.180732965 CEST	49990	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:33.180788040 CEST	443	49990	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:33.181253910 CEST	49990	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:33.181263924 CEST	443	49990	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:33.230825901 CEST	443	49991	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:33.230902910 CEST	443	49991	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:33.231093884 CEST	49991	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:33.231167078 CEST	49991	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:33.231187105 CEST	443	49991	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:33.231201887 CEST	49991	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:33.231206894 CEST	443	49991	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:33.231323957 CEST	443	49992	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:33.231426001 CEST	443	49992	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:33.231482029 CEST	49992	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:33.231528997 CEST	49992	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:33.231551886 CEST	443	49992	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:33.231563091 CEST	49992	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:33.231569052 CEST	443	49992	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:33.234319925 CEST	49995	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:33.234323025 CEST	49996	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:33.234357119 CEST	443	49995	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:33.234374046 CEST	443	49996	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:33.234430075 CEST	49995	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:33.234450102 CEST	49996	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:33.234565020 CEST	49995	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:33.234570980 CEST	49996	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:33.234577894 CEST	443	49995	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:33.234591007 CEST	443	49996	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:33.282946110 CEST	443	49990	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:33.283010006 CEST	443	49990	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:33.283114910 CEST	443	49990	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:33.283128023 CEST	49990	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:33.283166885 CEST	49990	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:33.283371925 CEST	49990	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:33.283402920 CEST	443	49990	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:33.283418894 CEST	49990	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:33.283425093 CEST	443	49990	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:33.286056995 CEST	49997	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:33.286108017 CEST	443	49997	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:33.286310911 CEST	49997	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:33.286449909 CEST	49997	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:33.286461115 CEST	443	49997	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:33.537698984 CEST	443	49994	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:33.538583040 CEST	49994	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:33.538619041 CEST	443	49994	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:33.539064884 CEST	49994	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:33.539078951 CEST	443	49994	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:33.558594942 CEST	443	49993	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:33.559150934 CEST	49993	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:33.559178114 CEST	443	49993	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:33.559514999 CEST	49993	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:33.559521914 CEST	443	49993	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:33.635812044 CEST	443	49994	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:33.635904074 CEST	443	49994	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:33.635961056 CEST	49994	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:33.636116028 CEST	49994	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:33.636135101 CEST	443	49994	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:33.636147976 CEST	49994	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:33.636156082 CEST	443	49994	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:33.639014006 CEST	49998	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:33.639067888 CEST	443	49998	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:33.639158010 CEST	49998	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:33.639319897 CEST	49998	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:33.639331102 CEST	443	49998	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:33.660923004 CEST	443	49993	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:33.661065102 CEST	443	49993	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:33.661158085 CEST	49993	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:33.661271095 CEST	49993	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:33.661281109 CEST	443	49993	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:33.661302090 CEST	49993	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:33.661308050 CEST	443	49993	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:33.664022923 CEST	49999	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:33.664081097 CEST	443	49999	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:33.664154053 CEST	49999	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:33.664321899 CEST	49999	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:33.664343119 CEST	443	49999	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:33.937292099 CEST	443	49995	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:33.937767982 CEST	49995	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:33.937796116 CEST	443	49995	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:33.937854052 CEST	443	49996	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:33.938095093 CEST	49996	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:33.938121080 CEST	443	49996	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:33.938230038 CEST	49995	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:33.938235044 CEST	443	49995	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:33.938518047 CEST	49996	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:33.938524961 CEST	443	49996	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:34.038717985 CEST	443	49996	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:34.038750887 CEST	443	49996	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:34.038793087 CEST	443	49995	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:34.038794041 CEST	49996	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:34.038814068 CEST	443	49996	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:34.038815975 CEST	443	49995	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:34.038831949 CEST	443	49996	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:34.038867950 CEST	49996	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:34.038872004 CEST	49995	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:34.038877010 CEST	443	49995	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:34.038909912 CEST	49995	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:34.039084911 CEST	49996	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:34.039105892 CEST	443	49996	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:34.039118052 CEST	49996	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:34.039125919 CEST	443	49996	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:34.039853096 CEST	49995	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:34.039869070 CEST	443	49995	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:34.042603970 CEST	50000	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:34.042642117 CEST	443	50000	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:34.042701960 CEST	50001	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:34.042717934 CEST	50000	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:34.042738914 CEST	443	50001	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:34.042785883 CEST	50001	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:34.042855024 CEST	50000	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:34.042870045 CEST	443	50000	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:34.042938948 CEST	50001	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:34.042948961 CEST	443	50001	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:34.121645927 CEST	443	49997	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:34.122129917 CEST	49997	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:34.122152090 CEST	443	49997	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:34.122701883 CEST	49997	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:34.122705936 CEST	443	49997	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:34.225370884 CEST	443	49997	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:34.225404024 CEST	443	49997	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:34.225450993 CEST	443	49997	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:34.225524902 CEST	49997	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:34.225549936 CEST	443	49997	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:34.225569963 CEST	49997	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:34.225601912 CEST	49997	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:34.299026012 CEST	443	49999	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:34.299524069 CEST	49999	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:34.299576998 CEST	443	49999	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:34.299932957 CEST	49999	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:34.299938917 CEST	443	49999	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:34.311346054 CEST	443	49997	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:34.311439991 CEST	443	49997	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:34.311564922 CEST	49997	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:34.311655998 CEST	49997	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:34.311681032 CEST	443	49997	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:34.311697960 CEST	49997	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:34.311702967 CEST	443	49997	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:34.314162970 CEST	50002	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:34.314204931 CEST	443	50002	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:34.314282894 CEST	50002	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:34.314287901 CEST	443	49998	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:34.314415932 CEST	50002	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:34.314424992 CEST	443	50002	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:34.314608097 CEST	49998	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:34.314614058 CEST	443	49998	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:34.314990044 CEST	49998	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:34.314994097 CEST	443	49998	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:34.404544115 CEST	443	49999	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:34.404608965 CEST	443	49999	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:34.404652119 CEST	443	49999	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:34.404716015 CEST	49999	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:34.404762983 CEST	443	49999	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:34.404783010 CEST	49999	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:34.404812098 CEST	49999	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:34.418766975 CEST	443	49998	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:34.418801069 CEST	443	49998	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:34.418900013 CEST	443	49998	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:34.418930054 CEST	49998	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:34.418956995 CEST	49998	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:34.419131994 CEST	49998	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:34.419152021 CEST	443	49998	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:34.419162989 CEST	49998	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:34.419168949 CEST	443	49998	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:34.421709061 CEST	50003	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:34.421771049 CEST	443	50003	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:34.421844006 CEST	50003	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:34.422137976 CEST	50003	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:34.422154903 CEST	443	50003	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:34.489243031 CEST	443	49999	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:34.489326000 CEST	443	49999	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:34.489397049 CEST	49999	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:34.489428043 CEST	443	49999	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:34.489470005 CEST	443	49999	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:34.489571095 CEST	49999	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:34.489571095 CEST	49999	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:34.489571095 CEST	49999	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:34.489658117 CEST	49999	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:34.489677906 CEST	443	49999	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:34.489689112 CEST	49999	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:34.489696026 CEST	443	49999	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:34.492398977 CEST	50004	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:34.492440939 CEST	443	50004	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:34.492530107 CEST	50004	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:34.492705107 CEST	50004	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:34.492719889 CEST	443	50004	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:34.704335928 CEST	443	50001	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:34.704917908 CEST	50001	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:34.704943895 CEST	443	50001	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:34.705368996 CEST	50001	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:34.705375910 CEST	443	50001	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:34.716547012 CEST	443	50000	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:34.717215061 CEST	50000	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:34.717253923 CEST	443	50000	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:34.717607021 CEST	50000	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:34.717614889 CEST	443	50000	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:34.807208061 CEST	443	50001	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:34.807246923 CEST	443	50001	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:34.807323933 CEST	50001	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:34.807353973 CEST	443	50001	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:34.807411909 CEST	50001	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:34.807521105 CEST	50001	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:34.807526112 CEST	443	50001	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:34.807538986 CEST	443	50001	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:34.807553053 CEST	50001	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:34.807604074 CEST	443	50001	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:34.810313940 CEST	50005	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:34.810369968 CEST	443	50005	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:34.810436010 CEST	50005	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:34.810585022 CEST	50005	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:34.810600042 CEST	443	50005	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:34.821547985 CEST	443	50000	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:34.821573019 CEST	443	50000	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:34.821614981 CEST	50000	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:34.821643114 CEST	443	50000	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:34.821825981 CEST	50000	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:34.821829081 CEST	443	50000	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:34.821846962 CEST	50000	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:34.821854115 CEST	443	50000	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:34.821863890 CEST	443	50000	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:34.821875095 CEST	50000	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:34.821878910 CEST	443	50000	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:34.824645996 CEST	50006	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:34.824676991 CEST	443	50006	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:34.824731112 CEST	50006	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:34.824868917 CEST	50006	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:34.824886084 CEST	443	50006	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:34.969571114 CEST	443	50002	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:34.970141888 CEST	50002	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:34.970184088 CEST	443	50002	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:34.970727921 CEST	50002	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:34.970735073 CEST	443	50002	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:35.059483051 CEST	443	50003	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:35.059966087 CEST	50003	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:35.060000896 CEST	443	50003	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:35.060446024 CEST	50003	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:35.060451031 CEST	443	50003	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:35.071435928 CEST	443	50002	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:35.071892977 CEST	443	50002	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:35.072115898 CEST	50002	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:35.072115898 CEST	50002	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:35.072117090 CEST	50002	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:35.074414968 CEST	50007	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:35.074459076 CEST	443	50007	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:35.074536085 CEST	50007	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:35.074666977 CEST	50007	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:35.074678898 CEST	443	50007	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:35.138336897 CEST	443	50004	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:35.138911963 CEST	50004	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:35.138955116 CEST	443	50004	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:35.139280081 CEST	50004	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:35.139286041 CEST	443	50004	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:35.158102036 CEST	443	50003	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:35.158193111 CEST	443	50003	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:35.158247948 CEST	50003	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:35.158375025 CEST	50003	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:35.158399105 CEST	443	50003	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:35.158411026 CEST	50003	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:35.158416033 CEST	443	50003	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:35.161565065 CEST	50008	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:35.161607981 CEST	443	50008	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:35.161670923 CEST	50008	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:35.161804914 CEST	50008	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:35.161814928 CEST	443	50008	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:35.236798048 CEST	443	50004	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:35.236918926 CEST	443	50004	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:35.237097025 CEST	50004	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:35.237176895 CEST	50004	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:35.237200975 CEST	443	50004	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:35.237215042 CEST	50004	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:35.237221003 CEST	443	50004	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:35.240225077 CEST	50009	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:35.240264893 CEST	443	50009	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:35.240356922 CEST	50009	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:35.240511894 CEST	50009	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:35.240525007 CEST	443	50009	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:35.382707119 CEST	50002	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:35.382750988 CEST	443	50002	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:35.459249973 CEST	443	50006	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:35.460176945 CEST	50006	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:35.460263014 CEST	443	50006	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:35.460366011 CEST	50006	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:35.460380077 CEST	443	50006	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:35.462629080 CEST	443	50005	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:35.462974072 CEST	50005	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:35.462990046 CEST	443	50005	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:35.463368893 CEST	50005	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:35.463378906 CEST	443	50005	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:35.557935953 CEST	443	50006	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:35.558159113 CEST	443	50006	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:35.558214903 CEST	443	50006	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:35.558242083 CEST	50006	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:35.558326960 CEST	50006	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:35.558372021 CEST	50006	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:35.558372021 CEST	50006	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:35.558418989 CEST	443	50006	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:35.558444977 CEST	443	50006	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:35.561424017 CEST	50010	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:35.561482906 CEST	443	50010	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:35.561568022 CEST	50010	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:35.561729908 CEST	50010	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:35.561743975 CEST	443	50010	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:35.564145088 CEST	443	50005	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:35.564296961 CEST	443	50005	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:35.564362049 CEST	50005	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:35.564398050 CEST	50005	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:35.564398050 CEST	50005	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:35.564414978 CEST	443	50005	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:35.564434052 CEST	443	50005	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:35.868725061 CEST	443	50007	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:35.869204044 CEST	50007	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:35.869247913 CEST	443	50007	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:35.869832039 CEST	50007	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:35.869843960 CEST	443	50007	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:35.873565912 CEST	443	50008	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:35.874067068 CEST	50008	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:35.874157906 CEST	443	50008	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:35.874445915 CEST	50008	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:35.874459982 CEST	443	50008	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:35.972189903 CEST	443	50008	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:35.972387075 CEST	443	50008	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:35.972577095 CEST	50008	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:35.972625017 CEST	50008	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:35.972646952 CEST	443	50008	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:35.972657919 CEST	50008	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:35.972665071 CEST	443	50008	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:35.973543882 CEST	443	50007	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:35.973607063 CEST	443	50007	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:35.973659039 CEST	50007	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:35.973756075 CEST	50007	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:35.973783016 CEST	443	50007	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:35.973795891 CEST	50007	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:35.973800898 CEST	443	50007	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:36.052160978 CEST	443	50009	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:36.052820921 CEST	50009	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:36.052871943 CEST	443	50009	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:36.053303957 CEST	50009	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:36.053313971 CEST	443	50009	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:36.152369976 CEST	443	50009	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:36.152463913 CEST	443	50009	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:36.152518988 CEST	50009	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:36.152740955 CEST	50009	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:36.152770996 CEST	443	50009	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:36.152784109 CEST	50009	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:36.152791023 CEST	443	50009	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:36.197256088 CEST	443	50010	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:36.197873116 CEST	50010	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:36.197923899 CEST	443	50010	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:36.198353052 CEST	50010	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:36.198364973 CEST	443	50010	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:36.297534943 CEST	443	50010	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:36.297617912 CEST	443	50010	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:36.297666073 CEST	50010	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:36.297916889 CEST	50010	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:36.297945976 CEST	443	50010	13.107.246.64	192.168.2.4
Oct 7, 2024 06:46:36.297960997 CEST	50010	443	192.168.2.4	13.107.246.64
Oct 7, 2024 06:46:36.297966957 CEST	443	50010	13.107.246.64	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 7, 2024 06:44:53.327914953 CEST	59450	53	192.168.2.4	1.1.1.1
Oct 7, 2024 06:44:53.342099905 CEST	53	59450	1.1.1.1	192.168.2.4
Oct 7, 2024 06:44:54.352334023 CEST	58739	53	192.168.2.4	1.1.1.1
Oct 7, 2024 06:44:54.361224890 CEST	53	58739	1.1.1.1	192.168.2.4
Oct 7, 2024 06:44:54.363523006 CEST	51505	53	192.168.2.4	1.1.1.1
Oct 7, 2024 06:44:54.372204065 CEST	53	51505	1.1.1.1	192.168.2.4
Oct 7, 2024 06:44:54.374341011 CEST	65261	53	192.168.2.4	1.1.1.1
Oct 7, 2024 06:44:54.383136988 CEST	53	65261	1.1.1.1	192.168.2.4
Oct 7, 2024 06:44:54.385298967 CEST	55843	53	192.168.2.4	1.1.1.1
Oct 7, 2024 06:44:54.394479036 CEST	53	55843	1.1.1.1	192.168.2.4
Oct 7, 2024 06:44:54.396629095 CEST	57070	53	192.168.2.4	1.1.1.1
Oct 7, 2024 06:44:54.405083895 CEST	53	57070	1.1.1.1	192.168.2.4
Oct 7, 2024 06:44:54.407208920 CEST	49797	53	192.168.2.4	1.1.1.1
Oct 7, 2024 06:44:54.417581081 CEST	53	49797	1.1.1.1	192.168.2.4
Oct 7, 2024 06:44:54.419956923 CEST	59576	53	192.168.2.4	1.1.1.1
Oct 7, 2024 06:44:54.428219080 CEST	53	59576	1.1.1.1	192.168.2.4
Oct 7, 2024 06:44:54.430762053 CEST	55578	53	192.168.2.4	1.1.1.1
Oct 7, 2024 06:44:54.439049006 CEST	53	55578	1.1.1.1	192.168.2.4
Oct 7, 2024 06:44:54.441793919 CEST	52877	53	192.168.2.4	1.1.1.1
Oct 7, 2024 06:44:54.448517084 CEST	53	52877	1.1.1.1	192.168.2.4
Oct 7, 2024 06:44:55.678402901 CEST	52527	53	192.168.2.4	1.1.1.1
Oct 7, 2024 06:44:55.714004040 CEST	53	52527	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 7, 2024 06:44:53.327914953 CEST	192.168.2.4	1.1.1.1	0xe7ff	Standard query (0)	methodbojjewkl.shop	A (IP address)	IN (0x0001)	false
Oct 7, 2024 06:44:54.352334023 CEST	192.168.2.4	1.1.1.1	0x9314	Standard query (0)	mobbipenju.store	A (IP address)	IN (0x0001)	false
Oct 7, 2024 06:44:54.363523006 CEST	192.168.2.4	1.1.1.1	0x34f0	Standard query (0)	eaglepawnoy.store	A (IP address)	IN (0x0001)	false
Oct 7, 2024 06:44:54.374341011 CEST	192.168.2.4	1.1.1.1	0xfe98	Standard query (0)	dissapoiznw.store	A (IP address)	IN (0x0001)	false
Oct 7, 2024 06:44:54.385298967 CEST	192.168.2.4	1.1.1.1	0xa642	Standard query (0)	studennotediw.store	A (IP address)	IN (0x0001)	false
Oct 7, 2024 06:44:54.396629095 CEST	192.168.2.4	1.1.1.1	0xe316	Standard query (0)	bathdoomgaz.store	A (IP address)	IN (0x0001)	false
Oct 7, 2024 06:44:54.407208920 CEST	192.168.2.4	1.1.1.1	0xdc96	Standard query (0)	spirittunek.store	A (IP address)	IN (0x0001)	false
Oct 7, 2024 06:44:54.419956923 CEST	192.168.2.4	1.1.1.1	0x8afe	Standard query (0)	licendfilteo.site	A (IP address)	IN (0x0001)	false
Oct 7, 2024 06:44:54.430762053 CEST	192.168.2.4	1.1.1.1	0x9a9	Standard query (0)	clearancek.site	A (IP address)	IN (0x0001)	false
Oct 7, 2024 06:44:54.441793919 CEST	192.168.2.4	1.1.1.1	0x1971	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false
Oct 7, 2024 06:44:55.678402901 CEST	192.168.2.4	1.1.1.1	0xbb89	Standard query (0)	sergei-esenin.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 7, 2024 06:44:53.342099905 CEST	1.1.1.1	192.168.2.4	0xe7ff	No error (0)	methodbojjewkl.shop		104.21.55.124	A (IP address)	IN (0x0001)	false
Oct 7, 2024 06:44:53.342099905 CEST	1.1.1.1	192.168.2.4	0xe7ff	No error (0)	methodbojjewkl.shop		172.67.148.27	A (IP address)	IN (0x0001)	false
Oct 7, 2024 06:44:54.361224890 CEST	1.1.1.1	192.168.2.4	0x9314	Name error (3)	mobbipenju.store	none	none	A (IP address)	IN (0x0001)	false
Oct 7, 2024 06:44:54.372204065 CEST	1.1.1.1	192.168.2.4	0x34f0	Name error (3)	eaglepawnoy.store	none	none	A (IP address)	IN (0x0001)	false
Oct 7, 2024 06:44:54.383136988 CEST	1.1.1.1	192.168.2.4	0xfe98	Name error (3)	dissapoiznw.store	none	none	A (IP address)	IN (0x0001)	false
Oct 7, 2024 06:44:54.394479036 CEST	1.1.1.1	192.168.2.4	0xa642	Name error (3)	studennotediw.store	none	none	A (IP address)	IN (0x0001)	false
Oct 7, 2024 06:44:54.405083895 CEST	1.1.1.1	192.168.2.4	0xe316	Name error (3)	bathdoomgaz.store	none	none	A (IP address)	IN (0x0001)	false
Oct 7, 2024 06:44:54.417581081 CEST	1.1.1.1	192.168.2.4	0xdc96	Name error (3)	spirittunek.store	none	none	A (IP address)	IN (0x0001)	false
Oct 7, 2024 06:44:54.428219080 CEST	1.1.1.1	192.168.2.4	0x8afe	Name error (3)	licendfilteo.site	none	none	A (IP address)	IN (0x0001)	false
Oct 7, 2024 06:44:54.439049006 CEST	1.1.1.1	192.168.2.4	0x9a9	Name error (3)	clearancek.site	none	none	A (IP address)	IN (0x0001)	false
Oct 7, 2024 06:44:54.448517084 CEST	1.1.1.1	192.168.2.4	0x1971	No error (0)	steamcommunity.com		104.102.49.254	A (IP address)	IN (0x0001)	false
Oct 7, 2024 06:44:55.059479952 CEST	1.1.1.1	192.168.2.4	0xad3e	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Oct 7, 2024 06:44:55.059479952 CEST	1.1.1.1	192.168.2.4	0xad3e	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Oct 7, 2024 06:44:55.531116009 CEST	1.1.1.1	192.168.2.4	0x8dd6	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 7, 2024 06:44:55.531116009 CEST	1.1.1.1	192.168.2.4	0x8dd6	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
Oct 7, 2024 06:44:55.714004040 CEST	1.1.1.1	192.168.2.4	0xbb89	No error (0)	sergei-esenin.com		104.21.53.8	A (IP address)	IN (0x0001)	false
Oct 7, 2024 06:44:55.714004040 CEST	1.1.1.1	192.168.2.4	0xbb89	No error (0)	sergei-esenin.com		172.67.206.204	A (IP address)	IN (0x0001)	false
Oct 7, 2024 06:45:52.317317963 CEST	1.1.1.1	192.168.2.4	0xb3fe	No error (0)	shed.dual-low.s-part-0036.t-0009.t-msedge.net	s-part-0036.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 7, 2024 06:45:52.317317963 CEST	1.1.1.1	192.168.2.4	0xb3fe	No error (0)	s-part-0036.t-0009.t-msedge.net		13.107.246.64	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

methodbojjewkl.shop

steamcommunity.com

sergei-esenin.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	104.21.55.124	443	6596	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 04:44:53 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: methodbojjewkl.shop
2024-10-07 04:44:53 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-10-07 04:44:54 UTC	770	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 04:44:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=vp4n14d57mg9nnmv71blep6esn; expires=Thu, 30 Jan 2025 22:31:33 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pDAXO9j0zsQIk0VEwyr%2BWMyJ7Poax308KLnhmlSPyJu5obLM5luXCMWhWwPQbEED5hO7sGOmuNZm1on%2FXgAqKcmrAevUG%2Bn2KFYl7wTbw7DbEItYF8BtH2SxyUSUeXu3lVbA4rIq"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ceb3d154b2241e6-EWR
2024-10-07 04:44:54 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-10-07 04:44:54 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49732	104.102.49.254	443	6596	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 04:44:55 UTC	219	OUT	GET /profiles/76561199724331900 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: steamcommunity.com
2024-10-07 04:44:55 UTC	1870	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.akamai.steamstatic.com/ https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq. [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Mon, 07 Oct 2024 04:44:55 GMT Content-Length: 34837 Connection: close Set-Cookie: sessionid=05b7526956744afd387fb159; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7Cd7fb65801182a5f50a3169fe2a0b7ef0; Path=/; Secure; HttpOnly; SameSite=None
2024-10-07 04:44:55 UTC	14514	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0d 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0d 0a 09 09 3c Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><
2024-10-07 04:44:55 UTC	16384	IN	Data Raw: 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0d 0a 09 09 6a 51 75 65 72 79 28 66 75 6e 63 74 69 6f 6e 28 24 29 20 7b 0d 0a 09 09 09 24 28 27 23 67 6c 6f 62 61 6c 5f 68 65 61 64 65 72 20 2e 73 75 70 65 72 6e 61 76 27 29 2e 76 5f 74 6f 6f 6c 74 69 70 28 7b 27 6c 6f 63 61 74 69 6f 6e 27 3a 27 62 6f 74 74 6f 6d 27 2c 20 27 64 65 73 74 72 6f 79 57 68 65 6e 44 6f 6e 65 27 3a 20 66 61 6c 73 65 2c 20 27 74 6f 6f 6c 74 69 70 43 6c 61 73 73 27 3a 20 27 73 75 70 65 72 6e 61 76 5f 63 6f 6e 74 65 6e 74 27 2c 20 27 6f 66 66 73 65 74 59 27 3a 2d 36 2c 20 27 6f 66 66 73 65 74 58 27 3a 20 31 2c 20 27 68 6f 72 69 7a 6f 6e 74 61 6c 53 6e 61 70 27 3a 20 34 2c 20 27 74 6f 6f 6c 74 69 70 50 61 72 65 6e 74 27 3a 20 27 23 67 6c 6f Data Ascii: <script type="text/javascript">jQuery(function($) {$('#global_header .supernav').v_tooltip({'location':'bottom', 'destroyWhenDone': false, 'tooltipClass': 'supernav_content', 'offsetY':-6, 'offsetX': 1, 'horizontalSnap': 4, 'tooltipParent': '#glo
2024-10-07 04:44:55 UTC	3768	IN	Data Raw: 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 72 6f 66 69 6c 65 5f 73 75 6d 6d 61 72 79 5f 66 6f 6f 74 65 72 22 3e 0d 0a 09 09 09 09 09 09 09 3c 73 70 61 6e 20 64 61 74 61 2d 70 61 6e 65 6c 3d 22 7b 26 71 75 6f 74 3b 66 6f 63 75 73 61 62 6c 65 26 71 75 6f 74 3b 3a 74 72 75 65 2c 26 71 75 6f 74 3b 63 6c 69 63 6b 4f 6e 41 63 74 69 76 61 74 65 26 71 75 6f 74 3b 3a 74 72 75 65 7d 22 20 63 6c 61 73 73 3d 22 77 68 69 74 65 4c 69 6e 6b 22 20 63 6c 61 73 73 3d 22 77 68 69 74 65 4c 69 6e 6b 22 3e 56 69 65 77 20 6d 6f 72 65 20 69 6e 66 6f 3c 2f 73 70 61 6e 3e 0d 0a 09 09 09 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 09 09 09 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 20 24 4a 28 20 66 75 6e 63 74 69 6f 6e 28 29 Data Ascii: <div class="profile_summary_footer"><span data-panel="{"focusable":true,"clickOnActivate":true}" class="whiteLink" class="whiteLink">View more info</span></div><script type="text/javascript"> $J( function()
2024-10-07 04:44:55 UTC	171	IN	Data Raw: 09 3c 73 70 61 6e 3e 56 69 65 77 20 6d 6f 62 69 6c 65 20 77 65 62 73 69 74 65 3c 2f 73 70 61 6e 3e 0d 0a 09 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 0d 0a 09 3c 2f 64 69 76 3e 09 3c 21 2d 2d 20 72 65 73 70 6f 6e 73 69 76 65 5f 70 61 67 65 5f 63 6f 6e 74 65 6e 74 20 2d 2d 3e 0d 0a 0d 0a 3c 2f 64 69 76 3e 09 3c 21 2d 2d 20 72 65 73 70 6f 6e 73 69 76 65 5f 70 61 67 65 5f 66 72 61 6d 65 20 2d 2d 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <span>View mobile website</span></div></div></div></div>... responsive_page_content --></div>... responsive_page_frame --></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49735	104.21.53.8	443	6596	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 04:44:56 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: sergei-esenin.com
2024-10-07 04:44:56 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-10-07 04:44:56 UTC	801	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 04:44:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=a8ltr04kepvo24dlg1besf6ogg; expires=Thu, 30 Jan 2025 22:31:35 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fPOG%2FSgBbZ50T0hUBP%2FTgnV51pAmxVuF7UJJaO1CV%2FIsBiYd%2FEVUcot90oW6O41yEZ2mmQ57M770B3awIXlroWWO9q6fdEWTbndtyEiUZfNzd0G8lzmwanNWpG%2FDLlwyIxFvVA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ceb3d23aede8cab-EWR
2024-10-07 04:44:56 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-10-07 04:44:56 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	00:44:52
Start date:	07/10/2024
Path:	C:\Users\user\Desktop\Setup.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Setup.exe"
Imagebase:	0x900000
File size:	530'944 bytes
MD5 hash:	5F965231AE39BC8E6A816C8CE8E69D95
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_LummaCStealer_4, Description: Yara detected LummaC Stealer, Source: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	00:44:52
Start date:	07/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Imagebase:	0x650000
File size:	262'432 bytes
MD5 hash:	8FDF47E0FF70C40ED3A17014AEEA4232
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_LummaCStealer_4, Description: Yara detected LummaC Stealer, Source: 00000001.00000002.1688980606.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	00:44:52
Start date:	07/10/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6576 -s 636
Imagebase:	0xb90000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	0.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	38.7%
Total number of Nodes:	75
Total number of Limit Nodes:	2

Executed Functions

Function 009020AD Relevance: 6.0, APIs: 1, Strings: 2, Instructions: 755
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(00980AE0,000004E4,00000040,?), ref: 0090293D

Strings

MZx, xrefs: 0090294F, 0090295B, 00902960
N, xrefs: 009028B2

Memory Dump Source

Source File: 00000000.00000002.1853283587.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1853248409.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853317233.000000000091E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853591948.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853656074.0000000000981000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853687370.0000000000983000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_Setup.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID: MZx$N
API String ID: 544645111-4171182330
Opcode ID: f0d4246ed95033cd7f7097d76f7bfd25fe50a5a53319ad97c0fbb2bcfa519d6f
Instruction ID: f94fba3bf98551f5dc0418bcb998471d1fbb74cf0168efc3adae0b716d7c0708
Opcode Fuzzy Hash: f0d4246ed95033cd7f7097d76f7bfd25fe50a5a53319ad97c0fbb2bcfa519d6f
Instruction Fuzzy Hash: 5B02FF1BA34E1B0AE30C21398D5B3E2D50ED7EA730F955337AE67D76F4E25E08428684

Non-executed Functions

Function 00945A4F Relevance: 31.9, Strings: 24, Instructions: 1933COMMON

Download Yara Rule

Strings

()./, xrefs: 009468AA
WP, xrefs: 00945BCF
mjkh, xrefs: 009466B8
`Y^_, xrefs: 0094687E
dcba, xrefs: 00946608
|, xrefs: 00946B91
xgfe, xrefs: 009465FD
QNOL, xrefs: 00946655
LKJI, xrefs: 009465C6
<=:;, xrefs: 00946810
`onm, xrefs: 00946613
T, xrefs: 00947037
89>?, xrefs: 009468D6
tsrq, xrefs: 009465DC
%*+(, xrefs: 00945D17, 00945D26
tuJK, xrefs: 00946847
89&', xrefs: 0094681B
AR, xrefs: 00945BF0
:WUE, xrefs: 00947597, 009475A6
@ONM, xrefs: 009465BB
lkji, xrefs: 0094661E
D, xrefs: 00946726
DCBA, xrefs: 00946767, 00946776
<=2, xrefs: 009468E1

Memory Dump Source

Source File: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1853248409.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853283587.0000000000901000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853317233.000000000091E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853591948.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853656074.0000000000981000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853687370.0000000000983000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID: %*+($()./$89&'$89>?$:WUE$<=2$<=:;$@ONM$AR$D$DCBA$LKJI$QNOL$T$WP$`Y^_$`onm$dcba$lkji$mjkh$tsrq$tuJK$xgfe$|
API String ID: 0-1418943773
Opcode ID: a9f1e68edfaf0ae1e626f109336ed9d19a6b5191b739eb3bbf20b7e6025201f9
Instruction ID: 003a984c73fcfcb9fff05c93364ebcdd41cc28b87e935d192510320b9b4f6bc8
Opcode Fuzzy Hash: a9f1e68edfaf0ae1e626f109336ed9d19a6b5191b739eb3bbf20b7e6025201f9
Instruction Fuzzy Hash: B5F266B050D3819BD770CF54C494BABBBE6AFD6344F14482CE4C98B292EB759894CB93

Function 00951ECC Relevance: 21.7, Strings: 17, Instructions: 438
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

/), xrefs: 0095254D
(a*c, xrefs: 00952027
WQ, xrefs: 0095250B
N[, xrefs: 00952255
JG, xrefs: 00952907
]{, xrefs: 009520C7, 009520D3
Gt, xrefs: 00951ED8
%e6g, xrefs: 00952032
_Y, xrefs: 00952521
S], xrefs: 00952516
?m,o, xrefs: 0095201C
hi, xrefs: 00952A7D
WH, xrefs: 009528FC
kW, xrefs: 00952260
CG, xrefs: 00952912
sm, xrefs: 00952710
=], xrefs: 0095224A

Memory Dump Source

Source File: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1853248409.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853283587.0000000000901000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853317233.000000000091E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853591948.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853656074.0000000000981000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853687370.0000000000983000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID: %e6g$(a*c$=]$?m,o$CG$Gt$JG$N[$WH$]{$hi$kW$/)$S]$WQ$_Y$sm
API String ID: 0-1131134755
Opcode ID: 7fe6c7d6d9efdaf882a2b9df3b8a54a15053ee68894a73401dbca1371ba866d9
Instruction ID: 9fa302f3383c6166b470099b6b87af12a52b9dbb0fa726c283090acf2d4fc06f
Opcode Fuzzy Hash: 7fe6c7d6d9efdaf882a2b9df3b8a54a15053ee68894a73401dbca1371ba866d9
Instruction Fuzzy Hash: 3742B5B414D3858AE270CF26D581B8EBAF1BB92740F608E1DE5ED5B255DBB08049CF93

Function 00951667 Relevance: 11.4, Strings: 9, Instructions: 103COMMON

Download Yara Rule

Strings

@-r/, xrefs: 009516E6
;IJK, xrefs: 0095171E
z=Q?, xrefs: 00951706
!E4G, xrefs: 00951716
|1]3, xrefs: 009516EE
W5W7, xrefs: 009516F6
I)C+, xrefs: 009516DE
,A&C, xrefs: 0095170E
W!Q#, xrefs: 009516CE

Memory Dump Source

Source File: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1853248409.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853283587.0000000000901000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853317233.000000000091E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853591948.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853656074.0000000000981000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853687370.0000000000983000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID: !E4G$,A&C$;IJK$@-r/$I)C+$W!Q#$W5W7$z=Q?$|1]3
API String ID: 0-2124749398
Opcode ID: f2cd62d45247a4721067a6d54a2199a1ff98fbe07b7bed4634b5cc81127c74ee
Instruction ID: a2795de15dd58172da7b0b2d108e6c925b78697214ee3894b9f4ab4fcc78a34d
Opcode Fuzzy Hash: f2cd62d45247a4721067a6d54a2199a1ff98fbe07b7bed4634b5cc81127c74ee
Instruction Fuzzy Hash: 0A3142B41093819BC710EF5AD8A062BBBF0FF8678AF54591CF8C58B221E374D948CB46

Function 0095A2C0 Relevance: 9.1, Strings: 7, Instructions: 359COMMON

Download Yara Rule

Strings

`tii, xrefs: 0095A573
f@~!, xrefs: 0095A4DF
mlc@, xrefs: 0095A63C
ggxz, xrefs: 0095A565
{l`~, xrefs: 0095A56C
fedc, xrefs: 0095A662
aenQ, xrefs: 0095A64A

Memory Dump Source

Source File: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1853248409.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853283587.0000000000901000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853317233.000000000091E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853591948.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853656074.0000000000981000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853687370.0000000000983000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID: `tii$aenQ$f@~!$fedc$ggxz$mlc@${l`~
API String ID: 0-3056062858
Opcode ID: 81e2fee55be0e0ed83158224188c4395161ee7ac948e32e04c625285de5dfabf
Instruction ID: 43ccbbc6399d9a87c2ef1e38fcb82afba0e6781218d9fb656e36823f7817e2de
Opcode Fuzzy Hash: 81e2fee55be0e0ed83158224188c4395161ee7ac948e32e04c625285de5dfabf
Instruction Fuzzy Hash: DCD12BB4801B409BD361EF398646797BFF0BB06300F444A5DE8EB4B686D731A41ACBD6

Function 0091A200 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,0091A51E,00000002,00000000,?,?,?,0091A51E,?,00000000), ref: 0091A299
GetLocaleInfoW.KERNEL32(?,20001004,0091A51E,00000002,00000000,?,?,?,0091A51E,?,00000000), ref: 0091A2C2
GetACP.KERNEL32(?,?,0091A51E,?,00000000), ref: 0091A2D7

Strings

OCP, xrefs: 0091A254
ACP, xrefs: 0091A21E

Memory Dump Source

Source File: 00000000.00000002.1853283587.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1853248409.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853317233.000000000091E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853591948.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853656074.0000000000981000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853687370.0000000000983000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_Setup.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 0ac7951be49d905ac2b5966e0daa30eb9612db9d31316037dae1d7c0eab75e1d
Instruction ID: 864e97081d53c7b4f248822f289bfb9b1ad406acbc8fb6ea53c97854778315aa
Opcode Fuzzy Hash: 0ac7951be49d905ac2b5966e0daa30eb9612db9d31316037dae1d7c0eab75e1d
Instruction Fuzzy Hash: C421B332706108AADB358F54C901AD773AEBB64B60B568C24E92ADB115F733DEC0D352

Function 0091A3D5 Relevance: 7.7, APIs: 5, Instructions: 183COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0091189A: GetLastError.KERNEL32(?,00000000,0090E1EF,?,?,?,?,00000003,0090B735,?,0090B6A4,00000000,00000016,0090B8B3), ref: 0091189E
Part of subcall function 0091189A: SetLastError.KERNEL32(00000000,00000016,0090B8B3,?,?,?,?,?,00000000), ref: 00911940

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 0091A4E1
IsValidCodePage.KERNEL32(00000000), ref: 0091A52A
IsValidLocale.KERNEL32(?,?), ref: 0091A539
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 0091A581
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 0091A5A0

Memory Dump Source

Source File: 00000000.00000002.1853283587.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1853248409.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853317233.000000000091E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853591948.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853656074.0000000000981000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853687370.0000000000983000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_Setup.jbxd

Yara matches

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID:
API String ID: 415426439-0
Opcode ID: f1560feb1b3ddc6aaa8e76ab9d4b8e7b3d9fe7b634a0c73a070aa10ee9708562
Instruction ID: b782abcf78a29bfff97b5d79c4a49d09de3f1191939075e05cb188e1b78436ae
Opcode Fuzzy Hash: f1560feb1b3ddc6aaa8e76ab9d4b8e7b3d9fe7b634a0c73a070aa10ee9708562
Instruction Fuzzy Hash: CB516E71B01209AFEB10DFA5DC45BFE73B9AF44300F144469F914E71A0EBB49E848B62

Function 00955C89 Relevance: 7.5, Strings: 6, Instructions: 38COMMON

Download Yara Rule

Strings

n\+H, xrefs: 00955CA0
upH}, xrefs: 00955CB5
%AUU, xrefs: 00955C99
iP`R, xrefs: 00955C92
1 G@, xrefs: 00955CAE
hX]N, xrefs: 00955CA7

Memory Dump Source

Source File: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1853248409.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853283587.0000000000901000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853317233.000000000091E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853591948.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853656074.0000000000981000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853687370.0000000000983000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID: %AUU$1 G@$hX]N$iP`R$n\+H$upH}
API String ID: 0-3520097955
Opcode ID: 6209497fda56ba42c0ca55be78a875de8b250e6332eb0d406aaca2855171a349
Instruction ID: 6d9c88250079438643b48aedb0a7a13b31faf9f79f66d976125d42b6f27442c3
Opcode Fuzzy Hash: 6209497fda56ba42c0ca55be78a875de8b250e6332eb0d406aaca2855171a349
Instruction Fuzzy Hash: A2012D70801745CBC721CF56D65066FFBF1BF06741F14480DD88277652C734AA48CBA5

Function 009291D7 Relevance: 7.2, Strings: 5, Instructions: 922COMMON

Download Yara Rule

Strings

@, xrefs: 0092B411
0, xrefs: 0092A31E
i, xrefs: 0092A7CA
0, xrefs: 00929D68
0, xrefs: 00929CA1

Memory Dump Source

Source File: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1853248409.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853283587.0000000000901000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853317233.000000000091E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853591948.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853656074.0000000000981000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853687370.0000000000983000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID: 0$0$0$@$i
API String ID: 0-3124195287
Opcode ID: 12572a0e7900ef4fab88ceb8c21c045fe7f3c85080e9f8e24115e1caf920c67f
Instruction ID: 7d23dd01b2c59768e81ce75029ce7e06f923b6e757e13609d4f601ca6dab4cd7
Opcode Fuzzy Hash: 12572a0e7900ef4fab88ceb8c21c045fe7f3c85080e9f8e24115e1caf920c67f
Instruction Fuzzy Hash: 8F62E33260C3A18FD318CF28E59476ABBE5AFD5304F188E2DE4D987295D374D949CB82

Function 0091755F Relevance: 6.1, APIs: 4, Instructions: 129fileCOMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000), ref: 009175FA
FindNextFileW.KERNEL32(00000000,?), ref: 00917675
FindClose.KERNEL32(00000000), ref: 00917697
FindClose.KERNEL32(00000000), ref: 009176BA

Memory Dump Source

Source File: 00000000.00000002.1853283587.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1853248409.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853317233.000000000091E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853591948.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853656074.0000000000981000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853687370.0000000000983000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_Setup.jbxd

Yara matches

Similarity

API ID: Find$CloseFile$FirstNext
String ID:
API String ID: 1164774033-0
Opcode ID: fc3a0a358ccfdd50de1da9c490d2593a35a002352ada7e0fb3dfa03e04dee975
Instruction ID: cc1b773d9bbc56b5c8a957660a5528eb9528c839d1837a0b0490f2c7708028bd
Opcode Fuzzy Hash: fc3a0a358ccfdd50de1da9c490d2593a35a002352ada7e0fb3dfa03e04dee975
Instruction Fuzzy Hash: A5418271B0862E9FDB20DFA8CC88EFAF7BDEB84344F104595E40597144E6309EC4CA65

Function 009078F8 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 00907904
IsDebuggerPresent.KERNEL32 ref: 009079D0
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 009079E9
UnhandledExceptionFilter.KERNEL32(?), ref: 009079F3

Memory Dump Source

Source File: 00000000.00000002.1853283587.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1853248409.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853317233.000000000091E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853591948.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853656074.0000000000981000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853687370.0000000000983000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_Setup.jbxd

Yara matches

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 769080753e30202a4b9baa187262e61d1cd71b17802ec2e580f9a07ec46585f5
Instruction ID: fb2976ad1e75dccddb1debc2ca1d4b292f018ddc194b26e8f0db5aad3bd52d25
Opcode Fuzzy Hash: 769080753e30202a4b9baa187262e61d1cd71b17802ec2e580f9a07ec46585f5
Instruction Fuzzy Hash: 4131D975E19218DFDB21DFA4D9497CDBBB8AF08300F1041AAE40DAB290EB719B84DF45

Function 0092945D Relevance: 5.5, Strings: 4, Instructions: 458COMMON

Download Yara Rule

Strings

gfff, xrefs: 0092A177
-, xrefs: 0092A0CD
gfff, xrefs: 0092A1C1
gfff, xrefs: 0092A106

Memory Dump Source

Source File: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1853248409.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853283587.0000000000901000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853317233.000000000091E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853591948.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853656074.0000000000981000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853687370.0000000000983000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID: -$gfff$gfff$gfff
API String ID: 0-3742897846
Opcode ID: 7718804b42ef8cf930431149c87fdc9c6f380754b2246168860b9e7f3cc38233
Instruction ID: f58f06cfc358459ab82da6a77548268b40e91adcfd174efabaa0a146032fbd3e
Opcode Fuzzy Hash: 7718804b42ef8cf930431149c87fdc9c6f380754b2246168860b9e7f3cc38233
Instruction Fuzzy Hash: 5BF1E6726097618FC708CE29D49036ABBE2AFD5304F18CA2DE5D98739AD634D945CB43

Function 0094A140 Relevance: 5.4, Strings: 4, Instructions: 383COMMON

Download Yara Rule

Strings

hu, xrefs: 0094A20F
sj, xrefs: 0094A207
lc, xrefs: 0094A3E7
a|, xrefs: 0094A1F7

Memory Dump Source

Source File: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1853248409.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853283587.0000000000901000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853317233.000000000091E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853591948.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853656074.0000000000981000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853687370.0000000000983000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID: a|$hu$lc$sj
API String ID: 0-3748788050
Opcode ID: 2da6593b7bce017c5e70d307783f88ffe4697bf2d3fed1e3eddb71d2ace34cd3
Instruction ID: a2c0b10a79045a339291cc457143224549bd9a88b8332fe609151d46c0bab5ac
Opcode Fuzzy Hash: 2da6593b7bce017c5e70d307783f88ffe4697bf2d3fed1e3eddb71d2ace34cd3
Instruction Fuzzy Hash: 07A18D744083418BD720DF18C881A2BB7F4FF96754F588A0CE8D99B2A1E379D945CB97

Function 00937B80 Relevance: 5.4, Strings: 4, Instructions: 373COMMON

Download Yara Rule

Strings

J|BJ, xrefs: 00937EED
t, xrefs: 00937B9E
V, xrefs: 00937DBC
VY^_, xrefs: 00937CDF

Memory Dump Source

Source File: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1853248409.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853283587.0000000000901000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853317233.000000000091E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853591948.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853656074.0000000000981000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853687370.0000000000983000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID: J|BJ$V$VY^_$t
API String ID: 0-3701112211
Opcode ID: 43469e6f44eed1a9b836f895c9410751fc96af4312bcce639396a2a91bef0c87
Instruction ID: cab42e55eb876ffe5b89782e0cddb5fb814f36c9ceb906bb9cd2041d6f296e26
Opcode Fuzzy Hash: 43469e6f44eed1a9b836f895c9410751fc96af4312bcce639396a2a91bef0c87
Instruction Fuzzy Hash: 3AD156B450C3809BD324DF54849066FFBE5AB92B48F28885CF4C99B262D736CD49DF92

Function 0095568F Relevance: 5.2, Strings: 4, Instructions: 213COMMON

Download Yara Rule

Strings

#', xrefs: 009558CA
T>, xrefs: 00955864
KV, xrefs: 0095585D
CV, xrefs: 0095586B

Memory Dump Source

Source File: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1853248409.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853283587.0000000000901000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853317233.000000000091E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853591948.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853656074.0000000000981000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853687370.0000000000983000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID: #'$CV$KV$T>
API String ID: 0-95592268
Opcode ID: c69b9ea6594a5c43ac04cb82c4969c9d22671953c70c58e81f226922327a0ad4
Instruction ID: aa365ed638a6e7c681c9f13103c447b0035fe512c41a59353d958d933c762ed6
Opcode Fuzzy Hash: c69b9ea6594a5c43ac04cb82c4969c9d22671953c70c58e81f226922327a0ad4
Instruction Fuzzy Hash: 178156B4801B459BDB20DFA6D28515EBFB1BF16301F604608E8866B655C334AA59CFE2

Function 00952B71 Relevance: 5.1, Strings: 4, Instructions: 80COMMON

Download Yara Rule

Strings

,{*y, xrefs: 00952BE7, 00952BF3
lk, xrefs: 00952B9C
(g6e, xrefs: 00952B81
4c2a, xrefs: 00952B89

Memory Dump Source

Source File: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1853248409.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853283587.0000000000901000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853317233.000000000091E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853591948.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853656074.0000000000981000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853687370.0000000000983000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID: (g6e$,{*y$4c2a$lk
API String ID: 0-1327526056
Opcode ID: f9dcc124c1b9a8638023c2dbdaf7777240da40c55f36b67bbdbdb3a86eb3612c
Instruction ID: 9bcb07f9331de4903f9acc81c8e47917f769c559623c0a48b051b27466e768fa
Opcode Fuzzy Hash: f9dcc124c1b9a8638023c2dbdaf7777240da40c55f36b67bbdbdb3a86eb3612c
Instruction Fuzzy Hash: 2A2198B84083818AC730DF21C5007ABB7F0FF92742F64599DE8C89B261DB75C844CB86

Function 00919E84 Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 0091189A: GetLastError.KERNEL32(?,00000000,0090E1EF,?,?,?,?,00000003,0090B735,?,0090B6A4,00000000,00000016,0090B8B3), ref: 0091189E
Part of subcall function 0091189A: SetLastError.KERNEL32(00000000,00000016,0090B8B3,?,?,?,?,?,00000000), ref: 00911940

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00919ED8
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00919F22
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00919FE8

Memory Dump Source

Source File: 00000000.00000002.1853283587.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1853248409.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853317233.000000000091E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853591948.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853656074.0000000000981000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853687370.0000000000983000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_Setup.jbxd

Yara matches

Similarity

API ID: InfoLocale$ErrorLast
String ID:
API String ID: 661929714-0
Opcode ID: 1ad409613dc8c90d63352af008a7c0d71ac84cd70e73bb2c6277687a9d1109e7
Instruction ID: f0b708f57645aa5afb3ab136130249252476bf952c2c0def93e6098759a7753c
Opcode Fuzzy Hash: 1ad409613dc8c90d63352af008a7c0d71ac84cd70e73bb2c6277687a9d1109e7
Instruction Fuzzy Hash: E561817171120B9FDB249F24CD92BFAB7A8EF49300F1040A9E906C6285E739EDC1CB52

Function 0090B736 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 0090B82E
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 0090B838
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,00000000), ref: 0090B845

Memory Dump Source

Source File: 00000000.00000002.1853283587.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1853248409.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853317233.000000000091E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853591948.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853656074.0000000000981000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853687370.0000000000983000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_Setup.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 515d11d547edbee5e3d989d5cea0971531c7533529924fdc8f3e20a243c8b459
Instruction ID: 39740971cbbd327144df10be1dcb788f4681b4e362a637509d1a1e1d5ec3d5bb
Opcode Fuzzy Hash: 515d11d547edbee5e3d989d5cea0971531c7533529924fdc8f3e20a243c8b459
Instruction Fuzzy Hash: 7231C6749112189BCB21DF64D8897CDB7B8BF48310F5041EAE81CA62A0EB709F858F44

Function 0092952F Relevance: 4.2, Strings: 3, Instructions: 472COMMON

Download Yara Rule

Strings

+, xrefs: 00929453
gfff, xrefs: 00929E1C
gfff, xrefs: 00929E37

Memory Dump Source

Source File: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1853248409.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853283587.0000000000901000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853317233.000000000091E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853591948.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853656074.0000000000981000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853687370.0000000000983000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID: +$gfff$gfff
API String ID: 0-3646763964
Opcode ID: 35b728ad1705faf1f3b3f1732b5860e73b9f66d7c2269a3ae04d64dfcb9b7f2b
Instruction ID: 13088613a580c957de51b40916be878b7c9bcc1fa96652e624bb391bea8935d3
Opcode Fuzzy Hash: 35b728ad1705faf1f3b3f1732b5860e73b9f66d7c2269a3ae04d64dfcb9b7f2b
Instruction Fuzzy Hash: 31F1A13160C7A18FC715CE29D48436AFBE2AFD9304F188A6DE4D98735AD334D949CB92

Function 00929283 Relevance: 4.1, Strings: 3, Instructions: 390COMMON

Download Yara Rule

Strings

-, xrefs: 00929E03
gfff, xrefs: 00929E1C
gfff, xrefs: 00929E37

Memory Dump Source

Source File: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1853248409.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853283587.0000000000901000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853317233.000000000091E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853591948.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853656074.0000000000981000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853687370.0000000000983000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID: -$gfff$gfff
API String ID: 0-837351935
Opcode ID: d6ff6ad1442cbdf409bfd7bb2423588c0ae80e6daf78ca5f303bac0752b65028
Instruction ID: 3d3c76077e509bde4e5547f6c1de9368cccc6e97a092e423680c5d3464a3ec94
Opcode Fuzzy Hash: d6ff6ad1442cbdf409bfd7bb2423588c0ae80e6daf78ca5f303bac0752b65028
Instruction Fuzzy Hash: 7AD19E3560C7928FC715CE29D48026AFBE2AFD9308F08CA6DE4D98735AD334D949CB52

Function 0095AF7C Relevance: 4.0, Strings: 3, Instructions: 254COMMON

Download Yara Rule

Strings

LTDV, xrefs: 0095AFE8
3<, xrefs: 0095B1B6
:, xrefs: 0095B1BD

Memory Dump Source

Source File: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1853248409.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853283587.0000000000901000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853317233.000000000091E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853591948.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853656074.0000000000981000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853687370.0000000000983000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID: 3<$:$LTDV
API String ID: 0-2797654093
Opcode ID: 9e7e827bec4cf70078eb32fa0fd477bc959d63c8314f3fba064201532e789eb4
Instruction ID: 6d7dff24b1222f4f938b8702bc63726094dc90bbe27a5277f76693598ae1e58a
Opcode Fuzzy Hash: 9e7e827bec4cf70078eb32fa0fd477bc959d63c8314f3fba064201532e789eb4
Instruction Fuzzy Hash: 0F716B70015781CBDBA18F36C590B27BBE5BF16301F585889E8D68BA96C335F809CB65

Function 0095AFDD Relevance: 4.0, Strings: 3, Instructions: 243COMMON

Download Yara Rule

Strings

LTDV, xrefs: 0095AFE8
3<, xrefs: 0095B1B6
:, xrefs: 0095B1BD

Memory Dump Source

Source File: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1853248409.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853283587.0000000000901000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853317233.000000000091E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853591948.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853656074.0000000000981000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853687370.0000000000983000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID: 3<$:$LTDV
API String ID: 0-2797654093
Opcode ID: 55370f4e5b9aebffe46f1c775ac834abbae90c9ef6c8401be1cb76cf2d82a942
Instruction ID: 07ef4b04395ba08af7f18a080eae808cbf5ac23364260d17c7195bf8ba374515
Opcode Fuzzy Hash: 55370f4e5b9aebffe46f1c775ac834abbae90c9ef6c8401be1cb76cf2d82a942
Instruction Fuzzy Hash: 87618A700057818BDB618F26C5A0B26BBE5BF16301F585889E8D69FA97C335E809CB61

Function 00957F38 Relevance: 3.8, Strings: 3, Instructions: 67COMMON

Download Yara Rule

Strings

J\KR, xrefs: 00957F58
:, xrefs: 00957F67
^XF^, xrefs: 00957F93

Memory Dump Source

Source File: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1853248409.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853283587.0000000000901000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853317233.000000000091E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853591948.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853656074.0000000000981000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853687370.0000000000983000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID: :$J\KR$^XF^
API String ID: 0-4266130588
Opcode ID: 64bd0f38261b9b9006df79643b90736e476ce14dd74394cd61dbc2cb2afcfc2a
Instruction ID: 34f52f05ab3154120ac230fe62ca61b112c3bf3bc6769866ddeb255656d35c1f
Opcode Fuzzy Hash: 64bd0f38261b9b9006df79643b90736e476ce14dd74394cd61dbc2cb2afcfc2a
Instruction Fuzzy Hash: E7214A7400C3808BD312CF269450B6AFBE5AF86716F584D5CECD49B251D73ADA0D9B62

Function 0096BF20 Relevance: 3.1, Strings: 2, Instructions: 577COMMON

Download Yara Rule

Strings

f, xrefs: 0096C0EC
%*+(, xrefs: 0096BF84, 0096BF8D

Memory Dump Source

Source File: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1853248409.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853283587.0000000000901000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853317233.000000000091E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853591948.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853656074.0000000000981000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853687370.0000000000983000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID: %*+($f
API String ID: 0-2038831151
Opcode ID: 89d37b99ddcec098b1c0d00c9a8877e78529c77cf73c3d1d79a6a6d3dd0eea3c
Instruction ID: e0b3b95a9c46be32f0299f5a14181a61004db2164795a9bddf95c78fc9ceea66
Opcode Fuzzy Hash: 89d37b99ddcec098b1c0d00c9a8877e78529c77cf73c3d1d79a6a6d3dd0eea3c
Instruction Fuzzy Hash: D0127AB16083419FC715CF28C890B2EBBE5BBC9314F588A2DF4E59B291D735E905CB92

Function 00947EBF Relevance: 2.7, Strings: 2, Instructions: 185COMMON

Download Yara Rule

Strings

BaBc, xrefs: 00948077
Ye[g, xrefs: 00947FD6

Memory Dump Source

Source File: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1853248409.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853283587.0000000000901000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853317233.000000000091E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853591948.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853656074.0000000000981000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853687370.0000000000983000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID: BaBc$Ye[g
API String ID: 0-286865133
Opcode ID: f1f7f391700c1d153706023ea2e533e08aec07d0302d054125fe460e923244f9
Instruction ID: 4f2a2655a50443314eda9a955ee1cfd94de885f31842e194b5a76df704dfb177
Opcode Fuzzy Hash: f1f7f391700c1d153706023ea2e533e08aec07d0302d054125fe460e923244f9
Instruction Fuzzy Hash: 2451B8B16083858BC730DF14C881BABF7E4FF96314F194D5DE89A8BA51E3749844CB66

Function 0095BF20 Relevance: 2.6, Strings: 2, Instructions: 128COMMON

Download Yara Rule

Strings

40F9, xrefs: 0095BF29
%*+(, xrefs: 0095BFCF

Memory Dump Source

Source File: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1853248409.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853283587.0000000000901000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853317233.000000000091E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853591948.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853656074.0000000000981000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853687370.0000000000983000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID: %*+($40F9
API String ID: 0-4141425864
Opcode ID: e36d9df26ce8d8e7db79f00bc2036a7f7c8980a0d99b81a382e9f2e5388ff683
Instruction ID: 60e6c8bb3a4e471981dc1aafa8f4a29f3bacf406d298d5487a60ba0f6119e3d0
Opcode Fuzzy Hash: e36d9df26ce8d8e7db79f00bc2036a7f7c8980a0d99b81a382e9f2e5388ff683
Instruction Fuzzy Hash: 5F418E701117418FDB258F26D990726BBF1FF02709F64544DE8825BA92C332F409CB64

Function 00928EE0 Relevance: 2.5, Strings: 1, Instructions: 1295COMMON

Download Yara Rule

Strings

@, xrefs: 0092AB20

Memory Dump Source

Source File: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1853248409.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853283587.0000000000901000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853317233.000000000091E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853591948.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853656074.0000000000981000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853687370.0000000000983000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: b9ab761e06cb60054b554ba1fd181e1af7336824aa7e9b9d9034564fed5e9b5a
Instruction ID: 1ba0d8ee6c71400b9a6d99cf4a7ea6b9ac0fddaa1e151ef19f82700c470f970a
Opcode Fuzzy Hash: b9ab761e06cb60054b554ba1fd181e1af7336824aa7e9b9d9034564fed5e9b5a
Instruction Fuzzy Hash: B39227326083228FD714CE28D89436EBBE6AFD5314F198A2DE895C7399D734DD45CB82

Function 00916775 Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,?,?,?,?,?,?,00916770,?,?,?,?,?,?,00000000), ref: 009169A2

Memory Dump Source

Source File: 00000000.00000002.1853283587.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1853248409.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853317233.000000000091E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853591948.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853656074.0000000000981000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853687370.0000000000983000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_Setup.jbxd

Yara matches

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 7ecf223e49fd15b643dcde2f45921b8de09742ea657f7f7dc9cf77090766e935
Instruction ID: 699ec3ebde9cef42934251869004ecc6d03c40634fc55d1dc9a4bfd668c0eec2
Opcode Fuzzy Hash: 7ecf223e49fd15b643dcde2f45921b8de09742ea657f7f7dc9cf77090766e935
Instruction Fuzzy Hash: 42B12C35A10609DFDB15CF28C486BA57BE4FF45364F258698E8DACF2A1C335E991CB40

Function 0090729C Relevance: 1.7, APIs: 1, Instructions: 242COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 009072B2

Memory Dump Source

Source File: 00000000.00000002.1853283587.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1853248409.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853317233.000000000091E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853591948.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853656074.0000000000981000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853687370.0000000000983000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_Setup.jbxd

Yara matches

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 7da36248f134726cf59f32fc7938a625f957341a2277abe734c75259bbe91374
Instruction ID: 9a51887b7638cbbfe4aedad432d80b4ae365c7d97ad3f08221a11a96acbdbaa5
Opcode Fuzzy Hash: 7da36248f134726cf59f32fc7938a625f957341a2277abe734c75259bbe91374
Instruction Fuzzy Hash: 25A19071D296058FDB28CFA4E8827DABBF4FB48720F14852AD509E73A0C734A845DF50

Function 009591B0 Relevance: 1.7, Strings: 1, Instructions: 484COMMON

Download Yara Rule

Strings

", xrefs: 009594B1

Memory Dump Source

Source File: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1853248409.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853283587.0000000000901000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853317233.000000000091E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853591948.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853656074.0000000000981000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853687370.0000000000983000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: 1e36e4a90a5bcd9904d9a2755a98640d2f51fe7f53356f7c076c40d918f289ea
Instruction ID: 4b3f2a7f2421197a0f8ca01ed69a9bb4b8aaea56ff4818bf30bf10fae0f6592f
Opcode Fuzzy Hash: 1e36e4a90a5bcd9904d9a2755a98640d2f51fe7f53356f7c076c40d918f289ea
Instruction Fuzzy Hash: D3F12571A083419FE724CF268490B2BBBDAABC5315F19896DEC9947382E734DD09C792

Function 0094FD40 Relevance: 1.7, Strings: 1, Instructions: 425COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00950143, 0095014B

Memory Dump Source

Source File: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1853248409.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853283587.0000000000901000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853317233.000000000091E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853591948.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853656074.0000000000981000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853687370.0000000000983000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: ccee2a807569c25fde004874fc692891e8030e5aaea5b8ac7fbb6ff0169ecf93
Instruction ID: dc4bef8492d2c0ca8718a6bccbc940ed0e921db7440149dec6d3f57d815ad4ea
Opcode Fuzzy Hash: ccee2a807569c25fde004874fc692891e8030e5aaea5b8ac7fbb6ff0169ecf93
Instruction Fuzzy Hash: 3BC1CD71508301ABD710EB25D891B2BB7F9EF96755F098828F8C597292E335ED08CB63

Function 0095B81B Relevance: 1.6, Strings: 1, Instructions: 363COMMON

Download Yara Rule

Strings

Zvt~, xrefs: 0095B827

Memory Dump Source

Source File: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1853248409.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853283587.0000000000901000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853317233.000000000091E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853591948.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853656074.0000000000981000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853687370.0000000000983000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID: Zvt~
API String ID: 0-694600945
Opcode ID: a6c653d8a13b2bff62d9e48921e2962895175bf4283dfb7f1703a331fac975e3
Instruction ID: 1011f13d54ce5f5d258382dd156fa2a889785a5bdf9583cc6a6e8d37bca459a7
Opcode Fuzzy Hash: a6c653d8a13b2bff62d9e48921e2962895175bf4283dfb7f1703a331fac975e3
Instruction Fuzzy Hash: C9C17B701047818FD766CF29C190B22BBE1BF56305F68989DE8DA8B793C776E806CB54

Function 00954BB0 Relevance: 1.6, Strings: 1, Instructions: 357COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00954CA3, 00954CAB

Memory Dump Source

Source File: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1853248409.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853283587.0000000000901000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853317233.000000000091E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853591948.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853656074.0000000000981000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853687370.0000000000983000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: f162ee7309057f34a05e18a7188bb59e25b4a99871efe8703988e1fac2c245e9
Instruction ID: 0235f5a32411ca96e528a210970a9153d9b935cca5a79a4be98c3a37cbbbd4d3
Opcode Fuzzy Hash: f162ee7309057f34a05e18a7188bb59e25b4a99871efe8703988e1fac2c245e9
Instruction Fuzzy Hash: 6CB105706093019BD754DF1AE88172BB7F6EF8534AF14492CE9C58B391E335E898CB92

Function 0091A0D7 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 0091189A: GetLastError.KERNEL32(?,00000000,0090E1EF,?,?,?,?,00000003,0090B735,?,0090B6A4,00000000,00000016,0090B8B3), ref: 0091189E
Part of subcall function 0091189A: SetLastError.KERNEL32(00000000,00000016,0090B8B3,?,?,?,?,?,00000000), ref: 00911940

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0091A12B

Memory Dump Source

Source File: 00000000.00000002.1853283587.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1853248409.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853317233.000000000091E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853591948.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853656074.0000000000981000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853687370.0000000000983000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_Setup.jbxd

Yara matches

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 1e912c554d6abd60a0b21da9dd1ecc77c2b0eb4b6b1b2e9c0cd9d0144e55aebc
Instruction ID: 197460d027eaeeeb3226e1bd2a48d722c32a3ea45249b8fe6380af0f6486b83d
Opcode Fuzzy Hash: 1e912c554d6abd60a0b21da9dd1ecc77c2b0eb4b6b1b2e9c0cd9d0144e55aebc
Instruction Fuzzy Hash: 4821807275A20ABBDB299B65DC41BFA73ACEF85310F10407AF906D6141EB74AD80CA51

Function 0096FEA0 Relevance: 1.6, Strings: 1, Instructions: 331COMMON

Download Yara Rule

Strings

P, xrefs: 00970047

Memory Dump Source

Source File: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1853248409.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853283587.0000000000901000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853317233.000000000091E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853591948.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853656074.0000000000981000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853687370.0000000000983000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID: P
API String ID: 0-3110715001
Opcode ID: b4fda1ba9dc91e6581218cfb9f953b2bbd6cc257535fdb74648dd629dc9337cc
Instruction ID: a1d79763c968823139e3af4e6300bec1cb4b1c53cb668915a2aeffecb705866d
Opcode Fuzzy Hash: b4fda1ba9dc91e6581218cfb9f953b2bbd6cc257535fdb74648dd629dc9337cc
Instruction Fuzzy Hash: CDB1FD726083618FC725CE18D89072EB7E1EBC5714F158A2CE8A9AB381C775DC06CBD2

Function 00919D5E Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0091189A: GetLastError.KERNEL32(?,00000000,0090E1EF,?,?,?,?,00000003,0090B735,?,0090B6A4,00000000,00000016,0090B8B3), ref: 0091189E
Part of subcall function 0091189A: SetLastError.KERNEL32(00000000,00000016,0090B8B3,?,?,?,?,?,00000000), ref: 00911940

EnumSystemLocalesW.KERNEL32(00919E84,?,00000000,?,-00000050,?,0091A4B5,00000000,?,?,?,00000055,?), ref: 00919DD0

Memory Dump Source

Source File: 00000000.00000002.1853283587.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1853248409.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853317233.000000000091E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853591948.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853656074.0000000000981000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853687370.0000000000983000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_Setup.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: d83c9977115d21fadc098978948f644fdea460c10c8f7bc0f07ac47536995c75
Instruction ID: 76de7cf8cc591c0e84465ab6408086d2c06c61ef6d749795391b6dc6fe35d33b
Opcode Fuzzy Hash: d83c9977115d21fadc098978948f644fdea460c10c8f7bc0f07ac47536995c75
Instruction Fuzzy Hash: C911253B3007095FDB18DF39D8A16FABBA5FF80758B14842CE98687A80D371B882C740

Function 0091A306 Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 0091189A: GetLastError.KERNEL32(?,00000000,0090E1EF,?,?,?,?,00000003,0090B735,?,0090B6A4,00000000,00000016,0090B8B3), ref: 0091189E
Part of subcall function 0091189A: SetLastError.KERNEL32(00000000,00000016,0090B8B3,?,?,?,?,?,00000000), ref: 00911940

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,0091A0A0,00000000,00000000,?), ref: 0091A332

Memory Dump Source

Source File: 00000000.00000002.1853283587.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1853248409.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853317233.000000000091E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853591948.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853656074.0000000000981000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853687370.0000000000983000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_Setup.jbxd

Yara matches

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 9c619df7980a8d4bb9993c97f4b01d8ec605c08ea4c004922b5d9d2430c7903f
Instruction ID: c808af59ada13c44c5dbeab15a8492a55ae78e56a76d30b4fc2cfd045d6d42ca
Opcode Fuzzy Hash: 9c619df7980a8d4bb9993c97f4b01d8ec605c08ea4c004922b5d9d2430c7903f
Instruction Fuzzy Hash: 5CF0F936700219BFDB285760C805BFA775CEB40754F154829ED1AE3180EA74FE82C591

Function 00919DF9 Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0091189A: GetLastError.KERNEL32(?,00000000,0090E1EF,?,?,?,?,00000003,0090B735,?,0090B6A4,00000000,00000016,0090B8B3), ref: 0091189E
Part of subcall function 0091189A: SetLastError.KERNEL32(00000000,00000016,0090B8B3,?,?,?,?,?,00000000), ref: 00911940

EnumSystemLocalesW.KERNEL32(0091A0D7,?,?,?,-00000050,?,0091A479,-00000050,?,?,?,00000055,?,-00000050,?,?), ref: 00919E43

Memory Dump Source

Source File: 00000000.00000002.1853283587.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1853248409.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853317233.000000000091E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853591948.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853656074.0000000000981000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853687370.0000000000983000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_Setup.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 10695b07a2266b38356e43587b6a3434ca1d0a10453958e167403b88dde4f205
Instruction ID: cb380040b3473f1094be8d56e4d594d3ad622be5ed72517759a29eb0f7721de2
Opcode Fuzzy Hash: 10695b07a2266b38356e43587b6a3434ca1d0a10453958e167403b88dde4f205
Instruction Fuzzy Hash: EAF0C23630430C5FDB249F35D891ABABB95EB81768F05846CFA054B680C6B1AC82D650

Function 00911B92 Relevance: 1.5, APIs: 1, Instructions: 33COMMON

Download Yara Rule

APIs

Part of subcall function 0090BA84: EnterCriticalSection.KERNEL32(-00981CD8,?,0090E57A,00000000,00926810,0000000C,0090E541,?,?,009122C6,?,?,00911A38,?,00000364,00000000), ref: 0090BA93

EnumSystemLocalesW.KERNEL32(Function_00011B85,?,009269E0,0000000C,00911F38,?), ref: 00911BCA

Memory Dump Source

Source File: 00000000.00000002.1853283587.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1853248409.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853317233.000000000091E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853591948.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853656074.0000000000981000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853687370.0000000000983000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_Setup.jbxd

Yara matches

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: c796b1caa49476bd91b01ff0e7fbc98c74efe190b3c623a907a6073e262da929
Instruction ID: 9c34c154b51ee6a56b4dd10025dbea9a388b0e9cf643fe258f0c726490d6fc41
Opcode Fuzzy Hash: c796b1caa49476bd91b01ff0e7fbc98c74efe190b3c623a907a6073e262da929
Instruction Fuzzy Hash: C0F0E776A58205EFD700EFA8E846B9977F0FB88725F10415AE5109B2E0DB755944DB40

Function 00919D13 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0091189A: GetLastError.KERNEL32(?,00000000,0090E1EF,?,?,?,?,00000003,0090B735,?,0090B6A4,00000000,00000016,0090B8B3), ref: 0091189E
Part of subcall function 0091189A: SetLastError.KERNEL32(00000000,00000016,0090B8B3,?,?,?,?,?,00000000), ref: 00911940

EnumSystemLocalesW.KERNEL32(00919C6C,?,?,?,?,0091A4D7,-00000050,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 00919D4A

Memory Dump Source

Source File: 00000000.00000002.1853283587.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1853248409.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853317233.000000000091E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853591948.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853656074.0000000000981000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853687370.0000000000983000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_Setup.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: b2a560c4974e0e1fd02ba089e8e93c0a3136fce8ec69e27b1baecd1f0c596e02
Instruction ID: 0147a07d48907016d671c6f7ed601755379233e057aaa678bcc770b742c9d0aa
Opcode Fuzzy Hash: b2a560c4974e0e1fd02ba089e8e93c0a3136fce8ec69e27b1baecd1f0c596e02
Instruction Fuzzy Hash: 14F0E53A70020D57CB049F35DC657AABFA8EFC2754B068098FB098B291C6719983C790

Function 0091203C Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,?,?,0091046C,?,20001004,00000000,00000002,?,?,0090FA6E), ref: 00912070

Memory Dump Source

Source File: 00000000.00000002.1853283587.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1853248409.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853317233.000000000091E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853591948.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853656074.0000000000981000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853687370.0000000000983000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_Setup.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 4463fcd41e87f2dca6d2754a87191a474a269cd60a7eddf3bfa52f228d36572d
Instruction ID: 1ab3b4bca7dcfefe321441f7a75021d15b6bf1442a447dd2aa96571f3a133545
Opcode Fuzzy Hash: 4463fcd41e87f2dca6d2754a87191a474a269cd60a7eddf3bfa52f228d36572d
Instruction Fuzzy Hash: E8E04F36A0421CBBCF223F61EC08AEE3E2AFF48750F108410FE4565160DB728970EAD1

Function 0092927A Relevance: 1.5, Strings: 1, Instructions: 273COMMON

Download Yara Rule

Strings

@, xrefs: 00929796

Memory Dump Source

Source File: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1853248409.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853283587.0000000000901000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853317233.000000000091E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853591948.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853656074.0000000000981000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853687370.0000000000983000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 33c5a5b9aaa3ad7d40147cb7931ce02fe19695e2396a5ce853ba19e0c001f1db
Instruction ID: a167b9b188bcb040babafb887f146a41684770242797f8a249080edeb9468374
Opcode Fuzzy Hash: 33c5a5b9aaa3ad7d40147cb7931ce02fe19695e2396a5ce853ba19e0c001f1db
Instruction Fuzzy Hash: 4BA1C13660C7518FC714CF19D49436ABBE2AFC9308F188A6DE4D987395C738D948CB82

Function 00907A85 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00007A91,00906DBF), ref: 00907A8A

Memory Dump Source

Source File: 00000000.00000002.1853283587.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1853248409.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853317233.000000000091E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853591948.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853656074.0000000000981000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853687370.0000000000983000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_Setup.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 19e4ac8d7681f17d3dc30c05159c0e11cadaab76f0d0146b4bb96baa8792e3d1
Instruction ID: 60ec3167d974b86520b9cb95a83db700fd9d7641916bc033b120544a0fd241ef
Opcode Fuzzy Hash: 19e4ac8d7681f17d3dc30c05159c0e11cadaab76f0d0146b4bb96baa8792e3d1
Instruction Fuzzy Hash:

Function 0096C920 Relevance: 1.5, Strings: 1, Instructions: 220COMMON

Download Yara Rule

Strings

%*+(, xrefs: 0096CB13, 0096CB1B

Memory Dump Source

Source File: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1853248409.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853283587.0000000000901000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853317233.000000000091E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853591948.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853656074.0000000000981000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853687370.0000000000983000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: 0caa54ea1a90315641ea19c1d2cce55cd527f95500d153b2503ff0c6c28a3b73
Instruction ID: 5b73300b523935c26b70aafc4bde39cf3ede23c3b4e06a3d7c0f0563ca4d6c44
Opcode Fuzzy Hash: 0caa54ea1a90315641ea19c1d2cce55cd527f95500d153b2503ff0c6c28a3b73
Instruction Fuzzy Hash: D561D1B16083459BD710DFA5C880B3AB7EAEBC8350F68891DF5D58B292D731EC40CB96

Function 0096B800 Relevance: 1.4, Strings: 1, Instructions: 172COMMON

Download Yara Rule

Strings

%*+(, xrefs: 0096B8C3, 0096B8CB

Memory Dump Source

Source File: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1853248409.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853283587.0000000000901000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853317233.000000000091E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853591948.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853656074.0000000000981000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853687370.0000000000983000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: 48588023ea1370a3b3f62b516369bf0138abb56be5ee286ad8c44f99da0f281a
Instruction ID: 89d4595d6a5ed67d470f90dab161e7394e8dd377a82409c10bd2e4fa2f66f031
Opcode Fuzzy Hash: 48588023ea1370a3b3f62b516369bf0138abb56be5ee286ad8c44f99da0f281a
Instruction Fuzzy Hash: 6251B275A093009BDB249F15D890B2FB7EAEF89749F14882DE5C9D7252E331DC90CB62

Function 00901E1E Relevance: 1.4, Strings: 1, Instructions: 156COMMON

Download Yara Rule

Strings

Z81xbyuAua, xrefs: 00901F40

Memory Dump Source

Source File: 00000000.00000002.1853283587.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1853248409.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853317233.000000000091E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853591948.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853656074.0000000000981000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853687370.0000000000983000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID: Z81xbyuAua
API String ID: 0-3121583705
Opcode ID: 4e01e02c617511826416832af333434574ac759e6a8e3c8df1e510604d1fe95f
Instruction ID: 40fb801f7ba959753e78b5867c4fc56717b19d8e2d6c4a527af1153b3f34ae7d
Opcode Fuzzy Hash: 4e01e02c617511826416832af333434574ac759e6a8e3c8df1e510604d1fe95f
Instruction Fuzzy Hash: 3A410E76E1052B4FCB4CEEB8C4561AFBB79EB45350B144279DE51DB3D1E2348A01CAD4

Function 00939ACE Relevance: 1.4, Strings: 1, Instructions: 128COMMON

Download Yara Rule

Strings

L3, xrefs: 00939B1E

Memory Dump Source

Source File: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1853248409.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853283587.0000000000901000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853317233.000000000091E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853591948.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853656074.0000000000981000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853687370.0000000000983000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID: L3
API String ID: 0-2730849248
Opcode ID: bf5552e4f83f3bf5aa9e4b1957c4ed33519c9f7afd665e70c400cb02b69d6293
Instruction ID: a6453022b79f08162b9e6cdf8e976d9ab7c39b09f12a002bd6e3f60aeb83c737
Opcode Fuzzy Hash: bf5552e4f83f3bf5aa9e4b1957c4ed33519c9f7afd665e70c400cb02b69d6293
Instruction Fuzzy Hash: 704141B80083809BC7149F14D894A2BBBF4BF86714F04991CF9C59B291E736CA05CF5A

Function 00967B3E Relevance: 1.4, Strings: 1, Instructions: 127COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00967B84, 00967B8D

Memory Dump Source

Source File: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1853248409.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853283587.0000000000901000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853317233.000000000091E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853591948.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853656074.0000000000981000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853687370.0000000000983000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: c9c3511cf99027d5277ab4afa78953f19eeb9f45ac490c8b653ea83e395facf0
Instruction ID: ef0bd17e86d991c6e87e453e088980b708d551d05d9e4d8dd7b8617816164a61
Opcode Fuzzy Hash: c9c3511cf99027d5277ab4afa78953f19eeb9f45ac490c8b653ea83e395facf0
Instruction Fuzzy Hash: B441BFB061D3019BD714DF90E984A2AB7E5EB89749F14482CE1C5A7252E335D840CB66

Function 0095082C Relevance: 1.4, Strings: 1, Instructions: 124COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00950863, 0095086B

Memory Dump Source

Source File: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1853248409.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853283587.0000000000901000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853317233.000000000091E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853591948.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853656074.0000000000981000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853687370.0000000000983000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: 452cdd5390474614f0ddbf0a7bb649cabe469c3da803ff3115ae04a2fb717320
Instruction ID: 5ff89145691c1ec5531356d8ef26e3511c843ba04495de697f8af54ed4b3a67c
Opcode Fuzzy Hash: 452cdd5390474614f0ddbf0a7bb649cabe469c3da803ff3115ae04a2fb717320
Instruction Fuzzy Hash: A0419A7060A301AFD715DF1AC890B2EBBEAFBC8746F604A1CE5C297291D331E814CB56

Function 00967E50 Relevance: 1.4, Strings: 1, Instructions: 124COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00967F13, 00967F1B

Memory Dump Source

Source File: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1853248409.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853283587.0000000000901000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853317233.000000000091E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853591948.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853656074.0000000000981000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853687370.0000000000983000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: e1a7b55e822f4c4c0b190b196c54346a81db642f877fb84c2c593a9f1511728d
Instruction ID: b6a5932b564c8f8a769c66dcca2f0369189fc1f43fb8228b65b9482c6499d081
Opcode Fuzzy Hash: e1a7b55e822f4c4c0b190b196c54346a81db642f877fb84c2c593a9f1511728d
Instruction Fuzzy Hash: 9B31B8B560C305ABD610EA94EC41F2BF7EDEB8474CF554828F88497252E331DC148762

Function 0093EE71 Relevance: 1.4, Strings: 1, Instructions: 108COMMON

Download Yara Rule

Strings

%*+(, xrefs: 0093EF1B

Memory Dump Source

Source File: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1853248409.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853283587.0000000000901000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853317233.000000000091E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853591948.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853656074.0000000000981000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853687370.0000000000983000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: 532d68ad360e3601756663246d56755396bef2663983efa083b5df1ddb856f39
Instruction ID: 016de44ba41399f8fc3227a0f5473cdd46563e70fd417de29a9c76cd891bcc87
Opcode Fuzzy Hash: 532d68ad360e3601756663246d56755396bef2663983efa083b5df1ddb856f39
Instruction Fuzzy Hash: 62411375611B00DBDB348F65D994B27BBF6FB49701F14892CE58A9BAA2E371F8008F14

Function 0096E83B Relevance: 1.4, Strings: 1, Instructions: 100COMMON

Download Yara Rule

Strings

@, xrefs: 0096E8A5

Memory Dump Source

Source File: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1853248409.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853283587.0000000000901000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853317233.000000000091E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853591948.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853656074.0000000000981000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853687370.0000000000983000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: c4c03cbc5544a13e512ffd9534df50902cc064df239456c5298f338a1898222a
Instruction ID: ace65e1d89e69a8dada86e9238be7c5b9f3f610541af4baca52d9962d20b871f
Opcode Fuzzy Hash: c4c03cbc5544a13e512ffd9534df50902cc064df239456c5298f338a1898222a
Instruction Fuzzy Hash: A83178B5A183018FD758DF14D8A073AB7F5EF95345F08482DE5C697262E338D904CB56

Function 00971BC0 Relevance: 1.3, Strings: 1, Instructions: 87COMMON

Download Yara Rule

Strings

@, xrefs: 00971C10

Memory Dump Source

Source File: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1853248409.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853283587.0000000000901000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853317233.000000000091E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853591948.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853656074.0000000000981000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853687370.0000000000983000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: f17ffc2d6e27705a654a95a8f2915903712d92e1ab09fb38acfa9e2b53ebfc9f
Instruction ID: f46a66aa7bc1787db99e5bbab93ea92f4b1fdf7775172309823fedd51ac9ee0f
Opcode Fuzzy Hash: f17ffc2d6e27705a654a95a8f2915903712d92e1ab09fb38acfa9e2b53ebfc9f
Instruction Fuzzy Hash: 78317671A083009BD311DF58D880A2AFBF9FF9A354F18C92CE5C897251D335D9048BA6

Function 009478A4 Relevance: 1.3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

Strings

%*+(, xrefs: 009478F7

Memory Dump Source

Source File: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1853248409.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853283587.0000000000901000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853317233.000000000091E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853591948.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853656074.0000000000981000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853687370.0000000000983000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: 24268017a7ecd41d9c94378706e298c4005a58272b1363c3163575431a6d74e9
Instruction ID: c487960d438508fd4d758f0f5b1192b47ae53ff7a1107cd537283e21645aed97
Opcode Fuzzy Hash: 24268017a7ecd41d9c94378706e298c4005a58272b1363c3163575431a6d74e9
Instruction Fuzzy Hash: 77218771548342DFC734CF58D898BBAB7E6FB98341F580D2CE08987682E331A941CB86

Function 009543B7 Relevance: 1.3, Strings: 1, Instructions: 67COMMON

Download Yara Rule

Strings

~/i!, xrefs: 00954417

Memory Dump Source

Source File: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1853248409.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853283587.0000000000901000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853317233.000000000091E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853591948.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853656074.0000000000981000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853687370.0000000000983000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID: ~/i!
API String ID: 0-1642318302
Opcode ID: ca5e31d4c722cdb773ff07964b58c5f5501e65a1289eb1d493cab06e26b7a2d7
Instruction ID: 67390f6512fd35d247a4232e5a1786ef195f39f82cb946ac88e0374e2399f23c
Opcode Fuzzy Hash: ca5e31d4c722cdb773ff07964b58c5f5501e65a1289eb1d493cab06e26b7a2d7
Instruction Fuzzy Hash: AB41C8B441D3848FE3609F529441B8FFBF1BB91314FA08A0DE6E85B251D77184098F97

Function 00956572 Relevance: 1.3, Strings: 1, Instructions: 46COMMON

Download Yara Rule

Strings

72?1, xrefs: 00956582

Memory Dump Source

Source File: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1853248409.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853283587.0000000000901000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853317233.000000000091E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853591948.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853656074.0000000000981000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853687370.0000000000983000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID: 72?1
API String ID: 0-1649870076
Opcode ID: 76f8ab0ed0d94e201e3e07d0fa783b670310ded641f28510d027d2591c6b76f4
Instruction ID: a580173c682ad53ce12442b141435189ebf00324b35aca7536b65a8d5c626a9f
Opcode Fuzzy Hash: 76f8ab0ed0d94e201e3e07d0fa783b670310ded641f28510d027d2591c6b76f4
Instruction Fuzzy Hash: E8016DB18006459FD721CF96D590ABFFBF6AF46305F50090CE486AB651D334AA09CFB6

Function 0091A637 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0091A637

Memory Dump Source

Source File: 00000000.00000002.1853283587.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1853248409.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853317233.000000000091E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853591948.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853656074.0000000000981000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853687370.0000000000983000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_Setup.jbxd

Yara matches

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: a2307c7c7688edcc618130b00dbe31acc34448b13add5fdc7613d7a3b6efc4b8
Instruction ID: bbeb6af0024d5a5ff6333d0ec80229b1500498f03053fbe824f448f5180dac55
Opcode Fuzzy Hash: a2307c7c7688edcc618130b00dbe31acc34448b13add5fdc7613d7a3b6efc4b8
Instruction Fuzzy Hash: 6BA0017062A2029F97488F36AA4A65E7AA9AA466A17098069A806C9271EA348451AB11

Function 00933D90 Relevance: .9, Instructions: 895COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1853248409.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853283587.0000000000901000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853317233.000000000091E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853591948.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853656074.0000000000981000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853687370.0000000000983000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6de66e3364744c6f46b7430cdf404bec020986853ce93ecd62be46533fc1686f
Instruction ID: 8b556be4434f7da1274ddd188ce20f8321c6738f9942c8d8387b0d5940ef5bce
Opcode Fuzzy Hash: 6de66e3364744c6f46b7430cdf404bec020986853ce93ecd62be46533fc1686f
Instruction Fuzzy Hash: DE52E831A087118BC7259F18D8802BBB3E5FFD5319F264A2DD9D697290D738B851CF86

Function 00933280 Relevance: .7, Instructions: 670COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1853248409.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853283587.0000000000901000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853317233.000000000091E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853591948.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853656074.0000000000981000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853687370.0000000000983000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31e46b44ab80c96838bc845868810fc41c008ea86121d9247d5acbc9ded64e9c
Instruction ID: 7826596f8875d7d2a3111fb636b94371de129c2018dc495dca27a96ede8b1596
Opcode Fuzzy Hash: 31e46b44ab80c96838bc845868810fc41c008ea86121d9247d5acbc9ded64e9c
Instruction Fuzzy Hash: D652E470948B849FE735CB24C0893A7BBE5EB91314F148D2DD5E746B82C27DAA84CF52

Function 0092F0D0 Relevance: .7, Instructions: 657COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1853248409.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853283587.0000000000901000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853317233.000000000091E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853591948.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853656074.0000000000981000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853687370.0000000000983000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b06f627f8f7063155f207e74ffce46a74d4b27d2ae33735865de5c38f21a1d3
Instruction ID: 4d909d4cb6e2ce7242da59f5641d7a6d65d0ca95e3e7710c06672cfe941b50c3
Opcode Fuzzy Hash: 6b06f627f8f7063155f207e74ffce46a74d4b27d2ae33735865de5c38f21a1d3
Instruction Fuzzy Hash: D852AF355083558BCB14CF28D0A06AABBF1FF88314F198A7DE8995B355D778E889CF81

Function 0092FAD0 Relevance: .6, Instructions: 592COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1853248409.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853283587.0000000000901000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853317233.000000000091E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853591948.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853656074.0000000000981000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853687370.0000000000983000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90a9ddde86f9f0d6dcf61a8da39fda9f839fcfb56b46b398fe7e1491a94c2c2e
Instruction ID: 0586df8a50f08f1df20be2d232012a0837186941e445604388e24b85bd65e783
Opcode Fuzzy Hash: 90a9ddde86f9f0d6dcf61a8da39fda9f839fcfb56b46b398fe7e1491a94c2c2e
Instruction Fuzzy Hash: B8322370515B218FC368CF29D5A066ABBF2BF85710B604A2ED6A787F95D336F844CB10

Function 009321E0 Relevance: .5, Instructions: 459COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1853248409.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853283587.0000000000901000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853317233.000000000091E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853591948.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853656074.0000000000981000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853687370.0000000000983000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8dbf8a9190905fd82ba4d34b3568b61c3c587483ba5650872ac470c2db95d517
Instruction ID: 7cfeb82b1db8d8316a7d76cbf9f4ca646a489eaf91949541600aa88eed2ee2e1
Opcode Fuzzy Hash: 8dbf8a9190905fd82ba4d34b3568b61c3c587483ba5650872ac470c2db95d517
Instruction Fuzzy Hash: 23F1AA762087418FD724CF29C881B6BFBE6AFD8304F48882DE5D587751E639E948CB52

Function 0092B490 Relevance: .4, Instructions: 411COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1853248409.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853283587.0000000000901000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853317233.000000000091E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853591948.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853656074.0000000000981000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853687370.0000000000983000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da9e90a145ef812cea4a1aec4dc33611fe657f569e89895301b885733208a132
Instruction ID: 39120e939e708465ad03952f4ff84084e2acf6cab6ce07bccab4afe789ea58ec
Opcode Fuzzy Hash: da9e90a145ef812cea4a1aec4dc33611fe657f569e89895301b885733208a132
Instruction Fuzzy Hash: 99D1B471A083229BC704CF28D98061ABBE5EFC8750F158E2DF999973A4E775DC458B82

Function 0096F990 Relevance: .4, Instructions: 354COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1853248409.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853283587.0000000000901000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853317233.000000000091E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853591948.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853656074.0000000000981000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853687370.0000000000983000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab695292c8b8be27e531aa2b31291d186ec3fa8c2225d2167c1a821e12252e0c
Instruction ID: 1408b784758c3c98dfa69123d141ecfc5ba8350994a25d8a99bf6955b9304949
Opcode Fuzzy Hash: ab695292c8b8be27e531aa2b31291d186ec3fa8c2225d2167c1a821e12252e0c
Instruction Fuzzy Hash: 8DB10572A083504BE714DE28EC6576BB7E9EBC5314F09493CE998D7392E735EC048B92

Function 0095BB2A Relevance: .3, Instructions: 330COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1853248409.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853283587.0000000000901000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853317233.000000000091E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853591948.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853656074.0000000000981000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853687370.0000000000983000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ee771dfa70001f925bfea03d664bd7776843dac40e7f18ab3edc6201f5f4258
Instruction ID: eee77940ca8eccd9dbb6fcf9766ea480de99bb6225727e9e28f62644601a3e88
Opcode Fuzzy Hash: 0ee771dfa70001f925bfea03d664bd7776843dac40e7f18ab3edc6201f5f4258
Instruction Fuzzy Hash: 6EB177705047818FD766CF29C190B22BBE1BF56305F68889DE8DA8B793C776E806CB50

Function 0095BB4B Relevance: .3, Instructions: 324COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1853248409.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853283587.0000000000901000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853317233.000000000091E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853591948.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853656074.0000000000981000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853687370.0000000000983000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b767dea67f4a2f7cf31decc1319bcbc18fec578ba60376257e9679b3c1f41b22
Instruction ID: 4655ae554916ca5f828ae7cf75d469f84e7c24c8c0376247094c31d03a22e2e9
Opcode Fuzzy Hash: b767dea67f4a2f7cf31decc1319bcbc18fec578ba60376257e9679b3c1f41b22
Instruction Fuzzy Hash: 0CB177701047818FD766CF29C190B22BBE1BF56305F68889DE8DA8B793C776E806CB54

Function 00932DF0 Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1853248409.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853283587.0000000000901000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853317233.000000000091E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853591948.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853656074.0000000000981000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853687370.0000000000983000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c6117061885288c1b39a5b943f8482e52345fd8b1a48c2f17ef7dcb0cf10c7c
Instruction ID: 8afa35f4433b8d14f9cd103a4f4ea71f8141fb37b7edf74cf502e4098fe67b94
Opcode Fuzzy Hash: 9c6117061885288c1b39a5b943f8482e52345fd8b1a48c2f17ef7dcb0cf10c7c
Instruction Fuzzy Hash: D5C14BB29487418FC364CF68DC86BABB7E1BF85318F08892DD1D9C6242D778A155CF46

Function 0093E416 Relevance: .3, Instructions: 295COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1853248409.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853283587.0000000000901000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853317233.000000000091E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853591948.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853656074.0000000000981000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853687370.0000000000983000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d3e80e1e551c1b5307767355c273c929f276517553dab3428ab8c78f89de879
Instruction ID: 8eb282190b13cad8aa7869d8f0f54b39b520ac53173022702cbaed2daf418504
Opcode Fuzzy Hash: 4d3e80e1e551c1b5307767355c273c929f276517553dab3428ab8c78f89de879
Instruction Fuzzy Hash: 57B102B4600B408FD721CF24D981B57BBF5AF56704F14885CE8AA8BB92E335F805CB95

Function 0096F5F0 Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1853248409.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853283587.0000000000901000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853317233.000000000091E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853591948.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853656074.0000000000981000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853687370.0000000000983000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a95dd50ec095db7a27f57ad37ec87d9359705260a1e90b17de809d3445c49d2e
Instruction ID: f4155b111465c71dadf9c04de919195f4648acffdb1dfd31396b79476f8bc800
Opcode Fuzzy Hash: a95dd50ec095db7a27f57ad37ec87d9359705260a1e90b17de809d3445c49d2e
Instruction Fuzzy Hash: E8918071608301ABE720DF14E861B6FBBE5EBC9354F54482CF99597351E730E950CB92

Function 0092D12B Relevance: .3, Instructions: 284COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1853248409.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853283587.0000000000901000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853317233.000000000091E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853591948.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853656074.0000000000981000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853687370.0000000000983000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2bc2c964d8783c56c0facf786f96d3b5996f0704cee37f54a01b38d77fa17338
Instruction ID: 15659ce4848d6f7c9c0e4755ac26254c790179aa5fc843b6dba3342a2e671d83
Opcode Fuzzy Hash: 2bc2c964d8783c56c0facf786f96d3b5996f0704cee37f54a01b38d77fa17338
Instruction Fuzzy Hash: A1A10AB250A3628BE715CF18F440727B7E6AFE1308F19856DE85987399E775EC08C781

Function 00971FB0 Relevance: .3, Instructions: 282COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1853248409.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853283587.0000000000901000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853317233.000000000091E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853591948.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853656074.0000000000981000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853687370.0000000000983000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a57c0111a676d4db74895e3ca6696bb045d8f27298eeec49787a9baf2036813
Instruction ID: 4ffe890ffccc1143430093a40f3fc1c78195e4f6464293fa44f74d2f962ceb8a
Opcode Fuzzy Hash: 4a57c0111a676d4db74895e3ca6696bb045d8f27298eeec49787a9baf2036813
Instruction Fuzzy Hash: 9A81B0362183019BC724DF68C890A2AB7F5FF89740F45C92CE58ACB252E730EC51CB92

Function 0095E3D0 Relevance: .2, Instructions: 246COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1853248409.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853283587.0000000000901000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853317233.000000000091E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853591948.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853656074.0000000000981000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853687370.0000000000983000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1cd372a116d043efc028469314845027128994ef8c54f150f525e54f19af1d2
Instruction ID: cb691638e9979913be45c239760b1c7b583584ef655224f3cf7d76aadae59c83
Opcode Fuzzy Hash: c1cd372a116d043efc028469314845027128994ef8c54f150f525e54f19af1d2
Instruction Fuzzy Hash: FC71E733B5AA904BC3189D7D4C81395BA834BE7335B3EC775EDB48B3E5D52A490A4350

Function 0094FAE0 Relevance: .2, Instructions: 242COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1853248409.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853283587.0000000000901000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853317233.000000000091E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853591948.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853656074.0000000000981000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853687370.0000000000983000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5eee379ce68d8c273bbc54570b7d3637e45457eb8161fd84b21c20bb6afda90
Instruction ID: 4eacf57cef1bd256cb48e574c238594e96c8d01a712a6f379920afce5a1c7c8b
Opcode Fuzzy Hash: e5eee379ce68d8c273bbc54570b7d3637e45457eb8161fd84b21c20bb6afda90
Instruction Fuzzy Hash: C451B0B16042059BDB209B24CCE6F7773A8EF86768F154968F989CB391F375E800C761

Function 00955D8C Relevance: .2, Instructions: 242COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1853248409.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853283587.0000000000901000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853317233.000000000091E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853591948.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853656074.0000000000981000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853687370.0000000000983000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 390502a7dbc55b931af77b2cd4db89728a94f04527eb6b4d510d3d8de7dda55c
Instruction ID: 49c46380a6145310f45d9f71c18266f1a87d7e2ff9c59ebb25aea8006fe44f0d
Opcode Fuzzy Hash: 390502a7dbc55b931af77b2cd4db89728a94f04527eb6b4d510d3d8de7dda55c
Instruction Fuzzy Hash: CF817676E009154BCB1CCE6DD86267EB6B3ABC8314B19C22DD927E73D5DF3499028B84

Function 0094A548 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1853248409.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853283587.0000000000901000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853317233.000000000091E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853591948.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853656074.0000000000981000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853687370.0000000000983000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d945db3ddaf58208315b5268697068eceb6d853915d256c1e8a4390fd1e69238
Instruction ID: 07d074df9431e64a57248651cd20b736b64b22555b2b12143c2a27d475ddb0b6
Opcode Fuzzy Hash: d945db3ddaf58208315b5268697068eceb6d853915d256c1e8a4390fd1e69238
Instruction Fuzzy Hash: 1E5164B44583808BD720AF19D891B2BBBF4EFA6754F09890CE4C58B361E379D910CB67

Function 0092D090 Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1853248409.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853283587.0000000000901000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853317233.000000000091E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853591948.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853656074.0000000000981000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853687370.0000000000983000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2039f829499ba2b7c9b1141e2c1bb0237ca780102234b95d4d22809a355a138f
Instruction ID: ea22630e0d53b77313457aa64fbdeaa08ad7ffcfb0d07d93c664c70e59918ff4
Opcode Fuzzy Hash: 2039f829499ba2b7c9b1141e2c1bb0237ca780102234b95d4d22809a355a138f
Instruction Fuzzy Hash: 907106B250A7628BE7258E18F540326FBA7AFE1308F2DC56DD8694B359E775CC08C742

Function 00959740 Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1853248409.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853283587.0000000000901000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853317233.000000000091E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853591948.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853656074.0000000000981000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853687370.0000000000983000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d108e008403b3c92b59985e25fae4eb0cb21936506a5ffd7efe5999b9cc5533
Instruction ID: c4e5d1fe653085039f5bef67ebf75c3db807f71dc4ba5a75c633309baa661ea1
Opcode Fuzzy Hash: 6d108e008403b3c92b59985e25fae4eb0cb21936506a5ffd7efe5999b9cc5533
Instruction Fuzzy Hash: A061C03161C301DBE714CF2AC59071EBBE6ABCA352F64C82EE8898B255D374DC499B42

Function 009601B0 Relevance: .2, Instructions: 215COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1853248409.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853283587.0000000000901000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853317233.000000000091E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853591948.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853656074.0000000000981000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853687370.0000000000983000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c84dc754691bb308a9dbcbaee720ee309334a0e93e615c3737e2285dce66845
Instruction ID: d94bbb775819642159214c9e49545d77ed9bb2d8eb886123d63754a08cc2b04a
Opcode Fuzzy Hash: 9c84dc754691bb308a9dbcbaee720ee309334a0e93e615c3737e2285dce66845
Instruction Fuzzy Hash: 4E614533B5AA904BC324463D1CDA3ABAA835BE2330F3EC776D9B14B3E5C96D48024341

Function 0093CD0A Relevance: .2, Instructions: 203COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1853248409.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853283587.0000000000901000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853317233.000000000091E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853591948.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853656074.0000000000981000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853687370.0000000000983000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef974d5467c23934b05c42b7d635b16aa9e9ab43c254c6b335f5a0cd9b41eca7
Instruction ID: 52e39737467ff5ce6e1f7b1cf19fb5750f1fe599ef122ad0d145a2ff2a970002
Opcode Fuzzy Hash: ef974d5467c23934b05c42b7d635b16aa9e9ab43c254c6b335f5a0cd9b41eca7
Instruction Fuzzy Hash: 016145B5500B018BC735CF24D580B26BBF9AF56704F14492CE49B97A92E770F848CFA1

Function 00966780 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1853248409.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853283587.0000000000901000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853317233.000000000091E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853591948.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853656074.0000000000981000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853687370.0000000000983000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53adb1b22930f8a695f789fdc3f4b943ccd6ac5fb5c634955e3c1cdf4e3fec6a
Instruction ID: 35fe802d3331c1a6666de3231ea514d0b77ed2a4a326fe9079bf43c1f618532d
Opcode Fuzzy Hash: 53adb1b22930f8a695f789fdc3f4b943ccd6ac5fb5c634955e3c1cdf4e3fec6a
Instruction Fuzzy Hash: A9515BB15087548FE314DF69D49475BBBE5BBC8318F044E2DE5E987390E379DA088B82

Function 0093BF77 Relevance: .2, Instructions: 178COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1853248409.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853283587.0000000000901000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853317233.000000000091E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853591948.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853656074.0000000000981000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853687370.0000000000983000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48cdc4f15658e30105a6f08c7e73f5cf13de9fa3d5a0f874ad6e22d423ce7761
Instruction ID: 440e7ef8be34ae4660e06b89eab6c44bd7e5b7bce0321bfb238b7693edb0dba9
Opcode Fuzzy Hash: 48cdc4f15658e30105a6f08c7e73f5cf13de9fa3d5a0f874ad6e22d423ce7761
Instruction Fuzzy Hash: 9261B1B4C10B00AFD360AF39D907757BEF4AB06601F504A1DE9EA96695E3316419CFE3

Function 0096F400 Relevance: .2, Instructions: 176COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1853248409.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853283587.0000000000901000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853317233.000000000091E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853591948.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853656074.0000000000981000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853687370.0000000000983000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 059aace7fb3d33d5b05fdb41d57cec956a4f2a5a1265165ba3f05433a5bfbe07
Instruction ID: 995e115d037ce3739c625089d4464185301f9c79159ae6bc71d34f75667c418f
Opcode Fuzzy Hash: 059aace7fb3d33d5b05fdb41d57cec956a4f2a5a1265165ba3f05433a5bfbe07
Instruction Fuzzy Hash: BF51E7316082009BC7149E18ECA0B3EB7E6EBC9755F588A3CF4DA973A1D731EC108751

Function 00936080 Relevance: .2, Instructions: 175COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1853248409.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853283587.0000000000901000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853317233.000000000091E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853591948.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853656074.0000000000981000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853687370.0000000000983000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fb79119c8b7e9dc55afa4138464863e5f7e156fcefff6606c592a99b47a041b
Instruction ID: dc2563f75456fcb848fc7ee033cc08bf4e5620411c5e6f5e950718e76bc41460
Opcode Fuzzy Hash: 7fb79119c8b7e9dc55afa4138464863e5f7e156fcefff6606c592a99b47a041b
Instruction Fuzzy Hash: 5C511627B1D6915BD3289A7C5C562A66EC30BD3334F3ECB6AE9F1CB3E1D55988008750

Function 00934FF0 Relevance: .2, Instructions: 164COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1853248409.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853283587.0000000000901000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853317233.000000000091E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853591948.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853656074.0000000000981000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853687370.0000000000983000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a584769e959b28c720a83d526e0753d41a88e74ccf0ead47e7f50f9f79b33220
Instruction ID: cd40ed1023a2b3402b71c8540481a30b464254e498505d04876a84074845bbd6
Opcode Fuzzy Hash: a584769e959b28c720a83d526e0753d41a88e74ccf0ead47e7f50f9f79b33220
Instruction Fuzzy Hash: 5541247480D380ABC301ABA4D594A2EFBF5EF9A745F558C1CE5C897212C336D8108FA7

Function 0092D930 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1853248409.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853283587.0000000000901000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853317233.000000000091E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853591948.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853656074.0000000000981000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853687370.0000000000983000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c510111869ba92912451a7b0d7d7782332ddc64f2b9d570885866b3e77a8514
Instruction ID: 0621b75867cbada0e25ac0be6cff6b9c602cb1e4c713883b4a847b51a0b4e9ee
Opcode Fuzzy Hash: 5c510111869ba92912451a7b0d7d7782332ddc64f2b9d570885866b3e77a8514
Instruction Fuzzy Hash: 2E51F3B5A093219FC714DF14E48092AB7A4FFC5364F16466CF8998B356D630EC82CB92

Function 009718B0 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1853248409.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853283587.0000000000901000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853317233.000000000091E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853591948.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853656074.0000000000981000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853687370.0000000000983000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d30d4e8a50d40c0e8e6fee20bdc4211b6d278f2fd574d11acf0e5d5d24d8c046
Instruction ID: 44a54a05fa98640133503eb95e304d2b4532c9b8cf24547d7828d11184ab835d
Opcode Fuzzy Hash: d30d4e8a50d40c0e8e6fee20bdc4211b6d278f2fd574d11acf0e5d5d24d8c046
Instruction Fuzzy Hash: CC419036619300ABD714DB58E8A0B2FB7EAEB85755F14C82CF5CE97251D331E801CB66

Function 00971A40 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1853248409.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853283587.0000000000901000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853317233.000000000091E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853591948.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853656074.0000000000981000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853687370.0000000000983000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d5a67f3ffa23472cfb88f51fe90dd05ce35a88d56981a423dec3974e78b2c01
Instruction ID: 7599ae1c85d0ae89d0140f27f21861f4b858ab293cee3b0c6b430d27e9307fba
Opcode Fuzzy Hash: 4d5a67f3ffa23472cfb88f51fe90dd05ce35a88d56981a423dec3974e78b2c01
Instruction Fuzzy Hash: 4641AE35619300ABD7149F19D890F3EB7EAEB89750F14C82CF58A9B252D331EC018B66

Function 00939F10 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1853248409.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853283587.0000000000901000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853317233.000000000091E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853591948.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853656074.0000000000981000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853687370.0000000000983000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a677d001378452f9222ddafdd89244ca075fbfc8bcdccc55e17e3a0b6c405d97
Instruction ID: 8cf0afc0fde404b367c4c87c65c16b584880568ee094aae9955e3a0760bfbc95
Opcode Fuzzy Hash: a677d001378452f9222ddafdd89244ca075fbfc8bcdccc55e17e3a0b6c405d97
Instruction Fuzzy Hash: 1F41D772A083614FD75CCF29849037ABBD2AFC5300F09C66EE4D68B2D5DAB48D45DB81

Function 00956B28 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1853248409.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853283587.0000000000901000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853317233.000000000091E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853591948.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853656074.0000000000981000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853687370.0000000000983000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10c2414fe1792f3da68675f1142f4c0fe16de70f006865abae02691a7f7a35df
Instruction ID: 7d9773e98863e6f9101282838034ed79ec0510d72ab6fee297242110a6d0ad19
Opcode Fuzzy Hash: 10c2414fe1792f3da68675f1142f4c0fe16de70f006865abae02691a7f7a35df
Instruction Fuzzy Hash: 6C419178A003259BDF20CF55D890BBDB7B0FF06341F444149ED85AB3A1EB38A955CBA5

Function 009453C7 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1853248409.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853283587.0000000000901000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853317233.000000000091E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853591948.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853656074.0000000000981000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853687370.0000000000983000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e23e85b138a55b5785af51337ab17c150877dc4adb199558c55d9d3bc3a9249
Instruction ID: ba157c6d4bd641f2d7a5adf5b29dfbaa259cc0334443e47b9d0a668b11689389
Opcode Fuzzy Hash: 5e23e85b138a55b5785af51337ab17c150877dc4adb199558c55d9d3bc3a9249
Instruction Fuzzy Hash: D521F361814624CBC7209F54C892A73B3F4FFA5365F5A5518E88A5F3A2F338AD40C751

Function 00939D73 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1853248409.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853283587.0000000000901000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853317233.000000000091E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853591948.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853656074.0000000000981000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853687370.0000000000983000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ba195b4828959f65e00ce52dd80ddb8fbff997edeacb4fd00185acfab274216
Instruction ID: 56efafe538ddd3fb5d8083d716c47c23568cd82ca415dbe66400baaba025704a
Opcode Fuzzy Hash: 1ba195b4828959f65e00ce52dd80ddb8fbff997edeacb4fd00185acfab274216
Instruction Fuzzy Hash: 7141EF745083809BD320AB59D884B1EFBF9FB86745F14491CF6C497292C37AE814CF66

Function 00970C6A Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1853248409.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853283587.0000000000901000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853317233.000000000091E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853591948.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853656074.0000000000981000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853687370.0000000000983000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a49b99cf3d7157d0ed907d3dfc7e1b3386e027d0657bcc432d1dbf0f3fdc52c
Instruction ID: 91d1f88591be85a5813e83122645913928ac5d252bf85026a50949b6e4f4759f
Opcode Fuzzy Hash: 9a49b99cf3d7157d0ed907d3dfc7e1b3386e027d0657bcc432d1dbf0f3fdc52c
Instruction Fuzzy Hash: 0B41CE3261C3518FC705DF68C49062EFBE6AFD9304F198A6DE4D9DB262D734D9018B82

Function 00966F10 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1853248409.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853283587.0000000000901000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853317233.000000000091E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853591948.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853656074.0000000000981000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853687370.0000000000983000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5be6113664422e96713363ec41851647c31506b086c17a8b3ff98e201e465e1
Instruction ID: 0006f90702be577a807174146702647c1793baa8e60ed0cd4ff9e5ef29524c8d
Opcode Fuzzy Hash: c5be6113664422e96713363ec41851647c31506b086c17a8b3ff98e201e465e1
Instruction Fuzzy Hash: BC213B329082244BC724DB5DD58153BF7E8EF99704F56C62EE9C4A7294E335DC2487E2

Function 0096E6CF Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1853248409.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853283587.0000000000901000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853317233.000000000091E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853591948.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853656074.0000000000981000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853687370.0000000000983000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22bb0a0a16351f1bf1c6c1539f0de18b004dbbca40553b19ee82d601e5bf0c89
Instruction ID: 144c689e4c6b06db97b11adcaa25be6c0b3b9f5d5f21c9a4782d4f37367a03cb
Opcode Fuzzy Hash: 22bb0a0a16351f1bf1c6c1539f0de18b004dbbca40553b19ee82d601e5bf0c89
Instruction Fuzzy Hash: EB3135744083429AD714CF14C4A0A2FBBF0EF96385F546C1CF4C8AB261E334D985CB9A

Function 00945872 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1853248409.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853283587.0000000000901000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853317233.000000000091E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853591948.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853656074.0000000000981000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853687370.0000000000983000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 442e2041b7d4f0044f3b33030fef62c39f21b01d4b2ce6fbad3c99d345b53e03
Instruction ID: 64bd39ae49f0a7e75a6deea737f0fdbfab92c29f0fcdc922481b8d0e60ad55e0
Opcode Fuzzy Hash: 442e2041b7d4f0044f3b33030fef62c39f21b01d4b2ce6fbad3c99d345b53e03
Instruction Fuzzy Hash: 923185B12083808BD3308F50C494FABB7B0FFA6364F45491DE4898BBA2E3748840CB53

Function 0096E298 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1853248409.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853283587.0000000000901000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853317233.000000000091E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853591948.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853656074.0000000000981000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853687370.0000000000983000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef5757cbf0b0f317ecf1d42ae58ac30bf33f4febf434d18edb842894bb03324b
Instruction ID: f7ad35198d5a49af44b48f6b77d47651b60f6ff371f7c8f478fd706ef56b2d80
Opcode Fuzzy Hash: ef5757cbf0b0f317ecf1d42ae58ac30bf33f4febf434d18edb842894bb03324b
Instruction Fuzzy Hash: A431D5B4649301BBD624DB04DD91F3AB7AAEB84741F644918F1915B2D1D370E8108B55

Function 0094DD50 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1853248409.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853283587.0000000000901000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853317233.000000000091E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853591948.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853656074.0000000000981000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853687370.0000000000983000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad53ddb2add9dc148ccbfce0f9bbc6833265dcee60d8dc427d2cea672e24ee2f
Instruction ID: c02c19a4d4db6c4ccbb63232db8675e1d1ebcb07d8a7e553800bb42c0d1e9744
Opcode Fuzzy Hash: ad53ddb2add9dc148ccbfce0f9bbc6833265dcee60d8dc427d2cea672e24ee2f
Instruction Fuzzy Hash: F921B2B950A3119BC310AF18C851A6BB7F8EF92754F45891CF4D89B292E334C900CBA2

Function 0092C880 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1853248409.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853283587.0000000000901000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853317233.000000000091E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853591948.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853656074.0000000000981000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853687370.0000000000983000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08fc7749f87834a0ac2745ce569e5a70dd2e905a0fab7b5503f7284ac12dee09
Instruction ID: 0517b545dad55f20c2ac3629a8d510ba7bf76355e6ed5b9f17a3471b91de7793
Opcode Fuzzy Hash: 08fc7749f87834a0ac2745ce569e5a70dd2e905a0fab7b5503f7284ac12dee09
Instruction Fuzzy Hash: 0231B6B16082209BD7149E58E880A3EB7E5EFC4314F19C92DE89ADB245D235DC52DB86

Function 00953059 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1853248409.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853283587.0000000000901000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853317233.000000000091E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853591948.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853656074.0000000000981000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853687370.0000000000983000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8e389976b406287930bf639976c9266f6cf3b476f1ef4286262bb577516eb39
Instruction ID: 7f3d18c913bad6505eba915cea46fdf6a0c3f3809f9894e9466c3d75d0c5ff7b
Opcode Fuzzy Hash: b8e389976b406287930bf639976c9266f6cf3b476f1ef4286262bb577516eb39
Instruction Fuzzy Hash: 13219171908B06878320DF26C4805ABB3F2FFD8791F15CA2CE89547268E734AA5ADB45

Function 0096E398 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1853248409.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853283587.0000000000901000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853317233.000000000091E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853591948.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853656074.0000000000981000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853687370.0000000000983000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4be7152b6fc8e7c35516a89d2ef9863e36723042a04817cdefcf23ca02a08de
Instruction ID: 332c7cf54c821626e9e94e689772d82a40e5c4563467af83533bccc966a8057e
Opcode Fuzzy Hash: c4be7152b6fc8e7c35516a89d2ef9863e36723042a04817cdefcf23ca02a08de
Instruction Fuzzy Hash: A92139B86082419BC704EF19D490A2EFBE6EB99745F18882CE4C593362D335E850CF66

Function 0093ECC2 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1853248409.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853283587.0000000000901000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853317233.000000000091E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853591948.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853656074.0000000000981000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853687370.0000000000983000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b3d95a434817f6c973c9ff02e9ec9249f9d0004a7a7719806d7aee0d8c1105b
Instruction ID: 244ca9892f53b8947001b7294e80edc045de433a094d0cdbe81f2876257dcadd
Opcode Fuzzy Hash: 6b3d95a434817f6c973c9ff02e9ec9249f9d0004a7a7719806d7aee0d8c1105b
Instruction Fuzzy Hash: F2214970A00B009FD7358F24D881B26B7F6AF49714F149D29E0AA87AE1E770F805CF58

Function 00938DCC Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1853248409.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853283587.0000000000901000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853317233.000000000091E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853591948.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853656074.0000000000981000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853687370.0000000000983000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01f69c16b9c6494f60613f818dcde7c35e0fbda7122440d87ad7206b78ff61d5
Instruction ID: 9c4526178676ca23e82462a4a1ee7148e5361a2bcda8c3413e878f8629e24130
Opcode Fuzzy Hash: 01f69c16b9c6494f60613f818dcde7c35e0fbda7122440d87ad7206b78ff61d5
Instruction Fuzzy Hash: 852125B4A0025A9FDB15CF94CC90BBFBBB6FB4A304F144818E811BB292C735A901CF64

Function 00931D48 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1853248409.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853283587.0000000000901000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853317233.000000000091E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853591948.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853656074.0000000000981000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853687370.0000000000983000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73d1958f67b8eb9f3a7656a6591d9f0965aa8cf07a1fb854fe5963536110b1f1
Instruction ID: 319152caa0ab24131fa0c503674417ff92718d5611af283b2f5e31117f55a682
Opcode Fuzzy Hash: 73d1958f67b8eb9f3a7656a6591d9f0965aa8cf07a1fb854fe5963536110b1f1
Instruction Fuzzy Hash: A8215E1521E3C4AE8386C67D088048FBEE15EFA004F896E9EF4C4AB397C554C619C7AB

Function 00963530 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1853248409.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853283587.0000000000901000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853317233.000000000091E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853591948.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853656074.0000000000981000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853687370.0000000000983000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction ID: becc4c2e9ec381fc9097404bc580b7b222baee82455cc546a23104c970d4d484
Opcode Fuzzy Hash: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction Fuzzy Hash: 6011A533A091E50EC3168D3C8410565BFA30AA3635B59C39AF4BE9B2D2D623CE8A8355

Function 00958A60 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1853248409.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853283587.0000000000901000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853317233.000000000091E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853591948.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853656074.0000000000981000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853687370.0000000000983000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90022ddfb32469098a8610d4b68e70bc315f5b0e8987f5b71d64abe4c0da561b
Instruction ID: 13b228692083463c5737b37e3605ab39e7c8b69f2feacad546548717c6442279
Opcode Fuzzy Hash: 90022ddfb32469098a8610d4b68e70bc315f5b0e8987f5b71d64abe4c0da561b
Instruction Fuzzy Hash: F70171F5B0130157DB20DE66A4C172BF2AC6F80705F1A442DEC0567242DF75EC098796

Function 0095913A Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1853248409.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853283587.0000000000901000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853317233.000000000091E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853591948.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853656074.0000000000981000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853687370.0000000000983000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7acb281752a9f4735269b9b1cc002f9492d4fa73a4f259361f6e86e2b95aaaf8
Instruction ID: 4f8d7cacfd48430779ccd76ed3ce0beb3ad1fcf179e65138705aa8dfa0ba8300
Opcode Fuzzy Hash: 7acb281752a9f4735269b9b1cc002f9492d4fa73a4f259361f6e86e2b95aaaf8
Instruction Fuzzy Hash: 5421493689A2808BCB4A8F3088960517BB5FE4721936DC2EFCC968D467E76E5407DB21

Function 0092ED80 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1853248409.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853283587.0000000000901000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853317233.000000000091E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853591948.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853656074.0000000000981000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853687370.0000000000983000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 205e877a776a04d6abd7e4e09befea2a77073528980a632510507c7b4451283a
Instruction ID: 7b4c302d5010194288dd22fdb925a83810e95a84781d65ff134efe7fd01f2b34
Opcode Fuzzy Hash: 205e877a776a04d6abd7e4e09befea2a77073528980a632510507c7b4451283a
Instruction Fuzzy Hash: F7F0E93E7192290BA210CEBABCC483BF3DAD7DA355B19553CFA41D3245DDB1E80292D4

Function 009550C1 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1853248409.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853283587.0000000000901000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853317233.000000000091E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853591948.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853656074.0000000000981000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853687370.0000000000983000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab6512b1c667dcaa1cc604779a64c1ce391463726a027d9a9669059550eb36de
Instruction ID: 773ce7a894f053db9b71dbe24242fe847f3463eeabe4b8df379119d52f0dad3c
Opcode Fuzzy Hash: ab6512b1c667dcaa1cc604779a64c1ce391463726a027d9a9669059550eb36de
Instruction Fuzzy Hash: 7411EFB0408780AFD310EF618494A2FFBE5AB96714F548C0DF5A49B261D375E809CF56

Function 009637A0 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1853248409.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853283587.0000000000901000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853317233.000000000091E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853591948.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853656074.0000000000981000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853687370.0000000000983000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dad40b8a8b0cf0c680be38028a9801f4e1e9da1297b4f3b9e1d9df466e9bee7e
Instruction ID: 6506d07c58c905065930edc77b6421f51c28c54387ea28b09faa2761b04cb969
Opcode Fuzzy Hash: dad40b8a8b0cf0c680be38028a9801f4e1e9da1297b4f3b9e1d9df466e9bee7e
Instruction Fuzzy Hash: 1E0162B3A199610B8348CE3DDC1156BBAD15BD5770F19872DBEF5CB3E0D230C8118695

Function 009444D0 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1853248409.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853283587.0000000000901000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853317233.000000000091E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853591948.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853656074.0000000000981000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853687370.0000000000983000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8ebd7708255391ffa87ed53dd5dbf97c7cff7b52fcdad9dabb06971c835301f
Instruction ID: afd6f86e1ed7dc578beff9a6215ab27dc393fb41cabbec3b70aacfa27007612f
Opcode Fuzzy Hash: d8ebd7708255391ffa87ed53dd5dbf97c7cff7b52fcdad9dabb06971c835301f
Instruction Fuzzy Hash: EB014B72A196204B8308CE3C9C1112ABEE19B86330F158B2EBCFAD73E0D664CD548696

Function 0093D655 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1853248409.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853283587.0000000000901000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853317233.000000000091E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853591948.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853656074.0000000000981000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853687370.0000000000983000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4320f5b54cd7c9a23a8005bed77f00b087a05b385b7ddd433214809cd8c5cbf
Instruction ID: bf00cafc31984742ae748ff576a70dcb2e5aab9d16462c0990531fe800d1cdf5
Opcode Fuzzy Hash: f4320f5b54cd7c9a23a8005bed77f00b087a05b385b7ddd433214809cd8c5cbf
Instruction Fuzzy Hash: C8F0AF366006069FDB20DE38DC80A67B7B6FB89304F08993CE58597466D732F525DB80

Function 009432F0 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1853248409.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853283587.0000000000901000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853317233.000000000091E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853591948.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853656074.0000000000981000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853687370.0000000000983000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 809ee23363f840c811a801533be2b64f834fb93f4c5a4ab9cc37b5a2fd812bb4
Instruction ID: 8b366666244cf403e663e4cb829c93378d4b3eb2eda739960c0d22318391b283
Opcode Fuzzy Hash: 809ee23363f840c811a801533be2b64f834fb93f4c5a4ab9cc37b5a2fd812bb4
Instruction Fuzzy Hash: CFF0E5B1A042616BDB22CE65ECC0F37BB9CCB8B324F194825E885D7102D571A944C7E6

Function 0096D609 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1853248409.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853283587.0000000000901000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853317233.000000000091E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853591948.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853656074.0000000000981000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853687370.0000000000983000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 279a4f57a637f8128bfd8be77460e1d279c07fa6b9848119afc157391d6ef02f
Instruction ID: 3dd3e473415c4902226d882d2a8f2774e14d050c415c6cb307b493d2ae622307
Opcode Fuzzy Hash: 279a4f57a637f8128bfd8be77460e1d279c07fa6b9848119afc157391d6ef02f
Instruction Fuzzy Hash: C7F0F970A0D280ABD311AF59D854B1EFFF4EF96701F14882CE1D89B261D335D850CB9A

Function 0095B945 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1853248409.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853283587.0000000000901000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853317233.000000000091E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853591948.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853656074.0000000000981000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853687370.0000000000983000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41ab932f2415c7df50655ebb21d4dd6f332960aa9c3ec918add296c67870008e
Instruction ID: bba26f06b17c8e3f80e5df2a7ede57c2e55de339e0e8ee4766907b2f3110de0d
Opcode Fuzzy Hash: 41ab932f2415c7df50655ebb21d4dd6f332960aa9c3ec918add296c67870008e
Instruction Fuzzy Hash: 5EF0F474521B418BD3A28F24C694A22FBF1BF46301F946858E8969BB51D335F814CB95

Function 00918038 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1853283587.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1853248409.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853317233.000000000091E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853591948.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853656074.0000000000981000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853687370.0000000000983000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5566999e0ab72da053a8abcc3324ddc8aa4becb6fcadd465fa76c36a84b4dcdd
Instruction ID: 4b1407b62aa1090478d47ac63e9e5df181b0b4fcbe9e150dbba9379e1ff29716
Opcode Fuzzy Hash: 5566999e0ab72da053a8abcc3324ddc8aa4becb6fcadd465fa76c36a84b4dcdd
Instruction Fuzzy Hash: CEE08C72A1122CEFCB14DBC8C944ACAF3ECEB88B00B61449AF601D3110C670DE80D7D0

Function 00969320 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1853248409.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853283587.0000000000901000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853317233.000000000091E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853591948.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853656074.0000000000981000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853687370.0000000000983000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4b5204e339133bf84330416a5308528dd9e98d6cb7a6fcb91640552a86da4e7
Instruction ID: ff2c3e7b3fd93177906bcc16148ad042e28219a46f0f3596565955336fbd6e1b
Opcode Fuzzy Hash: a4b5204e339133bf84330416a5308528dd9e98d6cb7a6fcb91640552a86da4e7
Instruction Fuzzy Hash: 24D0A721648362469F748E19A400D7BF7F8EBC7B11F89956EF582E3288D230EC41C2A9

Function 009399AD Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1853248409.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853283587.0000000000901000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853317233.000000000091E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853591948.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853656074.0000000000981000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853687370.0000000000983000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cc908392028c27f7ecf30c78ebf6660cf32a01492e826555e3d9857673c97f4
Instruction ID: f30c8f5f9cd64f15c93ac39b97d23ca64796af6aa1539c3c973c5cbc0f9e1d01
Opcode Fuzzy Hash: 5cc908392028c27f7ecf30c78ebf6660cf32a01492e826555e3d9857673c97f4
Instruction Fuzzy Hash: 83C08C38A581008FC2048F00FCD6636B3B8A35730DB00303EDA03FB222CE20C42A890D

Function 0090EFEC Relevance: .0, Instructions: 12COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1853283587.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1853248409.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853317233.000000000091E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853591948.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853656074.0000000000981000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853687370.0000000000983000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a143222fbadcdda3babb2bd23adbde204d1ca1d3ff22d9f4b52ceee6d3db84ec
Instruction ID: 79111b4b8de261a20cd34d1c2cbd90113aea7b3b536eca23fac350625db4c638
Opcode Fuzzy Hash: a143222fbadcdda3babb2bd23adbde204d1ca1d3ff22d9f4b52ceee6d3db84ec
Instruction Fuzzy Hash: 86C08C75201E044ECF39891082B13E63368A3D17C2F8004DCC8038BA83C92F9E8BEA00

Function 0093991C Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1853248409.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853283587.0000000000901000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853317233.000000000091E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853591948.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853656074.0000000000981000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853687370.0000000000983000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1ade6ef58d6580d8cbff1d8d081264510f391430feb37eef4a632f827e8cdbb
Instruction ID: fb5671f0b8ae2b239a62ba02da280c6dea56a1562183fa5988b34b3465d769c3
Opcode Fuzzy Hash: e1ade6ef58d6580d8cbff1d8d081264510f391430feb37eef4a632f827e8cdbb
Instruction Fuzzy Hash: 1BC04C28A590048AC2449F45A892532A2A8531720CB10343A8643E7261C960D419990D

Function 0096DF74 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1853248409.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853283587.0000000000901000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853317233.000000000091E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853591948.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853656074.0000000000981000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853687370.0000000000983000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eda25dfc225e456b4df2f38464500c90323af58adcbdfe6e488d54600b94eb62
Instruction ID: d1c756f3eadd8deff9e88308060997e8b4fd57908926ac4d8ccc4e56a5247bff
Opcode Fuzzy Hash: eda25dfc225e456b4df2f38464500c90323af58adcbdfe6e488d54600b94eb62
Instruction Fuzzy Hash: 3DC09B34B5D20087910CCF04D951475F3779B97757714B02DC91623357D135F512951D

Function 0096DEB6 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1853248409.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853283587.0000000000901000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853317233.000000000091E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853591948.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853656074.0000000000981000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853687370.0000000000983000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7e2c6ed00036b488e97d7b66a9e7c4df7905aef658a94aa0b4bf4ae83390246
Instruction ID: 5d07e073f59bc1d9ab006b13b9bdb4d2a63cac6ada5626c8abf9decc6d651ca6
Opcode Fuzzy Hash: e7e2c6ed00036b488e97d7b66a9e7c4df7905aef658a94aa0b4bf4ae83390246
Instruction Fuzzy Hash: 24C09224B682008BA24CCF18DD51935F2BB9B8BA9BB14B03DC906A3257E134E522860C

Function 00930FB8 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1853248409.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853283587.0000000000901000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853317233.000000000091E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853591948.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853656074.0000000000981000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853687370.0000000000983000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2933151f0ac7f075621f0545018cb448e1da5df1c2a72fb1f6ef91afbd1dabd
Instruction ID: 90f083a07c24874d7646f44137cd52b4f4485f2d8af233f17395c09b59a772d3
Opcode Fuzzy Hash: a2933151f0ac7f075621f0545018cb448e1da5df1c2a72fb1f6ef91afbd1dabd
Instruction Fuzzy Hash: 53C04878908204CAC724CF2AC040AB9F3F5BB4F201F00A01AECA8A3240D638D800DF29

Function 00952B50 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1853248409.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853283587.0000000000901000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853317233.000000000091E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853591948.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853656074.0000000000981000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853687370.0000000000983000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f0846c5d1b29fa8c7eb75566415611b062c9094183590c26b2b47b45be6fc4b
Instruction ID: bb9825d44238991dd192075755b19327866138ce72804a29b080075e6f376ac3
Opcode Fuzzy Hash: 1f0846c5d1b29fa8c7eb75566415611b062c9094183590c26b2b47b45be6fc4b
Instruction Fuzzy Hash: CCB012309082408BD204CF04C450530F374D747109F003418D10AB3152C220E844C60C

Function 0093D851 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1853248409.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853283587.0000000000901000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853317233.000000000091E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853591948.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853656074.0000000000981000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853687370.0000000000983000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c2b20021a969b34ebd9379bf9b485349b18f198d0552b071d404ad5cd0f597e
Instruction ID: f1c0c38a0b7feefcd14a7992d526c0f8ddc67da51ba104f186919c48afb70220
Opcode Fuzzy Hash: 8c2b20021a969b34ebd9379bf9b485349b18f198d0552b071d404ad5cd0f597e
Instruction Fuzzy Hash: CAB012B1C9C215CBC3008F10C40D1B0F335EE0B202F8071A5850527405C7328003CB0C

Function 00950C23 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1853248409.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853283587.0000000000901000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853317233.000000000091E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853591948.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853656074.0000000000981000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853687370.0000000000983000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05b00ae002dc55fb4e625dd24f5a9641755cf84b69f0189ba72e1364eef460e8
Instruction ID: 6fa0a1bee6cd81a0e7ee55e180bb11495692cb872df1a59e9b59285b5741de68
Opcode Fuzzy Hash: 05b00ae002dc55fb4e625dd24f5a9641755cf84b69f0189ba72e1364eef460e8
Instruction Fuzzy Hash: 4CA00138A883028B8209CE14E690875F3B8A74F602F103954E949B3216C620E8048A2E

Function 00914783 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 298COMMONLIBRARYCODE

Download Yara Rule

Strings

, xrefs: 009149FC

Memory Dump Source

Source File: 00000000.00000002.1853283587.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1853248409.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853317233.000000000091E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853591948.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853656074.0000000000981000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853687370.0000000000983000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_Setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID: 0-3907804496
Opcode ID: 3cf63be2087af89bb79773553fc37a03bb54177ea8bd2e39aca46d28473af160
Instruction ID: f987486d036f977d363415b4db75df1ed8bf1987678ed63dbfc5565234da910a
Opcode Fuzzy Hash: 3cf63be2087af89bb79773553fc37a03bb54177ea8bd2e39aca46d28473af160
Instruction Fuzzy Hash: B2B1F074B0824DAFDB11DF99C890BEE7BF9AF8D300F158199E515AB291C7709D82CB60

Function 00906AA9 Relevance: 12.2, APIs: 8, Instructions: 175COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,?,00000000,00000000,?,?,?,?), ref: 00906AF2
__alloca_probe_16.LIBCMT ref: 00906B1E
MultiByteToWideChar.KERNEL32(?,?,00000000,?,00000000,00000000), ref: 00906B5D
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00906B7A
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 00906BB9
__alloca_probe_16.LIBCMT ref: 00906BD6
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00906C18
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 00906C3B

Memory Dump Source

Source File: 00000000.00000002.1853283587.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1853248409.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853317233.000000000091E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853591948.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853656074.0000000000981000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853687370.0000000000983000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_Setup.jbxd

Yara matches

Similarity

API ID: ByteCharMultiStringWide$__alloca_probe_16
String ID:
API String ID: 2040435927-0
Opcode ID: 66c0e01993f46cf6bc17faf1183e5c8008325d338490a2ccbaae29e488262163
Instruction ID: 495782d79361b716b19a5699b373636828dc9c4c599ab494636a01efe98b850d
Opcode Fuzzy Hash: 66c0e01993f46cf6bc17faf1183e5c8008325d338490a2ccbaae29e488262163
Instruction Fuzzy Hash: 8851D0B2A0422AAFEF209F54CC45FAB7BADEF44750F144428FA54E61D0D7759C60DB60

Function 0090A598 Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 0090A6B7
___TypeMatch.LIBVCRUNTIME ref: 0090A7C5
CallUnexpected.LIBVCRUNTIME ref: 0090A932

Strings

csm, xrefs: 0090A6EE
csm, xrefs: 0090A5D5
csm, xrefs: 0090A642

Memory Dump Source

Source File: 00000000.00000002.1853283587.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1853248409.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853317233.000000000091E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853591948.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853656074.0000000000981000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853687370.0000000000983000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_Setup.jbxd

Yara matches

Similarity

API ID: CallMatchTypeUnexpectedtype_info::operator==
String ID: csm$csm$csm
API String ID: 1206542248-393685449
Opcode ID: 291cd28d898e1b4c034f2f83394d1d28fe535040dd8c9926078d2dfe68dafcf2
Instruction ID: a7518faf5bb594facbe74e1b06c5af90a0d772f81a64c965ca85eea9bc2cb015
Opcode Fuzzy Hash: 291cd28d898e1b4c034f2f83394d1d28fe535040dd8c9926078d2dfe68dafcf2
Instruction Fuzzy Hash: 2AB16A71D00309EFCF14DFA4C881AAEBBB9BF64310B158169E8116B292D735DA52CFD2

Function 00911D5B Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,00911E68,?,?,00000000,00000000,?,?,00912016,00000021,FlsSetValue,009213A8,009213B0,00000000), ref: 00911E1C

Strings

api-ms-, xrefs: 00911DB2
ext-ms-, xrefs: 00911DC6

Memory Dump Source

Source File: 00000000.00000002.1853283587.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1853248409.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853317233.000000000091E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853591948.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853656074.0000000000981000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853687370.0000000000983000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_Setup.jbxd

Yara matches

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: a854dd0628b37711b16052c488274a4b0e4b3f4a2289bbe7ef445d4be34736bb
Instruction ID: e7724e1f57a1478f2323d5e881548869e66865973b5100e57a3e7b0aaa65a720
Opcode Fuzzy Hash: a854dd0628b37711b16052c488274a4b0e4b3f4a2289bbe7ef445d4be34736bb
Instruction Fuzzy Hash: DF21E435B16219BBDB219BA4BC40AEA37ACDB46760F250110EE06A72D0E770ED41D6E0

Function 00903C41 Relevance: 10.5, APIs: 7, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00903C48
std::_Lockit::_Lockit.LIBCPMT ref: 00903C52
int.LIBCPMT ref: 00903C69

Part of subcall function 009016AA: std::_Lockit::_Lockit.LIBCPMT ref: 009016BB
Part of subcall function 009016AA: std::_Lockit::~_Lockit.LIBCPMT ref: 009016D5

codecvt.LIBCPMT ref: 00903C8C
std::_Facet_Register.LIBCPMT ref: 00903CA3
std::_Lockit::~_Lockit.LIBCPMT ref: 00903CC3
Concurrency::cancel_current_task.LIBCPMT ref: 00903CD0

Memory Dump Source

Source File: 00000000.00000002.1853283587.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1853248409.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853317233.000000000091E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853591948.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853656074.0000000000981000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853687370.0000000000983000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_Setup.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Registercodecvt
String ID:
API String ID: 2133458128-0
Opcode ID: 10fd89c2ce7b3e3b403ed9236adda6cd7952a0e4ab74611272d2d35327ee2fee
Instruction ID: 339c8f2c6b883e3aac35d96bf10ad679788d8302995a7f69b1491ebba449274a
Opcode Fuzzy Hash: 10fd89c2ce7b3e3b403ed9236adda6cd7952a0e4ab74611272d2d35327ee2fee
Instruction Fuzzy Hash: 7A01C076A041299FDB05EBA488057ADB7B9AFC0320F288509F851AB3D1DF749E01CB80

Function 0090536B Relevance: 9.1, APIs: 6, Instructions: 65COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00905372
std::_Lockit::_Lockit.LIBCPMT ref: 0090537C
int.LIBCPMT ref: 00905393

Part of subcall function 009016AA: std::_Lockit::_Lockit.LIBCPMT ref: 009016BB
Part of subcall function 009016AA: std::_Lockit::~_Lockit.LIBCPMT ref: 009016D5

std::_Facet_Register.LIBCPMT ref: 009053CD
std::_Lockit::~_Lockit.LIBCPMT ref: 009053ED
Concurrency::cancel_current_task.LIBCPMT ref: 009053FA

Memory Dump Source

Source File: 00000000.00000002.1853283587.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1853248409.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853317233.000000000091E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853591948.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853656074.0000000000981000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853687370.0000000000983000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_Setup.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Register
String ID:
API String ID: 55977855-0
Opcode ID: 5117ae3d79f83930e61d698d068816481d34df947673a76f24cb8798a6be5b65
Instruction ID: 462044ebcbbca59d05ec43a4655f401d5eb4d84aa0740738e82a31a5939204d1
Opcode Fuzzy Hash: 5117ae3d79f83930e61d698d068816481d34df947673a76f24cb8798a6be5b65
Instruction Fuzzy Hash: C611EE72A14619DFCB10ABA4C8457AEB7F9EF84360F15850EF401A73D0DFB4AE018B80

Function 0090A22A Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,0090A221,0090841B,00907AD5), ref: 0090A238
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0090A246
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0090A25F
SetLastError.KERNEL32(00000000,0090A221,0090841B,00907AD5), ref: 0090A2B1

Memory Dump Source

Source File: 00000000.00000002.1853283587.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1853248409.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853317233.000000000091E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853591948.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853656074.0000000000981000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853687370.0000000000983000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_Setup.jbxd

Yara matches

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: b8b6f2313acc757d70e466234761b5dbc7b3985d71477bf70db3368bbec22f56
Instruction ID: 398735dab8f6312899f4daee3592ad16f301a1897b3130243503bb5768f826eb
Opcode Fuzzy Hash: b8b6f2313acc757d70e466234761b5dbc7b3985d71477bf70db3368bbec22f56
Instruction Fuzzy Hash: 3A01F23226E3116EE62527B87C8ABAB379DFB41F707204339F520410F1EF634C06A286

Function 0090F00E Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,0E00F322,?,?,00000000,0091D6C8,000000FF,?,0090EF9E,?,?,0090EF72,00000016), ref: 0090F043
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 0090F055
FreeLibrary.KERNEL32(00000000,?,00000000,0091D6C8,000000FF,?,0090EF9E,?,?,0090EF72,00000016), ref: 0090F077

Strings

mscoree.dll, xrefs: 0090F03C
CorExitProcess, xrefs: 0090F04D

Memory Dump Source

Source File: 00000000.00000002.1853283587.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1853248409.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853317233.000000000091E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853591948.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853656074.0000000000981000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853687370.0000000000983000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_Setup.jbxd

Yara matches

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: dcceebda0d0e1084113bb9dfd4886785eeeb72d21907cb27294c5b0d8bf921e8
Instruction ID: 5a2944f759a2af393e10266126cef0681e5c2836eaa01f1588df2129874db837
Opcode Fuzzy Hash: dcceebda0d0e1084113bb9dfd4886785eeeb72d21907cb27294c5b0d8bf921e8
Instruction Fuzzy Hash: 0A01DB31A58619FFDB218F50DC09FEEBBB8FB44B14F004525FC11A26D0DBB49904CA50

Function 00915E36 Relevance: 7.7, APIs: 5, Instructions: 202COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00915EBD
__alloca_probe_16.LIBCMT ref: 00915F7E
__freea.LIBCMT ref: 00915FE5

Part of subcall function 00914F08: HeapAlloc.KERNEL32(00000000,00000000,?,?,00907C05,?,?,?,?,?,0090119C,?,00000001), ref: 00914F3A

__freea.LIBCMT ref: 00915FFA
__freea.LIBCMT ref: 0091600A

Memory Dump Source

Source File: 00000000.00000002.1853283587.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1853248409.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853317233.000000000091E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853591948.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853656074.0000000000981000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853687370.0000000000983000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_Setup.jbxd

Yara matches

Similarity

API ID: __freea$__alloca_probe_16$AllocHeap
String ID:
API String ID: 1096550386-0
Opcode ID: 52c8425b0b9f50166d6d44bc74cab11274532f01ce191f0fcfe8f901866e579e
Instruction ID: d9c639ea48aab5e66f256744488fd6729968cd1b7feef2df403efac52ebfd531
Opcode Fuzzy Hash: 52c8425b0b9f50166d6d44bc74cab11274532f01ce191f0fcfe8f901866e579e
Instruction Fuzzy Hash: 5351AF72B0061AEFEB219EA5DD41FFB3AADEF88350B170129FD04D6250EB35CD918660

Function 00902B16 Relevance: 7.5, APIs: 5, Instructions: 48COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00902B22
int.LIBCPMT ref: 00902B35

Part of subcall function 009016AA: std::_Lockit::_Lockit.LIBCPMT ref: 009016BB
Part of subcall function 009016AA: std::_Lockit::~_Lockit.LIBCPMT ref: 009016D5

std::_Facet_Register.LIBCPMT ref: 00902B68
std::_Lockit::~_Lockit.LIBCPMT ref: 00902B7E
Concurrency::cancel_current_task.LIBCPMT ref: 00902B89

Memory Dump Source

Source File: 00000000.00000002.1853283587.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1853248409.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853317233.000000000091E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853591948.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853656074.0000000000981000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853687370.0000000000983000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_Setup.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 8e6379ca9819dd7e4f1b917d67aaa331e60b547a8968df4ddbb0c94cb31271d0
Instruction ID: 53a43feb47103405e93259a7f4276df8bbe76679302810327a7fa9b9b4ee53ca
Opcode Fuzzy Hash: 8e6379ca9819dd7e4f1b917d67aaa331e60b547a8968df4ddbb0c94cb31271d0
Instruction Fuzzy Hash: 7401A232900118AFCB14AB68D94AAAD77ACEFC1760B240149F915AB3D1EA30DE42CB90

Function 0090363A Relevance: 7.5, APIs: 5, Instructions: 48COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00903646
int.LIBCPMT ref: 00903659

Part of subcall function 009016AA: std::_Lockit::_Lockit.LIBCPMT ref: 009016BB
Part of subcall function 009016AA: std::_Lockit::~_Lockit.LIBCPMT ref: 009016D5

std::_Facet_Register.LIBCPMT ref: 0090368C
std::_Lockit::~_Lockit.LIBCPMT ref: 009036A2
Concurrency::cancel_current_task.LIBCPMT ref: 009036AD

Memory Dump Source

Source File: 00000000.00000002.1853283587.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1853248409.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853317233.000000000091E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853591948.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853656074.0000000000981000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853687370.0000000000983000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_Setup.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 0c4cba38aaa28434cbe0bd0aa8179f2cf12b234431fa9f8ef716531e1c6a0ca8
Instruction ID: df768bb6724216af0254e0cf742dd73014eb6b2d15be64422f89f9b033ad1f14
Opcode Fuzzy Hash: 0c4cba38aaa28434cbe0bd0aa8179f2cf12b234431fa9f8ef716531e1c6a0ca8
Instruction Fuzzy Hash: 8001A272900118BFCB15AB64D8069AD77BCEFC0360B254149F5159B3D0EA319F41CBA0

Function 009050EE Relevance: 7.5, APIs: 5, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 009050F5
std::_Lockit::_Lockit.LIBCPMT ref: 00905100
std::_Lockit::~_Lockit.LIBCPMT ref: 0090516E

Part of subcall function 00905251: std::locale::_Locimp::_Locimp.LIBCPMT ref: 00905269

std::locale::_Setgloballocale.LIBCPMT ref: 0090511B
_Yarn.LIBCPMT ref: 00905131

Memory Dump Source

Source File: 00000000.00000002.1853283587.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1853248409.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853317233.000000000091E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853591948.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853656074.0000000000981000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853687370.0000000000983000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_Setup.jbxd

Yara matches

Similarity

API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_SetgloballocaleYarn
String ID:
API String ID: 1088826258-0
Opcode ID: aa873873cb771c9426addabe43cbe4f41bb37508b8ad2e0b369f7c59fb9fea46
Instruction ID: c806f49ef286685e095ee2bef24b7be56ee05c2d5e3754e2fc0bb1eb3025d196
Opcode Fuzzy Hash: aa873873cb771c9426addabe43cbe4f41bb37508b8ad2e0b369f7c59fb9fea46
Instruction Fuzzy Hash: 9901BCB5A085149FCB06EBA0C841ABEB7B9BFC4340B198009E861573D1DF34AE42DF81

Function 0090B372 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,0090B323,00000000,?,00981C5C,?,?,?,0090B4C6,00000004,InitializeCriticalSectionEx,0091FC70,InitializeCriticalSectionEx), ref: 0090B37F
GetLastError.KERNEL32(?,0090B323,00000000,?,00981C5C,?,?,?,0090B4C6,00000004,InitializeCriticalSectionEx,0091FC70,InitializeCriticalSectionEx,00000000,?,0090B27D), ref: 0090B389
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 0090B3B1

Strings

api-ms-, xrefs: 0090B396

Memory Dump Source

Source File: 00000000.00000002.1853283587.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1853248409.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853317233.000000000091E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853591948.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853656074.0000000000981000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853687370.0000000000983000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_Setup.jbxd

Yara matches

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: c89a3889a69dc92e8d02a9406eda718c1d48ad8d5a9fe7b0e2c27b70802c29d3
Instruction ID: 7c706a11ec8d5390e720c027a85bc19db6115f34c7aa62a73131f276b7a28316
Opcode Fuzzy Hash: c89a3889a69dc92e8d02a9406eda718c1d48ad8d5a9fe7b0e2c27b70802c29d3
Instruction Fuzzy Hash: 8EE04F30788208BBEF201FB0ED06F983E59AB00B44F204020FF0DE80E1EBA19860E6D5

Function 00912922 Relevance: 6.3, APIs: 4, Instructions: 338fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(0E00F322,00000000,00000000,00000000), ref: 00912985

Part of subcall function 00916F16: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,00915FDB,?,00000000,-00000008), ref: 00916FC2

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00912BE0
WriteFile.KERNEL32(?,?,?,?,00000000), ref: 00912C28
GetLastError.KERNEL32 ref: 00912CCB

Memory Dump Source

Source File: 00000000.00000002.1853283587.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1853248409.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853317233.000000000091E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853591948.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853656074.0000000000981000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853687370.0000000000983000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_Setup.jbxd

Yara matches

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: de3a5924313d5913d95c7e53e0b2622f945226a72b2759cc95406e111f41fbe1
Instruction ID: 91492d6103dd3f9d299425b99452db6ac615ea2f5827ed237284a59e872397c9
Opcode Fuzzy Hash: de3a5924313d5913d95c7e53e0b2622f945226a72b2759cc95406e111f41fbe1
Instruction Fuzzy Hash: 14D16875E0464C9FCB15DFA8D880AEDBBB8FF49300F18456AE956E7351D630A891CB90

Function 0090A341 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 0090A408
___AdjustPointer.LIBCMT ref: 0090A42B
___AdjustPointer.LIBCMT ref: 0090A4C7

Memory Dump Source

Source File: 00000000.00000002.1853283587.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1853248409.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853317233.000000000091E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853591948.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853656074.0000000000981000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853687370.0000000000983000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_Setup.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 15deb115ecf414126167d42179dabd52b6332a6dbd38f423b97823e4243919f0
Instruction ID: 376bd75d7a1a5c3d3d6066c05c475577ad11c61533a27715d507dfe7f110c728
Opcode Fuzzy Hash: 15deb115ecf414126167d42179dabd52b6332a6dbd38f423b97823e4243919f0
Instruction Fuzzy Hash: BF51247A604306AFDB288F50D845BBAB3A8EF80B10F14442DE885872E1E771EC81C7D2

Function 0091BE0B Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,0000000C,?,00000000,00000000,?,0091AE3B,00000000,?,00000000,00000000,?,00912D1F,00000000,00000000,00000000), ref: 0091BE22
GetLastError.KERNEL32(?,0091AE3B,00000000,?,00000000,00000000,?,00912D1F,00000000,00000000,00000000,00000000,00000000,?,009132A6,00000000), ref: 0091BE2E

Part of subcall function 0091BDF4: CloseHandle.KERNEL32(FFFFFFFE,0091BE3E,?,0091AE3B,00000000,?,00000000,00000000,?,00912D1F,00000000,00000000,00000000,00000000,00000000), ref: 0091BE04

___initconout.LIBCMT ref: 0091BE3E

Part of subcall function 0091BDB6: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,0091BDE5,0091AE28,00000000,?,00912D1F,00000000,00000000,00000000,00000000), ref: 0091BDC9

WriteConsoleW.KERNEL32(00000000,0000000C,?,00000000,?,0091AE3B,00000000,?,00000000,00000000,?,00912D1F,00000000,00000000,00000000,00000000), ref: 0091BE53

Memory Dump Source

Source File: 00000000.00000002.1853283587.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1853248409.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853317233.000000000091E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853591948.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853656074.0000000000981000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853687370.0000000000983000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_Setup.jbxd

Yara matches

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: e029a6d8c3eef3207c135dc345694e623f3f836b6a457b4e2605a62db4b72974
Instruction ID: 5f0a0b0e25ac9f9eac1fd4fb76d80c696bbc92834d88e4982f48e28511476008
Opcode Fuzzy Hash: e029a6d8c3eef3207c135dc345694e623f3f836b6a457b4e2605a62db4b72974
Instruction Fuzzy Hash: 31F0303A618119BBCF321FA1EC05ADA3FAAFB497A0B014010FE0985170CB328860FFD1

Function 0090A030 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 0090A06F
__IsNonwritableInCurrentImage.LIBCMT ref: 0090A123

Strings

csm, xrefs: 0090A10D

Memory Dump Source

Source File: 00000000.00000002.1853283587.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1853248409.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853317233.000000000091E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853591948.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853656074.0000000000981000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853687370.0000000000983000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_Setup.jbxd

Yara matches

Similarity

API ID: CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 3480331319-1018135373
Opcode ID: cf74e353f66047c815a508a986f3bfa40064979430ce87ff6947967a2d673dac
Instruction ID: a5465cd18d4f9718e6de3084f5d49bb3f98153602a928c6801fabeb4635c69a4
Opcode Fuzzy Hash: cf74e353f66047c815a508a986f3bfa40064979430ce87ff6947967a2d673dac
Instruction Fuzzy Hash: CD41AE30A04219EFCF10DF68C884A9EBBB5EF86324F148055E914AB3D2D736AA45CBD1

Function 0090A93D Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?), ref: 0090A962

Strings

RCC, xrefs: 0090A97C
MOC, xrefs: 0090A974

Memory Dump Source

Source File: 00000000.00000002.1853283587.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1853248409.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853317233.000000000091E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853591948.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853656074.0000000000981000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853687370.0000000000983000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_Setup.jbxd

Yara matches

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 6c92a90a1a81be052a92de9830ea5a7aebf123c4a61ec2845a3dccbd3094c7e5
Instruction ID: 593f8cb127c7d67babca345e56670f95d03942b7e45f46121fce2d247ead6fe9
Opcode Fuzzy Hash: 6c92a90a1a81be052a92de9830ea5a7aebf123c4a61ec2845a3dccbd3094c7e5
Instruction Fuzzy Hash: 09413B71A00209AFCF15DF98CD81AEEBBBAFF48304F158059F914A72A1D3359950DF92

Function 009015D5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 009015DC
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00901614

Part of subcall function 009051EC: _Yarn.LIBCPMT ref: 0090520B
Part of subcall function 009051EC: _Yarn.LIBCPMT ref: 0090522F

Strings

bad locale name, xrefs: 00901622

Memory Dump Source

Source File: 00000000.00000002.1853283587.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1853248409.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853317233.000000000091E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853488539.0000000000928000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853591948.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853656074.0000000000981000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1853687370.0000000000983000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_Setup.jbxd

Yara matches

Similarity

API ID: Yarnstd::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 1908188788-1405518554
Opcode ID: 8e4b0054bce25755427a8e5d094a430cdc3fe518b62ac8a2151ee38afe734e70
Instruction ID: 27f60df0b088e77ec9bd2ce450ad59ebd0819669e6e59c32c2e625b98b2fab40
Opcode Fuzzy Hash: 8e4b0054bce25755427a8e5d094a430cdc3fe518b62ac8a2151ee38afe734e70
Instruction Fuzzy Hash: 47F01772505B809EC3309F6A9881547FBE8BE69310394CE2FE0DEC3A51D730E504CBAA

Analysis Process: MSBuild.exePID: 6596, Parent PID: 6576COMMON

Execution Graph

Execution Coverage:	1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	44
Total number of Limit Nodes:	4

Executed Functions

Function 0040D110 Relevance: 6.2, APIs: 4, Instructions: 154
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetInputState.USER32 ref: 0040D121
GetCurrentThreadId.KERNEL32 ref: 0040D136
GetCurrentProcessId.KERNEL32 ref: 0040D13C
ExitProcess.KERNEL32 ref: 0040D2F0

Memory Dump Source

Source File: 00000001.00000002.1688980606.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: CurrentProcess$ExitInputStateThread
String ID:
API String ID: 1029096631-0
Opcode ID: 08eb499608fb6ca27a79879cc2e31d82174a6a7722ca31d8a5ded37d06d49044
Instruction ID: f02d3b79713e8d81e15a0fda541fde84aa13a8de9f5ea14ec3edbee07005130c
Opcode Fuzzy Hash: 08eb499608fb6ca27a79879cc2e31d82174a6a7722ca31d8a5ded37d06d49044
Instruction Fuzzy Hash: BD41697480D340ABC301BFA5D644A1EFBF1AF56709F048C6DE5C4A7292C339D8189B6B

Function 00445700 Relevance: 1.6, APIs: 1, Instructions: 69
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlReAllocateHeap.NTDLL(?,00000000,?,?), ref: 00445784

Memory Dump Source

Source File: 00000001.00000002.1688980606.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 451ba736794f0e2f30a849843ab83a7da9f20e1e8286aac8e33d1c41455145f3
Instruction ID: c85136016a5953b7558c7414a3c459db971abdd3e4f37367334958bb3d5b1fc4
Opcode Fuzzy Hash: 451ba736794f0e2f30a849843ab83a7da9f20e1e8286aac8e33d1c41455145f3
Instruction Fuzzy Hash: DF119E7191C240EBD711AF28E840A1BBBF5AF86716F05883DE4C49B212D339D811CB9B

Function 00445DCE Relevance: 3.0, APIs: 2, Instructions: 17
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetForegroundWindow.USER32 ref: 00445DCE
GetForegroundWindow.USER32 ref: 00445DE0

Memory Dump Source

Source File: 00000001.00000002.1688980606.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: 8c61841407d1a4852bfe4b40972173754e0679736d2baf3d56bf65322f3b4ff0
Instruction ID: 1e21c31d78f88c29f1ba1c45ad2c8465459836b227478d43c99d9611323569fd
Opcode Fuzzy Hash: 8c61841407d1a4852bfe4b40972173754e0679736d2baf3d56bf65322f3b4ff0
Instruction Fuzzy Hash: 11D05EE9A023405BEA08AB22FC0E4173615A78626E7040438E80B82312E535E924C64A

Function 00443220 Relevance: 1.6, APIs: 1, Instructions: 59
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL(?,00000000), ref: 004432A6

Memory Dump Source

Source File: 00000001.00000002.1688980606.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 50965382f7edf395daec22a3aa5bcca61c8fe5508095e75f982d05b7b9ec31b6
Instruction ID: 4bd1cfedf901e7341f085caf0d3c231c399316e56ace865125bd700590354386
Opcode Fuzzy Hash: 50965382f7edf395daec22a3aa5bcca61c8fe5508095e75f982d05b7b9ec31b6
Instruction Fuzzy Hash: 4B016D3450D3409BD701EF18E845A1ABBE8EF4AB02F054D6CE5C58B362D339DD60CB96

Function 00445BB0 Relevance: 1.5, APIs: 1, Instructions: 14
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL(0044973D,005C003F,00000006,?,?,00000018,8C8D8A8B,?,?), ref: 00445BDE

Memory Dump Source

Source File: 00000001.00000002.1688980606.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: b66ff63dfd389af1bc8afcc0025f999e8b2b47508af02e865142dda64173a8e3
Instruction ID: fb6f357373f259be8b0e83fffc5d2a3912a28e0da7d2036ce94b71e982b3a7e9
Opcode Fuzzy Hash: b66ff63dfd389af1bc8afcc0025f999e8b2b47508af02e865142dda64173a8e3
Instruction Fuzzy Hash: 76E0FE75908316AB9A09CF45C14444EFBE5BFC4714F11CC8DA4D867210D3B0AD46DF82

Function 00443202 Relevance: 1.5, APIs: 1, Instructions: 6
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(?,00000000), ref: 00443208

Memory Dump Source

Source File: 00000001.00000002.1688980606.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: f4e883208b5af43432b1f7820fa52118579d54aaadfbe7b6ea97085ba09a0524
Instruction ID: d989c2ef34d315249fff67303ad5b66d5fc7957262475763486a37997b8dd8e1
Opcode Fuzzy Hash: f4e883208b5af43432b1f7820fa52118579d54aaadfbe7b6ea97085ba09a0524
Instruction Fuzzy Hash: CCB012304401005FDA141B00EC0AF003510EF00606F800070A100040B2D1619864C559

Non-executed Functions

Function 00429510 Relevance: 30.2, APIs: 1, Strings: 16, Instructions: 426COMMON

Download Yara Rule

Strings

;IJK, xrefs: 0042983E
G+X5, xrefs: 00429AF3
T#a-, xrefs: 00429AE3
pq, xrefs: 004299E0
B7U1, xrefs: 00429AFB
X/R), xrefs: 00429AEB
!E4G, xrefs: 00429836
?M0K, xrefs: 00429968
B?Q9, xrefs: 00429B0B
2A"_, xrefs: 00429980
G'M!, xrefs: 00429ADB
z=Q?, xrefs: 00429826
8;, xrefs: 00429B13
L3Y=, xrefs: 00429B03
,A&C, xrefs: 0042982E
O+f), xrefs: 00429634, 0042963D

Memory Dump Source

Source File: 00000001.00000002.1688980606.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID:
String ID: !E4G$,A&C$2A"_$8;$;IJK$?M0K$B7U1$B?Q9$G'M!$G+X5$L3Y=$O+f)$T#a-$X/R)$pq$z=Q?
API String ID: 0-655414846
Opcode ID: 821277b00644bb46f69b775215d578a60cf2f50154e1c4f07745e3abcf78f76a
Instruction ID: 614779ad590eebcf7b8fe37e51d599c86efeb38568f1612107a067b093dacd9a
Opcode Fuzzy Hash: 821277b00644bb46f69b775215d578a60cf2f50154e1c4f07745e3abcf78f76a
Instruction Fuzzy Hash: 56F130B4608380ABD310DF15E881A2BBBF4FB86748F944D1DF4D59B252D378D908CB9A

Function 00438720 Relevance: 22.9, APIs: 6, Strings: 7, Instructions: 115clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00438738
GetWindowLongW.USER32 ref: 00438763
GetClipboardData.USER32 ref: 00438773
CloseClipboard.USER32 ref: 00438880

Strings

8, xrefs: 004387E5
?, xrefs: 004387C9
9, xrefs: 004387DD
=, xrefs: 004387CD
6, xrefs: 004387D5
6, xrefs: 004387D9
9, xrefs: 004387D1

Memory Dump Source

Source File: 00000001.00000002.1688980606.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Clipboard$CloseDataLongOpenWindow
String ID: 6$6$8$9$9$=$?
API String ID: 1647500905-2499364611
Opcode ID: 7c9163cd6bc49d62cda3546406a8a3a59e414d7ee2d25f2b6b977c001a77ad7b
Instruction ID: c6cecdc6b357f73a091e8619202f080a94ed584840656985310604660298186b
Opcode Fuzzy Hash: 7c9163cd6bc49d62cda3546406a8a3a59e414d7ee2d25f2b6b977c001a77ad7b
Instruction Fuzzy Hash: F741B170C08385CFDB01AFB8D5893AEBFB0AB5A314F14092EE485A7381D7794949C76B

Function 0043F620 Relevance: 19.7, APIs: 9, Strings: 2, Instructions: 452memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32 ref: 0043F67C
SysAllocString.OLEAUT32 ref: 0043F73C
VariantInit.OLEAUT32(00000000), ref: 0043F7BB
SysStringLen.OLEAUT32(?), ref: 0043F86B

Strings

dg, xrefs: 0043F7F5
hi, xrefs: 0043F6E6

Memory Dump Source

Source File: 00000001.00000002.1688980606.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: String$Alloc$InitVariant
String ID: dg$hi
API String ID: 3520221836-2859417413
Opcode ID: a29f64484bac79c51184cc7e0d437789df3d7f91ec00fbc448bf7e6117096322
Instruction ID: 76cd35575ce81f92284fb50bd1b390108f3350da4718470232658bad10f85c67
Opcode Fuzzy Hash: a29f64484bac79c51184cc7e0d437789df3d7f91ec00fbc448bf7e6117096322
Instruction Fuzzy Hash: E9F18776608301EFE704CF24D881B2ABBF5FB8A355F14992EF485872A1C738D845CB1A

Function 004390EE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 82COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32 ref: 00439124
GetSystemMetrics.USER32 ref: 00439133

Strings

, xrefs: 004391DE

Memory Dump Source

Source File: 00000001.00000002.1688980606.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: MetricsSystem
String ID:
API String ID: 4116985748-3916222277
Opcode ID: ab5555a52b31076e5eeb6519deaae68eca3c41e93bfc72b6c9b35e59f4d21b4a
Instruction ID: 7f7dffd27c621b542e95bdab6b7ee4d7f31120e949507c5ac4fca7aa65185fb2
Opcode Fuzzy Hash: ab5555a52b31076e5eeb6519deaae68eca3c41e93bfc72b6c9b35e59f4d21b4a
Instruction Fuzzy Hash: 6C3160B49183048FDB00EF6CDA8565EBBF4BF89704F11492DE498DB360D775A948CB86

Function 00438220 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1688980606.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bdc841d7a406348b8f463a63eb878eabe2c962c804589a40256072bab34e7f2b
Instruction ID: 5feb4677dc7f436114534582e8c0716e72c97c069455e78d6c85f3d503c4cf0a
Opcode Fuzzy Hash: bdc841d7a406348b8f463a63eb878eabe2c962c804589a40256072bab34e7f2b
Instruction Fuzzy Hash: 4501E4B44107009FD360EF29C485747BBE8EB08714F008A1DE8AECB680D774A5448B82

Function 00439843 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 109COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32 ref: 00439891
GetSystemMetrics.USER32 ref: 004398A0

Strings

, xrefs: 00439974

Memory Dump Source

Source File: 00000001.00000002.1688980606.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: MetricsSystem
String ID:
API String ID: 4116985748-3916222277
Opcode ID: c81f12191cba6e53c0562e90626fcbcb1d354553d74947de8f13948612130a55
Instruction ID: eb4df33fe1d6a66542a4d5aad425eba8fef39bce69b1d50955d9d3d9aaf60553
Opcode Fuzzy Hash: c81f12191cba6e53c0562e90626fcbcb1d354553d74947de8f13948612130a55
Instruction Fuzzy Hash: 3B516DB4E142188FDB40EFACD985A9EBBF0BB48310F018529E898E7350D734A944CF96

Function 0040F1FB Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 88COMMON

Download Yara Rule

APIs

ShellExecuteW.SHELL32(00000000,57A649BB,0044D58A,832F8123,00000000,00000005), ref: 0040F32F

Strings

8@-, xrefs: 0040F33A
PQ, xrefs: 0040F2BF

Memory Dump Source

Source File: 00000001.00000002.1688980606.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: ExecuteShell
String ID: 8@-$PQ
API String ID: 587946157-876866189
Opcode ID: 1a0b4a114143d5ca3374a3cd52da601592b1729854c1c1369e379120faed14fe
Instruction ID: 32a7b61192442560c6f92bb2f4be214f77c1956f3597500a90fccf8073e86402
Opcode Fuzzy Hash: 1a0b4a114143d5ca3374a3cd52da601592b1729854c1c1369e379120faed14fe
Instruction Fuzzy Hash: 5F312878A012689FDB208F94DD45BDEBB71BF46301F1408E9E689AA281C7B54E848F56

Function 00435551 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 0043555A
VariantInit.OLEAUT32 ref: 00435566

Strings

2, xrefs: 004355B5

Memory Dump Source

Source File: 00000001.00000002.1688980606.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Variant$ClearInit
String ID: 2
API String ID: 2610073882-450215437
Opcode ID: 9656e49463a1eac2a2e27d608098374d928559fc5e9cd49b246a20351250d731
Instruction ID: 1309dba7e2d53283adf9958502b19f3f730abdb88899d5b7c892982ad23b04e6
Opcode Fuzzy Hash: 9656e49463a1eac2a2e27d608098374d928559fc5e9cd49b246a20351250d731
Instruction Fuzzy Hash: 6341D370108BC1CED722DF2CC494646BFA0AB56324F188A9CD8EA4F3DAC775E505CB62

Function 00435A84 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 81COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 00435AA6
VariantInit.OLEAUT32 ref: 00435AB2

Strings

2, xrefs: 00435B01

Memory Dump Source

Source File: 00000001.00000002.1688980606.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Variant$ClearInit
String ID: 2
API String ID: 2610073882-450215437
Opcode ID: b9a854552b158eee2be1d84dc97acde07f31a6659becb1d60da7bb16dc3eeda4
Instruction ID: 10a0ad4f487e5ee891bf26f48cdc5f2681f831964d1233476b22d4ecaaddf2d0
Opcode Fuzzy Hash: b9a854552b158eee2be1d84dc97acde07f31a6659becb1d60da7bb16dc3eeda4
Instruction Fuzzy Hash: B141C570108BC18ED725CF2CC494656BFE0AB5A324F18868DE8EA8F3D6C775D506DB62

Function 00435A99 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 00435AA6
VariantInit.OLEAUT32 ref: 00435AB2

Strings

2, xrefs: 00435B01

Memory Dump Source

Source File: 00000001.00000002.1688980606.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Variant$ClearInit
String ID: 2
API String ID: 2610073882-450215437
Opcode ID: fb5371bdd09d0e906117c41cc88a3a5b350ebddee64f3fa9cb34d119133aa536
Instruction ID: e960a9e32f486725a985871b83e160e2d060c1978967536bf2cf05e5ffba8ce9
Opcode Fuzzy Hash: fb5371bdd09d0e906117c41cc88a3a5b350ebddee64f3fa9cb34d119133aa536
Instruction Fuzzy Hash: A831C320008BC18EDB229F3C8488646BFA05F27224F1887DDD8EA4F3DBC365D506DB66

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Setup.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Setup.exe_Micros_f154a420552aadfd6edff887bcf8cd9d2c902934_d4e2a79c_4268ced3-467b-466a-a0fa-08bb7222a531\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF493.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF59E.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF5BE.tmp.xml

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Windows Analysis Report
Setup.exe

Function 009020AD Relevance: 6.0, APIs: 1, Strings: 2, Instructions: 755
memoryCOMMON

Function 00951ECC Relevance: 21.7, Strings: 17, Instructions: 438
COMMON